SolarWinds.

All right, title, and interest in and to the software and documentation are and shall remain the
exclusive property of SolarWinds and its respective licensors.
SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS OR
IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND DOCUMENTATION FURNISHED
HEREUNDER INCLUDING WITHOUT LIMITATION THE WARRANTIES OF DESIGN,
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO
EVENT SHALL SOLARWINDS, ITS SUPPLIERS, NOR ITS LICENSORS BE LIABLE FOR ANY DAMAGES,
WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY EVEN IF SOLARWINDS
HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
The SOLARWINDS, the SOLARWINDS & Design, DAMEWARE, ORION, and other SolarWinds marks,
identified on the SolarWinds website, as updated from SolarWinds from time to time and incorporated herein, are
registered with the U.S. Patent and Trademark Office and may be registered or pending registration in other
countries. All other SolarWinds trademarks may be common law marks or registered or pending registration in
the United States or in other countries. All other trademarks or registered trademarks contained and/or
mentioned herein are used for identification purposes only and may be trademarks or registered trademarks of
their respective companies. Microsoft, Windows, and SQL Server are registered trademarks of Microsoft
Corporation in the United States and/or other countries.
Portions Copyright ComponentOne, LLC 1991-2002. All Rights Reserved.
Portions of the following SolarWinds SAM Documentation is excerpted from:
IBM DeveloperWorks, Copyright IBM Corporation 1994, [Link] at
[Link]
Microsoft TechNet, TechNet Library, 2010 Microsoft [Link] rights [Link] at
[Link].
Oracle Corporation, 2012 2010 Oracle Corporation. All rights [Link] at [Link]
Portions of the component monitor information used in the AppInsight for SQL feature are provided courtesy of
the following sources:
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]

[Link]
Portions of the following SolarWinds SAM Documentation is excerpted from:
Microsoft TechNet, TechNet Library, 2010 Microsoft Corporation. All rights reserved.
Available at [Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link] [Link]
[Link]
[Link]
[Link]
[Link]
[Link] .
[Link] .
[Link]
(v=office.14).aspx[Link]
[Link]
IBM Corporation, Copyright 2012 IBM Corporation. All rights reserved. Available at [Link]
[Link]
[Link]
m
[Link]
[Link]
[Link]
[Link]
[Link]
Portions of this document were originally created by and are excerpted from the following sources:
Oracle Corporation, 2012 2010 Oracle Corporation. All rights [Link] at [Link]
[Link]

[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
Guide/JBossAS_Server.html.
Symantec Corporation, Copyright 2012, Symantec Inc. All rights reserved. Available at
[Link]
[Link]
Citrix Corporation, Citrix InfoCenter, Copyright 2012 Citrix Corporation. All rights reserved. Available at
[Link]
RealNetworks, Inc., Helix Server and Helix Proxy Troubleshooting Guide, Copyright 2012 RealNetworks,
Inc. All rights reserved. Available at
[Link]
er%20process%20must%20wait%20for%20another%20%22&source=web&cd=4&ved=0CDoQFjAD&url=http
%3A%2F%[Link]%2Fhelp%2Flibrary%2Fguides%2FHelixServerWireline12%2Fpdf%2FServer
[Link]&ei=uyqQT9_XE6ie2wXPo5iSBQ&usg=AFQjCNE3CpUHuLmpfScz2A9GOM9ysztgA&cad=rja.
Hewlett-Packard Company, Copyright 2012 Hewlett-Packard Company. All rights reserved. Available at
[Link]
[Link]
Internet Systems Consortium, Copyright 2012 Internet Systems Consortium. All rights reserved. Available at
[Link]
[Link]
Danga Interactive, Copyright 2012 Danga Interactive. All rights reserved. Available at
[Link]
MongoDB, Copyright 2012 10gen, Inc. All rights reserved. Available at
[Link]
O'Reilly Squid, Copyright 2012 O'Reilly Media, Inc. All rights reserved. Available at
[Link]
Sybase, Copyright 2012 Sybase, Inc. All rights reserved. Available at [Link]
[Link]
[Link]
1251/html/monitoring/[Link].
SAP Corporation, Copyright 2012 SAP Corporation. All rights reserved. Available at
[Link] and
[Link]
APC powerchute, Copyright 2012. All rights reserved. Available at
[Link]
Oracle Corporation, Copyright 2012 Oracle Corporation. All rights reserved. Available at
[Link] and
[Link]
Thread_Monitoring.html.
[Link]

TrendMicro, Copyright 2012. All rights reserved. Available at

[Link]
[Link]%2Fdistrisoft%2Fantivirus%2Fcas%2Fman_01_spnt_58_1060_
[Link]&ei=tw4cUOeJKqrY2QXCgIGgDw&usg=AFQjCNGocyArGtBrtOWmt29IlqGYCQhxQQ
Server Manager for JD Edwards EnterpriseOne. Copyright 2012 JD Edwards Corporation. All rights reserved.
Available at [Link]
IBM, Copyright 2012. All rights reserved. Available at
[Link]
m.
Bind 9 Administrator Reference Manual: [Link]
Microsoft TechNet, TechNet Library, 2010 Microsoft Corporation. All rights [Link] at
[Link]
Unidata, Rocket software, 2010 Unidata. All rights [Link] at
[Link]
Portions of this documentation are based on:
[Link]
[Link]
Veeam Backup & Replication PowerShell Guide.
Portions of this document were originally created by and are excerpted from the following sources:
SAAS Corporation, Copyright 2012 SAAS Corporation. All rights reserved. Available at:
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
[Link]
MSIISSMTPServer document are based on: [Link] Microsoft
copyright 2013
BizTalk Server 2010-2013 is based on the following sources:
[Link]

[Link]
[Link]
[Link]
[Link]
Exchange 2013 templates are base on the following documents:
[Link]
[Link]
Portions of the Websense document are courtesy of Websense, copyright 2013.
[Link]
[Link]
Portions of the Microsoft DirectAccess documents are based on:
[Link] Microsoft, copyright 2013.
Potions the Oracle documents are based on the following and courtesy of Oracle, copyright 2013:
[Link]
[Link]
Portions of the Microsoft System Center Operations Manager 2012 document are courtesy of Microsoft Corp.
Copyright 2013.:
[Link]
[Link]
SolarWinds Server & Application Monitor Template Reference, 1/20/2014, version 6.1 - DJR

About SolarWinds
SolarWinds (NYSE: SWI) provides powerful and affordable IT management
software to customers worldwide from Fortune 500 enterprises to small
businesses. We work to put our users first and remove the obstacles that have
become status quo in traditional enterprise [Link] products are
downloadable, easy to use and maintain, and provide the power, scale, and
flexibility needed to address users management priorities. Our online user
community,thwack, is a gathering-place where tens of thousands of IT pros solve
problems, share technology, and participate in product development for all of
SolarWinds products. Learn more today at [Link]
SolarWinds, [Link], and Orion are registered trademarks of
SolarWinds. All other company and product names mentioned are used only for
identification purposes and may be trademarks or registered trademarks of their
respective companies.

Contacting SolarWinds
You can contact SolarWinds in a number of ways, including the following:
Team

Contact Information

Sales

1.866.530.8100
[Link]

Techni [Link] you need a customer account to

cal
access the Customer Support area of the website.
Suppor
t
User
[Link] contains the community oriented user forums
Forum
s

Conventions
The documentation uses consistent conventions to help you identify items
throughout the printed and online library.

SolarWinds Server & Application Monitor Documentation Library

Convention

Specifying

Bold

Window items, including buttons and fields.

Italics

Book and CD titles, variable names, new terms

Fixed font

File and directory names, commands and code

examples, text typed by you

Straight brackets, as
in [value]

Optional command parameters

Curly braces, as in
{value}

Required command parameters

Logical OR, as in
value1|value2

Exclusive command parameters where only one of the

options can be specified

SolarWinds Server & Application Monitor Documentation Library

The following documents are included in the Server & Application Monitor
(SolarWinds SAM) documentation library:
Document

Purpose

Administrator
Guide

Provides detailed setup, configuration, and conceptual

information for SolarWinds SAM.

Evaluation
Guide

Provides an introduction to SolarWinds Server & Application

Monitor features and instructions for installation and initial
configuration.

Page Help

Provides help for every window in the SolarWinds Server &

Application Monitor user interface

Quick Start
Guide

Provides installation, setup, and common scenarios for which

SolarWinds Server & Application Monitor provides a simple,
yet powerful, solution.

Release Notes

Provides late-breaking information, known issues, and

updates. The latest Release Notes can be found at
[Link].

The following documents supplement the Server & Application Monitor

documentation library with information about SolarWinds Common Components:
Document

Purpose

Orion Common
Provides detailed setup, configuration, and conceptual
Components
information for the common components.
Administrator Guide
Orion Common
Provides help for every window in the Orion Common
Components Page Components user interface.
Help
Release Notes

Provides late breaking information, known issues, and

updates. The latest Release Notes can be found at
[Link].

Note: With this release, Orion products are based on a set of common features
that are shared by all of the Orion products. Therefore you need to consult the
documentation listed above for the Orion Common Components in order to find
information about all of the common features.
About SolarWinds

Contacting SolarWinds

Conventions

SolarWinds Server & Application Monitor Documentation Library

Chapter 1: Introduction

89

SolarWinds SAM vs. Orion APM

89

Changes in this Guide from SAM 6.0 to 6.1

90

Applications Defined

91

Template/Application Relationship

91

SAM Glossary of Terms

92

How Does SolarWinds Server & Application Monitor Work?

94

Application Availability and Status

96

Chapter 2: Requirements and Installation

10

98

SolarWinds Server & Application Monitor Documentation Library

Requirements for SolarWinds SAM

98

SolarWinds Server Software Requirements

98

SolarWinds Server Hardware Requirements

100

Requirements for Virtual Machines and Servers

101

Requirements for the SolarWinds Database Server (SQL Server)

101

Additional SolarWinds SAM Requirements

103

FIPS Support

104

FIPS Manager

104

Server Sizing

106

SNMP Requirements for Monitored Devices

107

Enabling Microsoft Internet Information Services (IIS)

107

Enabling IIS on Windows Server 2003

107

Enabling IIS on Windows Server 2008

110

Upgrading SolarWinds Server & Application Monitor

Upgrading NPM and SolarWinds SAM on Your Current Server

114
115

Upgrading SAM to a New Server While Keeping NPM on Your Current

Server
115
Moving SolarWinds SAM to a different server

116

General Requirements

116

Database Requirements

117

Stopping SAM Services

117

To stop SolarWinds SAM services:

Creating a Database Backup File with Database Manager
To backup your SolarWinds database using Database Manager:

117
118
118

Creating a Database Backup File with SQL Server Management Studio Express
119
To backup your SolarWinds database using SQL Server Management Studio Express:

119

Creating a Database Backup File with SQL Server Management Studio

120

11

To backup your SolarWinds database using SQL Server Management Studio:

Restoring a Database Backup File for SQL Express Server
To restore your database backup file on a server running SQL
Express Server:
Restoring a Database Backup File for SQL Server 2005

120
121
121
122

To restore your database backup file on a server running SQL Server

2005:
122
Restoring a Database Backup File for SQL Server 2008

123

To restore your database backup file on a server running SQL Server

2008:
123
Updating SolarWinds SAM to Use the New Database Server
To update SolarWinds SAM to use a new database:
Reassigning Nodes

124
124
125

To reassign items to the new polling engine:

125

Copying Custom Reports

127

To copy your reports:

127

Updating Report Schemas

127

To update report schemas for custom properties:

Moving SolarWinds SAM Security Certificates to a New Server
To replicate the original certificate:
Migrating Licenses with License Manager
To deactivate currently installed licenses:
Installing License Manager

127
127
127
129
129
129

To install License Manager:

130

Using License Manager

130

To deactivate currently installed licenses:

130

Upgrading SolarWinds APM when SolarWinds Failover Engine is

Installed
On the primary/active server:

130
130

12

SolarWinds Server & Application Monitor Documentation Library

On the primary Server (assuming a successful upgrade of secondary

completed):
132
Installing SolarWinds Server & Application Monitor

133

Uninstalling SAM

138

Advanced Installation of SAM

139

To assign nodes to polling engines:

Activating Your License

145
145

To evaluate the software without a license:

145

To license the software on a server with Internet access:

146

To license the software on a server without Internet access:

146

Finishing SolarWinds SAM Installation

147

Follow the directions in the SolarWinds Configuration Wizard:

147

To configure Server & Application Monitor:

147

Excluding SolarWinds Data Directories from Anti-Virus Scanning

149

Exclude for Windows Server 2003:

149

Exclude for Windows Server 2008:

149

Running SolarWinds SAM

150

To run SolarWinds SAM:

150

Internet Explorer Security Settings

150

Licensing

150

To see the available component monitors remaining in your license: 152

Chapter 3: Common Tasks with SolarWinds SAM
Monitoring Internal and External Web Site Performance

153
153

Deciding What to Monitor

154

Monitoring the Intranet Home Page

154

Monitoring the Corporate Home Page

155

Troubleshooting the HTTP Template

156

Monitoring Microsoft Windows Performance

156

Deciding What to Monitor

156

13

Monitoring the Windows 2003 Servers

157

Troubleshooting the Windows 2003-2008 Template.

158

Monitoring IIS Application Pools

158

Deciding What to Monitor

159

What needs to be monitored:

159

Scanning for Applications Worth Monitoring

160

What needs to be monitored:

161

The administrator user name and passwords are:

161

Monitoring a Specific URL

162

To monitor a specific URL, follow the step outlined below:

Monitoring VMware Performance Counters

162
164

What needs to be monitored:

164

To create a new Application Monitor using the browsing method to

select the desired VMware performance counters:

164

Monitoring and Restarting Stopped Windows Services

What needs to be monitored:

167
167

Creating a Custom Component Availability Report

168

To generate an example report of component availability information: 169

Monitoring Large Directories

170

What needs to be monitored:

170

Troubleshooting the Large Directory Monitor

172

Chapter 4: Managing the Web Console

174

To manage the SolarWinds Web Console, navigate to the Settings

page:

175

Refer to the sections that follow for details about the administrative
commands available in each category:

176

Getting Started with SolarWinds

177

Discovery Central

177

Node & Group Management

177

14

SolarWinds Server & Application Monitor Documentation Library

Virtualization Settings

178

Accounts

178

Account List

179

Customize

179

Customize Menu Bars

179

Color Scheme

179

External Websites

179

Customized SAM Tabbed Sub-Views

180

Manage Alerts

180

Manage Advanced Alerts

181

Product Updates

182

Available Product Updates

182

SolarWinds Product Team Blog

182

Views

182

Manage Views

182

Add New View

182

Views by Device Type

183

Views by Application Type

183

Settings

183

Web Console Settings

183

Polling Settings

183

SAM Settings

184

SolarWinds Thresholds

184

Virtualization Thresholds

184

Details

184

Database Details

184

Polling Engines

184

Orion Core Details

185

License Details

185

15

Navigating the SolarWinds Web Console

185

Using Web Console Tabs

185

Using and Disabling Web Console Breadcrumbs

186

To disable web console breadcrumb navigation:

Managing Nodes from the Web Console
To manage the SolarWinds Web Console, navigate to the Settings
page:
Unmanaging Nodes

186
187
187
188

To unmanage a node:

188

Adding Nodes for Monitoring

188

To add a device for monitoring in the SolarWinds Web Console:

Deleting Nodes from Monitoring

188
191

To delete a node from monitoring in the SolarWinds Web Console:

191

Deleting Applications or Volumes from Monitoring

191

Viewing Node Data in Tooltips

192

Editing Node Properties

192

To edit object properties in the SolarWinds Web Console:

Promoting a Node from ICMP to SNMP Monitoring
To promote an ICMP only node to SNMP:
Promoting a Node to WMI Monitoring
To promote a node to WMI:

192
193
194
195
195

Viewing Node Resources

196

To view a list of all resources present on a node:

Setting Node Management States
To set or change the management state of a node:
Unscheduled Node Polling and Rediscovery
To perform an unscheduled poll or rediscovery:
Unmanage Scheduling Utility

196
197
197
197
197
198

To schedule tasks to be stopped:

16

198

SolarWinds Server & Application Monitor Documentation Library

Monitoring Windows Server Memory

199

Scheduling a Node Maintenance Mode Time Period

200

Administrative Functions of the SolarWinds Web Console

Changing an Account Password

200
200

To change an account password:

200

Viewing Secure Data on the Web

201

Handling Counter Rollovers

201

To designate the type of counter used by SolarWinds SAM:

SolarWinds General Thresholds

201
202

SolarWinds General Threshold Types

202

Setting SolarWinds General Thresholds

204

To set SolarWinds SAM thresholds:

204

Customizing Views

204

Creating New Views

205

To create a new view:

205

Editing Views

205

To edit an existing view:

205

Configuring View Limitations

207

To enable a view limitation:

208

Copying Views

208

To copy a view:

208

Deleting Views

208

To delete an existing view:

209

Views by Device Type

209

To assign a view by device type:

209

Resource Configuration Examples

209

Selecting a Network Map

209

To add a network map to the web console:

209

Displaying a List of Objects on a Network Map

210

17

To display a list of network map objects:

210

Displaying a Custom List of Maps

211

To display a custom list of maps:

211

Displaying an Event Summary - Custom Period of Time

211

To display an event summary:

211

Specifying User-Defined Links

212

To enable a user-defined links resource:

212

Specifying Custom HTML or Text

213

To specify custom HTML or text:

213

Specifying a SolarWinds Report

213

To include a SolarWinds report:

214

Displaying a Custom List of Reports

214

To display a custom list of reports:

214

Filtering Nodes

215

To enable filtering on a node list:

215

Grouping Nodes

216

To enable grouping on a node list:

216

Customizing Web Console Menu Bars

217

To customize web console menu bars:

217

Changing the Web Console Color Scheme

219

To change the web console color scheme:

219

Changing the Web Console Site Logo

219

To change the web console banner:

219

Configuring the Available Product Updates View

To configure product updates:

219
220

Updating your SolarWinds Installation

To update your SolarWinds installation:
Customizing Charts in the SolarWinds Web Console
Chart Information:

220
220
220
221

18

SolarWinds Server & Application Monitor Documentation Library

Custom Chart Resource Title Bar Options

221

Edit Chart Title View

221

Exporting Views to PDF

222

To export a view to PDF:

222

Creating a Custom Summary View

To create or edit a custom summary view in the web console:
Creating and Editing External Website Views
To create or edit an external website view in the web console:
Custom Object Resources in the SolarWinds Web Console
Editing a Custom Object Resource
To edit a Custom Object resource:

223
223
224
224
224
225
225

Selecting Custom Objects and Resources

225

Available Custom Resources

225

Integrating SolarWinds Engineers Toolset

Configuring a Toolset Integration

226
226

To configure SolarWinds Toolset integration settings:

Adding Programs to a Toolset Integration Menu
To add a program to the SolarWinds Toolset Integration menu:
Web Console Configuration

226
227
227
228

Creating a Web Console Configuration Backup

To create a SolarWinds Web Console configuration backup:
Restoring a Web Console Configuration Backup
To restore a SolarWinds Web Console configuration backup:
Clearing a Web Console Configuration
To clear your SolarWinds Web Console configuration:
Logging in for the First Time as an Administrator

228
228
228
229
229
229
229

To log in to the SolarWinds Web Console:

229

Windows Authentication with Active Directory

230

19

To enable Active Directory Windows authentication to the web console:

230
Using the Web Console Notification Bar

230

Using the SolarWinds Web Console Message Center

231

To view and configure the Message Center:

Suppressing Events

231
232

Suppressing Events:

232

Using Node Filters

233

To apply a node filter:

233

Accessing Nodes Using HTTP, SSH, and Telnet

234

Using Integrated Remote Desktop

234

To launch Integrated Remote Desktop:

Using Audit Events

234
235

Adding the Audit Events resource:

Filtering Audit Events

235
236

To Filter Audit Events:

236

Editing Audit Events:

238

Chapter 5: SolarWinds SAMCharts

239

Application Availability Chart

239

Custom Area Chart

240

Custom Bar Chart

241

Component Availability Chart

242

Custom Chart View

244

Printing Options

244

Chart Titles

244

Time Period

244

Sample Interval

245

Chart Size

245

Font Size

245

20

SolarWinds Server & Application Monitor Documentation Library

Data Export Options

245

Custom Line Chart

246

Custom Node Charts

246

Availability

247

CPU Load

247

Memory Usage

247

Packet Loss and Response Time

247

Custom Volume Charts

248

Event Log Message Details

248

Min/Max Average Chart

250

Adding the Chart:

250

Customizing the Chart

250

Zooming

251

Multiple Object Chart

251

Clicking Edit allows you to configure the characteristics of a selected

multiple objects chart:To add the Multiple Object Chart to your home
page:
252
To configure the Multiple Object Chart:
Multiple Statistic Chart

