I've been playing around with some of the alerts, but didn't find this option. I would like an alert to be generated if NPM cannot successfully poll a device IP after two polling intervals with X amount of failed retries with each interval.
I was also wondering for devices like access switches, if the switchports can be monitored, but not indicate an event everytime the switchport goes down? I'd still like it monitored though for useage/errors stuff like that
Alert Central is really useful when you've got too many sources that you have to configure independently, when you need to route alerts to different groups rather than telling everyone about everything, and when your manual processes are starting to break down. We tried to bring all of the features you might find bits and pieces of elsewhere into ONE product that does them all.
Rather than telling everyone about every alert, Alert Central can help you send alerts to a single group, or rotate through a set of users individually who can take responsibility for the alert. Distribution lists break down by distracting everyone with a lot of noise and creating chatter and involving people that don't need to be involved - sort of like using a megaphone when a telephone would do.
The biggest advantage of Alert Central is to centralize all of your calendaring to one place - the same place as your alerts. Rather than sending alerts to one person that has to find the on call person each time (requiring 24/7 staff to handle alerts that might not even be in their area), you can automate that process and automatically send the alert straight to the on call person first.
Absolutely - you can send alerts from multiple sources to Alert Central, then distribute them to different groups based on any information in the original alert. Add each group to Alert Central, add their alerts to Alert Central, then use routing rules to make sure they get to the right people. Each group can have their own escalation policy and one or more on call calendars to call their own.
Alert Central was designed to be a simple solution for centralizing and managing alerts. Helpdesk/ticketing systems are frequently designed around asset and relationships, not escalation and notification. Some systems do have similar escalation features, but they are often hard to manage and a sort of afterthought to the core functionality of a helpdesk system.
Most people with both Alert Central and helpdesk systems use them one of three ways:
We're looking at the best ways to better integrate with helpdesk systems, so if you've got thoughts, be sure to let us know.
Not yet. If you have two sources that generate the same alerts or a cascade failure that might generate a bunch of identical alerts, you'll get notified about all of them. Some of our customers have offered creative solutions, stopgaps, and good long term options in our feature requests forum, so be sure to go vote on them.
You can filter inbound alerts and decide based on any content within the alert whether to route it to a group (and user), or to trash the alert. You might have a source that includes alerts that you know are false positives or are handled another way. You can easily add a routing rule that says "if you see this noisy alert that contains the subject of 'ignore me', throw it away."
Alert Central is a virtual appliance with built-in web console, and is available for download HERE.
There are two choices of platform that we officially support: Microsoft Hyper-V (2008 R2 or 2012) and VMware (ESX/ESXi 4+).
For both platforms:
We have tested Alert Central with IE8/9/10, Firefox 15+, and Chrome 25+. There are a few known cosmetic issues when using Alert Central in IE8 and IE10, and IE7 won't work at all since Alert Central is backed by HTML5 technologies.
Our development and QA teams, along with customers, have had the best success using the latest version of Chrome (currently 26).
All of the Alert Central software management is done from the Alert Central web console - so if you're interested in adding users, configuring Alert Central, dealing with alerts, just access your Alert Central VM's IP/hostname on port 80 directly.
To manage the virtual appliance itself and do stuff like reboot, restart services, download logs, change to a static IP, upgrade, or perform other tasks directly against the virtual appliance, there's a virtual appliance management interface (you might see developers/QA refer to it on the forums as VAMI) available using HTTPS on port 5480 (e.g. https://virtual-appliance-ip-or-hostname:5480) with the credentials admin/admin.
In the current version of Alert Central, DHCP is by far the easiest way to deploy the virtual appliance, even temporarily. After assigning a DHCP IP, you can assign a static IP by going to the virtual appliance management interface (refer to the above question, or just hit up your appliance on https://virtual-appliance-ip-or-hostname:5480 with admin/admin).
While we work on a way to make assigning a static IP out of the box possible, your best bet if you need to use a static IP out of the box is to gently convince a workstation or server that the virtual appliance is on a static IP by manually adjusting your ARP tables and then accessing the virtual appliance management interface to set a new static IP. Yeah, it's a bit of a hack, but this has worked with other customers. Here's a really good example of how to do this borrowed from an APC customer with a similar issue (you can access the MAC of your virtual appliance or set a static MAC from within your virtualization management software): Manually Configuring Static IP addresses on APC Management Network Cards | The Day to Day Findings of an IT Engineer.
The best way to make sure your virtual appliance clock is correct is by making sure the hypervisor's clock is correct and synced to an NTP source, then let the virtual appliance sync its time to the host. If you don't have this option enabled, AC will synchronize itself to a public NTP server.
