Quantcast
Channel: THWACK: All Content - Network Performance Monitor
Viewing all 21870 articles
Browse latest View live

How to capture the TCP/IP session [ request/response mapping] in a cloud based monitoring traffic environments ( i.e AWS, Azure, Office365) ?

$
0
0
Hello !!
I would like to understand how to capture the TCP/IP session [ request/response  mapping]  in a cloud based monitoring traffic environments ( i.e AWS, Azure, Office365) ?

As per my understanding:- In case of normal scenario the  the analytic tool can   installed in the server location (data center) and traffic can be tapped for  the analytic tool.

In a cloud environment the physical servers for the TCP request and response can be a diffident geographic locations. So how the analytic tool  can capture at a cloud environment for TCP request response ? (want to more understand on CNF (cloud network function) and TCP session  mapping).

 

In cloud environment most of network elements will be virtualize and hidden to the actual network elements.  Through FQDN  the client can access the cloud network elements, but  the tool can  process mostly on layer 3 (IP layer) and layer 4 (TCP layer) not the Application layer protocols . The FQDN to IP will be resolved at the Application layer by DNS server.

 

Could you please help me to understand how to capture the TCP session from cloud packets with out processing to application layer ? What could be the deployment scenarios ?

 

Is it possible to provide me the sample cloud traffic pcap ?

 

 

 

Regards,

Dwijesh Maharana

Hyderabad, India

Mob: +91-8897120020


What are your MUST-HAVES on your NPM Summary page?

$
0
0

What sorts of charts, graphs and info do you have on your NPM Summary page? Looking for suggestions outside of what I have.

 

Thanks!

Network Maps

$
0
0

Is there a way to use visio stencils when making network maps? I want to get things to looks as close as our visio documentations Also what about for wireless heat maps?

.net and multiple polling engines

$
0
0

Greetings -

 

We got bit by this back in June, where we have a mix of 2016 and 2012R2 servers. and during the June Microsoft updates, functionality of the console started to not work.  This was due to mismatched versions.  We have resolved it since then to get it up and running proper but since then again, we have been very wary of doing ANY patches from Microsoft, we just been doing important updates.  But its very time consuming as we look at each KB to make sure it does  not contain any .net changes.  Because Microsoft can't be taxed with it showing .net update it shows us KB190393913 ect.  And running 2 different versions of windows on our polling environment makes it much more confusing.

 

I assume when we get the other polling engines to 2016 this will go away or the risk will, but what do we do in the meantime.  I want to keep things updated as much as possible but don't want to risk part of our system being unusable because of a chance at a .net mismatch.

 

For example we made sure all polling engines had the same version, installed VIA the same source, the registry even reported them as the SAME version of .net however, this was just the label as the 2012R2 servers had a different version to match the 2016 .net versions.  You could not use the same source across all servers it would create a mismatch.  Which is extremely confusing.

 

I tried blocking .net installs but i think it only applies to 4.7 being installed and not 4.6 being updated.

 

Any advice is greatly appreciated while we work on getting the polling engines up to 2016, because the main polling engine is on 2012r2 is why the wait

GPS Coordinates

$
0
0

I have devices in the field that are reporting GPS coordinates information. I created a Universal Device Poller and am able to see the Latitude and Longitude listed. I would like to have this information displayed on the Node Details as static information such as Lat xx.xxxx Lon -xx.xxxxx. The only option that I have been able to find is to display these items as two separate fields using radial gauges. Is there a way to display the coordinates properly?

Dependency aware Alert examples

$
0
0

Hi guys,

 

Could anyone please share screenshots of their trigger condition for an alert that is suited to mute Down alerts on Child objects that are down?

I have a dependency where a router is the parent and a group is the child. I only wish to receive alerts when the router is down and suppress the hundreds of alerts I would get when the group members are down. Any help greatly appreciated.

Complex Group Dependencies

$
0
0

Sorry if this has already been asked,  can you do nesting parent interfaces?  For example, say the MackDonald's Tampa restaurant, if you can’t ping the inside address of the firewall but you can ping the ISP it is most likely a VPN issue.   In that instance you would see everything go down and we would want to roll that all up into just the firewall alert.  Now if the ISP goes down we would see the ISP interface go down and then everything behind that as well.  So is it possible to have the inside interface of the Tampa firewall be the parent to all inside addresses at Tampa and then the public address be the parent to the inside interface?

Make ALL Links, In A SWQL Custom Query Resource, Open In New Tabs By Default

$
0
0

This is a super simple, single file, single line, edit.

