Everything else works fine Events, Alerts, Syslog, Traps... just Message Center... NADA

Anyone ever see when clicking on message center from home endless spin until "Orion Website Error" that end's up being:

Time: 11/13/2012 08:38:44.9989

Server: Microsoft-IIS/7.5

Pipeline: Integrated

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:16.0) Gecko/20100101 Firefox/16.0

Error Instance: 1a067ee6086742bbb8fc9e65a9ca25e1

User: xxxxx

URL: https://xxxxx.com:443/Orion/NetPerfMon/OrionMessages.aspx

Referrer: https://xxxxx.com:443/Orion/NetPerfMon/OrionMessages.aspx

Message: Request timed out.

ErrorSite:

ErrorType: System.Web.HttpException

Stack:

Orion Core 2012.1.1, SAM 5.0.1, NPM 10.3.1, NTA 3.9.0, IVIM 1.3.0

OK, I've poured over the threads available here at thwack that explain different methods to trigger and alert and clear that alert when corresponding trap comes in.  I have an example that is slightly different from others I've seen here, I'd like to get some help with.

Scenario - another monitoring tool (HP BSM) sends a trap as an action when an alert condition is raised:

11/29/2016 8:08:20 AM    10.10.10.10     pwbsmdps02     public     SNMPv2-SMI:enterprises.5233.4.0.1     snmpTrapEnterprise = SNMPv2-SMI:enterprises.5233.4

experimental.1057.1.0 = 10.10.10.10

sysUpTime = 226 days 5 hours 16 minutes 34.05 seconds

snmpTrapOID = SNMPv2-SMI:enterprises.5233.4.0.1

enterprises.5233.4.10 = Business Transaction Flow:LMS;transaction:LMS_003_Auth;

enterprises.5233.4.9 = d4aec8817ec54e330fcc047bac0890ea

enterprises.5233.4.8 = N/A

enterprises.5233.4.7 = Response time for 2 out of 3 transactions was greater than 8.00 seconds.;

enterprises.5233.4.6 = For Business Transaction Flow "LMS", transaction "LMS_003_Auth". Response time for 2 out of 3 transactions greater than 8.00 seconds.;

enterprises.5233.4.5 = Major

enterprises.5233.4.4 = 33dcb5b068c72fdb8779050b29df5c2c

enterprises.5233.4.3 = Regular Alert

enterprises.5233.4.2 = ITO: LMS Performance Alerts

enterprises.5233.4.1 = LMS

It also will send a corresponding clear trap when the alert clears:

1/29/2016 8:29:38 AM    10.10.10.10     pwbsmdps02     public     SNMPv2-SMI:enterprises.5233.4.0.1     snmpTrapEnterprise = SNMPv2-SMI:enterprises.5233.4

experimental.1057.1.0 = 10.10.10.10

sysUpTime = 226 days 5 hours 16 minutes 34.05 seconds

snmpTrapOID = SNMPv2-SMI:enterprises.5233.4.0.1

enterprises.5233.4.10 = Business Transaction Flow:LMS;transaction:LMS_003_Auth;

enterprises.5233.4.9 = d4aec8817ec54e330fcc047bac0890ea

enterprises.5233.4.8 = N/A

enterprises.5233.4.7 = Response time for 1 out of 3 transactions was greater than 8.00 seconds.;

enterprises.5233.4.6 = For Business Transaction Flow "LMS", transaction "LMS_003_Auth". Response time for 2 out of 3 transactions greater than 8.00 seconds.;

enterprises.5233.4.5 = Informational

enterprises.5233.4.4 = 33dcb5b068c72fdb8779050b29df5c2c

enterprises.5233.4.3 = Follow Up Alert

enterprises.5233.4.2 = ITO: LMS Performance Alerts

enterprises.5233.4.1 = LMS

The traps always come from the same IP/Hostname: 10.10.10.10/pwbsmdps02

So in following other examples here, I created two rules in the trap viewer:

BSM Alert:

BSM Clear:

Note: ${vbData4} contains the unique alert identifier, which is why I chose it to correlate the events.  I verified in the Trap Viewer that new traps are colored properly.

Next, I created an new Alert in NPM:

Trigger:

Reset:

Now here is where I am stuck...  I would like to pull this varbind from the specific trap and put it into the Message displayed when this alert is triggered:

enterprises.5233.4.6 = For Business Transaction Flow "LMS", transaction "LMS_003_Auth". Response time for 2 out of 3 transactions greater than 8.00 seconds.;

Is this even possible?!

