**REQUIRES ORION PLATFORM 2018.2 OR ABOVE**

I had assembled this based on a much older SQL report, and then updated it to SWQL, then added some more intelligence to it so you can filter it based on the duration of the outage, search by the device names, and it has a method of letting you know when nodes have been down so long they aged out of the events table.

Based on popular requests I figured it was time to put it out here to make it easier for the Thwackers to find and use.  This is intended to be used inside the Custom Query Resource

select n.caption as [Device]
-- shows the current status icon
, '/Orion/images/StatusIcons/Small-' + n.StatusIcon AS [_IconFor_Device]
-- makes a clickable link to the node details
, n.DetailsUrl as [_linkfor_Device]
-- shows the timestamp of the down event, if there is no timestamp then is says the event was greater than the number of days in your event retention settings
, isnull(tostring(t2.[Down Event]),concat('Greater than ',(SELECT CurrentValue FROM Orion.Settings where settingid='SWNetPerfMon-Settings-Retain Events'),' days ago')) as [Down Event]
-- shows the timestamp of the up event, unless the object is still down
, isnull(tostring(t2.[Up Event]),'Still Down') as [Up Event]
-- figures out the minutes between the down and up events, if the object is still down it counts from the down event to now, displays 99999 if we cannot accurately determine the original downtime, and 
, isnull(MINUTEDIFF(t2.[Down Event], isnull(t2.[Up Event],GETUTCDATE())),99999) as Minutes


from orion.nodes n
left join (SELECT    
 -- Device nodeid used for our join   
 StartTime.Nodes.NodeID     

 -- Down Event time stamp in local time zone    
 ,ToLocal(StartTime.EventTime) AS [Down Event]      
 -- Up Event time stamp in local time zone    
 ,(SELECT TOP 1    
 ToLocal(EventTime) AS [EventTime]    
 FROM Orion.Events AS [EndTime]    
-- picks the first up event that is newer than the down event for this node
 WHERE EndTime.EventTime >= StartTime.EventTime   
-- EventType 5 is a node up 
 AND EndTime.EventType = 5    
 AND EndTime.NetObjectID = StartTime.NetObjectID    
 AND EventTime IS NOT NULL    
 ORDER BY EndTime.EventTime    
 ) AS [Up Event]      
-- This is the table we are querying    
FROM Orion.Events StartTime      
-- EventType 1 is a node down
WHERE StartTime.EventType = 1        
) t2 on n.NodeID = t2.nodeid


-- this is how I catch nodes that are down but have aged out of the events table
where (n.status = 2 or t2.nodeid is not null)


-- If you want to filter the results to only show outages of a minimum duration uncomment the below line
--and MINUTEDIFF(isnull(t2.[Down Event],(GETUTCDATE()-30)), isnull(t2.[Up Event],GETUTCDATE())) >  60


-- if you want to use this query in a search box of the Custom Query resource uncomment the below line
--and n.Caption like '%${SEARCH_STRING}%'


order by t2.[down event] desc

-Marc Netterfield

    Loop1 Systems: SolarWinds Training and Professional Services

•                 LinkedIN: Loop1 Systems
•                 Facebook: Loop1 Systems
•                 Twitter: @Loop1Systems

NPM 12.3 has shipped and we're hard at work building the next release.  Here's what we're working on, in no particularly order.

• Cisco ACI Monitoring
• Remote Collector - New, agent based collector for distributed environments and hybrid deployments
• Next Generation Orion Mapping - First version delivered in NPM 12.3 via Orion Platform 2018.2.  Working on the next version.
• Centralized Upgrades
• Website & Database Performance Improvements
• Windows Device Guard Support
• SAML Authentication Support
• Replace syslog/trap with the functionality from our new Log Manager product

Hi All,

Just found the proper OID to monitor CPU and memory for Brocade SAN switch(SN6000B) so thought of sharing it. I was able to bring up a custom poller and also matching with details captured from the switch putty console.

below are the OIDs and in the same tree lot of other information is available.