 

ESTIMATED TIME TO INSTALL/PERFORM MODIFICATION:<1 Minute

 

DIFFICULTY LEVEL:1-Youngling

  1. Youngling(Easiest/Most Basic; no coding experience required, no config wizard required, no system restart required, no system downtime.)
  2. Padawan (Easy/Basic; no coding experience required, possible config wizard required, possible system/services restart required, limited/no downtime.)
  3. Jedi Knight (Moderately Difficult/Advanced; some coding experience required/recommended, config wizard required, possible system/services restart required, limited/short duration downtime.)
  4. Jedi Master (Most Difficult/Advanced; advanced coding experience required, config wizard required, system/services restarts required, 30+ minutes downtime/maintenance window recommended, and other things that I do not even know I would need to know, required...)

 

 

For all of those "tabbers", "shift-clickers", and "middle-button mashers" out there, that know the only way to truly use a tabbed browser, is to open so many tabs that you can even see the tabs anymore... this one is for you... And, of course, by you, I mean us...

 

This simple little modification may have been mentioned elsewhere before, however, I was not fortunate enough to have found it before I figured out how to do it. So, if it has been mentioned before, well, here it is again...

 

This modification will change the default behavior when clicking on a link within a SWQL Custom Query resource. (Any link, formed within the query, using the "_LinkFor_" alias.)

By default, clicking on a link will load the link in the same page/tab as the source was in.

The new behavior, after making this change, when clicking on a link, will load the link destination in a new tab/page, without the need to shift-click, or middle-mouse button click.

 

THINGS TO KNOW:

  • I have countless SWQL Custom Query resources scattered throughout my SolarWinds environment.
  • I cannot stand directly clicking links, having them open in the same page/tab.
  • If I can still see the icons on the tabs of Chrome, then I must be sleeping.
  • I am a very inexperienced, and untrained, amateur (with the exception being all things Star Wars related, which does you absolutely no good here...)
    • Always backup your system/files BEFORE making any changes, and/or test with a demo/dev system before making changes to your production environment.
    • Please don't break your system, then blame it on me.
      • If you break your system, then blame it on me, please know, "I don't give a care...", "I told you so...", and/or "Nanna nanna boo boo, stick your head in doo doo..." will most likely be my response...

 

**WARNING! THE INFORMATION YOU ARE ABOUT TO READ COMES FROM THE MIND OF AN UNTRAINED AMATEUR, AND IS MOST LIKELY FAR, FAR FROM THE BEST PRACTICE**

 

Filename:

CustomQuery.js

 

File Location:

\inetpub\SolarWinds\Orion\NetPerfMon\Resources\Misc\

 

Open the file, and look for the line that has "if (cellInfo.linkColumn) {" (it should be on/around line 160)

The change you will be making will need to be done on the next line, line 161.

 

Change the RED part, of the line below,

            element = $('<a/>').attr('href', rowArray[cellInfo.linkColumn]);

 

To match the GREEN part, of the line below,

            element = $('<a Target="_blank" />').attr('href', rowArray[cellInfo.linkColumn]);

 

Save your file, and you are done!

 

HERE IS HOW THE DEFAULT CODE LOOKS, BEFORE ANY CHANGES:

        var element;        if (cellInfo.linkColumn) {            element = $('<a/>').attr('href', rowArray[cellInfo.linkColumn]);        } else {            element = $('<span/>');        }

 

 

AND HERE IS HOW THE CODE SHOULD LOOK AFTER YOUR CHANGE:

        var element;        if (cellInfo.linkColumn) {            element = $('<a Target="_blank" />').attr('href', rowArray[cellInfo.linkColumn]);        } else {            element = $('<span/>');        }

 

 

Now, you should be able to use the "_LinkFor_" column alias in your SWQL query, on a Custom Query resource, and when you click the link, on the query results, it should, by default, automatically open in a new tab/window.

 

If you have any questions, or comments, please leave them below, and I will do my best to follow up with you.

 

Thank you,

 

-Will

 

--If you are interested in customizing, and/or modifying your SolarWinds environment, CourtesyIT has put together a terrific "Page of Pages" (PoP), "List of Links" (LoL), okay, you get the idea... Please visit his page, How to do various customizations with your Solarwinds, and discover a better way to enhance your SolarWinds environment. Make sure to bookmark, like, and rate his page, as it will help you, as well as others after you.


Min/Max Transmit bps

$
0
0

Hi All,

 

Can anyone please advise how these metrics for an interface are calculated and stored by Solarwinds NPM.  It looks like the values could be extremely useful for us for historic analysis where we need to track back to 2am in the morning and see if an interface was maxing out, but I was curious how this data is derived.  If Solarwinds only polls the interface every 2 minutes is the interface aware enough to give Solarwinds the max from the last 2 minutes or does the min / max counter get set and updated by a defined confguration on the switch.

 

I took a look through the documenation but this didn't seem clear - I hope this question makes sense.

 

Regards,

Rob.