I am looking for a way to create about 1000 fake interfaces so that I can track some unassigned custom properties

I had considered temporarily monitoring a device on and then leaving down but that would only get me the number of interfaces on the device

I have some unknown objects in the Atlas map, is there anyway to find out what they are?

So, i made a customer poller for optical power. But it just comes in a huge chart. There is no way to decifier what all the data goes to. 

1. Does anyone know the transform formula to get mW to Dbm?

2. What other oid's do I need to correlate this data? 

This was for an asr 9000.

I used this OId/MIB to get the mW

OID: 1.3.6.1.4.1.9.9.91.1.1.1.1.4

MIB: CISCO-ENTITY-SENSOR-MIB

When I applied this to a view it went crazy. long long list of

Every time we upgrade/update the application/database, it sets the autogrowth to 100MB and sets the max size to unlimited for both data and log files.  This is a huge problem.  Our database is 395GB.  Can you imagine the fragmentation/performance issues if we kept those settings?  This is a huge problem and has been ever since we bought this module three years ago.

Can we get a fix for this?

Hi,

Our Network team have enabled MAC change notification trap on their campus switches, please verify can we receive notification or detect MAC change on current module of Solarwind we have currently i.e. Orion Platform 2015.1.3, NCM 7.4.1, NPM 11.5.2 and NTA 4.1.2.

Awaiting usual support.

Can someone tell me why this alert has been triggered? I have roughly 6 servers out of about 75 that are triggering this alert but they shouldn't be, maybe some fresh eyes can see something.

Server is Oracle Linux.

Thanks

Is it necessary to disable snmp trap services before installing solarwinds trap services?

samiksha_shruti

Will the upgrade to 12.01 remove and/or change any custom MIBs added?

We've added several new tunnel interfaces to a PA-3050 recently, and I realized we needed to begin polling for them to track utilization.

When hitting the list resources button, it only shows one of the seven new interfaces.  I'm not sure what is going on.

Is there a specific way to get Solarwinds to see these new interfaces, or do I have to do some magic with custom pollers?

Does network discovery select 'Topology: Layer 2'? I am trying to come up with a way to make sure all added devices remain compliant and poll for topology

Hello Team,

I require technical assistance towards installation of solarwinds network monitoring tool in our organisation. Please assist.

Before I submit a feature request, has anyone yet tried to get monitoring for Rubrik going?  It's a pretty nice backup and recovery solution, and with great power comes great respon... er, need to monitor.

Hi Everyone,

I am hoping someone else has ran into this issue.  I have one additional polling engine that seems to be working fine but the devices on this poller will not poll. I can rediscover these nodes but when I go to poll them they fail.  I have moved a device or two to another additional poller and it will poll perfectly.

Any information or suggestions to fix this would be appreciated.

When I was running NPM v11.x, I had some SQL queries to determine (or validate) if there were alerts that had failed to be sent, or to prove that an alert had been "successfully sent" to the exchange system, or just to detect alert storms ( as sometimes NPM 11.x would try to send a lot of alerts to Exchange in a short amount of time, and Exchange would quickly start denying them because NPM attempted to open too many connections to Exchange) .

I had a few queries I ran, like this one for example, to determine if any alerts had failed to be sent via email:

SELECT TOP 1000
[MsgID]

      ,[LogDateTime]

      ,[AlertDefID]

      ,[ObjectType]

      ,[ObjectID]

      ,[ObjectName]

      ,[ActionType]

      ,[Message]

  FROM [SolarWindsOrion].[dbo].[AlertLog]

  where message like 'Failed%'

It appears in v12.x that these tables are now empty, and there are new/other alerting tables in place.  When I try to put it all together to fix my query, I can't seem to find any table in the database that lets me "validate" the status of alert notifications (email or otherwise) being successfully sent to systems outside of NPM.  Maybe now this information goes into logs on the system that sends the alerts?

Does anyone know where I would have to look for this information?  If a user asks me "where's my alert I thought I should have gotten at 4:15 AM", It appears with v12 I don't have any way to trace it within NPM to prove it at least made it out of the system, or no alert notification was (purposely) be sent to them at all (also very useful to prove).