252
253

Zooming

253

Multi Chart

255

Chapter 6: SolarWinds SAM Settings

Getting Started with SAM

258
259

Scan Nodes for Applications

259

Manually Assign Application Monitors

260

Component Monitor Wizard

260

Application Monitors

260

Manage Application Monitors

260

Application Monitor Templates

260

21

Manage Templates

260

Create a New Template

261

Component Monitors

261

Component Monitor Library

261

Manage Assigned Component Monitors

261

Manage Component Monitors within Templates

261

Application Detail Views

262

Views by Application Type

262

SAM Settings

262

Credentials Library

262

Data and Database Settings

262

Database Maintenance

263

To set the three Statistic Retention Intervals:

263

Polling Engine Mode

263

To set the Polling Engine Mode (v5.2 and earlier):

263

License Summary

264

SAM License Summary

264

thwack Community

264

Shared thwack Templates

264

SAM thwack Forum

264

Chapter 7: Discovering and Adding Nodes on a Network

Discovery Central

266
266

To access Discovery Central:

267

Virtualization Discovery

267

Application Discovery

267

Network Sonar Discovery

267

To discover devices on your network from Discovery Central:

Using the Network Sonar Results Wizard
To select the results of a network discovery for monitoring in SAM:

22

268
274
274

SolarWinds Server & Application Monitor Documentation Library

Managing Scheduled Discovery Results

275

Using the Discovery Ignore List

276

To manage devices on the Discovery Ignore List:

Chapter 8: Application Discovery

276
278

To Access Application Discovery:

278

Select Nodes

278

Select Applications

278

Enter Credentials

279

Review and Start Scan

279

Add UX Monitors

280

Add Application Monitors

280

To add Application Monitors on the Add Application Monitors page: 280

Reading the Application Summary

281

Active Application Alerts

281

Application Health Overview

281

Applications with Problems

282

Last 25 Application Events

282

Thwack Latest Application Templates

283

Top 10 Components Monitored by Response Time

283

Top 10 Processes Monitored by CPU Load

283

Top 10 Processes Monitored by Physical Memory

283

Top 10 Processes Monitored by Virtual Memory

284

Top XX Monitored Processes by I/O Reads/Sec

284

Top XX Monitored Processes by I/O Writes/Sec

285

Top XX Monitored Processes by I/O Total Operations/Sec

286

Server Warranty Summary

287

Server Warranty Summary Alerts

Chapter 9: Managing Groups and Dependencies
To access the Manage Groups page:

23

288
289
289

Creating Groups

289

To create a new group:

290

Editing Groups

291

To edit properties of an existing group:

Managing Group Members

291
291

To add and remove the objects of an existing group:

Deleting Groups

292
292

To delete a group:

292

Managing the Display of Group Status

To configure the method used to determine the status of a selected
group:

292
293

Managing Dependencies

294

Creating a Dependency

294

To create a dependency:

295

Editing a Dependency

296

To edit an existing dependency:

Deleting a Dependency

296
297

To delete an existing dependency:

Viewing Alerts on Child Objects

297
297

Chapter 10: Managing Accounts

298

Creating Accounts

298

To create a new user account:

298

Editing User Accounts

299

User Account Access Settings

300

To edit a user account:

301

Configuring Audible Web Alerts

302

To enable audible web alerts:

303

Setting Account Limitations

303

To set user account limitations:

24

303

SolarWinds Server & Application Monitor Documentation Library

Defining Pattern Limitations

305

Setting Default Account Menu Bars and Views

305

To set default menu bar and view options:

306

Configuring an Account Report Folder

To configure an account report folder:

307
308

Server & Application Monitor Settings

308

Orion General Settings

309

Integrated Virtual Infrastructure Monitor Settings

309

Chapter 11: Managing SolarWinds SAM Polling Engines

Viewing Polling Engine Status

311
311

To display the Polling Engine view:

Configuring Polling Engine Settings
To open the SolarWinds Polling Settings view:
SolarWinds Polling Settings

311
312
312
312

Polling Intervals

312

Polling Statistics Intervals

313

Network

313

Calculations & Thresholds

313

Calculating Node Availability

314

Node Status:

315

Percent Packet Loss:

315

Calculating a Baseline

315

Using the Polling Engine Load Balancer

316

To reassign nodes to a different polling engine:

316

Setting the Node Warning Level

317

Managing Packet Loss Reporting

317

To configure the Response Time Retry Count for your polling engine:317
Chapter 12: Virtualization

319

VMware Monitoring

319

25

Virtual Machine Auto-Summary

319

Virtualization Alerting and Reporting

320

Requirements for Monitoring ESXi and ESX Servers

320

Enabling SNMP on VMware ESXi and ESX Servers

322

Enabling SNMP on VMware ESXi

322

To enable SNMP on VMware ESXi:

Enabling SNMP on ESX Server Version 3.5
To enable SNMP on ESX Server version 3.5:
Enabling SNMP on ESX Server Version 4.0
To enable SNMP on ESX Server version 4.0:
Creating ESX Server Credentials for SolarWinds SAM
To create ESX Server credentials for SolarWinds SAM:
Managing VMware Credentials in the Web Console

322
323
324
325
325
326
327
327

To update a VMware credential:

327

Adding Virtual Servers for Monitoring

328

Polling for VMware nodes Using the Network Sonar Wizard

328

Adding VMs from the Virtualization Assets Resource

328

Virtualization Summary

328

To view the Virtualization Summary:

328

Viewing ESX Host Details

329

Changing Polling Orders for ESX Servers

329

To poll a vCenter-managed ESX Host from the SolarWinds server:

Troubleshooting ESX Hardware Monitoring
Hyper-V Monitoring

330
330
330

Requirements for Monitoring Hyper-V Servers

331

Configuring Hyper-V Servers for Discovery

332

Modifying the Windows Firewall

332

Ensure the Core Networking rules are enabled

333

26

SolarWinds Server & Application Monitor Documentation Library

To allow core networking traffic through the Windows Firewall on Windows 2008 R2:
333
Enable the Windows Management Instrumentation (DCOM-In) rule

333

To allow WMI traffic through the Windows Firewall on Windows 2008

R2:
333
Create a new firewall rule to open the RPC ports

334

To open the RPC ports on Windows 2008 R2:

334

Enabling and Disabling Hyper-V Monitoring

334

List Resources Method:

335

Virtualization Summary Method:

335

Accessing Hyper-V Details

336

Virtualization Assets:

336

Chapter 13: Building Component Monitors and Templates

Certificate Credentials Library

338
340

Adding a Certificate to the Library

340

Assigning Certificate Credentials

340

A.) When Assigning a Template to a Node:

341

B.) Editing a Template Directly:

341

Understanding the Credentials Library

341

To set up a user account on a SQL server

342

Adding Credentials to the Credentials Library

343

To add credentials from the Credential Library page:

Editing Credentials in the Credentials Library
To edit an existing credential from the Credential Library page:
Deleting Credentials from the Credentials Library
To delete an existing credential from the Credential Library page:
Using Quick Credentials

343
343
343
343
344
344

To create and assign credentials using Quick Credentials when editing a template or Application Monitor:
344

27

Managing Assigned Application Monitors

Editing an Assigned Application Monitor
To edit an individual application:
Unmanaging Assigned Application Monitors
To unmanage assigned Application Monitors:
Remanaging Assigned Application Monitors
To remanage assigned Application Monitors:
Deleting Assigned Application Monitors
To delete assigned Application Monitors:
Application Monitor Thresholds

345
345
345
346
346
347
347
347
347
348

Inheriting Thresholds

348

Threshold Adjustments at the Template Level

349

Threshold Adjustments at the Component Monitor Level

349

Automatic Calculation of Baseline Data

To Change the Amount of Data Used in Baseline Calculations:

349
350

Multi-value Scripts and Thresholds

350

Applying Baseline Thresholds at the Template Level

352

To Edit and Apply Baseline Thresholds for a Template:

Applying Baseline Thresholds at the Application Level
To Edit and Apply Baseline Thresholds for an Application:
Latest Baseline Details

352
353
354
355

To View the Latest Baseline Details Page:

Understanding Latest Baseline Details

355
356

Understanding the Occurrences Chart

357

Understanding the Metric Over Time Chart

358

Understanding the Latest Baseline Statistics Table

359

Understanding Baseline Details and Setting Thresholds

360

Understanding Sustained Thresholds

Working with Component Monitors

360
361

28

SolarWinds Server & Application Monitor Documentation Library

Viewing the Component Monitor Library

362

Managing Assigned Component Monitors

362

Creating a New Template with Assigned Component Monitors

363

To quickly create a new template with assigned component monitors:363

Assigning Component Monitors to a Node

363

To quickly assign component monitors to a node:

363

Copying Assigned Component Monitors to an Assigned Application

Monitor
364
To quickly copy component monitors to an assigned Application Monitor:
364
Copying Assigned Component Monitors to an Application Monitor
Template

364

To quickly copy component monitors to an Application Monitor template:

364
Editing Assigned Application Monitors

365

To edit the assigned Application Monitor for a component monitor:

365

Deleting Assigned Application Monitors

365

To delete an assigned component monitor:

365

Managing Component Monitors within Templates

365

Listing the Component Monitors Defined in a Template

366

To quickly see the different component monitors within your templates:

366

Creating a New Template from Existing Component Monitors

366

To create a new template that contains copies of existing component

monitors:
366
Creating Assigned Application Monitors from Existing Component
Monitors

367

To create assigned Application Monitors from existing component

monitors:

367

Copying a Component Monitor

368

29

To copy a component monitor to a template or an assigned Application Monitor:

Choosing Component Monitors and Templates Based on Protocol
RPC vs. WMI

368
368
368

Web Service Monitoring

369

JSON

369

SOAP Monitor

370

Definitions:

370

About the SOAPMonitorCurrently, the SOAPmonitor within

SAMcan return a status of either Up or Down, or return a status of
Warning or Critical based on response time thresholds. This monitor
also has the ability to search for the presence of a string. You can test
the SOAP monitor in Edit mode. If the test poll throws a web exception (indicating that there was a problem on the target) the response
content is extracted and you will be able to view the message to help
identify the issue.
371
Configuring the SOAP Monitor

371

Loading WSDLFilesThe SOAPmonitor within SAM currently supports the WSDL schema, which must be exposed on a URL. Once
the WSDL file is successfully loaded, the file will be parsed automatically and the fields, highlighted below, will populate.

371

Manually Entering XML

373

Scripting Custom Component Monitors

374

Creating a Linux/Unix Script Monitor

375

To adapt an existing Perl script to a Linux/Unix Script component

monitor in a new template:

375

Linux/Unix Scripts

377

Example Scripts

378

Scripts Must Report Status Through Exit Codes

378

Scripts with Text Output

379

Creating a Windows Script Monitor

Field Descriptions

380
380

30

SolarWinds Server & Application Monitor Documentation Library

Creating a Windows Script Monitor

382

To adapt an existing Visual Basic script to a Windows Script Monitor

in a new template:
383
Macros for Script Arguments

383

Scripts Must Report Status Through Exit Codes

384

Scripts with Text Output

384

Example Scripts

385

Creating a Nagios Script Monitor

387

Return Codes

387

Field Descriptions

388

Creating a Windows PowerShell Monitor

389

What needs to be monitored:

390

Troubleshooting the [Link] PowerShell Monitor

392

Using Application Monitor Templates

393

Scanning Nodes for Applications

393

To use the application discovery:

393

Select Nodes

393

Select Applications

393

Enter Credentials

394

Review & Start Scan

394

Add UX Monitors

395

Manually Assign Application Monitors

To assign a template using the wizard:

395
395

To assign a template through the Manage Application Monitor Templates page:

395
Creating New Templates

396

Creating New Templates Using the Traditional Method:

396

Creating New Templates Using the Browsing Method:

397

Managing Templates

398

31

Creating Templates

398

To create an application template:

398

Assign to Node

398

To create an assigned Application Monitor by assigning template(s)

to nodes:
398
Editing Templates

399

To edit an application template:

399

Multi-Edit Templates

400

Ordering Components

401

Copying Templates

401

To copy an application template:

401

Exporting and Importing Templates Locally or Using Thwack

402

To export a template:

402

To import a template from a file:

402

To import a template from thwack:

403

Deleting Templates

403

To delete a template:

404

Tagging Templates

404

To add tags:

404

To remove tags:

404

Understanding Component Monitors and Application Monitor Templates 405

Requirements for Component Monitors and Templates that use WMI

407

Monitoring External Nodes

408

Custom Application Monitor Template Example: Creating a SolarWinds

SAM Template
408
To create a SolarWinds SAM application template:

409

Web Service Monitoring

411

JMX Component Monitor Wizard

411

To add a JMX component monitor, perform the following steps:

32

412

SolarWinds Server & Application Monitor Documentation Library

Available Data Transformations

413

Conversion Value

415

Chapter 14: Asset Inventory

416

Asset Inventory Requirements

417

Third Party Software Required for Asset Inventory Information

418

HP

418

HP/VMWare

418

Dell/VMWare

418

IBM

418

VMWare

418

Asset Inventory Data Collection

418

Enabling the Asset Inventory Dashboard

419

To Enable Asset Inventory data collection via the Add Node Wizard: 419
To Enable Asset Inventory data collection via the Management
Resource:
Viewingthe Asset Inventory Dashboard
Navigating to the Asset Inventory page:

419
420
421

Custom Asset Information

421

Drivers

422

Firmware

423

Graphics and Audio

423

Hard Drives

424

Hosted Virtual Machines

425

Logical Volumes

425

Memory

426

Network Interfaces

427

Operating System Updates Applied

427

Out of Band Management

428

Peripherals

428

33

Ports and USB Controllers

429

Processors

429

Removable Media

430

Software Inventory

430

Storage Controllers

431

System Information

431

General

432

Hardware

432

Operating System

433

Windows Update Information

433

Chapter 15: AppInsight Applications

435

Template/Application Relationship

435

AppInsight for SQL

436

AppInsight for SQL Requirements and Permissions

437

AppInsight for SQL Requirements

437

AppInsight for SQL Permissions

438

The following script will configure permissions:

438

AppInsight for SQL Licensing

439

Adding AppInsight for SQL to a Node

439

To Add AppInsight for SQL via the Management Resource:

Editing the AppInsight for SQL Template
Editing the AppInsight for SQL Template:
Understanding the AppInsight for SQL Details View
Editing Resources

441
441
441
442
443

Navigating the AppInsight for SQL Details View

444

To Navigate to the Database Details view:

446

Monitoring Clusters with AppInsight for SQL

447

AppInsight for SQL Alerts

450

AppInsight for SQL Details View (Summary Tab)

451

34

SolarWinds Server & Application Monitor Documentation Library

All Databases

451

Application Availability

452

Zooming

452

Application Details

453

Buffer Manager

453

Cache

457

Connections

459

Disk

462

Latches and Locks

466

Memory

472

Pages

482

Sessions

488

SQL Agent Job Status

491

SQL Errors

491

SQL Event Log Message Details

492

SQL Server

492

Top 10 Databases by Active User Connections

502

Top 10 Most Expensive Queries by CPU Time

503

AppInsight for SQL Details View (Queries Tab)

Most Expensive Queries

505
505

Database Details View

506

To navigate to the Database Details view:

506

Active User Connections

507

Connections

507

Database Availability

510

Zooming

511

Database Details

512

Database Disk I/O

513

Database Size by File

514

35

Log Flushes

515

Processes and Services

519

Storage

519

Top 10 Clustered Indexes by Fragmentation

528

To change the thresholds for the Top Indexes for Database performance counter:

529

Top 10 Most Expensive Queries by CPU Time

531

Top 10 Nonclustered Indexes by Fragmentation

532

Top 10 Tables by Size

535

Transaction Log Disk I/O

537

Transaction Log Size by File

538

Transactions

539

AppInsight for Exchange

543

AppInsight For Exchange Licensing

544

Quick Configuration and Navigation

544

Adding AppInsight for Exchange to a Node

545

Understanding the AppInsight for Exchange Details Views

550

Navigating the AppInsight for Exchange Details Views

551

Advanced Manual Configuration

554

Changes that will be made to enable AppInsight for Exchange

555

Finding Exchange Credentials

556

Manually Configuring Exchange Server

558

Defining Exchange Credentials

558

Installing PowerShell 2.0 on Server 2008:

559

Installing PowerShell 2.0 on Server 2012:

560

Create a Self-Signed Certificate:

561

WinRM 2.0

562

Create a Firewall Rule

563

Configuring IIS

565

36

SolarWinds Server & Application Monitor Documentation Library

For correcting common configuration issues, see:

567

For more information, see:

567

AppInsight for Exchange Requirements and Permissions

568

Finding Exchange URL Settings

569

To verify the PowerShell instance used by Exchange on a server, follow the steps listed below:
570
PowerShell Permissions

573

Editing the AppInsight for Exchange Template

575

Attachment Extensions

576

AppInsight for Exchange Alerts

577

AppInsight for Exchange Details View

578

Active Alerts

579

Application Availability

579

Application Details

581

Calendar and Resource Booking

582

Critical Processes and Services

585

Exchange Event Log Message Details

591

Exchange Server

592

Information Store

597

Mailbox Database Copies

603

Mailbox Database Size and Space Used

606

Mailbox Database Status

607

Mail Database

612

Management

616

Replication

618

Replication Status Checks

622

Storage

625

Users By Mailbox Size

628

Users By % Mailbox Quota Used

629

37

Users By Messages Sent

631

AppInsight for Exchange Database Details View

633

To navigate to the Database Details view:

633

Active/Mounted Database Availability

633

Database Copies

635

Database Details

639

Database Disk I/O

647

Database File Size

648

Database I/O

649

Database Metrics

653

Events

656

Messages

658

Transaction Log Disk I/O

660

Transaction Log File Size

660

AppInsight for Exchange Mailbox Details View

661

Mailbox Details

661

Mailbox Synced Devices

662

Received Mail

663

Sent Mail

664

Total Mailbox and Attachments Sizes

665

Troubleshooting AppInsight for Exchagne

667

Troubleshooting Permissions

667

Troubleshooting Exchange Performance Counters

670

Troubleshooting Error Codes in AppInsight for Exchange

673

Performance Counter Details View

684

Performance Counters

685

Performance Counter Details

685

History Chart

687

Chapter 16: Viewing Performance and Status

38

688

SolarWinds Server & Application Monitor Documentation Library

Understanding the SAM Application Summary

688

Understanding SAM Application Details

690

Understanding SolarWinds SAM Component Details

691

Understanding SolarWinds SAM Component Settings

693

Showing SolarWinds SAM Data in Node Details

693

To enable SolarWinds SAM-specific resources:

Customizing SAM Application Summary Views

693
694

Pre-configured Summary Views

694

Summary View Filtering Criteria

695

To create a Filtered Applications Summary view based on the default

SAM Application Summary view:
696
To add a summary view menu item to the menu bar in the Applications tab:

696

Customizing Application Details Views

697

Default Application Details View

697

Custom Application Details View

697

To customize an application details view for an assigned Application

Monitor:
697
Managing Custom Application Details Views

698

To select a view for a template:

698

To select a view for an application:

698

Viewing Node and Application Data in Tooltips

699

Node Tooltips

699

Application Tooltips

700

Monitoring Network Events in the Web Console

700

Viewing Event Details in the Web Console

700

To view event details in the Web Console:

701

Acknowledging Events in the Web Console

701

To acknowledge events in the Web Console:

39

701

Understanding Volume Details

702

To navigate to the Volume Details page:

702

Volume Details Resource

702

Volume Polling Details

703

Total Disk IOPS

703

Avg. Disk sec/Transfer

704

Disk queue length

706

Avg. Disk Space Used - Today

707

Percent Disk Space Used - Today

708

Volume Size

709

Understanding Interface Details

710

Interface Details Resource

710

Percent Utilization

711

Min/Max Average bps In/Out Chart

711

Percent Utilization - Line Chart

712

In/Out Errors and Discards

714

Total Bytes Transferred

715

Min/Max/Average Packets In/Out

716

Chapter 17: Creating Account Limitations

Using the Account Limitation Builder
Creating an Account Limitation

719
719
719

To create an account limitation:

Deleting an Account Limitation

720
720

To delete an account limitation:

720

Chapter 18: Alerting and Reporting

722

Creating Alerts

722

Configuring SolarWinds SAM Alerts

723

To configure a new alert:

723

Example 1: SolarWinds SAM Alert

723

40

SolarWinds Server & Application Monitor Documentation Library

To set up this alert trigger condition:

723

To set up the alert trigger action:

724

Example 2: Displaying Root Cause of Group Status in SolarWinds

SAM Alert

724

To set up this alert trigger condition:

724

To set up the alert trigger action:

725

SolarWinds SAM Alerts

725

Component Monitor Alerting Properties

726

Application Monitor Alerting properties

729

Application Monitor Variables for Alerts

729

Component Monitor Variables for Alerts

732

Testing Alert Actions

735

To test an alert action:

736

Viewing Alerts in the SolarWinds Web Console

To view alerts in the Web Console:
Acknowledging Advanced Alerts in the Web Console
To acknowledge advanced alerts using the SolarWinds Web Console:
Viewing Alerts from Mobile Devices
To view and acknowledge alerts from a mobile device:
Restarting Windows Services with an Alert Action

