Hi all,

I have a query round the geolocation feature on the world map, I have some nodes that I am polling via ICMP (they are external ISP routers that we do not manage), under the custom properties for the node I have populated both the postal code and latitude and longitude fields but they do not appear to be showing on the world map? I have automatic geolocation turned on is there anything else I need to do to get this to work or does this only work via SNMP?

Just wondering if anyone else is having this issue.  On July 27th we had some really weird lockups of Orion for about 30 mins and again the next morning.  It was very similar to the port exhaustion issue but it would just make everything dog slow for some time and then finally Orion site would not load.

Support had me run these queries and it deleted rows in the database

delete from dbo.PendingNotifications

delete from dbo.SubscriptionTags

delete from dbo.Subscriptions

delete from dbo.ContainerMemberSnapshots

delete from dbo.LimitationSnapshots

Ran these and rebooted app server and that seemed to fix thing for a bit.  Then support had me apply a hot fix to replace these files

And that broke the network atlas and also I started seeing DCOM connection errors.

So removed the HF and that still did not fix the issue.  Rebooting the server fixed the issue. Anyone else with this issue - don't apply the hot fix. 

I recently discovered that NPM was logging into my ASA's much more frequently than I expected.  Every minute.

That seems excessive, and I question if it isn't the result of enabling the special NPM Secret Sauce called Advanced ASA Monitoring?

Do you have any experience with loads of logins to ASA's when the box is checked, or other proof for-or-against this theory?

I am trying to add an Alcatel-Lucent 9500 MPR Microwave Radio to SolarWinds.

It validates as OK, but does not disover any interfaces.

Just curious if anyone reading this post had any success on adding this Microwave Radio to Solarwinds.  We have another Alcatel-Lucent product called a 7705 which is new as well and was able to add it with no problem.

I need to add approximately 500 ICMP nodes to NPM 12.1. I have an excel file with node names and associated IP addresses. Is there a way to add all and include the node name? When I do  discover with just the IP addresses, the tool names all nodes with their IP addresses since they do not have SNMP ability.

Aaron

Hey Thwackers,

  Any one seeing ErrorCode: NetPath_20022 & 50014 errors?  I have been searching for these codes and have nothing so far.  This is on Server 2012 R2 and we updated last week to NPM 12.

ErrorCode: NetPath_20022

Message: Exception in processing detail response for IP 199.91.136.100: No connection could be made because the target machine actively refused it 192.0.32.59:43. Elapsed time: 2977 ms

Exception: System.Net.Sockets.SocketException (0x80004005): No connection could be made because the target machine actively refused it 192.0.32.59:43

   at System.Net.Sockets.Socket.EndConnect(IAsyncResult asyncResult)

   at System.Net.Sockets.TcpClient.EndConnect(IAsyncResult asyncResult)

   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)

--- End of stack trace from previous location where exception was thrown ---

   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)

   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)

   at SolarWinds.NetPath.Bgp.RawClients.RawClient.<TcpQueryAsync>d__4.MoveNext()

--- End of stack trace from previous location where exception was thrown ---

   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)

   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)

   at SolarWinds.NetPath.Bgp.RawClients.RawClient.<TcpQueryAsync>d__3.MoveNext()

--- End of stack trace from previous location where exception was thrown ---

   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)

   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)

   at SolarWinds.NetPath.Bgp.WhoisSources.WhoisSource.<QueryInternal>d__25.MoveNext()

--- End of stack trace from previous location where exception was thrown ---

   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)

   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)

   at SolarWinds.NetPath.Bgp.WhoisSources.WhoisSource.<Query>d__24.MoveNext()

--- End of stack trace from previous location where exception was thrown ---

   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)

   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)

   at SolarWinds.NetPath.Bgp.WhoisSources.WhoisSource.<ResolveAsync>d__10.MoveNext()

--- End of stack trace from previous location where exception was thrown ---

   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)

   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)

   at SolarWinds.NetPath.Bgp.Whois.<ResolveHandleAsync>d__12`1.MoveNext()

--- End of stack trace from previous location where exception was thrown ---

   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)

   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)

   at SolarWinds.NetPath.Bgp.Whois.<ResolveAsync>d__9.MoveNext()

--- End of stack trace from previous location where exception was thrown ---

   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)

   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)

   at SolarWinds.NetPath.Bgp.LocalManager.ExternalResolverClientPublic.<ResolveAsync>d__16`1.MoveNext()

--- End of stack trace from previous location where exception was thrown ---

   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)

   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)

   at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)

   at SolarWinds.NetPath.Bgp.LocalManager.ExternalResolverClientPublic.<QueryAllAsync>d__13.MoveNext()

--- End of stack trace from previous location where exception was thrown ---

   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)

   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)

   at SolarWinds.NetPath.Bgp.LocalManager.LocalBgpManager.<ProcessDetailResponseAsync>d__53.MoveNext()

I'm trying to figure out if there's a way using the Custom HTML resource to display a search field that's tied to a particular table in the database for a person to put the name of the server and receive the below output.