Hi,

We had tried to execute following query in Orion SDK to fetch report in below format :

Unsupported Query :

select (Select count(*) from NodesData) as Total,(Select count(*) from NodesData where Status=1) as Up,(Select count(*) from NodesData where Status=2) as Down,(Select count(*) from NodesData where Status=14) as Critical,(Select count(*) from NodesData where Status=3) as Warning,(Select count(*) from NodesData where Status=9) as Unmanaged

Query Output :

If we try to execute above query, it compiles with following error :

2016-08-19 13:40:47,523 [99] ERROR SolarWinds.InformationService.Core.InformationService - SWQL Studio  Exception running query:

select (Select count(*) from NodesData) as Total,(Select count(*) from NodesData where Status=1) as Up,(Select count(*) from NodesData where Status=2) as Down,(Select count(*) from NodesData where Status=14) as Critical,(Select count(*) from NodesData where Status=3) as Warning,(Select count(*) from NodesData where Status=9) as Unmanaged RETURN XML RAW

2016-08-19 13:40:47,570 [99] ERROR SolarWinds.InformationService.Core.InformationService - SWQL Studio  Exception for Operation: <s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">

  <s:Header>

    <a:Action s:mustUnderstand="1">http://schemas.solarwinds.com/2007/08/informationservice/InformationService/QueryXml</a:Action>

    <a:MessageID>urn:uuid:d6ade743-fe91-4125-b85f-d0cd938d1cd2</a:MessageID>

    <a:ReplyTo>

      <a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>

    </a:ReplyTo>

    <i18n xmlns="http://schemas.solarwinds.com/2007/08/informationservice" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">

      <Culture>en-US</Culture>

    </i18n>

    <SwisSettings xmlns="http://schemas.solarwinds.com/2007/08/informationservice" xmlns:i="http://www.w3.org/2001/XMLSchema-instance">

      <AppendErrors>true</AppendErrors>

      <ApplicationTag>SWQL Studio</ApplicationTag>

      <DataProviderTimeout>PT30S</DataProviderTimeout>

    </SwisSettings>

    <IsBase64EncodingAccepted xmlns="http://schemas.solarwinds.com/2007/08/informationservice">true</IsBase64EncodingAccepted>

    <a:To s:mustUnderstand="1">net.tcp://IP address:17777/SolarWinds/InformationService/v3/Orion/ssl</a:To>

    <o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">

      <u:Timestamp u:Id="_0">

        <u:Created>2016-08-19T08:10:47.273Z</u:Created>

        <u:Expires>2016-08-19T08:15:47.273Z</u:Expires>

      </u:Timestamp>

      <c:SecurityContextToken u:Id="uuid-cfe6a0af-500d-4039-b122-eaedf7fd5e3c-35929" xmlns:c="http://schemas.xmlsoap.org/ws/2005/02/sc">

        <c:Identifier>urn:uuid:3f451289-b4bc-4c42-b546-cd618b9e4eda</c:Identifier>

      </c:SecurityContextToken>

      <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">

        <SignedInfo>

          <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">

          </CanonicalizationMethod>

          <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#hmac-sha1">

          </SignatureMethod>

          <Reference URI="#_0">

            <Transforms>

              <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">

              </Transform>

            </Transforms>

            <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1">

            </DigestMethod>

            <DigestValue>+WGqDArof8MXMizkWXcFsgAYg1E=</DigestValue>

          </Reference>

        </SignedInfo>

        <SignatureValue>/4W440MDISBsLU5c82haD7alXFk=</SignatureValue>

        <KeyInfo>

          <o:SecurityTokenReference>

            <o:Reference URI="#uuid-cfe6a0af-500d-4039-b122-eaedf7fd5e3c-35929">

            </o:Reference>

          </o:SecurityTokenReference>

        </KeyInfo>

      </Signature>

    </o:Security>

  </s:Header>

  <s:Body>

    <QueryXml xmlns="http://schemas.solarwinds.com/2007/08/informationservice">

      <query>select (Select count(*) from NodesData) as Total,(Select count(*) from NodesData where Status=1) as Up,(Select count(*) from NodesData where Status=2) as Down,(Select count(*) from NodesData where Status=14) as Critical,(Select count(*) from NodesData where Status=3) as Warning,(Select count(*) from NodesData where Status=9) as Unmanaged RETURN XML RAW</query>

      <parameters>

      </parameters>

    </QueryXml>

  </s:Body>

</s:Envelope>

2016-08-19 13:40:47,601 [99] ERROR SolarWinds.InformationService.Core.InformationService - SWQL Studio  Exception caught in method SolarWinds.InformationService.Core.InformationService.RunQuery

SolarWinds.Data.SWQL.SWQLSyntaxException: mismatched input 'RETURN' expecting 'FROM' ---> Antlr.Runtime.MismatchedTokenException: A recognition error occurred.