We have a compliacated DMZ setup where my polling engine is unable to access individual ESXi hosts, however it has access to our VirtualCenter server using an account which has the correct permissions to monitor specific clusters. I have this imported into SolarWinds and all looked fine, however because my poller has no access to the hosts when I imported the ESXi servers I had to set them as external. This appears to have frozen all data relating to the host servers whereas that data should be polled via the VirtualCenter server? It's not updating the ESXi hardware status, the virtual machine info etc etc that all appears to be static? Any idea how to get around this? Because the hosts are being polled from VirtualCenter I should not have to set them as external - it should just know to get their status from the management environment? Thanks Mike

We would like to improve user experience and for such reason I'd like to better understand if our users prefers INITIALLY to add nodes manually or run product network discovery in order to import devices to NPM

We are trying to implement alerting via a Slack channel and are running into problems.  After following the Solarwinds guide, everything works from the command line of the Orion server but we never get a message when it is triggered from an actual alert.  We see the "Send Slack Message" event task run in Orion but the message never shows up in Slack.  What could we be missing?  My guess is that it is a permissions issue when calling the curl.exe.  Is there a certain permission that should be allowed for this to work?

Thanks,

Jon

Can anyone provide some guidance or documentation on how integrate Orion with HEAT Ticketing system? Thanks

Hi Team,

We are using percentile utilization report and it is good to get the data in terms of bps.

Could someone help to get this data in terms of percentage usage of configured bandwidth?

Thanks

Prashant

I use NetPath in a number of ways, but the foremost is to validate that connections to SaaS applications are within tolerances all around my environment.  Having that information in a summary is very helpful.

NetPath already does that, but having a filter would be nice to only show a specific service.  What would be more awesome would be being able to give me summary information over time instead of just showing the most recent.

With that in mind, I started digging into the API to find if I could get a better summary of this information.  Much to my pleasure, I was able to find the information, but it was strewn across a few tables.  So I had to dust off some old SQL tactics in my brain to get the information.  (I'm terrible at hand-writing join queries and almost as bad when doing GROUP BY for calculating minimums/averages/minimums).

The two "tables" that I need to use are Orion.NetPath.ServiceAssignments and Orion.NetPath.Tests.

What I cam up with was a little bit of SQL magic, a little bit of SWQL magic, and exactly what I needed in a resource.  I've added some comments in the script to show what I'm doing.  Without further ado, here's the SWQL script:

SELECT [SA].ProbeName AS [Source]     , [SA].ServiceName AS [Destination]     , [SA].DetailsUrl AS [_LinkFor_Source]     , CONCAT('/Orion/images/StatusIcons/Small-', [SI].IconPostfix, '.gif') AS [_IconFor_Source] -- This is the status for the most recent poll only     , ROUND([Tests].MinLatency, 2) AS [Min Latency (ms)]     , ROUND([Tests].AvgLatency, 2) AS [Avg Latency (ms)]     , ROUND([Tests].MaxLatency, 2) AS [Max Latency (ms)]     , CONCAT(ROUND([Tests].MinLatency, 2), ' / ', ROUND([Tests].AvgLatency, 2), ' / ', ROUND([Tests].MaxLatency, 2) ) AS [Min/Avg/Max Latency (ms)]     , ROUND([Tests].MinPacketLoss, 2) AS [Min Packet Loss (%)]     , ROUND([Tests].AvgPacketLoss, 2) AS [Avg Packet Loss (%)]     , ROUND([Tests].MaxPacketLoss, 2) AS [Max Packet Loss (%)]     , CONCAT(ROUND([Tests].MinPacketLoss, 2), ' / ', ROUND([Tests].AvgPacketLoss, 2), ' / ', ROUND([Tests].MaxPacketLoss, 2) ) AS [Min/Avg/Max Packet Loss (%)]
FROM Orion.NetPath.ServiceAssignments AS [SA]
INNER JOIN Orion.StatusInfo AS [SI]   ON [SA].Status = [SI].StatusID
INNER JOIN (    SELECT EndpointServiceID         , ProbeID         , MIN(Rtt) AS MinLatency         , AVG(Rtt) AS AvgLatency         , MAX(Rtt) AS MaxLatency         , MIN(PacketLoss) AS MinPacketLoss         , AVG(PacketLoss) AS AvgPacketLoss         , MAX(PacketLoss) AS MaxPacketLoss    FROM Orion.NetPath.Tests    WHERE ExecutedAt >= GETUTCDATE() - 1 -- ExecutedAt is stored in UTC, so we use 'GETUTCDATE() - 1' to get last 24 hours only    GROUP BY EndpointServiceID, ProbeID
) AS [Tests]
ON  [Tests].ProbeID = [SA].ProbeID
AND [Tests].EndpointServiceID = [SA].EndpointServiceID
WHERE [SA].ServiceName = 'Office 365' -- This is the NetPath Service Name as displayed on your NetPath summary page  AND [SA].Enabled = 'True'
ORDER BY [SA].ProbeName