736
736
737
737
738
738
738

Example Alert Manager Trigger Action to Restart a Windows Service 739

Using the Preconfigured Restart a Service Alert

739

To enable the Restart a Service alert:

739

Creating a New Advanced Alert

739

To create a new advanced alert:

Naming, Describing, and Enabling an Advanced Alert
To name and describe an advanced alert:
Setting a Trigger Condition for an Advanced Alert

41

739
741
741
743

To set the trigger conditions for an advanced alert:

Setting a Reset Condition for an Advanced Alert
To set the conditions for resetting an advanced alert:
Setting a Suppression for an Advanced Alert

743
746
746
747

To set conditions for advanced alert suppression:

747

Setting the Monitoring Period for an Advanced Alert

748

To set the monitoring time period and days for an advanced alert:

748

Setting a Trigger Action for an Advanced Alert

749

To set a trigger action for an advanced alert:

749

Setting a Reset Action for an Advanced Alert

749

To set a reset action for an advanced alert:

749

Alert Escalation

750

Understanding Condition Groups

750

All Condition Group

751

Any Condition Group

751

None Condition Group

751

Not All Condition Group

751

Using the Advanced Alert Manager

752

Current Events Window

752

To use the Current Events window to view network events:

752

Active Alerts Window

753

To use the Active Alerts window to view active network alerts:

753

Alert Viewer Settings

754

To configure alert views in the Advanced Alert Manager:

754

Adding Alert Actions

755

To add an alert action:

755

Sending an E-mail / Page

755

To configure an email/page action for an advanced alert:

Playing a Sound

756
757

42

SolarWinds Server & Application Monitor Documentation Library

To configure a play sound action for an advanced alert:

Logging an Advanced Alert to a File

757
758

To configure an alert log file for an advanced alert:

758

Logging an Advanced Alert to the Windows Event Log

759

To configure advanced alert logging to the Windows Event Log:

Logging an Advanced Alert to the NetPerfMon Event Log
To configure advanced alert logging to the NetPerfMon Event Log:
Sending a Syslog Message

759
760
760
761

To configure an advanced alert to send a Syslog message:

Executing an External Program

761
762

To configure an advanced alert to execute an external program:

Executing a Visual Basic Script

762
763

To configure alerts to execute a Visual Basic (VB) script:

Emailing a Web Page

763
764

To configure an email web page action for an advanced alert:

Using Text to Speech Output

764
765

To configure a text-to-speech output action for an advanced alert:

Sending a Windows Net Message
To configure SolarWinds to send a Windows Net message upon
alert:
Sending an SNMP Trap

765
766
766
767

To configure SolarWinds to send an SNMP trap upon alert:

Using Get or Post URL Functions
To configure SolarWinds to use GET or POST URL functions with
alerts:
Dial Paging or SMS Service

767
767
768
768

Escalated Advanced Alerts

768

Escalated Alert Example

769

Creating a Series of Escalated Alerts

769

43

To create an escalated alert:

770

Creating and Viewing Reports

772

Creating SolarWinds SAM-Specific Reports

773

Using Predefined SolarWinds SAM Reports

773

Current Application and Component Status

774
774
774

Current Hardware and Hardware Sensor Status

774
775
775

Daily Application Availability

775

Hardware Health Power Consumption Cost Calculations

775

Historical Application CPU and Memory Reports

776
777
777

Historical Hardware Sensor Daily Availability

777

Historical Hardware Sensor Statistic

777
778
778

Historical Reports

778

Viewing SolarWinds Server & Application Monitor Reports

To start Report Writer:

778
778

Filtering and Grouping Data in Resources

779

Grouping Applications

779

To group resource data by category:

780

Filtering Data Using Filter Criteria

780

To filter application data using filter syntax:

780

SQL Syntax

780

Wildcards

780

44

SolarWinds Server & Application Monitor Documentation Library

Filtering by Custom Property

780

Filtering by Built-in Properties

781

Examples

781

Filtering by Status

781

Built-in SQL Application Properties

781

Built-in SQL Component Monitor Properties

782

Built-in SQL Node Properties

782

SWQL Syntax (SolarWinds Query Language)

782

Wildcards

782

Filtering by Custom Property

782

Filtering by Built-in Properties

783

Examples

783

Filtering by Status

783

Built-in SWQL Application Properties

784

Built-in SWQL Application Status Properties

784

Built-in SWQL Component Monitor Properties

784

Built-in SWQL Component Monitor Status Properties

784

Built-in SWQL Nodes Properties

785

Predefined SolarWinds Reports

785

Availability

786

Current Node Status

786

Current Volume Status

787

Daily Node Availability

787

Events

787

Historical CPU and Memory Reports

788

Historical Response Time Reports

789

Historical VMware ESX Server Reports

789

Groups: Current Groups and Groups Members Status

790

Groups: Daily Group Availability

790

45

Groups: Group Availability (with members)

790

Groups: Historical Groups Status

791

Historical Volume Usage Reports

791

Inventory

791

Viewing Reports

792

Viewing Reports in the SolarWinds Web Console

792

To view reports in the SolarWinds Web Console:

792

Viewing Reports in the SolarWinds SAM Report Writer

792

To view reports with SolarWinds SAM Report Writer:

792

Using Report Writer

793

To start Report Writer:

793

Preview Mode

793

Design Mode

794

Creating and Modifying Reports

794

To open a report with Report Writer:

794

General Options Tab

795

To configure General options:

795

Select Fields Options Tab

795

To select and configure fields:

795

Filter Results Options Tab

796

To configure results filters:

796

Top XX Records Options Tab

797

To configure Top XX records:

797

Time Frame Options Tab

797

Summarization Options Tab

797

To configure results summarization:

797

Report Grouping Options Tab

798

To add and edit report groups:

798

Field Formatting Options Tab

798

46

SolarWinds Server & Application Monitor Documentation Library

Customizing the Report Header and Footer Image

799

Exporting Reports

799

To export a report from Report Writer:

Example Device Availability Report

799
799

To generates an example report of network device availability information:

800
Reports and Account Limitations

806

To allow account-limited users access to reports:

Web Console Based Reports

806
807

Using Predefined Web Console Based Reports

807

Predefined SAM Web Console Based Reports

808

Application Reports

808

Group Reports

810

Hardware Health Reports

811

Interface Reports

811

Node Reports

813

Creating and Editing Web Based Reports

817

Edit Report Screen:

819

Report Width:

819

Header Section:

820

Logo

820

Content Section:

821

Page Layout

821

Layout Columns

823

For Dropdown Menu

823

Edit Table

824

Edit Resource Screen

824

Table Layout

825

Table Layout

827

47

Table Layout (Column Details)

827

Display Settings

829

Creating a Scheduled Report

829

Scheduling a Web-Based Report

830

Creating a Web-Based Report Schedule

830

Using an Existing Web-Based Report Schedule

834

Chapter 19: Monitoring Hardware Health

835

Hardware Items Monitored by SAM

836

Hardware Monitoring and VMware

836

Accessing Hardware Monitoring Agent Software

837

Adding Server Hardware Monitoring

838

Add Node Wizard

838

Manually Add Hardware Monitoring

838

Hardware Details

839

Current Hardware Health Status

840

Hardware Health Overview Chart

841

Changing Threshold Values

842

Hardware Health Chart

843

Customizing the Hardware Health Chart

Alerting on Hardware Health

844
846

Manually Changing Alert Thresholds

Chapter 20: Managing Processes, Services, Tasks, and Events in
Real Time
Real Time Process Explorer

847
849
849

Accessing the Real Time Process Explorer

850

Node Details page

850

To navigate to the Node Details page:

851

Application Details page

851

To navigate to the Application Details page:

852

48

SolarWinds Server & Application Monitor Documentation Library

Component Details page

852

To navigate to the Component Details page:

852

Monitoring Unmonitored Processes

To have SAM monitor a process that is not being monitored:
Using the Real Time Process Explorer

852
853
853

To show all running processes:

854

To show a set number of running processes:

854

To pause polling:

854

To end processes:

854

To start polling:

855

Real Time Process Explorer Alerts

855

Real Time Process Information in Top XX Alerts

856

To edit an alert:

856

Service Control Manager

859

Accessing the Service Control Manager

859

Application Details page

859

To navigate to the Application Details page:

860

Component Details page

860

Node Details page

860

To navigate to the Node Details page:

861

Using the Service Control Manager

861

Starting and Stopping a Service:

862

Windows Scheduled Task Monitor

863

Requirements for the Windows Scheduled Task Monitor

863

Enabling the Windows Scheduled Task Monitor

864

Accessing the Windows Scheduled Task Monitor

866

Understanding the Windows Scheduled Task Monitor

867

Alerting Using Windows Scheduled Task Monitor Macros

868

Windows Scheduled Task Monitor Returned Status Codes

869

49

Real Time Event Viewer

872

Accessing the Real Time Event Viewer

873

To navigate to the Node Details page:

873

To navigate to the Application Details page:

873

To navigate to the Component Details page:

873

Filtering Events

873

To Select a Log Type:

874

Reading Events

876

Monitoring Events

876

Component Monitor Wizard

877

Chapter 21: Monitoring Syslog Messages

878

Configuring the SolarWinds Syslog Port

878

To configure the Syslog port:

879

Syslog Messages in the Web Console

879

Syslog Resources

879

Viewing Syslog Messages in the Web Console

880

To view Syslog messages in the Web Console:

Acknowledging Syslog Messages in the Web Console

880
881

To acknowledge Syslog messages in the SolarWinds Web Console: 881

Using the Syslog Viewer

882

Viewing and Acknowledging Current Messages

To view and acknowledge current Syslog messages:
Searching for Syslog Messages

882
882
882

To search the Syslog message list:

Syslog Server Settings

882
883

To start and configure the Syslog Viewer:

883

Configuring Syslog Viewer Filters and Alerts

884

To configure Syslog Viewer filters and alerts:

Available Syslog Alert Actions

884
886

50

SolarWinds Server & Application Monitor Documentation Library

Forwarding Syslog Messages

887

To configure the forward Syslog message action:

Syslog Alert Variables

888
888

Syslog Date/Time Variables

888

Other Syslog Variables

890

Syslog Message Priorities

890

Syslog Facilities

890

Syslog Severities

892

Chapter 22: Monitoring SNMP Traps

893

The SNMP Trap Protocol

893

Viewing SNMP Traps in the Web Console

893

To view SNMP traps in the Web Console:

Using the Trap Viewer

894
894

Viewing Current Traps

894

To view current trap messages:

Searching for Traps

894
895

To search the trap message list:

Trap Viewer Settings

895
895

To start and configure the Trap Viewer:

895

Configuring Trap Viewer Filters and Alerts

896

To configure Trap Viewer filters and alerts:

Available Trap Alert Actions

896
898

Trap Alert Variables

900

Trap Date/Time Variables

900

Other Trap Variables

901

Chapter 23: Managing the SolarWinds SAM Database

Using Database Manager

903
903

Adding a Server

904

To add a SQL server to Database Manager:

51

904

Creating Database Backups

904

To back-up a database in Database Manager:

Restoring a Database

904
905

To restore a database from backup:

Compacting your Database

905
906

To compact a database with Database Manager:

Compacting Individual Tables

906
906

To compact individual tables:

906

Viewing Database Details

907

To view database details:

907

Viewing Table Details

907

To view table details:

907

Editing Database Fields

908

To edit database fields with Database Manager:

Detaching a Database

908
909

To detach a database:

909

Using SQL Server Management Studio

To use SQL Server Management Studio to manage your database:
Database Maintenance

909
910
912

Running Database Maintenance

912

To run the Database Maintenance utility:

Migrating your Database

912
913

Stopping SolarWinds Services

913

To stop SolarWinds services:

913

Migrating SolarWinds SAM

913

To migrate SAM:

914

Creating a Database Backup File with SQL Server Management Studio Express
915

52

SolarWinds Server & Application Monitor Documentation Library

To backup your database using SQL Server Management Studio

Express:

915

Creating a Database Backup File with SQL Server Management Studio

916
To backup your database using SQL Server Management Studio:

916

To restore your database backup file on a server running SQL

Express Server:

917

To restore your database backup file on a server running SQL Server

2005:
918
To restore your database backup file on a server running SQL Server
2008:
919
To update SAM to use a new database:

920

Moving SAM to a New Server

921

To replicate the original certificate:

921

To export data from one SolarWinds database and import it into

another:

922

Chapter 24: Creating Custom Properties

Creating a Custom Property

924
924

To create a property with Manage Custom Properties Editor:

Removing a Custom Property

925
926

To remove a custom property:

926

Importing and Exporting Custom Property Data

927

To import custom property data:

927

To export custom property data:

928

Editing Custom Properties

929

To edit a custom property:

929

To edit a custom property's value:

929

Chapter 25: Additional Polling Engine and Web Console

Understanding How Polling Engines Work
SolarWinds SAM is Poller-Unaware By Default

53

931
931
932

SolarWinds SAM Additional Polling Engines are Poller-Aware

932

Requirements for Installing an Additional Polling Engine

933

Installing an Additional Polling Engine

934

To install the additional polling engine:

935

To assign nodes to polling engines:

935

Installing an Additional Web Console

936

To install an additional Web Console:

936

Copying the Default Reports

936

Chapter 26: Status Icons and Identifiers

938

Chapter 27: SolarWinds Variables and Examples

939

Variable Modifiers

939

95th Percentile Calculations

940

Regular Expression Pattern Matching

941

Characters

941

Character Classes or Character Sets [abc]

941

Anchors

943

Quantifiers

944

Dot

946

Word Boundaries

946

Alternation

946

Regular Expression Pattern Matching Examples

947

Advanced Alert Engine Variables

948

General

948

Date/Time

948

Group Variables

950

SQL Query

952

Status Variables

953

Node Variables

954

Volume Variables

963

54

SolarWinds Server & Application Monitor Documentation Library

Hardware Specific Variables

965

Hardware Status

965

Node Hardware Type

967

Node Hardware Sensor

968

I/O Operations Macros

969

Asset Inventory Alert Macros

969

Example Messages Using Variables

971

Syslog Alert Variables

971

Syslog Date/Time Variables

971

Other Syslog Variables

972

Trap Alert Variables

973

Other Trap Variables

973

Trap Date/Time Variables

974

Script Macros

976

Node Custom Property Macros

977

Application Custom Property Macros

977

Baseline Threshold Macros

977

Chapter 28: Network Atlas

978

What is in a Map?

978

Example Maps

979

Installing Network Atlas

980

Network Atlas Requirements

980

Network Atlas Requirements

980

Creating a Basic Map

981

Starting Network Atlas

981

To start Network Atlas:

981

Adding Map Objects

982

To add monitored objects to your map:

Connecting Map Objects Manually

982
983

55

To manually connect map objects:

Using Object Links to Represent Interface Status
To use object links to represent actual interface states:

983
983
983

Interpreting Map Links

983

Using Anchor Points to Reshape Map Links

984

To use object link anchor points:

Adding a Background

984
984

Selecting a Background Color

984

To set a map background color:

984

Selecting a Background Texture

984

To set a map background textures:

984

Selecting a Background Image

985

To select a background image:

985

Clearing the Background

986

Saving Maps

986

To save a map:

986

Opening Maps

986

To open a map:

987

Displaying Maps in the Web Console

987

Map Resources in the Network Atlas Web Console

987

Displaying Maps in the SolarWinds Web Console

988

To display a saved map in the Home view of the SolarWinds Web

Console:
Displaying Maps in the SolarWinds EOC Web Console
To display a saved map in the Home view of the SolarWinds EOC
web console:

988
988
988

Advanced Mapping Techniques

988

Zooming In and Out of a Map

989

Creating Nested Maps

989

56

SolarWinds Server & Application Monitor Documentation Library

To create a nested map:

990

Displaying Map Object Metrics

991

To add the secondary status indicator:

991

To change the thresholds of the metrics:

991

Adding Independent Map Objects and Floating Labels

991

To add an independent object:

991

To add an independent label:

992

Changing the Appearance of Map Objects

992

To set the default representations of map objects:

992

To change the representation of selected map objects:

992

Pasting Custom Icons from the Windows Clipboard

993

To paste a custom icon into Network Atlas:

993

To delete a custom icon:

993

Adding Custom Icons from Graphics Files

994

To add custom icons from graphics files:

994

To assign a custom icon to an object:

995

Changing the Appearance of Links

995

To change the appearance of a link:

Changing the Appearance of Labels

995
995

To move a label:

995

To edit the text in a label:

995

To change the appearance of a label:

995

Linking Map Objects to URLs

996

To link a map object to a URL.

996

Linking or Embedding Maps in Web Pages

996

Customizing SolarWinds Web Console Tooltips

997

To add additional information to map object tool tips:

997

Example Custom SolarWinds Node Tooltip

997

Advanced Map Layouts

998

57

Displaying Grid Guides

998

To display a grid:

998

To customize the grid:

998

Aligning Map Objects

998

Distributing Map Objects

999

Selecting Automatic Layout Styles

1000

To arrange map objects according to a layout style:

Map Properties

1001
1001

Setting the Map Up Status Threshold

1001

To set the percentage of map objects that determine Up status of a

map:
1001
Overriding Account Limitations

1001

To hide nodes from users who have account limitations:

1001

To reveal nodes to all users:

1001

Network Atlas Settings

1002

Network Atlas Tooltip Variables

1003

Application Variables

1003

Application Component Monitor Variables

1004

Date and Time Variables

1004

General Variables

1006

Node Variables

1007

Volume Variables

1012

Wireless Variables

1014

Group Variables

1014

Chapter 29: Configuring Automatic Login

Using Windows Pass-through Security
To enable IIS NT security for Windows Pass-through Security:

1017
1017
1018

Passing Login Information Using URL Parameters

1019

Using the DirectLink Account

1020

58

SolarWinds Server & Application Monitor Documentation Library

To enable a DirectLink account for the SolarWinds Web Console:

Chapter 30: Component Monitor Types
DHCP User Experience Monitor

1020
1021
1022

Statistic

1022

Field Descriptions:

1022

Directory Size Monitor

1024

Statistic

1025

Field Descriptions:

1025

DNS Monitor - TCP

1026

Statistic

1026

Field Descriptions:

1026

DNS User Experience Monitor

1027

Statistic

1027

Field Descriptions:

1028

DNS Monitor - UDP

1029

Statistic

1029

Download Speed Monitor

1030

Statistic

1030

Field Descriptions:

1030

Exchange Web Services User Experience Monitor

Field Descriptions:

1031
1032

File Age Monitor

1033

Statistic

1033

Field Descriptions:

1033

File Count Monitor

1035

Statistic

1035

Field Descriptions:

1035

File Existence Monitor

1037

Statistic

1037

59

Field Descriptions:

1037

File Change Monitor

1038

Statistic

1038

Field Descriptions:

1038

File Size Monitor

1040

Statistic

1040

Field Descriptions:

1040

FTP User Experience Monitor

1041

To configure the FTP User Experience Monitor and generate a snapshot checksum:
1041
Statistic

1042

Field Descriptions:

1042

FTP Monitor

1044

Statistic

1044

Field Descriptions:

1044

HTTP Form Login Monitor

1045

Statistic

1045

Troubleshooting

1045

Field Descriptions:

1046

HTTP Monitor

1048

Statistic

1049

Field Descriptions:

1049

HTTPS Monitor

1051

Statistic

1052

Field Descriptions:

1052

IMAP4 Monitor

1055

Statistic

1055

Field Descriptions:

1055

IMAP4 User Experience Monitor

1056

60

SolarWinds Server & Application Monitor Documentation Library

Statistic

1056

Field Descriptions:

1056

JMX Monitor

1058

Field Descriptions:

1058

LDAP User Experience Monitor

1060

Statistic

1060

Field Descriptions:

1060

Linux/Unix Script Monitor

1062

Statistic

1062

Field Descriptions:

1062

MAPI User Experience Monitor

1064

Install the MAPI Client on Your SolarWinds SAM Server

1064

Statistic

1065

Notes:

1065

Field Descriptions:

1065

Nagios Script Monitor

1067

Field Descriptions:

1067

NNTP Monitor

1069

Statistic

1069

Field Descriptions:

1069

ODBC User Experience Monitor

1070

Statistic

1070

Install ODBC Drivers on the SolarWinds SAM Server.

1070

TCP Ports

1071

Field Descriptions:

1071

To create the SQL Server connection string:

1072

Oracle User Experience Monitor

1073

Statistic

1074

Install Oracle Client on the SolarWinds SAM Server.