You can set the timezone within the virtual appliance management interface under "System" -> "Time Zone".
There's two kinds of users: those that understand.... wait, no, I'm getting off track. There are two types, admin and plain ol' user. Admin has access to configure Alert Central and manage all the users, groups, and calendars. Users only have access to view everyone's profile, view calendars, view alerts, and manage their own preferences (how to get notified, avatar photo, that sort of thing). Admin will receive a weekly report containing everyone's statistics, users will receive a weekly report specific to the group (or groups) they are in. A single user of any type can be a member of multiple groups.
Right now there are no alert visibility restrictions, group management, or similar permissions. If that's something you'd find useful, be sure to vote and/or add features in the Alert Central Feature Requests forum.
Alert Central uses its configured mailbox for 3 things:
Yeah, I know, if you don't have email sources you don't care about #1, and it's arguable that #2 doesn't need a dedicated address, but we've found enough people require SMTP authentication AND the other features (#3) are used almost all the time, so we haven't yet provided an alternative method.
Why certainly. During the Getting Started process, you'll be prompted to sync up with AD to pull down users and groups automatically. When you do this:
You can either return to the Getting Started Wizard itself from Settings -> Getting Started Wizard, or you can access each area directly from Settings, too. There are also some additional configuration options in Settings that we kept simple in the Getting Started wizard, like advanced routing and alert parsing.
Users need to validate their primary address so that you can guarantee alerts are going to someone who can receive them. If the address is NOT validated, that user will be skipped in the escalation policy, and the next user in the policy notified. You'll also see a note in the alert details in the console that says the user was skipped due to not being validated.
We're working on improving the validation process. There is no way to bypass or force validation when adding users, it happens automatically. You can't tell right now - other than inside the alerts view when they are skipped - that a user's address isn't validated. You can creatively force a validation email to be re-sent by changing their primary address to something else, then changing it back to their real address.
The weekly report contains statistics relevant to each user's group (or for admin users, all groups), like the time it takes to close alerts, how many alerts they've handled, and links to related content. It's a handy way to reference the activity from the previous week. Each user receives one weekly report for each group they are in (so, in the simplest configuration where each user is in a single group, users just get one). Any user that's an admin will receive a weekly report that shows an overview of all groups in the system with their statistics.
It's not possible to turn off or change the schedule, but if this would be useful to you, be sure to let us know how and why we can make it better.
When you add or sync users from Active Directory, Alert Central will retrieve:
There are some additional settings, like timezone, photo, and phone numbers, that need to be set manually by each user (or an admin) after they are added.
No, but we did try to make it easy by adding synchronize with Active Directory buttons everywhere we could! If you edit a user that was added with AD and want to get updates, just press the "Synchronize with Active Directory" button. Same thing if you edit a group that was originally added from AD to pick up new users or other changes.
If you want to import an entirely new group, you can do so from Settings->Import Users & Groups from Active Directory.
You do have to enter valid domain credentials each time you do this. We're doing that to avoid having just one more place that you have credentials saved, but if it would be useful for you to save them, be sure to tell us.
We've got a native integration with Orion platform products that allows you to use built-in Orion alerting without having to send alerts via e-mail first. As alerts are added in Orion, they will automatically be sent to Alert Central. As notes are added in either Alert Central or Orion, they will be shared with each other, so if you're looking at either console, you can see the associated notes. You do need to close alerts separately in each system, though.
The two systems communicate on port 443 (from your Alert Central virtual appliance to Orion port 443). You do need to be running Orion Core version 2012.2.0 or later - which comes automatically with NPM 10.4 or later and SAM 5.5 or later. If you have multiple Orion products on one system, you can upgrade one of them and it'll automatically work for them all.
Well, I can try. First, here's a super high level pretty picture (click to enlarge):
Step 1: You send your alerts to Alert Central. This is configured in sources - which can be either Orion or email-based.
Step 2: You parse out key parts of the email (automatically done for Orion) that define the object, summary, and severity of the alert. This is also done in sources.
Step 3: You decide which group will get the alerts based on data inside the alert (like the node name, or a keyword, or part of the network). This is also done in sources.
Step 4: Alerts are sent to the group, and each group has an escalation policy that decides which user gets it first, second, third, and how many times it tries. This is done in groups.
Step 4.5: If you want to use an On Call calendar as a part of an escalation policy, each group can have as many as you want. Adding new calendars is done in groups. Editing calendars is done in the calendars.
Step 5: Each user decides what email address and format to use and whether to try more than one way of contacting them. This is configured in users.