Hi All,

I am planing to upgrade my environment. Not sure how much downtime would be required.

Please suggest ..

I've to upgrade following modules to the latest version:  NPM 12.2, NCM 7.7, NTA 4.2.3, VNQM 4.4

I have setup a custom poller that pulls from the MIB CISCO-CDP-MIB:cdpChacheDeviceId.

Specifically OID: 1.3.6.1.4.9.9.23.1.2.1.1.6

I'm doing to alert on unauthorized devices that plug into the network.

I've added the custom poller to the Node Details, Networks Tab, and it is showing all the devices attached with no issues.

I'm however having problems with the alerts.

I've created an alert with the following information

I want to alert on:

Custom Table Poller Current Status

All objects in my environment

Trigger alert when:

     All child conditions must be satisfied  (AND)

          Custom Node Poller Unique Name Is equal to cdpCacheDevceId

and

Custom Table Poller Current Status            Current Value        does not start with          SEP

and

Custom Table Poller Current Status            Current Value        does not contain             NRouter

and

Custom Table Poller Current Status            Current Value        does not contain             NSwitch

When entering the values I see lots of SEP##### (cisco Phones) so it looks like it pull from the correct column in the table.

On the summery screen above submit I see This alert would be immediately trigger on 1 object(s) in the alert scope. When I click on Show List it shows unknown.

Unknown is the value in Display Name Field on the Select Field/Event screen, so not sure if that is where it is pulling that name from. The table pulls two fields from the OID which correlate to Current Value: and Row ID:

The real issue is the alert never actually triggers.

Update: The alert is working, but their is no useful information on the alert. if shows the display name of unknown instead of the Current Value field.

I apologize if this has already been addressed, I tried searching for this question/information and cannot find it.

When we first installed NPM and added our devices, we started using the LAN IP as the Polling IP Address.  We have decided to start polling on the Loopback IP instead and I see where we can change the polling IP in the properties of the individual nodes but I have a need to update in bulk due to the large number of nodes in our environment. 

We have over 3700 nodes so updating one at a time is not feasible.  I tried a network discovery but since the devices were already in the DB, the polling IP did not change. 

I really do not want to delete all the devices and start over due to history being lost so any help is much appreciated.

Thanks,

I'm working with some Netpath probes that are regularly reporting packet loss on a particular link.  I am trying to help parse through the data but I wanted to confirm my query and what each of the fields means.  I'm also wondering if I am missing any fields of relevance.

My greatest curiosity is why NetPath Probes (these ones run every 1 minute from a Lab environment) are reporting packet loss but the ResponseTimeDetail table is not recording a similar event? (Paging cobrien on this one!)

Here is my query.

SELECT
DATEADD(mi, DATEDIFF(mi, GETUTCDATE(), GETDATE()), npt.ExecutedAt)        AS LocalTime
,npes.ServiceName
,npes.HostName
,npes.Protocol
,npes.Port
,npt.PacketLoss
,npt.SentPackets
,npt.LostPackets 
FROM [dbo].[NetPath_Tests] npt
JOIN [dbo].[NetPath_EndpointServices] npes ON npt.ServiceMonitorID = npes.EndpointServiceID
WHERE
npt.PacketLoss > 0
ORDER BY 
npes.ServiceName
,npt.ExecutedAt DESC

I also broke out the individual hops in the NetPath probe tests using the following query, although I have been unable to find the reference table of ObjectID in this query.

SELECT 
npes.ServiceName
,npes.HostName
,npes.Protocol
,npes.Port
,npp.ObjectID
,npp.ObjectType
,npp.RttAvg
,npp.PacketLossAvg
,DATEADD(mi, DATEDIFF(mi, GETUTCDATE(), GETDATE()), npp.TimeStamp)        AS LocalTime
FROM [dbo].[NetPath_Performances] npp
JOIN [dbo].[NetPath_EndpointServices] npes ON npp.ServiceMonitorID = npes.EndpointServiceID
WHERE
PacketLossAvg > 0
ORDER BY npes.HostName, npp.TimeStamp DESC

Summary:

1.  Are my queries missing any fields?

2. Why does npt.PacketLoss (query 1) not reflect in the ResponseTimeDetails table?

3. BONUS QUESTION: What table does npp.ObjectID (query 2) reference?

I've been a SolarWinds Orion user for over 3 years now and love the product.  One feature I have always wanted is the ability to escalate my alerts and place a phone call if a downed node is not acknowledged or recovered within a defined period.  This is great for the middle of the night since we are not staffed in our NOC 24x7 and most of us turn off email alerts due to the overwhelming number we receive for other stuff throughout the night.  After much testing and trial/error I came up with a cost effective robust solution which works extremely well.  I hope others can use this info to solve similar situations.