1074

61

TCP Ports

1074

Monitoring Oracle Real Application Clusters

1074

Field Descriptions:

1074

Performance Counter Monitor

1078

Statistic

1079

Field Descriptions:

1079

POP3 Monitor

1081

Statistic

1081

Field Descriptions:

1081

POP3 User Experience Monitor

1082

Statistic

1082

Field Descriptions:

1082

Process Monitor - SNMP

1084

Statistic

1084

Field Descriptions:

1084

Process Monitor - WMI

1086

Statistic

1086

Field Descriptions:

1086

RADIUS User Experience Monitor

1088

Statistic

1088

Field Descriptions:

1088

Service Status SNMP

1089

Statistic

1089

Field Descriptions:

1089

SMTP Monitor

1090

Statistic

1090

Field Descriptions:

1090

SNMP Monitor

1091

Statistic

1091

62

SolarWinds Server & Application Monitor Documentation Library

Field Descriptions:

1091

SOAP Component Monitor

1093

Field Descriptions:

1093

SQL Server User Experience Monitor

1096

Statistic

1096

Field Descriptions:

1097

SSL Certificate Expiration Date Monitor

Field Descriptions:

1099
1099

TACACS+ User Experience Monitor

1100

Statistic

1100

Field Descriptions:

1101

TCP Port Monitor

1102

Statistic

1102

Field Descriptions:

1102

Tomcat Server Monitor

1103

Statistic

1103

Field Descriptions:

1104

VMware Performance Counter Monitor

1105

Statistic

1106

Field Description:

1106

Web Link Monitor

1109

Statistic

1109

Field Descriptions:

1109

Windows Event Log Monitor

1111

Statistic

1112

Field Descriptions:

1112

Windows PowerShell Monitor

1115

Statistic

1116

Field Descriptions:

1116

63

Windows Script Monitor

1118

Field Descriptions:

1118

Windows Service Monitor

1120

Statistic

1120

Field Descriptions

1120

WMI Monitor

1122

Statistic

1122

Field Descriptions:

1123

Chapter 31: Filter Syntax Reference

1125

To apply a resource filter:

1125

Filter Syntax

1125

SQL or SWQL?

1125

SWQL Filter Syntax Examples

1126

Wildcards

1126

Filtering by Custom Property

1126

Filtering by Built-in Properties

1126

Examples

1126

Filtering by Status

1126

SQL Filter Syntax Examples

1127

Wildcards

1127

Filtering by Custom Property

1127

Examples

1127

Filtering by Status

1127

SWQL Resource Matrix

1128

EOC Filters

1128

Alert Resource Filters

1128

Orion SAM Resource Filters

1128

Events Filters

1131

Inventory Filters

1131

64

SolarWinds Server & Application Monitor Documentation Library

EOC Filters

1131

IP SLA Filters

1133

NCM Filters

1135

NTA Filters

1136

Wireless Filters

1136

Summary Report Filters

1137

SysLog Filters

1138

Trap Filters

1138

IVIM Filters

1138

Virtualization Summary

1138

Datacenter Details

1139

Cluster Details

1139

SolarWinds SAM Filters

1140

SAM Resource Filters

1140

Configuring and Integrating

1143

JMX

1143

JConsole

1144

To login to JConsole:

1145

Adding a JMX Component Monitor to SAM

To add a JMX Monitor to a node using the wizard:
Configuring Java Applications Servers for JMX

1146
1146
1149

Configuring Apache Tomcat (tested on version 7.0)

1149

Configuring JBoss (tested on versions 5.0.1, 5.1, and 6.0)

1152

Configuring GlassFish (tested on version 3.1):

1154

Configuring IBM WebSphere (tested on version 7.0)

1155

Configuring Oracle WebLogic (tested on version [Link])

1156

Configuring Java Virtual Machines for SNMP

1157

Configuring a Standalone Java Virtual Machine

1158

Configuring Apache Tomcat (tested on version 7.0)

1160

65

Configuring JBoss (tested on versions 5.0.1, 5.1, and 6.0)

1162

Configuring GlassFish (tested on version 3.1):

1164

Configuring IBM WebSphere (tested on version 7.0):

1164

Configuring Oracle WebLogic (tested on version [Link])

1165

MAPI

1167

The MAPI User Experience Monitor in SAM

1168

What credentials should a user use?

1168

Why does the profile have to be able to log in to the SAM server?

1168

Install the MAPI Client on the SolarWinds SAM Server

Field Descriptions of the MAPI Monitor:
Troubleshooting MAPI

1168
1170
1171

MAPI Probe Diagnostic Checklist

1172

Install CDO or Outlook

1172

Check the MAPI profile

1172

Check probe settings

1172

Mailbox recommendations

1173

Advanced Troubleshooting

1173

[Link] Command Line Arguments

1173

In SAM v5.0+:

1174

New in SAM 5.0+ (not listed in the configuration file):

1175

Oracle

1175

Physical and Logical Structures

1176

Storage

1176

Disk files

1176

Configuring SAM to Monitor an Oracle Database Server

1177

Prerequisites for Oracle Server Monitoring

1177

Installing [Link]

1177

Installing the Basic Lite Oracle Client

1183

Adding an Oracle Database Server to SAM

1186

66

SolarWinds Server & Application Monitor Documentation Library

Monitoring an Oracle Database on an Existing Node

1191

Getting the Required Settings

1195

Troubleshooting

1198

Oracle Client Driver and Server Compatibility

1199

SAM is Unable to Load the Oracle Client Driver

1199

Troubleshooting Steps:

1200

Using Process Explorer to Determine if SAM is Loading the Correct

Oracle Client Library
1201
Using Process Monitor to Determine Why the Oracle Client Fails

1203

Oracle User Experience Monitor is Unable to Connect to the Oracle

Server
1206
Troubleshooting steps:

1207

Using the Oracle SQL*Plus Tool to Troubleshoot Connectivity

Issues:

1208

Connecting to an Oracle Server Using Simple Syntax

1208

Connecting to the Oracle Server Using Full Oracle Connection Syntax

1209
Executing queries using SQL*Plus
PowerShell

1211
1212

PowerShell and SAM: Configuration and Usage

1213

Exchange 2010 Management Tools

1214

Installation of Exchange Management Tools:

1214

64-bit vs. 32-bit

1218

Platform Scenarios

1218

Troubleshooting PowerShell Snap-In Compatibility

1219

PowerShell Templates and Monitors

1221

PowerShell Code with SAM

1225

Scripts Must Report Status Through Exit Codes

1227

Scripts with Text Output

1228

Remote Execution vs. Local Execution

67

1229

Script:

1229

To save this script as a PowerShell (ps1) file:

1230

To open the PowerShell console:

1230

To run this command via remote execution:

1230

To run this command via local execution:

1230

Execute Scripts Remotely via Secure WinRM

1231

PowerShell 2.0 Remoting Requirements

1232

PowerShell 2.0 Remoting Configuration

1233

Configuration of the Remoting Server

1233

Create a Self-signed Certificate

1233

Create a WinRM HTTPS Listener

1241

Adding a Firewall Exception

1243

Remoting Client/SAM Computer Configuration

Transferring the Certificate:

1243
1247

Communicate with Remoting Host

1251

Setup Windows PowerShell Monitor in SAM

1252

LDAP

1256

LDAP Key Terms and Components

1256

Distinguished Names

1256

Search Root

1257

Search Filter

1257

Basic LDAP Syntax

1257

The LDAP User Experience Monitor

1259

Use the LDAP Monitor to test that:

1259

How this Monitor Works:

1259

Integrating the LDAP User Experience Monitor

1260

Prerequisites

1260

Fields Defined

1260

Credentials

1261

68

SolarWinds Server & Application Monitor Documentation Library

SAM Page Help

1263

Application Custom Properties

1263

Find Processes, Services and Performance Counters

1263

SolarWinds SAM Application Detail Reports

1263

Active Application Alerts

1264

Application Availability

1264

Application Details

1264

Last XX Application Events

1265

Application Dependencies

1265

Availability Statistics

1266

Custom Area Graph

1266

Custom Bar Graph

1266

Custom Line Graph

1267

Components

1267

Processes and Services

1267

Application Health Overview

1267

Application Summary Reports

1268

All Applications Tree

1269

Active Application Alerts

1269

Last 25 Application Events

1269

Applications With Problems

1270

Down Applications

1270

Getting Started with SAM

1270

No Applications Defined

1270

thwack Community: Latest Application Monitor Templates

1270

Top XX Processes by CPU Load

1270

Top XX Processes by Physical Memory

1271

Top XX Components by Response Time

1271

Top XX Components by Statistic Data

1272

69

Top XX Processes by Virtual Memory

1272

Whats New in SolarWinds SAM

1273

SolarWinds SAM Charts

1273

Component Monitor Library

1273

Component Settings

1274

Configuration Settings for SolarWinds Server & Application Monitor

1274

Add New Application Monitors

1275

Application Discovery

1275

Assigned Application Monitor

1275

Create or Edit Template

1276

Create Assigned Application

1276

Create Assigned Application Monitor

1276

Credentials Library

1276

Data and Database Settings

1277

Database Settings

1277

Poller Setting

1277

Licensing Summary

1278

Manage Application Monitor Templates

1278

Manage Assigned Application Monitors

1279

Manage Assigned Component Monitors

1280

Manage Component Monitors Within Templates

1280

Conversion Value

1280

Customize Chart

1280

Creating a Windows Script Monitor

1282

Field Descriptions

1282

Available Data Transformations

1283

SolarWinds Server & Application Monitor Page Help

1287

Component Detail Reports

1287

Component Statistics Linear Gauges

1287

70

SolarWinds Server & Application Monitor Documentation Library

Min/Max Average CPU Load

1289

Min/Max Average Physical Memory

1289

Min/Max Average Response Time

1290

Min/Max Average Statistic Data

1291

Min/Max Average Virtual Memory

1291

Component Availability

1292

Component Details

1293

Last XX Component Events

1293

Multi Component Statistics Linear Gauges

1293

Multi Component Statistics Statistic Data

1294

Multiple Value Component Statistics Radial Gauges

1295

Multiple Statistic Chart

1296

Multiple Value Component Statistics Linear Gauges

1296

Component Statistics Radial Gauges

1297

Event Log Message Details Resource

1298

Node Details

1299

Applications

1299

Top XX Components by Response Time

1299

Top XX Processes by CPU Load

1300

Top XX Processes by Physical Memory

1300

Top XX Processes by Virtual Memory

1301

Top XX Components by Statistic Data

1301

Node Related XX Syslog Messages

1302

Tags

1302

SAM thwack Forum

1303

Shared Application Monitor Templates on thwack

1303

Finding Templates to Import

1303

Importing a Template

1303

Views by Application Type

1303

71

Real-Time Process Explorer

1303

Triggered Alerts - Last 30 Days

1304

Group Details

1304

CPUs by Percent Load

1304

Virtual Assets

1304

Adding VMs from the Virtual Assets Resource

1305

Virtual Asset Summary

1305

Node is not Being Polled via Windows Credentials

1305

How To...

1309

How To Add and Manage Resources in a Page View

1309

How To Change the Width and Number of Columns in a Page View

1311

How To Disable Asset Inventory Data Collection

1311

How to Handle Microsoft Server Clusters in AppInsight for SQL

1311

How to Remove an Application Template from Multiple Nodes

1312

How to Monitor Multiple Instances of [Link]

1312

How to Restart a Windows Service with an Alert Action

1312

How to Wrap a VBScript Around an Executable File

1313

How to Control Whether Alerts are Repeated or Suppressed if a Condition Still Exists
1314
How to Stop the Polling of all Applications Monitored by SAM.

1314

How To Use VB Script to Monitor Your SSL Expiration Date

1315

How to Monitor an Application Process Launched from a Specific Path. 1318

Troubleshooting

1320

Why do my SAM WMI Monitors Show Status Unknown?

1321

Working with Temporary Directories

1322

Moving the SQL Server Temporary Directory

1322

Redefining Windows System Temporary Directories

1323

To Redefine Default System Temporary Directories:

Slow Performance on Windows Server 2008

72

1323
1323

SolarWinds Server & Application Monitor Documentation Library

To Disable TCP Auto-tuning:

1324

WMI Troubleshooting Flowchart for SolarWinds SAM

1325

Testing Local WMI Services

1326

Test WMI on the Target Server

1326

Reset the WMI Counters

1329

To manually reset the WMI counters:

1329

Testing Remote WMI Connectivity

1329

Remotely Test WMI on the Target Server

1329

Verify Administrator Credentials

1332

Enable Remote Procedure Call (RPC)

1332

To enable the RPC service:

1332

Configure Distributed Component Object Model (DCOM) and User

Account Control (UAC)

1332

Enabling DCOM

1333

To enable DCOM permissions for your Server & Application Monitor

credentials:
1333
Enabling Account Privileges in WMI
To enable namespace and sub-namespaces privileges:
Disabling Remote User Account Control for Workgroups
To disable remote UAC for a workgroup computer:

1334
1334
1334
1335

Add a Windows Firewall Exception for Remote WMI Connections

1335

Do You Need an Additional Polling Engine?

1335

Verify SAM Component Configuration

1336

Service reporting, "Invalid Class"

1336

WMI is Still Not Working. Now What?

1337

Troubleshooting Hardware Health

1338

Hardware Prerequisite Checklist

1338

Hardware Troubleshooting Flowchart

1339

Troubleshooting an SNMP Node

1340

73

Using [Link]:

1341

Troubleshooting a WMI Node

1342

Using [Link] to troubleshoot WMI:

Troubleshooting a VMWare Node
To determine if a node is polled through the vCenter or directly:
Troubleshooting AppInsight for Exchagne

1342
1344
1345
1346

Troubleshooting Permissions

1346

Troubleshooting Exchange Performance Counters

1349

Troubleshooting Error Codes in AppInsight for Exchange

1352

Server & Application Monitor Template Reference

Active Directory

1364
1364

Active Directory 2003-2008 Services and Counters

1365

Active Directory 2008 R2-2012 Services and Counters

1371

AIX

1376

AIX

1377

Monitored Components:

1377

AIX LPD

1382

Apache

1382

Apache

1383

Apache (Windows)

1385

Below is an example using the Scripts Arguments field:${IP},8080

APC PowerChute Agent (Windows)
Monitored Components:

1386
1387
1387

Bind

1390

Bind (Linux - v9.5 and earlier)

1391

Note: Tested on CentOS 5.5 and Bind 9.3.6 version.

Bind (Linux - v9.6 and higher)

1391
1393

Note: Tested on CentOS 5.5 and Bind 9.9.2 version.

74

1393

SolarWinds Server & Application Monitor Documentation Library

Note: All monitors, except SNMP Process Monitor: Named, has the
Count statistic as difference option enabled and will show the statistical difference from the last SAM polling [Link] monitors except
SNMP Process Monitor: Named, require the following arguments:
perl ${SCRIPT} path_to_rndc path_to_named.statswhere path_to_
rndc - This is full path to the rndc command. By default:
/usr/local/sbin/rndc. path_to_named.stats - This is full path to
[Link] file, which is generated by the rndc stats command.
1393
Below is an example using the Scripts Arguments field:perl
${SCRIPT} /usr/local/sbin/rndc /var/named/[Link]

1393

Monitored Components:

1393

BizTalk

1401

BizTalk Server 2010 Adapters Performance Counters

Monitored Components:

1402
1402

BizTalk Server 2010 Host Throttling Performance Counters

Monitored Components:

1406
1406

BizTalk Server 2010 Message Box and Orchestrations Performance

Counters
1413
BizTalk Server 2010 Availability Status

1418

BizTalk Server 2010-2013 Adapters Performance Counters

1420

Monitored Components

1420

BizTalk Server 2010-2013 Availability Status

1424

This template allows you to check the status of BizTalk statistics:

Host Instances, Orchestrations, Send Ports and Send Port Group by
using WMI queries.
1424
Prerequisites: WMI access on target [Link]: Administrator on target server.

1424

Note: Before using this template you should provide the correct
names of instances/ports/orchestrations in the Query field. See
notes for each particular monitor.

1424

Monitored Components

1424

BizTalk Server 2010-2013 Host Throttling Performance Counters

75

1426

Monitored Components

1426

BizTalk Server 2010-2013 Message Box and Orchestrations Performance Counters

Monitored Components

1432
1433

Blackberry

1437

Blackberry Delivery Confirmation

1438

Customizing Script Variables

1438

Blackberry Enterprise Server

1440

Monitored Components:

1440

Citrix

1441

Cisco CallManager

1442

CiscoSecure ACS (via SNMP)

1444

Monitored Components:

1444

CiscoWorks LAN Management Solution

Monitored Components:

1445
1445

Citrix

1450

Citrix XenApp 5.0 Core Counters

Monitored Components

1451
1451

Citrix XenApp 5.0 ICA Session Counters

Monitored Components:

1455
1455

Citrix XenApp 5.0 Presentation Server Counters

1461

Citrix XenApp 5.0 Services

1466

Citrix XenApp 6.0 Core Counters

1469

Citrix XenApp 6.0 ICA Session

1472

Monitored Components:

1472

Citrix XenApp 6.0 Presentation Server

1478

Citrix XenApp 6.0 Services

1483

CUPS

1486

DHCP User Experience Monitor

1488

76

SolarWinds Server & Application Monitor Documentation Library

Directory Size

1489

Distributed File System (DFS)

1490

DNS User Experience

1498

Download Speed Monitor

1499

Installing the Microsoft Windows Character Generator Service

1499

Enabling the Unix/Linux Character Generator Service

1499

Errors in Application Event Log

1501

Exchange 2007 and 2010

1502

Basic versus Advanced Templates

1502

Typical Usage Scenario

1502

Exchange 2007-2010 Client Access Role Services and Counters

(Basic)

1504

Exchange 2007-2010 Mailbox Role Services and Counters (Basic)

1506

Exchange 2007-2010 Edge Transport Role Services and Counters

(Basic)

1510

Exchange 2007-2010 Unified Messaging Role Services and Counters (Basic)

1513

Exchange 2007-2010 Common Performance Counters

1515

Exchange 2007-2010 Statistics with PowerShell

1518

Exchange 2007-2010 Hub Transport Role Services and Counters

(Basic)

1525

Exchange 2007-2010 Mailbox Send and Receive Statistics with

PowerShell

1528

Exchange 2010 Client Access Role Counters (Advanced)

1530

Exchange 2010 Mailbox Role Counters (Advanced)

1532

Exchange 2010 Hub Transport Role Counters (Advanced)

1537

Exchange 2010 Edge Transport Role Counters (Advanced)

1541

Exchange 2010 Mailbox Send and Receive Statistics with PowerShell

1545

Exchange 2010 Unified Messaging Role Counters (Advanced)

1549

77

Exchange 2010 OWA Form Login (PowerShell)

1551

Exchange 2007 Client Access Role Counters (Advanced)

1552

Exchange 2007 Mailbox Role Counters (Advanced)

1554

Exchange 2007 Hub Transport Role Counters (Advanced)

1560

Exchange Server 2000 and 2003

1564

Exchange 2007 Edge Transport Role Counters (Advanced)

1565

Exchange 2007 Unified Messaging Role Counters (Advanced)

1569

Exchange 2007 Outlook Web Access (OWA) Form Login

1571

Exchange 2010 Database Availability Group

1572

Exchange 2010 Statistics with PowerShell

1578

Basic versus Advanced Templates

1595

Typical Usage Scenario

1595

Exchange 2013 Client Access Role Services and Counters (Basic)

1596

Basic versus Advanced Templates

1598

Typical Usage Scenario

1598

Exchange 2013 Client Access Role Counters (Advanced)

1599

Basic versus Advanced Templates

1603

Typical Usage Scenario

1603

Exchange 2013 Mailbox Role Services and Counters (Basic)

1604

Basic versus Advanced Templates

1607

Typical Usage Scenario

1608

Exchange 2013 Mailbox Role Counters (Advanced)

Files

1608
1614

File Age Monitor

1615

Monitored Components:

1615

File Change Monitor

1616

Monitored Components:

1616

File Count

1617

File Count Script

1618

78

SolarWinds Server & Application Monitor Documentation Library

Monitored Components:

1618

File Existence Monitor

1619

Monitored Components:

1619

File Size Monitor

1620

Monitored Components:

1620

FTP User Experience

1621

Monitored Components:

1621

GlassFish (JMX)

1622

GoodLink Server for Microsoft Exchange

1626

Monitored Components

1626

Generic Mail Server

1630

Monitored Components:

1630

Group Policy Object (System and Application Logs)

Monitored Components:

1631
1631

Helix

1635

Helix Universal Media Server (Linux/Unix)

Monitored Components:

1636
1636

Helix Universal Media Server (Windows)

Monitored Components:

1647
1647

HP-UX

1658

Monitored Components:

1658

HTTP

1661

HTTP

1663

Monitored Components:

1663

HTTPS Monitor

1664

HTTP Form Login

1665

Monitored Components:

1665

IBM

1665

IBM DB2

1666

79

IBM DB2 HADR Health

1670

IBM Informix

1673

IBM WebSphere (JMX)

1687

IMAP4 Round Trip Email

1690

Monitored Components:

1690

ISC DHCP Server (Linux)

1691

Note: Tested on CentOS 5.5 and ISC DHCP 3.0.5 version.