Also, be sure to check out the configuration videos here: Making Alert Central All That it Can Be - Resources & Help
The easiest way is to just start sending emails to Alert Central, then they'll appear in your alerts view with red exclamation points. You can click on one, then pick to define a source for that unmatched email (or modify an existing source that it should have matched). This has the handy benefit of sending the sample email message over for testing your configuration at the end.
You can also directly go to Settings and add an email alert source. If you do this, you should probably have an example in front of you or it's pretty easy to get lost. There's a handy video that talks about configuring email sources on this page: Making Alert Central All That it Can Be - Resources & Help.
Nope, once we set up the link between Alert Central and Orion, we don't need your username and password anymore, so we don't store it.
Since all of your emails go to one address that Alert Central checks, you might be able to manage a single source in Alert Central for all tools on your network. You can also configure multiple sources, and separate them based on some important keywords or data in the email itself (like the from address or subject). Some good indicators of when you want to configure multiple sources rather than a single one:
There's a bit more discussion of common scenarios in the "configuring email sources" video, embedded here: Making Alert Central All That it Can Be - Resources & Help
These values are something that shows up in all of your alerts and your dashboard for all alert sources and should help you quickly scan alerts to see what's going on.
When you configure your "capture" rules, you tell them where to find these keywords in the messages, so that when users receive alerts OR when you're looking at your dashboard, you can see this info quickly.
We briefly touch on capturing the summary, object, and severity in the email source configuration video on this page: Making Alert Central All That it Can Be - Resources & Help
When you're adding or editing a source, the "Test" button runs your configuration against a sample email or Orion alert and tells you how they match (or whether they match at all). You need to have a sample alert or email handy to paste or add to the Test page, then press "Test". It'll tell you:
For Orion alerts, it's easiest to set up a very basic source, set it to anything other than "trash this alert", and see alerts come in. Then, from to the alerts area, click on an alert, and click on "Original Orion Alert". You'll see a link there that says "Not happy with how this alert was routed?" that will take you straight to the sources configuration with that alert pre-populated for the test area.
For email alerts, a basic source is set up by default that does something similar. Start sending email alerts to Alert Central, then they'll appear in the alerts area with a red exclamation point. From there, you can click on the email, and choose to create a new source.
Best practices and config tips are discussed in the "configuring" videos for Orion and Email sources on this page: Making Alert Central All That it Can Be - Resources & Help
Not yet. But, if this is something you're interested in, be sure to let us know.
Definitely. When you're editing the calendar, there's a "recur" checkbox that lets you specify the recurrence. This is useful for regular on call scheduling, or using the on call calendar as a sort of staff availability list rather than manually picking someone in the group configuration.
Alert Central will try the escalation steps in order. The first option ("if the alert is not acknowledged...") tells Alert Central how long to wait between moving to the next step in the policy, i.e. "Notify Alice, wait 5 minutes, Notify Bob, wait 5 minutes..." The next option tells Alert Central how many times to repeat the policy steps before giving up, i.e. "Notify Alice, wait 5 minutes, notify Bob, wait 5 minutes, and if neither of them do anything, try those steps 5 more times."
In the end, if we're out of steps and nobody has raised their hand, we'll follow your instructions at the bottom. You can assign the alert directly to someone, acknowledge or close it, and you can carbon copy someone else to let them know this alert didn't get handled (yet).
We discuss escalation policies and on call calendars in more depth in one of our videos, which you can find on this page: Making Alert Central All That it Can Be - Resources & Help
We're working on adding upgrade notification to tell you within Alert Central when something new is up. In the meantime, we will post here on thwack as soon as upgrades are available.
The upgrade download will include instructions, but the short version:
Post to our Thwack forum, which is monitored by members of our product management, development, and QA teams.
It helps to let us know what version of Alert Central you're running (found at the bottom of your web console), your browser and OS versions (especially when reporting cosmetic issues or weird behavior), a good description of the steps you took that got you in your situation, and whether you just saw it once or have seen it repeatedly.
We might also ask you for your logs. There's a handy doc on retrieving logs here: Instructions for collecting Alert Central Logs
Check out our Library area here on Thwack. We'll post any updated content there, including documentation, videos, and anything else that's handy.
Post your ideas in the Alert Central Feature Requests forum where members of the community will vote on them. Every time we plan our roadmap, we refer back to the ideas on Thwack to help us prioritize. The most votes isn't a guarantee it'll be the next thing we do, but it is something we take very seriously. Also, vote on other peoples' ideas! If you agree that something is worthy, it's something you'd use, or something you agree would make Alert Central more useful, vote for it.