Let me break it down a little bit.  First off, we are joining up three tables here.  The one that I didn't mention earlier is Orion.ServiceInfo.  This table has the status "names" based on the numbers.  I use them for pulling in the icons.  This leads to a bit of SWQL magic.

SWQL has the ability to recognize icons and links, but only if they are formatted properly.  This is where lines 3 and 4 from the above script come into play.  If you have an element in a custom query called "Stuff", then you can give it a URL named "_IconFor_Stuff" and it will be displayed to the left of the label.  Similarly, you can use the "_LinkFor_Stuff" to provide a clickable link.  As a note for the future, many tables provide a "DetailsUrl" field that's very useful for this.

I'm also using some specific SQL-like constructs - specifically joining a table to a table and joining a table to a query (which returns table-like content).  In lines 14 and 15, I'm joining in the Orion.StatusInfo table which provides the IconPostfix needed for line 4.

Later in lines 16 through 28 I'm making a query from Orion.NetPath.Tests where I summarize information over the last 24 hours.  Note that in line 26 I'm using a comparison to only pull back minimums, averages, and maximums over the last 24 hours.  You can change this, but be aware that it will take more time to execute the query.  On a 10 minute probe (the default), each probe provides 60 minutes / 10 minutes per test * 24 hours = 144 tests / probe.  Multiple this by the number of probes (4 in my environment) means the query has to summarize 576 entries into six total statistics.

Thankfully SWQL is highly optimized.  As an example me running this full query takes 0.023 seconds.  If I change the number of days on line 26 to 7 (show me the last week), then it runs in 0.59 seconds.  Like I said, the SWQL is highly optimized.

So what's all this look like?  Just edit a page and add a Custom Query widget and paste in the above query (changing line 31 to match one of your own NetPath Services) and you should get something very pretty.

I've elected to show Min/Avg/Max in multiple ways, but in a production environment, I probably only care average.  To get just the average to display, just comment out (or delete) the unneeded elements.  In SQL (and SWQL) the double-dash indicates a comment.

SELECT [SA].ProbeName AS [Source]     , [SA].ServiceName AS [Destination]     , [SA].DetailsUrl AS [_LinkFor_Source]     , CONCAT('/Orion/images/StatusIcons/Small-', [SI].IconPostfix, '.gif') AS [_IconFor_Source] -- This is the status for the most recent poll only
--     , ROUND([Tests].MinLatency, 2) AS [Min Latency (ms)]
--     , ROUND([Tests].AvgLatency, 2) AS [Avg Latency (ms)]
--     , ROUND([Tests].MaxLatency, 2) AS [Max Latency (ms)]     , CONCAT(ROUND([Tests].MinLatency, 2), ' / ', ROUND([Tests].AvgLatency, 2), ' / ', ROUND([Tests].MaxLatency, 2) ) AS [Min/Avg/Max Latency (ms)]
--     , ROUND([Tests].MinPacketLoss, 2) AS [Min Packet Loss (%)]
--     , ROUND([Tests].AvgPacketLoss, 2) AS [Avg Packet Loss (%)]
--     , ROUND([Tests].MaxPacketLoss, 2) AS [Max Packet Loss (%)]     , CONCAT(ROUND([Tests].MinPacketLoss, 2), ' / ', ROUND([Tests].AvgPacketLoss, 2), ' / ', ROUND([Tests].MaxPacketLoss, 2) ) AS [Min/Avg/Max Packet Loss (%)]
FROM Orion.NetPath.ServiceAssignments AS [SA]
INNER JOIN Orion.StatusInfo AS [SI]   ON [SA].Status = [SI].StatusID
INNER JOIN (    SELECT EndpointServiceID         , ProbeID         , MIN(Rtt) AS MinLatency         , AVG(Rtt) AS AvgLatency         , MAX(Rtt) AS MaxLatency         , MIN(PacketLoss) AS MinPacketLoss         , AVG(PacketLoss) AS AvgPacketLoss         , MAX(PacketLoss) AS MaxPacketLoss    FROM Orion.NetPath.Tests    WHERE ExecutedAt >= GETUTCDATE() - 1 -- ExecutedAt is stored in UTC, so we use 'GETUTCDATE() - 1' to get last 24 hours only    GROUP BY EndpointServiceID, ProbeID
) AS [Tests]
ON  [Tests].ProbeID = [SA].ProbeID
AND [Tests].EndpointServiceID = [SA].EndpointServiceID
WHERE [SA].ServiceName = 'Office 365' -- This is the NetPath Service Name as displayed on your NetPath summary page  AND [SA].Enabled = 'True'
ORDER BY [SA].ProbeName