1691

Monitored Components:

1691

Java Application Server (SNMP)

1693

JBoss (JMX)

1699

JD Edwards EnterpriseOne Server Manager (Windows)

1705

Monitored Components:

1705

LDAP User Experience Monitor

1708

Linux

1708

Linux CPU Monitoring Perl

1709

Monitored Components:

1709

Linux Disk Monitoring Perl

1711

Monitored Components:

1711

Linux Memory Monitoring Perl

1714

Monitored Components:

1714

Linux Sendmail Monitoring Perl

1717

Monitored Components:

1717

Log Parser

1718

Log Parser (PowerShell)

1719

Configuring Windows Remote Management (WinRM)

Log Parser (Perl)

1719
1722

Lotus

1723

Lotus Domino Server Processes and Network Ports (Windows)

1724

Lotus Domino Server Processes and Network Ports (Linux)

1727

80

SolarWinds Server & Application Monitor Documentation Library

Lotus Domino Server Statistics

1730

MAPI Round Trip Email

1734

Monitored Components:

1734

Memcached

1735

Microsoft Direct Access

1739

Microsoft DirectAccess 2008 R2

1739

Configuring Windows Remote Management (WinRM)

Microsoft DirectAccess 2012

1746
1746

Configuring Windows Remote Management (WinRM)

Microsoft DirectAccess 2012 (Health with PowerShell)
Microsoft Dynamics

1753
1753
1754

Microsoft Dynamics CRM 2011 Statistics

Monitored Components:

1755
1755

Microsoft Dynamics CRM 2011 Events

Monitored Components:

1761
1761

Microsoft Forefront

1767

Microsoft Forefront Endpoint Protection 2010 (Client)

Monitored Components:

1768
1768

Microsoft Forefront Endpoint Protection 2010 (Server)

1772

Microsoft Forefront Threat Management Gateway 2010

1775

Monitored Components:

1775

Microsoft IIS

1780

Internet Information Services and Counters (IIS)

1781

Monitored Components:

1781

Microsoft IIS SMTP Server

1783

Microsoft Lync

1786

Microsoft Lync Server (Edge Role)

Monitored Components:

1788
1788

Microsoft Lync Server (Front-End Role)

81

1793

Monitored Components:

1793

Microsoft Lync Server (Mediation Role)

Monitored Components:

1799
1799

Microsoft Lync Server 2013 (Front-End Role)

Monitored Components:

1801
1801

Microsoft Lync Server 2013 (Edge Role)

Monitored Components:

1808
1808

Microsoft Lync Server 2013 (Mediation Role)

1814

Monitored Components:

1814

Microsoft Message Queuing

1815

Microsoft Message Queuing (Performance)

Monitored Components:

1816
1816

Microsoft Message Queuing Events

Monitored Components

1820
1820

Microsoft Network Policy

1836

Microsoft Network Policy Server Events

Monitored Components:

1837
1837

Microsoft Network Policy Server RADIUS Proxy

Monitored Components:

1843
1843

Microsoft Network Policy Server RADIUS Server

Monitored Components:

1846
1846

Microsoft SharePoint

1848

SharePoint Server 2007

1849

SharePoint Server 2010

1852

SharePoint Services (WSS) 3.0

1855

SharePoint Server 2013

1857

Monitored Components:

1857

Service: SharePoint Search Host Controller

1857

Service: SharePoint Server Search 15

1857

82

SolarWinds Server & Application Monitor Documentation Library

Service: SharePoint Timer Service

1857

Service: SharePoint Tracing Service

1857

Service: SharePoint User Code Host

1858

Service: Document Conversions Launcher

1858

Service: Document Conversions Load Balancer

1858

Current Requests

1858

Request Wait Time

1858

Requests Queued

1858

Requests Rejected

1859

Worker Process Restarts

1859

Requests/Sec

1859

Cache API Trims

1859

Cache API Hit Ratio

1860

Sql Query Executing time

1860

Executing Sql Queries

1860

Responded Page Requests Rate

1860

Executing Time/Page Request

1860

Current Page Requests

1860

Rejected Page Requests Rate

1861

Incoming Page Requests Rate

1861

Active Threads

1861

Microsoft SQL

1861

SQL Server 2005 Analysis Services

Monitored Components:

1862
1862

SQL Server 2008 Analysis Services

Monitored Components:

1867
1867

SQL Server 2012 Analysis Services

Monitored Components:

1873
1873

SQL Server Query

1878

83

Monitored Components:

1878

Microsoft System Center

1878

Microsoft System Center Configuration Manager 2012

Monitored Components

1878
1879

Configuring Windows Remote Management (WinRM)

Microsoft System Center Operations Manager 2012 (Agent)
Monitored Components

1884
1884
1884

Configuring Windows Remote Management (WinRM)

Microsoft System Center Operations Manager 2012 (Management
Server)
Monitored Components

1886
1886
1886

Configuring Windows Remote Management (WinRM)

1892

Microsoft Windows Internet Name Service (WINS)

1892

Microsoft Windows Internet Name Service (WINS) Statistic

Monitored Components:

1893
1893

Microsoft Windows Internet Name Service (WINS) Events

Monitored Components:

1895
1895

Microsoft Windows

1902

Windows 2003 -2008 FTP Service

1903

Windows 2008 R2 - 2012 FTP Service

1905

Windows DHCP Server

1907

Windows DNS Server

1913

Windows Network Load Balancing

1917

Windows Print Services

1926

Windows Remote Desktop Services (Session Host Role)

1927

Windows Update Monitoring

1936

Configuring Windows Remote Management (WinRM)

Microsoft Windows Server

1936
1938

Microsoft Windows Server 2003 Failover Cluster

84

1939

SolarWinds Server & Application Monitor Documentation Library

Monitored Components:

1939

Microsoft Windows Server 2008 Failover Cluster

Monitored Components:

1950
1950

Microsoft Windows Server 2012 Failover Cluster

Monitored Components:

1963
1963

Windows Server 2003 Domain Controller Security

1966

Configuring Windows Remote Management (WinRM)

1966

Monitored Components:

1966

Windows Server 2003-2012 Services and Counters

Monitored Components

1971
1971

Windows Server 2008 - 2012 Domain Controller Security

1974

Configuring Windows Remote Management (WinRM)

1974

Monitored Components

1974

Windows Server 2003-2012 Services And Counters

Mongo

1980
1983

MongoDB (Windows)

1984

MongoDB (Linux)

1988

MySQL

1992

Nagios Linux File & Directory Count Script

1999

Field Descriptions

1999

Novell GroupWise

2002

Novell GroupWise Post Office Agent (Windows)

2003

Novell GroupWise Message Transfer Agent (Windows)

2009

Novell GroupWise Post Office Agent (Unix)

2012

Novell GroupWise Message Transfer Agent (Unix)

2018

OpenLDAP

2021

Oracle

2023

Oracle Automatic Storage Management

Monitored Components

2024
2024

85

Oracle Database

2029

Monitored Components:

2029

Oracle WebLogic (JMX)

2033

POP3 Round Trip Email

2040

Monitored Components:

2040

Postfix

2041

Monitored Components:

2041

PostgreSQL

2045

Progress Database

2048

Progress Database (Linux and Unix)

2049

Arguments in Linux/Unix monitors:

2049

Monitored Components

2049

Progress Database (Linux and Unix sh script)

2054

Arguments in Linux/Unix monitors:

2054

Monitored Components:

2054

RADIUS User Experience

2059

Monitored Components:

2059

Server Clock Drift

2059

Server Clock Drift (PowerShell)

2060

Server Clock Drift (Perl)

2061

Solaris

2061

Solaris

2062

Solaris LPD

2067

Monitored Components:

2067

SolarWinds

2068

SolarWinds (Orion) Server

2069

Monitored Components:

2069

Orion Server

2074

Monitored Components:

2074

86

SolarWinds Server & Application Monitor Documentation Library

SolarWinds NetFlow Traffic Analyzer Database

2079

SolarWinds NetFlow Traffic Analyzer

2083

SolarWinds Web Performance Monitor (WPM) Player

2088

Monitored Components

2088

Kiwi Syslog Server

2091

Monitored Components:

2091

Squid

2093

Squid (Windows)

2094

Squid (Linux and Unix)

2102

Streaming Media Services 2008

2111

Sybase

2115

Sybase ASE

2116

Sybase SQL Anywhere

2120

Symantec

2123

Symantec Backup Exec Server

2125

Monitored Components:

2125

Symantec Backup Exec Remote Agent

2132

Monitored Components:

2132

Symantec NetBackup Server

2134

Symantec NetBackup Client

2139

Symantec Endpoint Protection Server

2141

Monitored Components:

2141

Symantec Endpoint Protection Client

2143

Monitored Components:

2143

TACACS+ User Experience

2146

Terminal Licensing Server

2147

Monitored Components

2147

Tomcat Server

2153

Monitored Components:

2153

87

Trend Micro Server Protect (Windows)

Monitored Components:

2155
2155

UniData Database (Windows)

2158

Monitored Components

2158

Unix

2164

Unix CPU Monitoring Perl

2165

Monitored Components:

2165

Unix Disk Monitoring Perl

2168

Unix Memory Monitoring Perl

2170

Monitored Components:

2170

Veeam Backup and Replication Server

2173

VMware ESX Host

2176

Web Link

2178

Websense Web Security

2178

Monitored Components

2178

88

Chapter 1:
Introduction
SolarWinds Server & Application Monitor (SolarWinds SAM) allows you to create
and monitor your own custom collection of monitored components, providing an
open field of opportunity to the network engineer. It also allows you to create
flexible Application Monitor templates to combine process monitors, port
availability, and performance counters, allowing you to assess the status of every
aspect of your application and the health of the application as a whole.

SolarWinds SAM vs. Orion APM

The SolarWinds family of products (NPM, SAM, and so on) share many common
components, including the engine these products use to function. These common
components are referred to as the Orion Platform.
In an effort to distinguish SAM as a powerful and unique product, we changed the
name of the product from Orion APM to SolarWinds SAM beginning with version
5.0. This name change should not have a large impact on the user's experience;
however, it is worth noting that there may be instances of the words and
acronyms, SolarWinds, Orion, APM, and SAM, where they appear to be
interchangeable.
Be aware of these name changes as you explore the software and this manual:
l

The acronym APM has been replaced with, SAM, when referring to this software product. There are instances throughout this guide, as well as various
places within the software itself, and on the SolarWinds website, that the
acronym, APM, may still exist. This is intentional and will be found in paths,
variables, and previous versions of the software. While this may be a slight
inconvenience, it is essential to ensure the integrity of an already active
implementation of previous versions of the software.
The word Orion has been removed when referring to specific SolarWinds
software. For example: Orion APM, Orion NPM, and so on.
The word Orion refers to shared platform items such as alerts, shared components, variables, and so on.

89

Chapter 1: Introduction

Changes in this Guide from SAM 6.0 to 6.1

l
l
l
l
l
l
l

l
l
l

l
l
l
l
l

AppInsight for Exchange chapter added.

Windows Scheduled Task Monitor chapter added.
Web Service Monitoring section added.
Understanding Sustained Thresholds section added.
SolarWinds SAMCharts chapter has been added.
Monitoring Clusters with AppInsight for SQL has been added.
Both online and offline help files have been upgraded to an improved system.
How To...section added to the Help files.
Creating a Scheduled Report
Documentation for the desktop version of the Report Scheduler has been
removed.
Minor note added to SSL Certificate Expiration Date Monitor.
Minor note added to SQL Event Log Message Details page.
Minor note added to WQLQuery section of WMI Monitor
AppInsight Applications chapter reorganized.
The following templates were added to the Template Reference guide and
remain on [Link]:
l Microsoft IIS SMTP Server
l Microsoft System Center Configuration Manager 2012
l Microsoft System Center Operations Manager 2012 (Management
Server)
l Microsoft System Center Operations Manager 2012 (Agent)
l Exchange 2013 Client Access Role Services and Counters (Basic)
l Exchange 2013 Client Access Role Counters (Advanced)
l Websense Web Security
l Microsoft DirectAccess 2008 R2
l Microsoft DirectAccess 2012
l Microsoft DirectAccess 2012 (Health with PowerShell)
l Oracle Automatic Storage Management
l SolarWinds Web Performance Monitor (WPM) Player
l BizTalk Server 2010-2013 Message Box and Orchestrations Performance Counters
l BizTalk Server 2010-2013 Host Throttling Performance Counters
l BizTalk Server 2010-2013 Adapters Performance Counters
l BizTalk Server 2010-2013 Availability Status

90

Applications Defined

Applications Defined
An application in SolarWinds SAM is considered a collection of component
monitors housed in a template. A component monitor is defined as a value
returned by a specific process, counter, status, or a value returned by a script.
With this received data, SolarWinds SAM can easily show you a myriad of vital
statistics concerning the health of your system.
Templates provide blueprints for the applications to be monitored. You can
quickly and easily customize numerous templates, using only the component
monitors you need for a specific environment. Take a look at the following
diagram:
Template/Application Relationship
The following illustration explains the Template and Application relationship and
is true for all templates, including AppInsight for SQL.
Here you can see that if you change something at the template level, the
applications based on that template will be affected. Conversely, if you change
something on the application level, only the individual application will be affected.
This inheritance relationship is beneficial if you need to make a great deal of
changes quickly. For example, rather than change one item on 100 applications
that are based on a single template (which requires 100 changes), you can more
easily change the one item on the template. That one change in the template will
trickle down to all 100 applications that are based on the template.

91

Chapter 1: Introduction

SolarWinds SAM recognizes and answers the complexity of todays business

applications with scalability, flexibility, and reliability.
Refer to the following sections for more information:
l
l

SAM Glossary of Terms

How Does SolarWinds Server & Application Monitor Work?

SAM Glossary of Terms

Here is a list of fundamental terms with which you should be familiar. A tree-like
map is also provided to visualize how SAM operates.

92

SAM Glossary of Terms

Component Monitor A component monitor is the fundamental element of an

application. Component monitors return the current status or value of a monitored
service or process. All component monitors return at least one value or one status
condition.
Node - A node is considered to be any endpoint of a given network. For example,
any server or computer on a network is considered a node. Sometimes a node is
referred to as a device.
Application - An application in SolarWinds SAM is a collection of component
monitors.
Template - A template is the blueprint for an application. It is a collection of
component monitors designed to monitor a server or application. You can
customize numerous templates using only the component monitors you need for a
specific environment.
The type of information returned by the component monitor is based upon the type
of monitor being utilized. For example, one type of monitor can report the up or
down status of a service or process, another monitor can return the percentage of

93

Chapter 1: Introduction
free space of a volume. Another type of component monitor can return up to ten
values. Each monitor type, along with its parameters and returned values and/or
states, is unique.
Each node, along with its applications and component monitors, can be viewed
from the SolarWinds SAM web console as shown in the diagram below. The view
can be customized to suit your needs.

How Does SolarWinds Server & Application Monitor Work?

Using UDP, TCP, SNMP, and WMI calls to your network framework and
application servers, SolarWinds Server & Application Monitor provides real time
feedback on your applications and trending through statistics stored in the

94

How Does SolarWinds Server & Application Monitor Work?

SolarWinds database. Keeping with the SolarWinds common components
infrastructure, there are no agents installed on your servers and no remote
software to maintain. All calls are made in real time and displayed on a Web
Console accessible from any supported browser.
As a standalone product, SAM's operations can be visualized with the following
flowchart:

Installed as a module in your family of SolarWinds products, SAM can be

visualized with the following flowchart:

95

Chapter 1: Introduction

Application Availability and Status

On any given poll, an applications availability is either 100% or 0% based on the
status of the [Link] is 100% if the application status is available,
warning, or critical. For any other status on that poll, SAM marks the availability at
0%.
The status of an application is determined by the worst status of the individual
component monitors for that application. For example, if one component for an
application is down, then the application is marked as down. If one component is
in a warning state and the rest of the components are up, then the application is
given a warning status.

96

Application Availability and Status

With respect to how an applications availability is calculated over time, SAM
aggregates the availability values to Hourly/Daily tables during database
maintenance, which is how the average is calculated. Availability for component
monitors is calculated in the same way.

97

Chapter 2:
Requirements and Installation
Installing SolarWinds Server & Application Monitor (SolarWinds SAM) is a wizard
driven process. Resource and space requirements are reasonable, and most
deployments do not require hardware updates to your SolarWinds Server.
This chapter discusses:
l
l
l
l
l
l
l
l
l
l
l
l

Requirements for SolarWinds SAM

FIPS Support
Server Sizing
SNMP Requirements for Monitored Devices
Upgrading SolarWinds Server & Application Monitor
Installing SolarWinds Server & Application Monitor
Activating Your License
Finishing SolarWinds SAM Installation
Excluding SolarWinds Data Directories from Anti-Virus Scanning
Running SolarWinds SAM
Internet Explorer Security Settings
Licensing

Requirements for SolarWinds SAM

SolarWinds recommends installing your SolarWinds product on one server, and
installing the SolarWinds database on its own SQL Server. Installations of
multiple SolarWinds SAM servers using the same database are not supported.
SolarWinds Server Software Requirements
The following table lists minimum software requirements and recommendations
for your SolarWinds server.
Software

Requirements

Operating
System

Windows Server 2003, Windows Server 2008 R2, with IIS in

32-bit mode, Windows 2012, or Windows 2012 Datacenter

98

Chapter 2: Requirements and Installation

edition. IIS must be installed. SolarWinds recommends that

SolarWinds administrators have local administrator privileges to
ensure full functionality of local SolarWinds tools. Accounts
limited to use of the SolarWinds Web Console do not require
administrator privileges.
Notes:
l

Web
Server

SolarWinds does not support production installations of

SolarWinds products on Windows XP, Windows Vista,
or Windows 7 systems.
If you are installing SolarWinds SAM on Windows
Server 2003, confirm that your full computer name is no
longer than 15 characters in length. Windows Server
2003 trims any characters beyond the fifteenth, and this
may prevent SolarWinds services from properly identifying your SolarWinds server.
For more information, see Additional SolarWinds SAM
Requirements on page 103.

Microsoft IIS, version 6.0 and higher, in 32-bit mode.

DNS specifications require that hostnames be composed of
alphanumeric characters (A-Z, 0-9), the minus sign (-), and periods
(.). Underscore characters (_) are not allowed. For more
information, see RFC 952.
Warning: The following Windows accounts, as configured by IIS
6.0 on Windows Server 2003 with their default security settings,
are required:
IUSR_<hostname>, as

a member of theGuestsgroup ONLY.

IWAM_<hostname>, as

a member of theIIS_WPG group ONLY.

Disabling these accounts or changing any default settings of

these accounts may negatively affect the operation of your
SolarWinds installation. SolarWinds strongly recommends
against altering these accounts or their settings.
Note: SolarWinds neither recommends nor supports the
installation of any SolarWinds SAM product on the same server
or using the same database server as a Research in Motion

99

SolarWinds Server Hardware Requirements

(RIM) Blackberry server.

.NET
Version 3.5 .NET Framework, 4.0 is recommended.
Framework
SNMP
Trap
Services

Windows operating system management and monitoring tools

component

Web
Console
Browser

Microsoft Internet Explorer version 7 or higher with Active

scripting,
Firefox 13.0 or higher (Toolset Integration is not supported on
Firefox), Google Chrome

SolarWinds Server Hardware Requirements

The following table lists minimum hardware requirements and recommendations
for your SolarWinds server.
Note: Hardware requirements are listed by SolarWinds license level.
Hardware

AL50 - AL500

AL700 AL1500

ALX

CPU
Speed

2.4 GHz

Dual Core 3.0 GHz

Quad Core 3.0 GHz

Note: Dual processor, dual core is recommended.

Hard Drive 4 GB
10 GB
25 GB
Space
Note: A RAID 1 drive for server operating system, SolarWinds
installation, and tempdb files is recommended. The SolarWinds
installer needs 1GB on the drive where temporary Windows
system or user variables are stored. Per Windows standards, some
common files may need to be installed on the same drive as your
server operating system.
Memory

4 GB

6 GB

8 GB

Application 161/SNMP and 443/SNMP. VMware ESX/ESXi Servers are polled

Ports
on 443.
17777/TCP open for SolarWinds module traffic
17778/ HTTPS open to access the SolarWinds Information Service
API

100

Chapter 2: Requirements and Installation

Requirements for Virtual Machines and Servers

SolarWinds installations on VMware Virtual Machines and Microsoft Virtual
Servers are fully supported if the following minimum configuration requirements
are met for each virtual machine.
Note: SolarWinds strongly recommends that you maintain your SQL Server
database on a separate physical server.
Virtual
SolarWinds Requirements by License Level
Machine
AL700 - AL1500
ALX
Configuration AL50 - AL500
CPU Speed

2.4 GHz

Dual Core 3.0 GHz

Quad Core 3.0

GHz

Allocated
Hard Drive
Space

4 GB

10 GB

25 GB

Memory

4 GB

Network
Interface

Each virtual machine on which SolarWinds is installed should

have its own, dedicated network interface card.

Note: Due to intense I/O requirements, SQL Server should be

hosted on a separate physical server configured as RAID 1+0.
RAID 5 is not recommended for the SQL Server hard drive.
6 GB

8 GB

Note: Since SolarWinds uses SNMP to monitor your network,

if you are unable to dedicate a network interface card to your
SolarWinds server, you may experience gaps in monitoring
data due to the low priority generally assigned to SNMP
traffic.