Post here or start a thread in the forum!
I am working with a customer that has recently installed Orion and Alert Central. They would like to import a sharepoint calendar into the alert central calendar. Has anyone tried and succeeded this?
anybody successfully using any Cisco 3750's with the C3KX-NM-10G module working in NTA (Netflow Traffic Analyzer). We are trying to avoid buying routers at our satellite locations simply to gather Netflow data. Cisco's documentation reads that with the C3KX-NM-10G module, netflow data can be captured from the Cisco 3750's. Would love to have confirmation before we purchase 8 of these modules and hope that it is supported in NTA.
thanks!
-eloy
Model: NetApp FAS3160 (2 Node Cluster)
We have had a couple of single disk failures in the past couple of days and I am trying to figure out if Storage Manager can alert me when this happens. I see that STM is aware of the failed disk, but I cannot seem to get a rule created that will notify me. I had attempted to setup an Asset Rule to send a trap for Disk > Status, and I have notifications setup for the devices. We did have another drive fail and get replaced with nothing listed in the events or any emails generated.
I do know that STM can send emails and that our SMTP settings are correct, as I do receive alerts from another system via STM.
Does the spop.conf query its info directly from a file on the LEM box? For some reason when installing the agent on a brand new machine the spop.conf is populating with the old appliance IP address. When LEM was first installed it was using .164 as its IP. We have since moved the vm to a beefier box and re-deployed it with an IP of .167. I can ping the DNS name just fine, and have verified there are no stale records showing the old .164 address. I can also telnet to port 37891,37890,37892 via the new IP. Ultimately I can edit the spop.conf and manually change the IP to .167 but it's very annoying. The user guide mentions clearing the agent certificate but so far I have not found any in the local cert stores. (Edit: This must be done when deleting the spop folder within the ContegoSPOP folder.) I can also manually edit the .conf file and use the DNS name as well w/o issues. But where is it getting its initial query? IE NioComNetworkParent Making install request to: x.x.x.164
When do you use NCM to backup router/switch configurations
I'm working with EOC trying to use the Custom SWQL query resources to get a resource to show me all Acknowledged alerts from Orion servers. The following works in SQL:
Select
EOC_AlertStatus.ObjectName, EOC_AlertStatus.TriggerTimeStamp,
EOC_AlertDefinition.Name, EOC_AlertStatus.Acknowledged,
EOC_AlertStatus.AcknowledgedTime, EOC_AlertStatus.AcknowledgedBy
From EOC_AlertStatus
Join EOC_AlertDefinition on EOC_AlertStatus.AlertDefID = EOC_AlertDefinition.AlertDefID
Where EOC_AlertStatus.Acknowledged = 1
But if I try to use it following the SWQL documentation I've found, trying to run it this way:
SELECT
EOC.AlertStatus.ObjectName, EOC.AlertStatus.TriggerTimeStamp,
EOC.AlertDefinition.Name, EOC.AlertStatus.Acknowledged,
EOC.AlertStatus.AcknowledgedTime, EOC.AlertStatus.AcknowledgedBy
FROM EOC.AlertStatus
INNER JOIN EOC.AlertDefinition on EOC.AlertStatus.AlertDefID = EOC.AlertDefinition.AlertDefID
WHERE EOC.AlertStatus.Acknowledged = 1
results in the resource being unable to process the request. Anyone thoughts?
It's not the most elegant solution in the world, but I managed to get this working. Let's say that you want version control for httpd.conf and php.ini on a *nix server is running SSH. Here's what I did. First, I created a bash script called "Show" (you must use a capital "S") somewhere in the path (I used /usr/local/sbin). It looks like this:
=== BEGIN SCRIPT ===
#! /bin/sh
echo *** HTTPD.CONF ***
cat /path/to/httpd.conf
echo *** PHP.INI ***
cat /path/to/php.ini
=== END SCRIPT ===
Don't forget to chmod a+x Show
Then I gave NCM a login to the Linux server, and told it that there is no enable password. It worked!
I have added a physical box (server) in to NPM
OS = rhel 5.7
Model = HP ProLiant DL580 G7
The snmp poll is fetching all the volumes/interfaces/mem information from the node, but its not able to discover any hardware details.
its running the HP SIM agent 6.3.1.
I m not able to understand, what could be the reason for not discovering hardware details.
The HP servers need to have "HP Insight Manager" installed or just HP Insight Management agent is sufficient?