So the above returns:

Hopefully this has helped a few of you with getting your feet wet within SWQL and the custom query.  Now go forth and script around a bit.

Greetings!!  I have a question that should be simple BUT I want to make sure I do not have any gotchas.  I am going to be changing authentication domains for my Solarwinds application and was wondering if there could be any issues that may happen when I do this change?  I do have local accounts in case something happens with AD authentication but want to make sure I do not blow anything up.  Currently authenticate against Domain A and will be changing it to Domain B.  Will this affect the direct links at all?  Or will it all just work? 

Thanks! - Dave

Hey All!  Now, you’re probably looking at the title of this and thinking “yeah, that’s easy enough, just create a custom chart and get the top 10 already”.  Well, this one is going to be a bit different.  What if, instead, you want to see the top 10 interfaces, but the interfaces are in separate charts?  Perfstack seems the obvious choice, but perfstack only gives you a static list, not a top 10 list.  That’s where things get a bit tricky.

But fear not!  With the power of SQL, this can be accomplished:

Here I’ve gone and created a view in Orion that contains the top 10 interfaces across the entire environment.  Each one of these resources is a custom chart that is based on a custom SQL query. Each query is exactly the same, except there is an offset number that is changed for the first, second, etc. interface. Below are the steps in creating:

Step 1 - Create a new view (Optional, but recommended):

Go to Settings --> All Settings, and click on Manage Views. Click on Add, then create a Summary View called “Top 10 Interfaces”

Step 2 – Add the new view to a menu bar (Optional, but recommended):

Go to Settings --> All Settings, and click on “Customize Menu Bars”.  Click on the menu bar you want to add the view to (I used Network_TabMenu), and select Edit.

From the list of available views on the left, find the “Top 10 Interfaces” you created, and drag that to the right.

Now you have the new view under My Dashboards --> Network --> Top 10 Interfaces

Step 3 – Create the widgets:

Click on the view we just created in steps 1 and 2, and on the left side of our blank canvas, click on Customize Page:

Then go to “Add Widgets” in the upper right:

Search for the “Custom Chart” Widget, then drag and drop that widget 10 times to the main part of the screen (5 in each column):

Click “Done Adding Widgets when finished”

Step 4 – Make the charts:

This is the meaty part. On the first chart, click on “Configure this resource” or “edit” (both will take you to the same page):

For “Title”, call this “Interface #1”
Subtitle we can leave blank
Then for datasource, click "Select Datasource", and change the selection method to “Advanced Database Query (SQL, SWQL)”, then change the query type to SQL:

Now for the query, copy and paste the following:

SELECT

     (no.caption + ' - ' + interf.interfacename) as [Node Name],

     interf.interfacename as [Interface Name],

     it.datetime,

     it.in_averagebps as [Average BPS In],

     it.out_averagebps as [Average BPS Out]