Requirements for the SolarWinds Database Server (SQL Server)

The following table lists software and hardware requirements for your SolarWinds
database server. SolarWinds license levels are provided as a reference.
Requirements AL50 -

AL700 -

101

ALX

Requirements for the SolarWinds Database Server (SQL Server)

AL500
SQL Server

AL1500

SQL Server 2005 SP1 Express, Standard, or Enterprise

(Important: Not supported in SAM6.1+.)
SQL Server 2008 Express, Standard, or Enterprise
SQL Server 2012
Notes:
l

Due to latency effects, SolarWinds does not recommend installing your SQL Server and your
SolarWinds server or additional polling engine in different locations across a WAN. For more information, see SolarWinds Knowledge Base article, Can
I install my SolarWinds server or Additional Polling
Engine and my SolarWinds database (SQL Server)
in different locations across a WAN?
Either mixed-mode or SQL authentication must be
supported.
If you are managing your SolarWinds database,
SolarWinds recommends you install the SQL Server
Management Studio component.
Use the following database SQL statement to check
your SQL Server version, service pack or release
level, and edition:

select SERVERPROPERTY ('productversion'), SERVERPROPERTY

('productlevel'), SERVERPROPERTY ('edition')

CPU Speed

2.4 GHz

Dual Core
3.0 GHz

102

Quad Core 3.0 GHz

Chapter 2: Requirements and Installation

Hard Drive
Space

4 GB

Memory

4 GB

10 GB

25 GB

Note: Due to intense I/O requirements, a RAID 1+0 drive is

strongly recommended the SQL Server database and
SolarWinds data and log files. RAID 5 is not recommended
for the SQL Server hard drive. The SolarWinds installer
needs at least 1GB on the drive where temporary Windows
system or user variables are stored. Per Windows standards,
some common files may need to be installed on drive as your
server operating system.
6 GB

8 GB

Note: SolarWinds recommends additional RAM for

SolarWinds SAM installations utilizing more than 1,000
monitors. For optimal performance in larger ALX
environments, we recommend 8GB of RAM or greater.
Additional memory will improve both performance and
reliability.
Memory and
Additional
Pollers

Each additional poller requires 8GB of

additional RAM. For example, SAM plus 2
additional pollers would require 24GB of
RAM. 3 additional pollers would require
32GB of RAM, and so on.

PowerShell

PowerShell 2.0 must be installed on the

SAMserver for versions 5.5+.

The Configuration Wizard installs the following required x86 components if they
are not found on your SolarWinds database server:
l
l

Microsoft SQL Server Native Client

Microsoft SQL Server Management Objects

Additional SolarWinds SAM Requirements

Enterprise-level SolarWinds SAM deployments with the potential for more than
1,000 monitors may need additional computing resources above the standards
required for SolarWinds common components:

103

FIPS Support

Component Monitors Additional Requirements

Up to 1,000

No additional requirements

More than 1,000

8+ GB RAM

Important: If you are running Windows Server 2008, you must upgrade to
Windows Server 2008 R2 because SolarWinds SAM does not support Windows
Server 2008 due to known WMI issues.

FIPS Support
FIPS (Federal Information Processing Standard) defines security and
interoperability standards for computers used by the U.S. federal government.
To enable FIPS in the Local Security Policy on Windows:
1. Click Start > Control Panel > System and Security > Administrative Tools,
and then double-click Local Security Policy.
2. Expand the Local Policies category in the left pane, and then click Security
Options.
3. Right-click System Cryptography: Use FIPS compliant algorithms for
encryption, hashing, and signing.
4. In the context menu that is displayed, click Properties.
5. In the Local Security Setting tab, click Enabled and then click OK.
Notes:
l FIPS can also be enabled as part of Group Policy.
l If using the FIPS Manager to enable/disable FIPS, you need to restart your
web browser to apply the new settings.
SolarWinds SAM installations on Windows Server 2008 R2 require a Microsoft
hotfix to realize the FIPS-compatibility features of this release. For more
information about this required Microsoft hotfix, see the article
[Link] As noted in the KB article, you need to
enable FIPS first before applying the Microsoft hotfix.
If you use component monitors that have not passed FIPS testing, they may not
work properly when FIPS is enabled.
FIPS Manager
SolarWinds does provide a FIPS manager. The default location of this program is
C:\Program Files (x86)\SolarWinds\Orion\[Link].

104

Chapter 2: Requirements and Installation

The FIPS Manager allows you to switch between both Windows and SolarWinds
FIPS compatible mode. (FIPS mode in Windows needs to be disabled manually if
needed).
The following SolarWinds SAM component monitors have passed FIPS testing:
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l

l
l
l

l
l
l
l

DHCP User Experience Monitor

Directory Size Monitor
DNS Monitor - TCP
DNS Monitor - UDP
DNS User Experience Monitor
Download Speed Monitor
File Age Monitor
File Count Monitor
File Existence Monitor
File Size Monitor
FTP Monitor
HTTP Form Login Monitor
HTTP Monitor
HTTPS Monitor
IMAP4 Monitor
IMAP4 User Experience Monitor
LDAP User Experience Monitor
Linux/Unix Script Monitor
MAPI User Experience Monitor
NNTP Monitor
ODBC User Experience Monitor
Oracle User Experience Monitor
Performance Counter Monitor
POP3 Monitor
POP3 User Experience Monitor
Process Monitor - SNMP FIPS not supported when SNMP is SNMPv3
and using MD5.
Process Monitor - WMI
SMTP Monitor
SNMP Monitor FIPS not supported when SNMP is SNMPv3 and using
MD5.
SQL Server User Experience Monitor
TCP Port Monitor
Tomcat Server Monitor
Web Link Monitor

105

Server Sizing
l
l

Windows Event Log Monitor

Windows Script Monitor

Server Sizing
SolarWinds SAM is capable of monitoring networks of any size, ranging from
small corporate LANs to large enterprise and service provider networks. Most
SolarWinds SAM systems perform well on 3.0 GHz systems with 4 GB of RAM
using default polling engine settings. However, when monitoring larger networks,
you should give additional consideration to the hardware used and the system
configuration.
There are three primary variables that affect scalability. The most important
consideration is the number of monitored components. Monitoring more than
1,000 components may require fine tuning for optimal performance. The second
variable to consider is polling frequency. For instance, if you are collecting
statistics more frequently than the default, the system will have to work harder and
system requirements will increase. Finally, the number of simultaneous users
accessing SolarWinds SAM directly impacts system performance.
When planning a SolarWinds SAM installation, there are four main factors to keep
in mind with respect to polling capacity: CPU, memory, number of polling
engines, and polling engine settings. For minimum hardware recommendations,
see Requirements for SolarWinds SAM on page98. For more information about
polling engines, see Additional Polling Engine and Web Console on page 931.
Installing SolarWinds SAM and SQL Server on different servers is highly
recommended, particularly if you are planning on having more that 1,000
component monitors. This scenario offers several performance advantages as the
SolarWinds SAM server does not perform any database processing and it does
not have to share resources with SQL Server.
If you plan to monitor 10,000 or more components, SolarWinds recommends that
you install additional polling engines on separate servers to help distribute the
work load. For more information about sizing SolarWinds SAM to your network,
contact the SolarWinds sales team or visit [Link]. For more
information about configuring additional pollers, see Additional Polling Engine
and Web Console on page 931.

106

Chapter 2: Requirements and Installation

SNMP Requirements for Monitored Devices

SolarWinds SAM can monitor the performance of any SNMPv1-, SNMPv2c-, or
SNMPv3-enabled device on your network. Consult your device documentation or
a technical representative of your device manufacturer to acquire specific
instructions for configuring SNMP on your device.
Notes:
l To properly monitor devices on your network, you must enable SNMP on all
devices that are capable of SNMP communications.
l Unix based devices should use the configuration of Net-SNMP version 5.5
or higher that is specific to the type of Unix-based operating system in use.
l SolarWinds SAM is capable of monitoring VMware ESX and ESXi Servers
versions 3.5 and higher with VMware Tools installed. For more information
about enabling SNMP and VMware Tools on your VMware device, consult
your VMware documentation or technical representative.
l If SNMPv2c is enabled on a device you want to monitor, by default,
SolarWinds SAM will attempt to use SNMPv2c to poll the device for performance information. If you only want SolarWinds SAM to poll using
SNMPv1, you must disable SNMPv2c on the device to be polled.

Enabling Microsoft Internet Information Services

(IIS)
To host the SolarWinds Web Console, Microsoft Internet Information Services
(IIS) must be installed and enabled on your SolarWinds SAM server. Windows
Server 2003 requires IIS version 6 while Windows Server 2008 requires IIS
version 7, as detailed in the following sections:
l
l

Enabling IIS on Windows Server 2003

Enabling IIS on Windows Server 2008

Enabling IIS on Windows Server 2003

The following procedure enables IIS on Windows Server 2003.
To enable IIS on Windows Server 2003:
1. Click Start> Control Panel> Add or Remove Programs.
2. Click Add/Remove Windows Components.

107

Enabling IIS on Windows Server 2003

3. Confirm that Application Server is checked, and then click Details.

4. Confirm that Internet Information Services (IIS) is checked, and then click
Details.

108

Chapter 2: Requirements and Installation

5. Confirm that World Wide Web Service is checked, and then click Details.

6. Confirm that World Wide Web Service is checked, and then click OK.

7. Click OK on the Internet Information Services (IIS) window, and then

click OK on the Application Server window.

109

Enabling IIS on Windows Server 2008

8. Confirm Management and Monitoring Tools is checked and click
Details.

9. Confirm that both Simple Network Management Protocol and WMI

SNMP Provider are checked, and then click OK.

10. Click Next, and then click Finish when the wizard completes.
Note: You may be prompted to install additional components, to provide
your Windows Operating System media, or to restart your computer.

Enabling IIS on Windows Server 2008

IIS is enabled automatically after the SAM installation and prior to the start of the
Configuration Wizard. If the Configuration Wizard detects that IIS is not installed

110

Chapter 2: Requirements and Installation

on Windows 2008, it installs IIS. The following manual procedure is provided for
Windows Server 2008 in case problems occur with the automatic IIS installation.
To enable IIS on Windows Server 2008:
1. Click Start> All Programs> Administrative Tools> Server Manager.
2. Click Roles.

3. Click Add Roles.

4. Click Next to start the Add Roles Wizard, and then check Web Server
(IIS).

111

Enabling IIS on Windows Server 2008

5. If you are prompted to add features required for Web Server (IIS), click
Add Required Features.

6. Click Next on the Select Server Roles window, and then click Next on the
Web Server (IIS) window.

7. Confirm that Common HTTP Features> Static Content is installed.

8. Check Application Development> [Link].

112

Chapter 2: Requirements and Installation

9. Click Add Required Role Services.

10. Check both Security> Windows Authentication and Security> Basic

Authentication.

113

Upgrading SolarWinds Server & Application Monitor

11. Check Management Tools> IIS 6 Management Compatibility.

12.
13.
14.
15.

Click Next on the Select Role Services window.

Click Install on the Confirm Installation Selections window.
Click Close on the Installation Results window.
If you are currently enabling IIS as part of a SolarWinds SAM installation, restart the SolarWinds SAM installer.

Upgrading SolarWinds Server & Application Monitor

If you have version 3.1 or lower of SolarWinds APM installed, you must first
upgrade to NPM 10 and then upgrade to APM 3.5 before you can upgrade to
SAM 5.X. For more information, click Upgrade Instructions in any SolarWinds
NPM group on the License Management page of the Customer Portal.
Note: SolarWinds recommends creating a backup of your database before
starting any SolarWinds upgrade or installation.
If you have version 3.5 or later of APM installed, you have an option for
upgrading to APM 4.X, or SAM 5.X:
Upgrading NPM and SolarWinds SAM on Your Current Server
Notes:
l
l
l

Upgrading from SAM 5.5 to 6.1 is supported.

Always upgrade NPM first, then you can upgrade to SAM
If installed together on the same server, SAM and SolarWinds NPM share
the same database.

114

Chapter 2: Requirements and Installation

If installed on different servers, SAM and SolarWinds NPM each require

their own database. You cannot share one database between separate
SAM and SolarWinds NPM servers.

Upgrading NPM and SolarWinds SAM on Your Current Server

To upgrade both SolarWinds NPM and SolarWinds SAM on your current
SolarWinds server:

1. Upgrade SolarWinds NPM to version 10.3.

Note: For compatablitiy between specific versions of SolarWinds software,
refer to the following KB article: [Link]
2. Install SAM 5.X as described in the section Installing SolarWinds Server &
Application Monitor on page133.
Important: Always upgrade NPM on all SolarWinds servers first. After that is
complete, you can successfully upgrade. Failure to upgrade in the correct order
will result in the Configuration Wizard generating a Database Configuration
Failure error.
For more information, see Installing SolarWinds Network Performance Monitor
in the SolarWinds Network Performance Monitor Administrator Guide.

Upgrading SAM to a New Server While Keeping NPM on Your Current Server
To upgrade SAM to a new server:
1. Back up your current SolarWinds Server.
2. Shutdown SolarWinds NPM and SAM on your current SolarWinds Server.
3. Have your Database Administrator clone your SolarWinds database to a
different name.
Note: To clone your SolarWinds database, use the appropriate version of
Microsoft SQL Server Management Studio for your database. You can
download this from the Microsoft website if it is not already installed.
4. Uninstall SAMfrom your original SolarWinds Server.
a. Use Add or Remove Programs in Control Panel to remove
SolarWinds Server & Application Monitor.
b. The Configuration Wizard should be run automatically as part of the
uninstallation. If it is not, execute it manually by clicking Start> All
Programs> SolarWinds Orion> Configuration andAutoDiscovery> Configuration Wizard.

115

Moving SolarWinds SAM to a different server

c. In the Configuration Wizard, select all components to be modified:
Database, Website, and Services, and then configure them appropriately for your original SolarWinds Server.
d. Ensure that you specify the original database.
e. Delete the SAM folder in the <drive>:\INETPUB\SOLARWINDS\ORION
directory, where <drive> is the drive letter for the SAM Website Root
Directory, for example: C.
5. Copy the security certificate from the original server to the new server.
6. Install SAM on its new server as described in the section Installing
SolarWinds Server & Application Monitor on page133, and in the Configuration Wizard specify the new cloned database.
For more information, see Installing SolarWinds Server & Application Monitor
on page133.

Moving SolarWinds SAM to a different server

Migrating SolarWinds SAM to a different server is a process that can take as little
as 30 minutes or as long as several hours, depending on the size of your
SolarWinds database. Consider scheduling an appropriate maintenance window
in which to perform your migration. The process involves deactivating the
licenses of your products, stopping the services, migrating the products, and then
uninstalling your previous installation.

General Requirements
Moving your SolarWinds SAM implementation to a new server requires the
following:
l

Server hardware meeting minimum requirements for the new

SolarWindsSAM implementation.
Windows user account credentials that have been granted administrative
rights on both servers.
A license reset to register SolarWindsSAM on your new server. You will
need to install SolarWinds License Manager to manage the required
license migration.

Note: Maps and map objects created or edited in SolarWinds Network Atlas are
stored in the SolarWinds database. If the database is successfully migrated, there
is no need to migrate any additional Network Atlas map files.

116

Chapter 2: Requirements and Installation

Database Requirements
Ensure that you comply with the following requirements before you attempt to
modify or back up your existing database:
l

SolarWinds APM version 4.0 and higher requires SQL Server 2005 SP1 or
later, including SQL Server 2008.
Install your new database server. The following procedures assume you
are moving your database from one physical server to another and that the
management tool (Enterprise Manager, SQL Server Management Studio
Express, or SQL Server Management Studio) is installed on the new database server.
If you want to use a Microsoft SQL Server Express database, recognize
that the database store is limited to 4GB.
Know the sa password to both your existing SolarWinds database server
and your new database server.
Know the credentials to an account with administrator rights on both your
existing SolarWinds database server and your new database server.
Have a maintenance window during which you can safely shutdown your
SolarWinds SAM services. You need to stop data collection to ensure that
your backup file matches your last active database state.

Stopping SAM Services

It is important to stop the SolarWinds SAM services that are currently writing to the
database. This ensures that you do not have data inconsistencies when you bring
your new database server online.
To stop SolarWinds SAM services:
1. Click Start> All Programs> SolarWinds Orion > Advanced Features>
Orion Service Manager.
2. Expand Services.
3. Click each service, except the SQL Server service, and then click Stop.
Notes:
l

If you have more than one Polling Engine, you will need
to stop each additional Polling Engine before continuing.
Do not stop the SQL Service. The SQL Service needs to
be running in order to make the necessary changes to
the database.

4. Click File> Exit.

117

Creating a Database Backup File with Database Manager

Creating a Database Backup File with Database Manager

Complete the following procedure if you want to use Database Manager.
To backup your SolarWinds database using Database Manager:
1. Log on to the computer that hosts your current SolarWinds SAM server.
2. Click Start> All Programs> SolarWinds Orion> Advanced Features>
Database Manager.
3. If your SQL Server is not listed in the left pane, add your server, as
shown in the following steps:
a. Click Add Server.
b. Select the name of the SQL instance from the SQL Server list. If
your server is not listed, type the name or IP address.
c. Select the appropriate authentication type, and then click Connect
to Database Server.
4. Locate and right-click your database in the Database Manager tree in the
left pane, and then click Backup Database.
5. Type a Description of the database backup, and then specify a Backup
Filename, including the path.
Note: Click the ellipsis to directly select the Backup Filename.
6. Select either of the following options:
l If you want to attach your new database backup to the end of the
selected backup file, select Append to the end of the Backup File.
l If you want to overwrite the selected backup file, select Overwrite
Backup File.
7. Click OK.
8. If you are moving the SQL database to the new SolarWinds SAM
server, copy the new backup file to a folder on the new server.
9. Install SolarWinds SAM on the new server, but DO NOT run the Configuration Wizard yet. Reboot the server if prompted, and then register the
software.
Note: A new license key is required, and you will need to install
SolarWinds License Manager to manage the required license migration.
10. On the new server, click Start> SolarWinds Orion> Advanced
Features> Database Manager.
11. If your SQL Server is not listed in the left pane, add your server, as
shown in the following steps:

118

Chapter 2: Requirements and Installation

1. Click Add Server.
2. Select the name of the SQL instance from the SQL Server list. If
your server is not listed, type the name or IP address.
3. Select the appropriate authentication type, and then click Connect
to Database Server.
12. Locate and right-click on your server in the Database Manager tree in the
left pane, and then click Connect to Server.
13. If you moved the SQL database to the new server, perform the following
steps:
Note: Database Manager cannot create new folders. Therefore, specify a
path that already exists.
a. Click Database> Restore Database.
b. Click the ellipsis to Select the Database file to Restore.
c. If you want to verify the validity of the selected database, click
Verify.
d. Confirm or edit the name of the restored database in the Restore Database as the following Database name field.
e. If you want to restore the database as .MDF or .LOG files, provide appropriate filenames in the Restore Database in the following MDF and
LOG files fields.
f. Click OK.
14. Run the Configuration Wizard and specify the existing (or newly restored)
database on the Database setup section of the wizard. When prompted,
click Yes to use the existing database.
Note: Do not skip tabs or deviate from the tab order. Click Start, and then
click Continue to complete the wizard in order. Completing tabs out of
order may adversely affect the install process.

Creating a Database Backup File with SQL Server Management Studio Express
Complete the following procedure if your new database server uses SQL Server
2005 Express edition.
To backup your SolarWinds database using SQL Server Management Studio Express:
1. Log on to the new database server using an administrator account.
2. Click Start > All Programs > Microsoft SQL Server 2005 > SQL Server
Management Studio Express.

119

Creating a Database Backup File with SQL Server Management Studio

3. Specify the name of the current SolarWinds database server on the Connect to Server window.
4. If you are using SQL Server Authentication, click SQL Server Authentication in the Authentication field, and then specify your credentials in the
Username and Password fields.
5. Click Connect.
6. Expand the name of your SolarWinds server, and then expand Databases
in the left pane.
7. Right-click the name of your SolarWinds database, and then click Tasks >
Backup.
8. Click Add, and then specify and remember the Destination you provide.
This is the directory and name of your backup.
Note: Remember, this file is created on the remote database server. It is
not created locally.
9. Click Options in the Select a page pane on the left.
10. Check Verify backup when finished.
11. Click OK.
12. Copy the .bak file from your current SolarWinds database server to your
new database server.

Creating a Database Backup File with SQL Server Management Studio

Complete the following procedure if your new database server uses SQL Server
2005 or 2008.
To backup your SolarWinds database using SQL Server Management Studio:
1. Log on to the new database server using an administrator account.
2. Click Start > All Programs > Microsoft SQL Server 200X > SQL Server
Management Studio.
3. Specify the server name of the current SolarWinds database server on the
Connect to Server window.
4. If you are using SQL Server Authentication, click SQL Server Authentication in the Authentication field, and then specify your credentials in the
User name and Password fields.
5. Click Connect.
6. In the pane on the left, expand the name of the server hosting the SQL
instance you are using for SolarWinds SAM, and then expand Databases.