Requirements:

• SolarWinds Orion NPM
• sipcli (http://www.yasinkaplan.com/SipCli/) paid version ($69)
• Cisco Unified Communications Manager (I'm sure it will work with any IP based phone system which supports SIP trunking, but we had CUCM and that's what I'm basing this post off of)

Procedure:

1.  Download and extract sipcli.  I extracted it to c:\sipcli on my Orion server.  The free version only plays a 3 second audio clip before it hangs up, the paid version removes this limitation.  The 3 seconds doesn't give you enough time to get anything out of a cell phone call since it's just starting to ring before it hangs up.
2. In Unified Communications Manager create a new SIP Trunk for use with Orion.
   1. Device -> Trunks
   2. Add New
      1. Trunk Type: SIP Trunk
      2. Device Protocol: SIP
      3. Trunk Service Type: None(Default)
   3. Values below were set, anything not listed was left as default.  Consult your Telecom engineer if you have any questions.
      1. Device Name: SIPCLITrunk (you can set this to anything you want, as long as it's unique)
      2. Device Pool: Set this to whatever DP is local to your Orion installation
      3. Location: Set this to where your Orion installation is
      4. Run On All Active Unified CM Nodes: Check this
      5. Inbound Calls: Calling Search Space: Use a CSS which gives you access to wherever you want to call
      6. Redirecting Diversion Header Delivery - Inbound: Check this
      7. Redirecting Diversion Header Delivery - Outbound: Check this
      8. SIP Information: Destination: Add the IP address of your Orion server with port 5060
      9. SIP Trunk Security Profile: Non Secure SIP Trunk Profile
      10. Rerouting Calling Search Space: Use a CSS which gives you access to wherever you want to call
      11. Out-Of-Dialog Refer Calling Search Space: Use a CSS which gives you access to wherever you want to call
      12. SIP Profile: Standard SIP Profile
3. Configure SolarWinds Orion Advanced Alert to use sipcli
   1. Open the alert you want to edit
   2. Navigate to the Trigger Actions tab
   3. Select Add New Action
   4. Choose Execute an external program
   5. Under Program to execute enter "C:\sipcli\sipcli.exe 1234 -d 192.168.1.10:5060 -t "This is an automated message that the network node ${NodeName} is down." -c g711u -h 5"
      1. C:\sipcli\sipcli.exe = Update to match where you extracted sipcli.exe in step 1
      2. 1234 = this is the phone number or extension you want to call, format it however you need to to place an external call (i.e. add 9 to the front if necessary)
      3. -d 192.168.1.10:5060 = This is the IP address of your CUCM server
      4. -t "This is an automated message that the network node ${NodeName} is down." = This is the text to read, you can add any variable you need and it will be dynamically filled
      5. -c g711u = Define this to use the G.711ulaw codec
      6. -h 5 = this defines how many times to repeat the audio before terminating the call, if you are calling a cell phone, you many want to set this higher than 1.
   6. Configure the Alert Escalation however you need, my example is below:
      1. We wanted the phone call to be placed 1 hour after the event triggered and if it had not been acknowledged
      2. Check "Do not execute this Action if the Alert has been Acknowledged"
      3. Check "Delay the execution of this Action" and set for 1 Hour

Have looked a bit and haven't found information on this yet. I can't imagine I am the only one wanting this kind of alert. In the screenshot below you can see the Interface Utilization has warning and Critical Values and the drop down shows Greater than and Less Than.

Anyone know of a way to have two separate Warning and Critical Thresholds based on a low value and a high value?

I can see the Baseline Statistics with standard deviations for greater than and less than for all hours here:

Is this a feature in a newer version than my current NPM?

I haven't been able to find these values in the DB or SWQL. I am guessing they may be calculated on the fly and never stored in the DB. I could figure ways to create alerts based on custom properties if I could grab those values with a query.

Anyone have some magic customization that makes this manageable and not a manual task per interface?

The majority of my sites are T1's with sub-interfaces.  I don't want to get 3 alerts every time the physical interface goes down.  I only want to be alerted on the physical interface.  I have created a custom field for all of my sub-interfaces.  