FROM [dbo].[InterfaceTraffic] it

inner join Interfaces interf

     on it.interfaceid=interf.interfaceid

inner join nodes no

     on it.nodeid=no.nodeid

where it.interfaceID=(

SELECT

     it.interfaceid

FROM [dbo].[InterfaceTraffic] it

where it.datetime >= DATEADD(day, -1, GETDATE()) and it.in_averagebps IS NOT NULL and it.out_averagebps IS NOT NULL

group by it.interfaceid

order by(avg(it.in_averagebps)+avg (it.out_averagebps)) desc

OFFSET 0 ROWS FETCH NEXT 1 ROWS ONLY)

So, quick explanation as to what this query does.  The first part, up to the “where” statement, pulls the interface traffic information. The magic happens in the where clause. The where clause takes the last 24 hours of performance information, per interface, and averages it out and sorts the top interfaces.

The important piece to this is the LAST line;

OFFSET 0 ROWS FETCH NEXT 1 ROWS ONLY)

What this line does is return just one line, but offset the rows X number of lines.  So, for this chart, we take the top result.  For the next chart, we will take an offset of 1, so our query is now:

OFFSET 1 ROWS FETCH NEXT 1 ROWS ONLY)

This query will give us the chart for the 2nd interface in the top ten, and so on.

Step 4 – The rest of the chart setup:

Now that our data source is set for the first chart, you can now set the rest of the options.

1. Set your time period (I set mine to last 24 hours)
2. On the left y-Axis, click Add data series, select “Average BPS In”
3. Once added, click ‘More’, and a button will appear for “Time Column”.  Click that and select ‘datetime’
4. Again on the left y-Axis, click Add data series, select “Average BPS Out”.
5. And again, once added, click ‘More’, and select ‘datetime’ for the “Time Column”
6. For “Units Displayed”, set this to “Bit/s”
7. Under “Data Grouping”, “Group chart data” by “Interface Name”
8. And for “Legend Shows”, select “Node Name”

And that’s it!  Hit submit.

Step 5 – Rinse and Repeat:

Repeat steps 3 and 4 for the other ten charts, and make sure you:

Change the offset number for each chart (Interface #2 has an offset of 1, Interface #3 has an offset of 2, etc.)

Change the name of the Charts for Interface 2, 3, etc.

That should do it! From this point, if you want to change the query to include a custom property, or maybe do volumes or cpu performance, you can.  The real part of this is the where clause where you look up your information ahead of time, then offset/fetch.  Let me know in the comments if you have any questions!

We have a few alerts which have actions designed to repeat every x days if not ack'd/closed. What I've noticed is that after we restart Orion, those variables for the existing alert are lost and don't populate in the email action.

For example, we have a drive alert set to nag every 24 hours if not resolved. Yesterday at 1:24pm, the alert read:

We patched our Orion servers today and rebooted, and at 1:24 today the alert read:

When I close the alert and it triggers a new alert, it is fine.

What I also noticed is that the node variable we're using is ${NodeName}, and it is formatted differently before and after. Looks like when all is well, it uses the caption, but when the formatting is wrong, it is pulling some other value which is the accurate server name, but it is not fully qualified.

The quick solution is to just close the open alerts after a restart, but that is not optimal as it regenerates alerts sooner than the agreed upon interval. Any ideas?

I'm pleased to announce that the Network Performance Monitor (NPM) 12.4 Beta 1 is now available!

This beta includes certain items that are mentioned in What We're Working on for NPM (Updated June 1st, 2018) post.

At SolarWinds, being customer-driven and responsive to customer needs is a fundamental part of how we build software. Beta feedback is one of the key avenues we use to inform and adjust what we're building so that it can fit your needs and your environment. We'll take feedback anytime we can get it, but now is the best time to provide feedback that can affect the product.

As an added incentive, beta users who submit feedback will receive 3,000 THWACK® points to buy swag at the THWACK Store. That's enough points to score yourself all sorts of stuff.

To get access to the beta, you need to be a customer on active maintenance for NPM and sign up here. To share feedback, please post on the NPM Beta forum.

Sincerely,

NPM Team

We're also pleased to announce NTA 4.5 Beta 1 is now available! We've been working to build new features, and we think you'll be impressed with the results!