120

Chapter 2: Requirements and Installation

7. Right-click the name of your SolarWinds database, and then click Tasks >
Back Up.
8. In the Source area, select Full as the Backup type.
9. In the Backup set area, provide an appropriate Name and Description for
your database backup.
10. If there is not already an appropriate backup location listed in the Destination area, click Add, and then specify and remember the destination path
and file name you provide. This is the location where your backup is
stored.
Note: Remember, if your database is on a remote server, as recommended, this backup file is also created on the remote database server. It
is not created locally.
11. Click Options in the Select a page pane on the left.
12. In the Reliability area, check Verify backup when finished.
13. Click OK.
14. Copy the .bak file from your current SolarWinds database server to your
new database server.

Restoring a Database Backup File for SQL Express Server

Complete the following procedure if you are restoring your SolarWinds database
backup file to a database server running SQL Express Server.
Note: Remember that SQL Express has a 4GB data store limitation. If at all
possible, consider using a production version of SQL Server.
To restore your database backup file on a server running SQL Express
Server:
1. Log on to the new database server using an administrator account.
2. Click Start > All Programs > Microsoft SQL Server 2005 > SQL Server
Management Studio Express.
3. Click File > Connect Object Explorer.
4. Specify the name of the new SolarWinds database server on the Connect
to Server window.
5. If you are using SQL Server Authentication, click SQL Server Authentication in the Authentication field, and then specify your credentials in the
User name and Password fields.
6. Click Connect.
7. Click the name of your server to view an expanded list of objects associated with your server.
8. Click Databases, and then click Restore Database.

121

Restoring a Database Backup File for SQL Server 2005

9.
10.
11.
12.
13.
14.
15.
16.
17.
18.

Leave To database blank.

Click From device, and then browse () to the location of your .bak file.
Click Add, and then navigate to the .bak file and click OK.
Click OK on the Specify Backup window.
Check Restore.
Select the name of your database from the To database field. It will now
be populated with the correct name.
Click Options in the left Select a page pane, and then check Overwrite
the existing database.
Ensure you select a directory that already exists for the files listed in the
Restore As column.
Click OK.
Open and run the configuration wizard to update your SolarWinds SAM
installation.

Restoring a Database Backup File for SQL Server 2005

Complete the following procedure if you are restoring your SolarWinds database
backup file to a database server running SQL Server 2005.
To restore your database backup file on a server running SQL Server 2005:
1. Log on to the new database server using an administrator account.
2. Click Start > All Programs > Microsoft SQL Server 2005 > SQL Server
Management Studio.
3. Click File > Connect Object Explorer.
4. Specify the name of the new SolarWinds database server on the Connect
to Server window.
5. If you are using SQL Server Authentication, click SQL Server Authentication in the Authentication field, and then specify your credentials in the
User name and Password fields.
6. Click Connect.
7. Click the name of your server to view an expanded list of objects associated with your server, and then right-click Databases.
8. Click Restore Database.
9. Leave To database blank.
10. Click From device, and then browse () to the location of your .bak file.
11. Click Add, and then navigate to the .bak file and then click OK.
12. Click OK on the Specify Backup window.
13. Check Restore.
14. Select the name of your database from the To database field. It will now be
populated with the correct name.

122

Chapter 2: Requirements and Installation

15. Click Options in the left Select a page pane.
16. Check Overwrite the existing database.
17. For each Original File Name listed, complete the following steps to ensure
a successful restoration:
a. Click Browse ().
b. Select a directory that already exists.
c. Provide a name for the Restore As file that matches the Original File
Name, and then click OK.
18. Select Leave the database ready to use by rolling uncommitted transactions(RESTORE WITH RECOVERY).
19. Click OK.
20. Open and run the configuration wizard to update your SolarWinds SAM
installation.
Note: Due to the nature of security identifiers (SIDs) assigned to SQL
Server 2005 database accounts, SolarWinds recommends that you create
and use a new account for accessing your restored SolarWinds database
on the Database Account window of the SolarWinds Configuration Wizard.

Restoring a Database Backup File for SQL Server 2008

Complete the following procedure if you are restoring your SolarWinds database
backup file to a database server running SQL Server 2008.
To restore your database backup file on a server running SQL Server 2008:
1. Log on to the new database server using an administrator account.
2. Click Start > All Programs > Microsoft SQL Server 2008 > SQL Server
Management Studio.
3. Click File > Connect Object Explorer.
4. Specify the name of the new SolarWinds database server on the Connect
to Server window.
5. If you are using SQL Server Authentication, click SQL Server Authentication in the Authentication field, and then specify your credentials in the
User name and Password fields.
6. Click Connect.
7. Click the name of your server to view an expanded list of objects associated with your server, and then right-click Databases.
8. Click Restore Database.
9. Leave To database blank.
10. Select From device, and then click Browse ().
11. Confirm that File is selected as the Backup media.
12. Click Add.

123

Updating SolarWinds SAM to Use the New Database Server

13. Navigate to the .bak file, select it, and then click OK.
14. Click OK on the Specify Backup window.
15. In the Destination for restore area, select the name of your database from
the To database field.
Note: The To database is now populated with the correct name.
16. Check Restore next to the database backup you are restoring.
17. Click Options in the left Select a page pane.
18. Check Overwrite the existing database (WITH REPLACE).
19. For each Original File Name listed, complete the following steps to ensure
a successful restoration:
a. Click Browse ().
b. Select a directory that already exists.
c. Provide a name for the Restore As file that matches the Original File
Name, and then click OK.
20. Select Leave the database ready to use by rolling uncommitted transactions(RESTORE WITH RECOVERY), and then click OK.
21. Open and run the configuration wizard to update your SolarWinds SAM
installation.
Note: Due to the nature of security identifiers (SIDs) assigned to SQL
Server 2008 database accounts, SolarWinds recommends that you create
and use a new account for accessing your restored SolarWinds database
on the Database Account window of the SolarWinds Configuration Wizard.

Updating SolarWinds SAM to Use the New Database Server

In general, SolarWinds recommends that you use SQL Server Authentication with
the sa login and password to ensure that SolarWinds SAM can always access
your SQL Server database, even when it is hosted remotely on a separate server.
To update SolarWinds SAM to use a new database:
1. Log on to your SolarWinds SAM server.
2. Click Start> All Programs> SolarWinds Orion> Configuration and
Auto-Discovery> Configuration Wizard.
3. Check Database, and then click Next.
4. Specify your new database server in the SQL Server field.
5. If you want to use SQL authentication, check Use SQL Server Authentication, and then provide the appropriate credentials.
Note: SolarWinds recommends that you use the sa login and password for
your database server to ensure that you are able to properly configure the
SolarWinds database user account.

124

Chapter 2: Requirements and Installation

6. Click Next.
7. Select Use an existing database, select or type the Existing Database
name, and then click Next.
8. If you are prompted to use the existing database, click Yes.
9. Select Create a new account, and then provide a New Account name.
Notes:
l Creating a new account ensures that SolarWinds SAM has required
access to your migrated database.
l The New Account must be a member of the securityadmin server
role.
l The sysadmin role and the sa user account are always members of
securityadmin.
10. Provide and confirm an account Password.
11. Click Next to start database configuration, and then click Finish to exit the
Configuration Wizard.

Reassigning Nodes
If a new name is used for the new SolarWindsSAM server, it is added to the
database as a new polling engine. All current nodes remain assigned to the old
polling engine name and must be reassigned to the new polling engine, as
shown in the following procedure.
To reassign items to the new polling engine:
1. Click Start> All Programs> SolarWinds Orion > Advanced Features>
Orion Service Manager.
2. Stop all SolarWinds services.
Notes:
l If you have more than one Polling Engine, you will need to stop
each additional Polling Engine before continuing.
l Do not stop the SQL Service. The SQL Service needs to be running
in order to make the necessary changes to the database.
3. Click File> Exit
4. Click Start> SolarWinds Orion> Database Utilities> Database Manager.
5. Expand your SQL Server in the tree.
6. Expand the SolarWinds database.
Note: By default, this database is named NetPerfMon.
7. Right-click on the Engines table, and then click Query Table.
8. Click Refresh to display the table entries.

125

To reassign items to the new polling engine:

9. Select Read-Write (Results can be edited).

10. Replace the value in the ServerName field for the old polling engine with
the server name of the new polling engine. In the previous graphic, the
OLD-SERVER is renamed NEW-SERVER.
Note: It is not necessary to update the IP field. The next time the service is
started, SolarWinds SAM discovers the new IP address, and the IP field is
updated automatically.
11. Delete the newly added engine from the table (EngineID: 2 in this
example) by clicking on the blank area to the left of the row to select it.
Right-click anywhere in the selected row, and then click Delete Selected
Rows.

12. Click Yes when prompted to confirm deleting the row.

Note: The final result will display the new server name with the IP address
of the old server. The next time the service starts, the IP field will be
updated with the IP address of the new server.
13. Close Database Manager.

126

Chapter 2: Requirements and Installation

Copying Custom Reports

Complete the following task to copy your custom reports to the new SolarWinds
SAM server.
To copy your reports:
1. On the old server, copy your custom reports located in the \Orion\Reports
folder.
2. Paste these reports into the Orion\Reports folder on the new server.

Updating Report Schemas

If you have added custom properties to the database, you will need to upgrade
the report schemas on the new server. Updating the report schemas allows
Report Writer to display and use custom property data.
To update report schemas for custom properties:
1. Ensure that Report Writer is closed, and then click Start> All Programs>
SolarWinds Orion> Grouping and Access Control> Custom Property
Editor.
2. Right-click on the toolbar, and then click Customize
3. Click the Commands tab, and then click Properties in the category list.
4. Drag Update Report Schemas to the toolbar to add a new button to the
toolbar.
5. Close the Customize window.
6. Click Update Report Schemas on the toolbar.
7. Click OK after the custom properties have been added to the report
schemas.
8. Close the Custom Property Editor.

Moving SolarWinds SAM Security Certificates to a New Server

SolarWinds SAM encrypts your sensitive data with a security certificate stored on
the original SolarWinds SAM server. To grant a new server access to this
encrypted data, you must copy the original security certificate to the new server.
Warning: If you do not replicate the original certificate, SolarWinds SAM on the
new server cannot access any credentials used by your component monitors, and
all of those component monitors will fail.
To replicate the original certificate:
1. Export the credential from the original server.

127

To replicate the original certificate:

a.
b.
c.
d.
e.
f.
g.
h.

On the Start Menu, click Run, type MMC, and then click OK.
On the File menu, click Add/Remove Snapin, and then click Add.
Select Certificates and then click Add.
Select Computer account and then click Next.
Select Local computer and then click Finish.
Click Close.
Click OK.
Expand the Certificates (Local Computer)> Personal > Certificates
group.
i. Right-click SolarWinds APM Engine (if present), and SolarWindsOrion, point to All Tasks on the shortcut menu, and then click Export.
Note: Exporting SolarWinds APM Engine is only required if you are
upgrading from APM 4.0.1 or earlier. If you have APM 4.0.2 or later, you
do not need to do anything with this certificate. Just migrate the
SolarWinds-Orion certificate.
j. Click Next in the Certificate Export Wizard.
k. Select Yes, export the private key, click Next, and then click Next
again.
l. Type and confirm a password for this private key, and then click Next.
m. Specify the file name to which you want to save the certificate, click
Next, and then click Finishthe certificate is saved with a .pfx file
name extension.
2. Copy the .pfx certificate file to the new server.
3. Import the certificate to the new server.
a. On the Start Menu, click Run, type MMC, and then click OK.
b. On the File menu, click Add/Remove Snapin, and then click Add.
c. Select Certificates, and then click Add.
d. Select Computer account, and then click Next.
e. Select Local computer, and then click Finish.
f. Click Close.
g. Click OK.
h. Expand the Certificates (Local Computer) group.
i. Expand the Personal group.
j. Expand the Certificates group.
k. If there is a SolarWinds SAM Engine item in the list, right-click
SolarWinds APM Engine and SolarWinds-Orion and select Delete
from the shortcut menu.
l. Right-click the CertificatesPersonalCertificates node, point to All
Tasks in the shortcut menu, and then click Import.
m. Click Next in the Certificate Import Wizard.

128

Chapter 2: Requirements and Installation

n. Specify the .pfx certificate file you copied to the server and then click
Next.
o. Enter the password for the private key, check Mark this key as exportable, and then click Next.
p. Select Place all certificates in the following store, and then select
Personal as the Certificate Store.
q. Click Next and then click Finish.

Migrating Licenses with License Manager

You must run License Manager on the computer where the currently licensed
SolarWinds products are installed before you can migrate licenses to a new
installation. The following procedure deactivates currently installed licenses that
can then be transferred to a new installation.
To deactivate currently installed licenses:
1. Click Start> All Programs> SolarWinds> SolarWinds License Manager.
2. Check the products you want to deactivate on this computer.
3. Click Deactivate.
4. Specify your SolarWinds Customer ID and password when prompted, and
then click Deactivate.
Note: Deactivated licenses are now available to activate on a new computer.
When you have successfully deactivated your products, log on to the computer on
which you want to install your products, and then begin installation. When asked
to specify your licenses, provide the appropriate information. The license you
deactivated earlier is then assigned to the new installation.

Installing License Manager

You will need to install License Manager on the computer from which you are
migrating currently licensed products.
Note: You must install License Manager on a computer with the correct time. If
the time on the computer is even slightly off, in either direction, from Greenwich
Mean Time (GMT), you cannot reset licenses without contacting SolarWinds
Customer Service. Time zone settings neither affect nor cause this issue.

129

To install License Manager:

To install License Manager:
1. Click Start> All Programs> SolarWinds> SolarWinds License Manager
Setup.
2. Click I Accept to accept the SolarWinds EULA.
3. If you are prompted to install the SolarWinds License Manager application,
click Install.
Using License Manager
You must run License Manager on the computer where the currently licensed
SolarWinds product is installed before you can migrate licenses to a new
installation. The following procedure deactivates currently installed licenses that
can then be transferred to a new installation.
To deactivate currently installed licenses:
1. Click Start> All Programs> SolarWinds> SolarWinds License Manager.
2. Check the products you want to deactivate on this computer.
3. Click Deactivate.
4. Specify your SolarWinds Customer ID and password when prompted, and
then click Deactivate.
Note: Deactivated licenses are now available to activate on a new computer.
When you have successfully deactivated your products, log on to the computer on
which you want to install your products, and then begin installation. When asked
to specify your licenses, provide the appropriate information. The license you
deactivated earlier is then assigned to the new installation.

Upgrading SolarWinds APM when SolarWinds Failover Engine is

Installed
Prior to attempting this upgrade you should read the entire procedure.
On the primary/active server:
Note: If the secondary server is the active server, omit step 1 below.
1. Switch active server to secondary, shutdown Failover Engine on
primary server. Using the SolarWinds Orion Failover Manager, select the
secondary (passive) server and click Make Active. Wait for the secondary

130

Chapter 2: Requirements and Installation

server to become active. After that stop Stop Orion Failover Engine from context menu of tray icon.
2. Shutdown Orion Failover Engine on the secondary (active) server. Stop
Orion Failover Engine on the secondary (active) server leaving the protected applications running from context menu of tray icon.
On the secondary server:
1. Upgrade the desired SolarWinds product :
a. Install theSolarWinds Update by running the setup program.
b. If asked, reboot the server. After the reboot is complete, shutdown
the Failover Engine and proceed with the Configuration Wizard.
c. Verify that SolarWinds is operational.
2. If the upgrade procedure was successful, proceed to step 4.
3. If Upgrade on the secondary server fails:
a. Research the cause of the upgrade failure.
b. If the issue can be resolved, then it is safe to proceed with the
upgrade procedure. Otherwise, you can revert to a previous version.
c. To revert to a previous version:
i. Uninstall the upgraded components.
ii. On the secondary server, launch the SolarWinds Failover
[Link] the Server wizard and click on the
Machine tab. Change the Current role to Secondary/passive.
iii. Reboot the server.
iv. SolarWinds Failover Enginewill start andSolarWinds will be
stopped.
v. On the primary server, launch the SolarWinds Failover
Engine. Configure the Server wizard and click on the
Machine tab. Change the Current role to Primary/active.
vi. Restart SolarWinds Failover Engine on the primary server
and allow the system to synchronize.
vii. Start SolarWinds Failover Manager and check that the system completes the full system check.
Needs to be updated:
l
l

SQL is already updated, needs reverting.

SolarWinds is not able to uninstall/upgrade, needs repair of the previous
release.

131

On the primary Server (assuming a successful upgrade of secondary completed):

4. Change the server role to Secondary/passive:

a. Start the Failover Engine in the context menu of the tray icon.
b. Stop the Failover Engine, including stopping all protected applications in the context menu of the tray icon.
c. Wait until all protected services are stopped.
d. Launch the Configure Server wizard and then click on the Machine
tab. Change the Current role to Secondary/passive.
e. Start the Failover Engine to enable the packet filter.
f. Shutdown Failover Engine.
On the primary Server (assuming a successful upgrade of secondary completed):
5. Perform upgrade on primary:
a. Disable Neverfail Packet Filter Driver on Public NIC
1. Open Properties of the Public Network Adapter.
l (e.g. in Network Connections window, accessible via
Control Panel, right click the Public Network Adapter
and select Properties)
2. Uncheck the Neverfail Packet Filter Driver item on the list
and close the window by clicking OK.
b. Install the SolarWinds Update by running the setup program.
c. If asked, reboot the server now. After the reboot is complete, shutdown Failover Engine and proceed with the Configuration Wizard.
d. Verify that SolarWinds is operational.
e. Enable the Neverfail Packet Filter Driver on Public NIC
1. Open Properties of the Public Network Adapter.
l (e.g. in Network Connections window, accessible via
Control Panel, right click the Public Network Adapter
and select Properties)
2. Check the Neverfail Packet Filter Driver item on the list and
close the window by clicking OK.
6. Resume the Failover Engine:
a. Start the Failover Engine on the Primary Server.
b. Launch the Failover Manager on the Primary Server and make the
Primary Server Active using the Make Active button.
c. Start Failover Engine on the Secondary server.

132

Chapter 2: Requirements and Installation

d. Start Replication using the Start Replication button in the Failover Manager.
7. License SolarWinds
a. If applicable, license the application(s) on the Active (Primary)
server.
8. IfSolarWinds fails to start on the secondary server, follow the steps below:
1. Shutdown the Failover Engine.
2. Launch the Configure Server wizard and set the secondary server role to
passive.
3. Startthe Failover Engineon the secondary server.
4. Start the Configure Server wizard on the primary server and set the server
role to active.
5. Startthe Failover Engineon the primary server.
6. Launch theSolarWinds Orion Failover Managerand verify that the system
completes the Full System Check.
7. Investigate the cause of the SolarWinds failure on the secondary server.

Installing SolarWinds Server & Application Monitor

SolarWinds Server & Application Monitor offers an intuitive wizard to guide you
through installing and configuring the product. If you are performing a clean install
of SolarWinds SAM and also want to install SolarWinds NPM, you should install
SolarWinds NPM version 10.2.2 or higher. For more information, see Installing
SolarWinds Network Performance Monitor in the SolarWinds Network
Performance Monitor Administrator Guide.
To install or upgrade SolarWinds Server & Application Monitor:
1. Using an account with local administrative privileges, log on to the
SolarWinds server on which you want to install SolarWinds SAM. To
avoid permissions issues, this account should not be a domain
account, and it should not be subject to any local or group policy
restrictions.
2. If you downloaded the product from the SolarWinds website, complete
the following steps:
a. Navigate to the location of your downloaded .zip file, and then extract
the evaluation package to an appropriate location.
b. Launch the SolarWinds SAM evaluation executable.

133

Installing SolarWinds Server & Application Monitor

3. If you are prompted to install any required components, such as
Microsoft .NET Framework 3.5 or Microsoft [Link] 2.0 AJAX Extensions, click Install and then complete the component installation.
Note: Downloading and installing Microsoft .NET Framework 3.5 may take
a long time, depending on your existing system configuration.
4. Review the Welcome text, and then click Next.

5. If the InstallShield Wizard detects that Microsoft Internet Information

Services (IIS) is not installed, suspend installation, quit setup, and then
install Internet Information Services (IIS).
6. If you had to install Internet Information Services (IIS), launch the
SolarWinds evaluation executable again.
7. Accept the terms of the license agreement, and then click Next.

134

Chapter 2: Requirements and Installation

8. Accept the default install location, or navigate to a different location, and

then click Next.

9. Select either the Express Install Recommended option or the

Advanced Install option, and then click Next.

135

Installing SolarWinds Server & Application Monitor

10. Click Next to start copying files. Installation begins.

11. After files are copied and installed, configuring begins automatically.

136

Chapter 2: Requirements and Installation

12. Click Finish to exit the Configuration Wizard.

13. Type Admin in the User Name field, and then click LOGIN.

137

Uninstalling SAM

14. The Network Sonar Wizard is displayed. Click Cancel and then confirm
that you want to cancel the network discovery by clicking OK.
Note: The wizard can be used to discover a set of nodes in your network.
You will use it later in this guide.