   at SolarWinds.Data.SWQL.Parser.SWQLParser.MismatchIsUnwantedToken(IIntStream input, Int32 ttype)

   at Antlr.Runtime.BaseRecognizer.RecoverFromMismatchedToken(IIntStream input, Int32 ttype, BitSet follow)

   at Antlr.Runtime.BaseRecognizer.Match(IIntStream input, Int32 ttype, BitSet follow)

   at SolarWinds.Data.SWQL.Parser.SWQLParser.fromClause()

   --- End of inner exception stack trace ---

   at SolarWinds.Data.SWQL.Parser.SWQLParser.fromClause()

   at SolarWinds.Data.SWQL.Parser.SWQLParser.selectFrom()

   at SolarWinds.Data.SWQL.Parser.SWQLParser.queryRule()

   at SolarWinds.Data.SWQL.Parser.SWQLParser.selectStatement()

   at SolarWinds.Data.SWQL.Parser.SWQLParser.statement()

   at SolarWinds.Data.SWQL.SWQLParser.Parse(String query)

   at SolarWinds.Data.Query.Engine.QueryProcessor.ProcessInternal(String query, IQueryExecutionContext context)

   at SolarWinds.InformationService.Core.QueryPlanCache.GetQueryPlan(String query, String username, Boolean federationEnabled, Func`1 buildQueryPlan)

   at SolarWinds.InformationService.Core.InformationService.RunQuery(String query, IDictionary`2 parameters, IDataSerializer serializer)

We would like to improve user experience and for such reason I'd like to better understand if our users prefers INITIALLY to add nodes manually or run product network discovery in order to import devices to NPM

Not as happy as I would like.

It seems the information service is quite fragile, in particular it does not seem to recover well if a transaction takes too long to complete or if an exception occurs.

Custom limitations built using the [windows based] account limitation builder are broken: Anything based on custom properties are not handled properly.

NetObjectDowntime tracking -- this has a smalldatetime field, so two updates in the same minute will cause a primary key violation (e.g. if a node goes into warning, and then into 'up' due to a delayed ping)

I'm not seeing an event logged in this case, so it's hard to work out what is going wrong.

2015-10-14 11:50:43,761 [20] ERROR SolarWinds.Orion.Core.BusinessLayer.DowntimeMonitoring.DowntimeMonitoringNotificationSubscriber - Exception occured when processing incoming indication of type "System.InstanceModified"
System.Data.SqlClient.SqlException (0x80131904): Violation of PRIMARY KEY constraint 'PK_ObjectDownTime'. Cannot insert duplicate key in object 'dbo.NetObjectDowntime'. The duplicate key value is (Oct 14 2015  6:51PM, 9504, Orion.Nodes).
The statement has been terminated.   at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction)   at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction)   at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose)   at System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady)   at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString)   at System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async, Int32 timeout, Task& task, Boolean asyncWrite, SqlDataReader ds)   at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, TaskCompletionSource`1 completion, Int32 timeout, Task& task, Boolean asyncWrite)   at System.Data.SqlClient.SqlCommand.InternalExecuteNonQuery(TaskCompletionSource`1 completion, String methodName, Boolean sendToPipe, Int32 timeout, Boolean asyncWrite)   at System.Data.SqlClient.SqlCommand.ExecuteNonQuery()   at SolarWinds.Orion.Common.SqlHelper.ExecuteNonQuery(SqlCommand command, SqlConnection connection, SqlTransaction transaction)   at SolarWinds.Orion.Core.Common.DALs.NetObjectDowntimeDAL.Insert(NetObjectDowntime item)   at SolarWinds.Orion.Core.BusinessLayer.DowntimeMonitoring.DowntimeMonitoringNotificationSubscriber.OnIndication(String subscriptionId, String indicationType, PropertyBag indicationProperties, PropertyBag sourceInstanceProperties)
ClientConnectionId:0ba46c82-f129-4b44-9cc1-d248a2193d00
Error Number:2627,State:1,Class:14

We are a State Agency that acts as a service provider to other state agencies for networking services/connectivity to each other and the internet.

Our group needs to come up with what the "Industry Standard" threshold of utilization performance before starting upgrading an Ethernet circuit.  To do so, we need to have documented (verifiable) sources of what the best practices are for what KPI's/metrics to check and at what point (threshold) does it pass a line that indicates we need to start moving towards an upgrade. Sounds simple, right? Nope, there's not one right answer from my research so far.

So, I'm reaching out here to ask the following questions:

What measurements and thresholds, in regards to network performance, are being used elsewhere?

Can you post links to back up why?

Any feedback would be appreciated.  We do have some idea of what look at, but I'm keeping it general to see what shakes loose here.