This beta includes certain items that are mentioned in the What We're Working on for NTA Post 4.4 (June 5th, 2018)

At SolarWinds, being customer-driven and responsive to customer needs is a fundamental part of how we build software. Beta feedback is one of the key avenues we use to inform and adjust what we're building so that it fits your needs and your environment. We'll take feedback anytime we can get it, but now is the best time to provide feedback that can affect the product.

As an added incentive, beta users who submit feedback will receive 3,000 Thwack points to buy swag at the THWACK Store. That's enough points to score yourself all sorts of stuff, including a lanyard or a pair of Koozie® drink sleeves.   To access the NTA beta, sign up here. To share feedback, please post in the Netflow Traffic Analyzer Beta Forum!

Joe Reves

Product Manager, NTA

This document was generated from the following discussion: The specified item was not found.

Hi Everyone,

I am using NPM12.2 and needs to integrate BMC remedy 8.1 . BMC team has provided the https-Post SOAP URL and I have tested it with SoapUI tool and it is working fine to create the incident. But when I tried the same XML code in NPM alert action in http-Post body, the action is successful but nothing happens in Remedy and no incident is created.

Please help urgently if any one experienced it.

The URL is http://test:8080/arsys/services/ARService?server=test&webService=test_Solarwind_Integration

Please find the code below

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:test_Solarwind_Integration">

   <soapenv:Header>

      <urn:AuthenticationInfo>

         <urn:userName>testuser</urn:userName>

         <urn:password>***</urn:password>

         <urn:authentication>?</urn:authentication>

         <urn:locale>?</urn:locale>

         <urn:timeZone>?</urn:timeZone>

      </urn:AuthenticationInfo>

   </soapenv:Header>

   <soapenv:Body>

      <urn:Create>

         <urn:Login_ID>testuser</urn:Login_ID>

         <urn:Incident_Type>Infrastructure Event</urn:Incident_Type>

         <urn:Customer_First_Name>test</urn:Customer_First_Name>

         <urn:Customer_Last_Name>user</urn:Customer_Last_Name>

         <urn:Summary>Test from NPM</urn:Summary>

         <urn:Notes>Test from NPM</urn:Notes>

         <urn:Assigned_Company>XYZ</urn:Assigned_Company>

         <urn:Category_Tier1>ABC</urn:Category_Tier1>

         <urn:Action>CREATE</urn:Action>

         <urn:Reported_Source>Other</urn:Reported_Source>

      </urn:Create>

   </soapenv:Body>

</soapenv:Envelope>

We are trying to implement alerting via a Slack channel and are running into problems.  After following the Solarwinds guide, everything works from the command line of the Orion server but we never get a message when it is triggered from an actual alert.  We see the "Send Slack Message" event task run in Orion but the message never shows up in Slack.  What could we be missing?  My guess is that it is a permissions issue when calling the curl.exe.  Is there a certain permission that should be allowed for this to work?

Thanks,

Jon

A combination of both

What has your upgrade to NPM 12.3 on Orion Platform 2018.2 looked like? We on the product manager team would like to hear about it all, the good the bad and the ugly! For a starting point here is a quick getting started blog post on upgrading to 2018.2 Orion Platform: Preparing for the Upgrade to 2018.2

A couple of my sites have greater distance and latency involved when their APE's need to get Polling Engine updates from my main NPM instance during hot fix / patch episodes.

They regularly give me this error:

If I let these servers just sit without clicking Yes or No, I can see the progress bar in the background continue moving to the right until the download is complete, and it appears all I need do is click "Next.  But that's not possible while the previous dialog box is unanswered, and I can't click X on it to remove it.

If I click No, the process ends and I have to start all over again.

If I wait until the back progress bar makes it all the way to the right, and then the Solarwinds Orion Compatibility Check Summary window (above) appears, then I can click Yes, and the front dialog box closes I can click "Next" and move through the patch/upgrade.

It seems as if that initial window about the Downloading Process being interrupted is caused by some arbitrary timer that expires.

1.  Do you ever experience this?

2.  Is there something I can do to prevent this?  The download is not truly interrupted.

3.  Can we get this corrected/repaired/fixed?