I have tried the alerting a couple different ways and cant seem to get it figured out.

When I have the alert like this I get emails on the sub-interfaces but not the physical interface.

When I have the alert like this I get inconsistent alerts.  For some sites the emails work just like I want.  For other sites I get no emails.

Those that have been part of the Thwack Community a while may be familiar with the long running Tell us your "Unknown" devices! thread which had been active since 2007. That thread had become too unwieldy, and most of the user submissions had been implemented many years ago. I recently reviewed each and every posting in that thread, verified what had been implemented in-product, and which ones had not so they could be included in a forthcoming release. With that done, it was time to lock that thread for good and start anew. This time, providing a bit more guidance along the way to ensure everyone is successful in providing the necessary information required to properly identify these devices.

What is an 'Unknown' Device anyway?

Orion does its best to automatically identify and classify nodes as they're added to Orion. There are however, new device types and models released all the time. It's entirely possible you might be managing a device right now that Orion is unable to properly identify. You can find these easily by going to [Settings - Manage Nodes], changing the 'Group by:' option to 'Machine Type' and clicking on the 'Unknown' category. It's also helpful to add the 'Polling Method' column to the layout, as this thread pertains exclusively to SNMP managed nodes.

Any SNMP managed nodes listed under the 'Unknown' Machine Type category are prime candidates for submission to this thread. All that's required is that you provide the devices SNMP System Object Identifier (SysObjectID), as well as the Make & Model of the device associated with that SysObjectID. This post is an excellent example of the perfect submission.

What Exactly is a SysObjectID?

I have yet to find a clearer definition for what the SysObjectID (System Object Identifier) is then the following excerpt which can typically be found written in virtually every vendor's MIB file verbatim.

Object Name: sysObjectID
Object ID: 1.3.6.1.2.1.1.2.0
Object Syntax: OBJECT IDENTIFIER
Object Access: read-only
Object Status: mandatory
Object Description: The vendor's authoritative identification of the  network management subsystem contained in the  entity. This value is allocated within the SMI  enterprises subtree (1.3.6.1.4.1) and provides an  easy and unambiguous means for determining `what  kind of box' is being managed. For example, if  vendor `Flintstones, Inc.' was assigned the  subtree 1.3.6.1.4.1.4242, it could assign the  identifier 1.3.6.1.4.1.4242.1.1 to its `Fred  Router'.

Essentially, it's a string of numbers in dotted notation that is (hopefully) unique to at least the manufacturer, and in most cases, to the specific make and model of the device being monitored. It's how we identify for example, that the device vendor is 'Cisco' and the model is a 'Nexus C7018'. All System Object ID's begin with '1.3.6.1.4.1' followed by a number which uniquely identifies the manufacturer. The numbers which then follow typically identify the specific model of the device.

Where Can I Locate the SysObjectID?

If the device is already managed as a Node in Orion then you can locate the SysObjectID in the 'Node Details' resource as shown below, when viewing the node in the Orion web interface.

Node Details

NET-SNMP

Alternatively, you can use NET-SNMP to query the following SNMP OID to return the unique SysObjectID.   1.3.6.1.2.1.1.2.0   Below is an example of the 'snmpget' command line arguments which will return you the SysObjectID for the device.   snmpget -v2c -On -c public 10.199.5.103 1.3.6.1.2.1.1.2.0   The example above is executed against a device with the IP address of '10.199.5.103' using SNMPv2c, with the community string 'public'. Below is a screenshot of the resulting output from that command. The string of numbers and periods highlighted in yellow below is this device's unique SysObjectID.

My Device Incorrectly Appears Listed as 'NET-SNMP'

Linux hosts, virtual appliances, and even some network equipment built on Linux, FreeBSD, etc. are often identified as 'NET-SNMP'. This is because the SNMP Daemon running on those hosts is, you guessed it, NET-SNMP. Unfortunately, these vendors for some reason, have chosen not to implement their own unique SysObjectID, and instead kept the default SysObjectID '1.3.6.1.4.1.8072.3.2.10' which is designated for NET-SNMP. If you have a device such as this, fret not. There are a few options available to you if you'd like these devices to be properly identified by their appropriate vendor's make & model within Orion.

Install The Orion Linux Agent

The easiest solution would be to install the Orion Linux Agent on the device which is reporting itself to be 'NET-SNMP'. The Linux Agent does not rely upon SNMP to identify the machine type or vendor. Instead, the Agent will report the Vendor as 'Linux' and the 'Machine Type' as the Linux distribution running on the device as depicted in the screenshots below.