Asset Inventory polling snagged by application whitelisting app

$
0
0

I want the inventory data but i can't just go whitelisting the filename. If the inventory wasn't injecting date/time into the vbs scripts i could whitelist based on a file hash.
Is there any way to get Orion to generate these dynamically created vbs files without the date/time?

Tell Us Your Unknown Devices v2.0

$
0
0

Those that have been part of the Thwack Community a while may be familiar with the long running Tell us your "Unknown" devices! thread which had been active since 2007. That thread had become too unwieldy, and most of the user submissions had been implemented many years ago. I recently reviewed each and every posting in that thread, verified what had been implemented in-product, and which ones had not so they could be included in a forthcoming release. With that done, it was time to lock that thread for good and start anew. This time, providing a bit more guidance along the way to ensure everyone is successful in providing the necessary information required to properly identify these devices.

 

What is an 'Unknown' Device anyway?

 

Orion does its best to automatically identify and classify nodes as they're added to Orion. There are however, new device types and models released all the time. It's entirely possible you might be managing a device right now that Orion is unable to properly identify. You can find these easily by going to [Settings - Manage Nodes], changing the 'Group by:' option to 'Machine Type' and clicking on the 'Unknown' category. It's also helpful to add the 'Polling Method' column to the layout, as this thread pertains exclusively to SNMP managed nodes.

 

Any SNMP managed nodes listed under the 'Unknown' Machine Type category are prime candidates for submission to this thread. All that's required is that you provide the devices SNMP System Object Identifier (SysObjectID), as well as the Make & Model of the device associated with that SysObjectID. This post is an excellent example of the perfect submission.

 

What Exactly is a SysObjectID?

 

I have yet to find a clearer definition for what the SysObjectID (System Object Identifier) is then the following excerpt which can typically be found written in virtually every vendor's MIB file verbatim.

 

Object Name: sysObjectID
Object ID: 1.3.6.1.2.1.1.2.0
Object Syntax: OBJECT IDENTIFIER
Object Access: read-only
Object Status: mandatory
Object Description: The vendor's authoritative identification of the  network management subsystem contained in the  entity. This value is allocated within the SMI  enterprises subtree (1.3.6.1.4.1) and provides an  easy and unambiguous means for determining `what  kind of box' is being managed. For example, if  vendor `Flintstones, Inc.' was assigned the  subtree 1.3.6.1.4.1.4242, it could assign the  identifier 1.3.6.1.4.1.4242.1.1 to its `Fred  Router'.

 

Essentially, it's a string of numbers in dotted notation that is (hopefully) unique to at least the manufacturer, and in most cases, to the specific make and model of the device being monitored. It's how we identify for example, that the device vendor is 'Cisco' and the model is a 'Nexus C7018'. All System Object ID's begin with '1.3.6.1.4.1' followed by a number which uniquely identifies the manufacturer. The numbers which then follow typically identify the specific model of the device.

 

Where Can I Locate the SysObjectID?

 

If the device is already managed as a Node in Orion then you can locate the SysObjectID in the 'Node Details' resource as shown below, when viewing the node in the Orion web interface.

 

Node DetailsNET-SNMP

Alternatively, you can use NET-SNMP to query the following SNMP OID to return the unique SysObjectID.

 

1.3.6.1.2.1.1.2.0

 

Below is an example of the 'snmpget' command line arguments which will return you the SysObjectID for the device.

 

 snmpget -v2c -On -c public 10.199.5.103 1.3.6.1.2.1.1.2.0

 

The example above is executed against a device with the IP address of '10.199.5.103' using SNMPv2c, with the community string 'public'. Below is a screenshot of the resulting output from that command. The string of numbers and periods highlighted in yellow below is this device's unique SysObjectID.

 

My Device Incorrectly Appears Listed as 'NET-SNMP'

 

Linux hosts, virtual appliances, and even some network equipment built on Linux, FreeBSD, etc. are often identified as 'NET-SNMP'. This is because the SNMP Daemon running on those hosts is, you guessed it, NET-SNMP. Unfortunately, these vendors for some reason, have chosen not to implement their own unique SysObjectID, and instead kept the default SysObjectID '1.3.6.1.4.1.8072.3.2.10' which is designated for NET-SNMP. If you have a device such as this, fret not. There are a few options available to you if you'd like these devices to be properly identified by their appropriate vendor's make & model within Orion.

 

Install The Orion Linux Agent

 

The easiest solution would be to install the Orion Linux Agent on the device which is reporting itself to be 'NET-SNMP'. The Linux Agent does not rely upon SNMP to identify the machine type or vendor. Instead, the Agent will report the Vendor as 'Linux' and the 'Machine Type' as the Linux distribution running on the device as depicted in the screenshots below.