Thanks,
Chetz
I am working to enhance the subject lines of the alert central emails to be a little more informative, much like the email alerts directly out of Orion. There is some inconsistency in the variable naming between trigger action emails and alert sharing. For instance, if I want to put the name of the node in the email, the variable is ${NodeName}, however, if I put that variable name in Alert Subject of the Alert Sharing tab, it's blank. If I use the variable ${SysName}, the node name is inserted correctly in the subject line in alert central. Is the a document with guidelines on which variables are available to alert sharing?
Hi Solarwinds family!
I have Orion with SAM, NPM and some others. I use Advanced Alerts to alert when issues arise. The emails received directly from Orion are very specific and useful because I customized the Variables being used (example below)
------------------------------------------------------------------------------------------------------------------------------------------------
Email Subject:
${NodeName} - ${ApplicationName} 's ${ComponentName} Status is ${ComponentStatus}
Email Body:
Server: ${NodeName}
Application: ${ApplicationName}
Component: ${ComponentName}
Status: ${ComponentStatus}
More information can be found at:
https://ORION_WEB_SERVER/Orion/NetPerfMon/NodeDetails.aspx?NetObject=N:${NodeID}
--------------------------------------------------------------------------------------------------------------------------------------------------
Gives me these results:
Server: SQL_SERVER01.domain.dc
Application: Windows Server 2003-2012 Services and Counters
Component: Windows Event Log Monitor
Status: Down
Component Message: 4 event(s) matched the specified criteria.
More information can be found at:
https://SOLARWINDS_WEB_SERVER/Orion/NetPerfMon/NodeDetails.aspx?NetObject=N:150
---------------------------------------------------------------------------------------------------------------------------------------------------
However, when I send the same details to Alert Central I am only receiving rather useless/default information:
Solarwinds Alert Central | ||
| ||
| ||
| ||
| ||
| ||
| ||
| ||
| ||
| ||
On Call Now: | ||
Buttons not working? Reply to this email with: | ||
© 2013 SolarWinds. All Rights Reserved. Post your feedback on Alert Central |
_____________________________________________________________________________________________________________________________________________
If anyone is aware on how to change the Alert Central email notification, please let me know.
Thanks,
Robert
We purchased IPAM last week and I installed IPAM 4.0 yesterday. Today I was looking around in it while skimming the admin guide when I decided to clear some of the obvious events to reduce the clutter on the main IPAM page.
After some digging and some reading, it appeared to me that the IPAM events are separate from the other events in Orion. While that was a bit unexpected, I was not too concerned until I could not find any way to "clear" alerts like I can in the main Orion events section. Is there a way to “clear” the events from IPAM?
Along the same lines, the “Last XX IPAM Events” resource appears to not support filters. So am I right to assume that the way to get a filtered list would be to create a custom report/SQL and add it as a resource?
Am I just behind on my IPAM learning curve, or are the IPAM events truly isolated and untouchable?
Because NPM 10.5 has been released recently we are already working on the next release of NPM. Here is a preview:
PLEASE NOTE: We are working on these items based on this priority order, but this is NOT a commitment that all of these enhancements will make the next release. We are working on a number of other smaller features in parallel. If you have comments or questions on any of these items (e.g. how would it work?) or would like to be included in a preview demo, please let us know!
I'm looking to see if within Solarwinds I have to install the CISCO-FIREWALL-MIB? I cannot find where this MIB is.
After spending a couple days trying to work out Advanced Alerts with different OID numbers I come here asking for help.
Here is the example of the Alert:
OID is equal to 1.3.6.1.4.1.9.9.147.1.2.1.1.1.3
Numeric Status is not equal to 9
Node Name is equal to *
The OID number along with the Numeric Status was found here: http://thwack.solarwinds.com/thread/14604
The Node name is the specific firewall that we are testing with.
Any help would be great so thank you in advance.
Be able to assign a connector profile based on the AD Group membership.
We are needing to monitor SQL security events. Can anyone tell me how MSSQL AUDITOR performs from this perspective?
We'd like to see granular information such as Change Data Capture - inserts, updates, deletes, across tables .etc...
Thanks!
Would be nice to see the ability to group edit a number of occurrences at once. Basically if a set call rotation is setup for an entire year (with recurrences), and one person goes on PTO for a week, would be nice to quickly bulk edit that weeks occurrences and change the user.
I am unable to get Solarwinds Netflow Traffic Analyzer to collect the F5 sflow statistics.
I have packet captures that show the flows are getting to the Solarwinds server, but they never show up in the UI. Any ideas?
Hey All,
Was wondering if Cisco's WAAS is/could be on the roadmap for being supported by Solarwinds??
Have roughly 15 of these devices in our network and would love to have the pretty stats in solarwinds for reporting and such.
Thanks
Michael