Red Hat	Citrix XenServer

Modify NET-SNMP Configuration

Another approach is to customize NET-SNMP and Orion to properly reflect the Vendor and Machine Type. Simply following the steps outlined by adatole's post entitled No More Net-SNMP Nodes. This method uses a script osname.sh which is executed when a particular OID is is queried. Next, you would create a custom Device Poller to query that newly created OID and populate the Machine Type value in Orion for that device.

If you find it more fun to follow along, you can watch adatole walk you through the entire process in the following video.

Can't I Just Upload My Vendor's MIB File Here And You figure it Out?

While it would be nice if that's how it worked, unfortunately many (or most) vendors don't include this information within their MIB files. MIB files include a listing of all possible OIDs which could be polled across a wide variety of different devices (typically an entire product family), but it doesn't include the values which are returned by the devices (Enums notwithstanding). For that reason we need users, such as yourself, to post the SysObjectID's in this thread, along with the device vendor and model information so it can be included in our database.

If you'd still like your device's MIB file included in the Orion MIB database, for use with Network Performance Monitor's Universal Device Poller, or the Orion Platform's SNMP Trap Receiver, simply follow the steps outlined in KB article at the link below.  The latest version of the MIB database, containing your submissions, can always be downloaded from within the Customer Portal.

Request additional MIBs to the SNMP MIB browser database - SolarWinds Worldwide, LLC. Help and Support

What has your upgrade to NPM 12.3 on Orion Platform 2018.2 looked like? We on the product manager team would like to hear about it all, the good the bad and the ugly! For a starting point here is a quick getting started blog post on upgrading to 2018.2 Orion Platform: Preparing for the Upgrade to 2018.2

Hey Fellow Thwacksters, I have seen an issue with Alerting service in two different client environments this week and have got stumped as to how to proceed.

In both environments, the clients have confirmed that alerts are still being trigged and are showing up in the Orion web console, and dashboards are highlighting status changes (where applicable). However, they get no emails.

If I try and simulate an alert I get an error - "An Error has Occurred"

In the Alerting.Service.V2 log file it is full of errors like this:

2018-07-31 08:41:48,353 [55] ERROR SolarWinds.Orion.Core.Alerting.Service.ActionsResolverInternal.PendingExecutionActions - System.ServiceModel.FaultException`1[SolarWinds.Orion.Core.Common.CoreFaultContract]: ProvideFault failed, check fault information. (Fault Detail is equal to SolarWinds.Orion.Core.Common.CoreFaultContract(Unknown): System.ComponentModel.Composition.CompositionException: The composition produced a single composition error. The root cause is provided below. Review the CompositionException.Errors property for more detailed information.

1) The composition failed because it did not complete within '100' iterations. This is most likely caused by a cycle in the dependency graph of a part which is marked with a non-shared creation policy.

Resulting in: Cannot get export 'SolarWinds.Orion.Core.Actions.Impl.Email.EmailExecutor (ContractName="SolarWinds.Orion.Core.Models.Actions.Contracts.IActionExecutor")' from part 'SolarWinds.Orion.Core.Actions.Impl.Email.EmailExecutor'.

Element: SolarWinds.Orion.Core.Actions.Impl.Email.EmailExecutor (ContractName="SolarWinds.Orion.Core.Models.Actions.Contracts.IActionExecutor") -->  SolarWinds.Orion.Core.Actions.Impl.Email.EmailExecutor -->  AssemblyCatalog (Assembly="SolarWinds.Orion.Core.Actions, Version=2018.2.5200.5426, Cul...).

I've tried restarting the alerting service but that doesn't resolve the issue. If I stop and restart all the services then it seems to restore service but only for a short period of time.

Permission Checker didn't show any issues

Has anybody seen anything similar and resolved it?

I do have a case open with SolarWinds Tech - CASE# 151769 so will update if I hear anything back from them.

Hello everyone!

So a bit of background. We have a pfsense box that we tied to for the next year at least. It has two Internet connections that operate in active/standby scenario. pfsense tests each link to verify that it is online. From the command line, we can execute a script that will list the connections and its status.

We've created an Extended NET-SEND command that is able to pull the connection status where the states are:

• none - working
• down - not working
• latency - latency detected

At this time, we are only concerned if the connection is working or not working.

How do I use SolarWinds to represent this data? Can it be displayed as an interface? Can I create a table and show the connections' status?

Any suggestions would be greatly appreciated! Thanks guys!

Hi All,

I have upgraded recently NPM 12.2 but I am not getting ASA Node View like below. can you please suggest?

Hi All,

I just wanted to know like how does ICMP polling work? Node is down (not pinging as well- from last 3months )but still status is up and alert is being not generated and its happening with all unknown vendor nodes which are polling via ICMP and how to fix it?