 

Red HatCitrix XenServer

 

 

Modify NET-SNMP Configuration

 

Another approach is to customize NET-SNMP and Orion to properly reflect the Vendor and Machine Type. Simply following the steps outlined by adatole's post entitled No More Net-SNMP Nodes. This method uses a script osname.sh which is executed when a particular OID is is queried. Next, you would create a custom Device Poller to query that newly created OID and populate the Machine Type value in Orion for that device.

 

If you find it more fun to follow along, you can watch adatole walk you through the entire process in the following video.

 

 

 

Can't I Just Upload My Vendor's MIB File Here And You figure it Out?

 

While it would be nice if that's how it worked, unfortunately many (or most) vendors don't include this information within their MIB files. MIB files include a listing of all possible OIDs which could be polled across a wide variety of different devices (typically an entire product family), but it doesn't include the values which are returned by the devices (Enums notwithstanding). For that reason we need users, such as yourself, to post the SysObjectID's in this thread, along with the device vendor and model information so it can be included in our database.

 

If you'd still like your device's MIB file included in the Orion MIB database, for use with Network Performance Monitor's Universal Device Poller, or the Orion Platform's SNMP Trap Receiver, simply follow the steps outlined in KB article at the link below.  The latest version of the MIB database, containing your submissions, can always be downloaded from within the Customer Portal.

 

Request additional MIBs to the SNMP MIB browser database - SolarWinds Worldwide, LLC. Help and Support

Disks Approaching 100% Capacity This Month

NetPath - Cannot "Create New Service" or Edit default Google service

$
0
0

Hello! We have a relatively fresh SolarWinds installation with multiple polling engines.

 

When we attempt to create a NetPath service, it tries forever but nothing happens so we just click cancel.

 

The same thing happens if we try to edit the default NetPath service pointing to Google.

 

We can't really troubleshoot this by pointing it to internal resources because we can't create a service or edit the default service.

 

The only thing we've tried so far is to add PUT and DELETE to 32/64 handler mappings in IIS as per SolarWinds support.

 

Has anyone else had this issue and found a resolution? Thanks!

 

Step 1

Step 2

Step 3 - it hangs here forever but you can still click Cancel.

Query: NPM:: Location of Network Atlas Files

$
0
0

Hi,

 

I am trying to find where network atlas and saves and retrieves the individual map files from.

I notice that some maps *.orionmap are stored in C:\Temp\SolarWinds\NetworkAtlas\Maps\Orion\localhost

however if you delete a file in this folder and open Network Atlas, the file you deleted reappears. So its seems like the master files are stored somewhere which are then copied to the Temp dir for Network Atlas download.

 

Where are the new master files for the maps stored? Also need to know for backing up as they used to be under the maps folder.

 

Regards

 

Miron

Are your Orion server and SQL database server in the same Active Directory domain?


When you installed NPM, did you add Nodes manually or did you run discovery?

$
0
0

We would like to improve user experience and for such reason I'd like to better understand if our users prefers INITIALLY to add nodes manually or run product network discovery in order to import devices to NPM

NPM Design question

$
0
0

Hi Guys

I have a "small" design question to ask

Today we have 2 NPM instances one in our corp network and one in our secure enclave, witch is a secluded portion of our network, so it would be possible to be able to cut it of and operate it autonomously in case of an attack.

But our normal procedures do that monitoring both systems simply isn't an option on a day to day basis.

 

So I need to design a system where we can monitor both the the Corp network and the Enclave through a single "pain of glass"

One suggestion is the Enterprise console I understand that this will be able to receive data from several systems, but as I understand this will only give us monitoring capabilities, If we need to dig deeper we have to do it on the relevant system.

Anther suggestion is to place 2 Corp APE's in the Enclave and monitor it all through the Corp system but still retaining the Enclave system, but then I fear that if we ever had to run the Enclave autonomously equipment will not be up to date on the Enclave system.

 

I am not sure how big a problem the last one will be, because the Enclave setup is pretty static.

 

Is there anybody out there that has solved this or have some design recommendations, suggestion or anything?

What are the pro's and con's and is there another solution that I haven't thought about?

 

We have 2 NPM setups, one with unlimited nodes (Corp), and the one in the Enclave has a max of 2000 Nodes i think

If we could do this with one setup That would be sweet

Hope you can help me a little

 

Regards Jens

total capacity alert

$
0
0

Hi

 

I need to keep my eyes on that situation

I need alert /report that keep  eye  on  the total capacity from the PE  router

We just had service on the fibers to core1  and the capacity   toward core2 could keep up..

 

 

 

 

 

 

Solarwinds SMS Alerting

$
0
0

Can you use an alternative SMS application to send text alerts?  I only see the option to use NotePager.

VXLAN Monitoring

$
0
0

Hello,

Does solarwinds NPM supports the VXLAN feature ?
I have VXLAN enable on my nexus 9k and I cant see them in the npm/nta module


Is it supported or not yet?


Thanks
Mickael

Viewing all 21870 articles
Browse latest View live


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>