Uninstalling SAM
The following procedure fully uninstalls SAM and deletes the SAM database.
Notes:
l

This is a general uninstall procedure, and it may differ slightly from version
to version.
This is the recommended procedure when installing daily builds for testing.

To fully uninstall SAM and remove the SAM database:

1. Click Start > Control Panel > Add or Remove Programs.
2. Click SolarWinds Orion Server and Application Monitor..., and then click
Remove.
3. Complete the SAM uninstall wizard.
4. In the Add or Remove Programs window, click SolarWinds Job
Engine..., and then click Remove.
5. Complete the uninstallation of the SolarWinds Job Engine.
6. In the Add or Remove Programs window, click SolarWinds Orion Information Service, and then click Remove.
7. Complete the uninstallation of the SolarWinds Orion Information Service.
8. Click Start > Run...
9. Type regedit, and then click OK.

138

Chapter 2: Requirements and Installation

10. Expand HKEY_LOCAL_MACHINE > Software.
11. Delete both the SolarWinds and the [Link] folders.
12. If you are uninstalling Orion SAM from a 64-bit computer, expand HKEY_
LOCAL_MACHINE > Software > Wow6432Node, and then delete both the
SolarWinds and the [Link] folders.
13. Delete the SolarWinds folder from the Program Files folder on your main
volume. Typically, the Program Files folder is located at C:\Program
Files\.

14. Delete the SolarWinds folder from the Program Files\Common Files folder
on your main volume. Typically, the Common Files folder is located at
C:\Program Files\Common Files\.

15. Delete the SolarWinds website directory. Typically, the SolarWinds website
directory is located in C:\Inetpub\.
16. Delete the SolarWinds folder from the All Users\Application Data\ directory. Typically, this SolarWinds folder is located in C:\Documents and Settings\All Users\Application Data\.

17. Using your SQL Server tools, delete your Orion database. The Orion database is typically named NetPerfMon, and it can be found in the Databases
folder of your SQL Server management application.
18. Using your SQL Server tools, delete your Orion database user. The Orion
database user can be found by expanding Security > Logins in your SQL
Server management application.

Advanced Installation of SAM

SolarWinds Server & Application Monitor offers an intuitive wizard to guide you
through installing and configuring the product.
To install or upgrade SolarWinds Server & Application Monitor:
l

Using an account with local administrative privileges, log on to the

SolarWinds server on which you want to install SolarWinds SAM. To
avoid permissions issues, this account should not be a domain
account, and it should not be subject to any local or group policy
restrictions.
If you downloaded the product from the SolarWinds website, complete
the following steps:
a. Navigate to the location of your downloaded .zip file, and then
extract the evaluation package to an appropriate location.
b. Launch the SolarWinds SAM evaluation executable.
If you are prompted to install any required components, such as
Microsoft .NET Framework 3.5 or Microsoft [Link] 2.0 AJAX

139

Advanced Installation of SAM

Extensions, click Install and then complete the component installation.

Note: Downloading and installing Microsoft .NET Framework 3.5 may take
a long time, depending on your existing system configuration.
Review the Welcome text, and then click Next.

If the InstallShield Wizard detects that Microsoft Internet Information

Services (IIS) is not installed, suspend installation, quit setup, and then
install Internet Information Services (IIS).
If you had to install Internet Information Services (IIS), launch the
SolarWinds evaluation executable again.

1. Accept the terms of the license agreement, and then click Next.

140

Chapter 2: Requirements and Installation

2. Accept the default install location, or navigate to a different location, and then
click Next.

3. Select the Advanced Install option, and then click Next.

141

Advanced Installation of SAM

4. SAM will begin installation, taking you through multiple installation screens.
Click Next as prompted to be taken to the Database Settings of the Configuration
Wizard,

5. Configure the database for your environment by selecting the appropriate SQL
Server database and Authentication information, and then click Next.

142

Chapter 2: Requirements and Installation

6. Select whether to Create a new database, or Use an existing database, and

then enter the information as needed, then click Next.

7. Select whether to Create a new account, or Use an existing account, and

then enter the account information, then click Next.

143

Advanced Installation of SAM

If the Website Settings page is displayed, configure the IP Address, Port,

and Website Root Directory as appropriate and select whether you want to
enable automatic login, then click Next.

8. Ensure that all the services displayed in the Service Settings page are
checked, and then click Next.

144

Chapter 2: Requirements and Installation

9. Review the Configuration wizard Summary page, and then click Next.
10. Click Finish to complete the Configuration Wizard.
Note: If you encounter any issues with the additional polling engine, rerun the
Configuration Wizard on the SolarWinds SAM server.
To assign nodes to polling engines:
You can assign nodes to the polling engines by selecting the desired Polling
Engine in the Add Node wizard.
You can also perform Poller Load Balancing using the Monitor Polling Engines
tool to assign nodes to polling engines. Click Start> All Programs>
SolarWinds> AdvancedFeatures> Monitor Polling Engines. Then click
Servers > Poller Load Balancing to display a dialog where you can assign
nodes to particular polling engines. For more information, see Understanding
How Polling Engines Work" on page 931.

Activating Your License

After installing the software through the setup wizard, you are prompted to enter
the license activation key for your product. If you do not have an activation key,
the product runs in a time-limited evaluation mode.
To evaluate the software without a license:
1. Click Continue Evaluation.

145

To license the software on a server with Internet access:

To license the software on a server with Internet access:
1. Click Enter Licensing Information.
2. Select I have internet access and an activation key.
3. Click the [Link] link to access the customer portal on the SolarWinds web site.
4. Log on to the portal using your SolarWinds customer ID and password.
5. Click License Management on the left navigation bar.
6. Navigate to your product, choose an activation key from the Unregistered
Licenses section, and then copy the activation key.
7. If you cannot find an activation key in the Unregistered Licenses section, contact SolarWinds customer support.
8. Return to the Activate SAM window, and then enter the activation key in
the Activation Key field.
9. If you access Internet web sites through a proxy server, click I access
the internet through a proxy server, and enter the proxy address and
port.
10. Click Next.
11. Enter your email address and other registration information, and then click
Next.
To license the software on a server without Internet access:
1.
2.
3.
4.
5.
6.
7.

8.
9.
10.
11.
12.

Click Enter Licensing Information

Select This server does not have internet access, and then click Next.
Click Copy Unique Machine ID.
Paste the copied data into a text editor document.
Transfer the document to a computer with Internet access.
On the computer with Internet access, complete the following steps:
Browse to [Link] and then log on to
the portal with your SolarWinds customer ID and password.
Navigate to your product, and then click Manually Register License.
If the Manually Register License option is not available for your product,
contact SolarWinds customer support.
Provide the Machine ID from Step 5, and then download your license key
file.
Transfer the license key file to the server.
Return to the Activate SAM window, browse to the license key file, and
then click Next.

146

Chapter 2: Requirements and Installation

Finishing SolarWinds SAM Installation

After activating your license, you are prompted to configure SolarWinds SAM.
Doing so configures the SolarWinds database, web site, and services to work in
your specific environment.
Follow the directions in the SolarWinds Configuration Wizard:
Notes:
l Confirm that you have designated a SQL Server database instance for
SolarWinds SAM.
l Confirm that the Internet Information Services (IIS) Manager is not open
while the Configuration Wizard is running.
During configuration, the SolarWinds polling engine will shut down temporarily
with the result that, if you are actively polling, you may lose some polling data.
SolarWinds recommends that you perform upgrades during off-peak hours of
network usage to minimize the impact of this temporary polling stoppage.
To configure Server & Application Monitor:
1. If the Configuration Wizard has not loaded automatically, click Start>
All Programs> SolarWinds Orion> Configuration and AutoDiscovery> Configuration Wizard.
2. Click Next on the Welcome window of the Configuration Wizard.
3. If you are prompted to stop services, click Yes.
Note: To ensure that all updates and changes are installed correctly, it is
imperative that you stop all services.
4. Specify the SQL Server instance you want to use to store network data.
5. Provide the credentials, if necessary, that are required to log into the selected instance.
Notes:
l If you are using an existing database, the user account needs only
to be in the db_owner database role for the existing database.
l If you are using an existing SQL account, the user account needs
only to be in the db_owner database role for the SolarWinds SAM database.
The selected instance must support mixed mode or SQL authentication with
strong passwords. A strong password must meet at least three of the following
four criteria:
l
l

Contains at least one uppercase letter.

Contains at least one lowercase letter.

147

To configure Server & Application Monitor:

l
l

Contains at least one number.

Contains at least one non-alphanumeric character, e.g., #, %, or ^.

For more information about authentication with strong passwords, see

[Link]
If you are using SQL Express, specify your instance as (local) and use a
strong password. For more information about authentication with strong
passwords, see [Link] Due to its inherent limitations, SolarWinds recommends against the use of SQL Express in
production environments.
l If you are creating a new database, the user account must be a member of
the dbcreator server role. The sysadmin role and the sa user account are
always members of dbcreator.
l If you are creating a new SQL account for use with SolarWinds SAM, the
user account must be a member of the securityadmin server role.
Note: The sysadmin role and the sa user account are always members of
securityadmin.
6. Click Next.
7. If you are creating a new database, select Create a new database,
provide a name for the new database, and then click Next.
Note: SolarWinds recommends against using non-alphanumeric characters in database names.
8. If you are using an existing database, select Use an existing database,
type the database name or select it from the list, and then click Next.
9. If you want to create a new SQL account for the SolarWinds SAM
polling engine and web console to use for accessing the database,
select Create a new account, provide an account name and password,
confirm the account password, and then click Next.
10. If you want to use an existing SQL account for the SolarWinds SAM
polling engine and web console to use for accessing the database,
select the existing account, provide the appropriate password, and then
click Next.
11. If you need to specify a particular IP Address for the SolarWinds SAM
Web Console, provide the IP address of the host web server.
Note: SolarWinds recommends the default All Unassigned unless your
environment requires a specific IP address for your SolarWinds Web Console.
12. Specify both the port through which you want to access the web console
and the volume and folder in which you want to install the web console
files.
Note: If you specify any port other than 80, you must include that port in the
l

148

Chapter 2: Requirements and Installation

13.
14.
15.

16.
17.
18.
19.
20.
21.

URL used to access the web console. For example, if you specify an IP
address of [Link] and port 8080, the URL used to access the web console is [Link]
Click Next.
If you are prompted to create a new directory, click Yes.
If you are prompted to create a new website, click Yes.
Note: Choosing to overwrite the existing website will not result in the deletion of any custom SolarWinds SAM website settings you may have previously applied.
Confirm that all services you want to install are checked, and then click
Next.
Review the final configuration items, and then click Next.
Click Next on the Completing the SolarWinds Configuration Wizard dialog.
Click Finish when the SolarWinds Configuration Wizard completes.
Log in to the SolarWinds Web Console as an administrator.
Note: By default, you can log in with User Name Admin and no password.
If you have not discovered your network devices and added them to
the SolarWinds database, the Network Discovery Wizard starts.

Excluding SolarWinds Data Directories from AntiVirus Scanning

Anti-virus programs may lock files used by the SolarWinds Job Engine v2 during
scanning. This can cause the SolarWinds Job Engine v2 services to stop and
restart, causing delayed polling and gaps in data for a poll cycle.
SolarWinds recommends that you exclude certain SolarWinds data directories
(depending on your Windows platform) from your anti-virus scanning to improve
performance and stability:
Exclude for Windows Server 2003:
C:\Documents and Settings\All Users\Application
Data\SolarWinds

Exclude for Windows Server 2008:

C:\ProgramData\SolarWinds

149

Running SolarWinds SAM

Running SolarWinds SAM

To run SolarWinds SAM:
1. Click Start > All Programs > SolarWinds Orion> Orion Web Console.
The SolarWinds Web Console is displayed. You can login by default by entering
the User name Admin and no password. Then click Login.

Internet Explorer Security Settings

If you are using Internet Explorer, SolarWinds recommends that you add the URL
of your SolarWinds website ([Link] the URL of
SolarWinds support ([Link] and about:blank to the list of
trusted sites.
If you do not add these URLs to the list of trusted sites, you may see Internet
Explorer dialogs that contain messages similar to the following regarding
blocking website content:
l

Content from the website listed below is being blocked by the Internet
Explorer Enhanced Security Configuration.
To add the specified URLs to your trusted sites list, click the Add button
in the Internet Explorer dialog.

For more information about adding sites to your trusted sites list, see the Microsoft
article, Working with Internet Explorer Security Settings.

Licensing
The SolarWinds SAM license you purchase is based on the number of allowed
assigned component monitors. A component monitor provides a statistic that you
want to monitor in SolarWinds SAM. You can have as many application templates
and assigned monitors as you need, as long as the number of assigned
component monitors does not exceed the license count.
If you have more assigned component monitors than allowed by your license, the
monitors that exceed your license limit are not activated, and their component
statuses are changed to "Not Licensed." You can either disable some assigned
component monitors to reduce your total assigned monitor count, or contact
SolarWinds about upgrading your SolarWinds SAM license.
AppInsight for SQL
When usingAppInsight for SQL, 50 component monitors will count against your
150

Chapter 2: Requirements and Installation

licensed number of component monitors,per SQL instance. For example, if you
have an active license for 1,500 component monitors and useAppInsight for
SQLto monitor ten instances of SQL, 500 component monitors will count against
your total license of 1,500, leaving you with 1,000 component monitors available
for use elsewhere. (50 X 10 = 500, 1,500 500 = 1,000). There is no restriction on
the number of databases you can have monitored. Also note that if you choose
not to use this application, you will not be penalized any number of component
monitors.
AppInsight for Exchange
When using AppInsight for Exchange, 50 component monitors will count against
your licensed number of component monitors, per Exchange Server. For
example, if you have an active license for 1,500 component monitors and use
AppInsight for Exchange to monitor 88 mailboxes over ten Exchange servers, 500
component monitors will count against your total license. The number of
mailboxes you have on these servers is irrelevant. (50 component monitors X 10
Exchange Servers = 500 component monitors used.) This will leave you with
1,000 component monitors available for use elsewhere. (1,500 component
monitors 500 component monitors used for AppInsight for Exchange = 1,000
component monitors remaining). There is no restriction on the number of
mailboxes you can have monitored. Also note that if you choose not to use this
application, you will not be penalized any number of component monitors.
Asset inventory data collection does not count against your SAM component
monitor license.
Note: SolarWinds SAM licenses do not have to mirror the license count of any
other installed SolarWinds product. For example, you can install SolarWinds
SAM with a 150 component license on a SolarWinds NPM server with an
unlimited node license.
Windows Scheduled Task Monitor
The WSTM consumes five license units per node.

151

To see the available component monitors remaining in your license:

To see the available component monitors remaining in your license:
1.
2.
3.
4.

Log on to the SolarWinds Web Console with an administrator account.

Click Applications.
Click SAM Settings.
Click SAM License Summary.
Note: As an alternative to the previous procedure, you can also click
License Details in the Settings page to view the used and available component monitors.

152

Chapter 3:
Common Tasks with SolarWinds
SAM
The features and flexibility provided by Server & Application Monitor give highly
detailed insight into the performance quality of applications on your network. The
tasks presented in this chapter illustrate the value of Server & Application Monitor,
and how it can immediately offer you a significant return on your investment:
l
l
l
l
l
l
l
l
l

Monitoring Internal and External Web Site Performance

Monitoring Microsoft Windows Performance
Monitoring IIS Application Pools
Scanning for Applications Worth Monitoring
Monitoring VMware Performance Counters
Monitoring and Restarting Stopped Windows Services
Creating a Custom Component Availability Report
Creating a Windows PowerShell Monitor
Monitoring Large Directories

Monitoring Internal and External Web Site Performance

You are the website administrator for your company. You are responsible for the
Intranet web site accessed by the employees and the corporate web site
accessed by the customers. You want to make sure both your employees and
customers are able to access your web sites and that you are alerted to any
problems that would prevent them from doing so.

153

Chapter 3: Common Tasks with SolarWinds SAM

Deciding What to Monitor

The Intranet server is in your server room. To make sure only employees can
access the Intranet web site, the web site is secured using basic HTTP
authentication (htpasswd) that requires them to log on using a user name and
password. You decide to monitor this server using the HTTP template and the
valid credentials: user name "admin" and password "password.
The corporate web server is hosted and managed by a web hosting company.
You can monitor the web site with the HTTP Template, but because you do not
have direct control over the server hardware, you will add the server to the
SolarWinds database as an external node.
Monitoring the Intranet Home Page
We need to add the Intranet web server to the SolarWinds database, and then
assign the SolarWinds SAM HTTP template to the web server.
1. Log on to the SolarWinds Web Console.
2. Click Applications if not already selected.
3. Add the Intranet web server to the SolarWinds database.
a. Click Add a Node.
b. Type the Hostname or IP Address of the Intranet web server.
c. Check the ICMP (Ping only) check box, select the appropriate
Polling Engine (if applicable), and then click Next.
d. In the Add Application Monitors page, click Next.
Note: If you wish to add an Application Monitor to the node, you
may do so either here or from the Application Settings as described
elsewhere in this guide.
e. In the Change Properties page, click OK, Add Node.

154

Monitoring the Corporate Home Page

Assign the HTTP template to the Intranet web server node.
a.
b.
c.
d.
e.
f.
g.
h.
i.
j.
k.
l.
m.
n.

Click Applications if not already selected.

Click SAM Settings.
Click Manually Assign Application Monitors.
Select Web Server in the Show only list.
Select HTTP, and then click Next.
Expand the categories and locate your Intranet web server node, select
it, and then click Next.
Select <New Credential> in the Choose Credential list.
Type Intranet Admin in the Credential Name field.
Type admin in the User Name field.
Type password in the Password and Confirm Password fields.
Click Test.
If the test fails, see Troubleshooting the HTTP Template.
Click Assign Application Monitors.
Click Done.

Monitoring the Corporate Home Page

We need to add the corporate web server to the SolarWinds database as an
external node, and then assign the HTTP template to the web server.
1. Log on to the SolarWinds Web Console.
2. Click Applications if not already selected.
3. Add the corporate web server to the SolarWinds database as an external
node.
a. Click Add a Node.
b. Type the Hostname or IP Address of the corporate web server.
c. Check the External check box, select the appropriate Polling Engine
(if applicable), and then click Next.
4. Assign the HTTP template to the corporate web server node.
a. Select Web Server in the Show only list.
b. Select HTTP.
c. Select Inherit credentials from template and then click Test.
d. If the test fails, see Troubleshooting the HTTP Template.
e. Click Next.
f. Enter the Name for your corporate web server.
g. Click OK, Add Node.

155

Chapter 3: Common Tasks with SolarWinds SAM

Troubleshooting the HTTP Template
If the web site requires a user name and password, verify that you are entering a
working user name and password.
If the SolarWinds SAM server must connect to the Internet through a web proxy:
1.
2.
3.
4.
5.
6.
7.

Click Assign Application Monitors even though the test failed.

Click Edit.
Click [+] to expand the HTTP Monitor component.
Click Override Template next to Use Proxy.
Check the Use Proxy check box.
Click Override Template next to Proxy Address.
Type the proxy address in the Proxy Address field using the syntax [Link]
8. Click Test All.
9. Click Submit.
10. Click Done.

Monitoring Microsoft Windows Performance

You are a systems administrator who maintains several Microsoft Windows
Server 2003 servers in your server room that host databases. Several database
users have complained recently that their databases are "running slow" during
certain times of the day. You want to monitor the performance of these database
servers to see what you can do to remedy the situation.

Deciding What to Monitor

You suspect that the disk systems on a few of these servers need to be upgraded
to RAID or something similar to increase the speed. You know that monitoring the
disk queue length for each system would tell you whether there is an I/O
bottleneck.

156

Monitoring the Windows 2003 Servers

You decide to apply the Windows Server 2003-2008 template to these servers
because it includes a built-in Disk Queue Length monitor.
Monitoring the Windows 2003 Servers
We need to add the server nodes to the SolarWinds database, assign the
Windows Server 2003-2008 template to the server nodes, and then adjust the
warning threshold of the template's Disk Queue Length component to >2. This will
make SolarWinds SAM send us a warning if the Disk Queue Length of any server
is greater than 2.
The Windows 2003 servers occupy the IP address range [Link] to
[Link]. We could add each server to the SolarWinds database one at a
time, but it is easier to add the entire IP range using SolarWinds Network
Discovery.
1. Log on to the SolarWinds Web Console.
2. Add the Windows 2003 servers to the SolarWinds database.
a. Click Settings.
b. Click Network Sonar Discovery.
c. Click Add New Discovery.
d. Click Next.
e. Click Next.
f. Enter [Link] as the Start address, [Link] as the End
address, and then click Next.
g. Click Next to save the discovery settings.
h. Click Discover to begin the discovery process. The Discovering Network dialog is displayed.
i. Click Next on each page until you reach the Import Preview page.
j. When you reach the Import Preview page, click Import.
k. When you reach the Results page, click Finish.
3. Assign the Windows 2003-2008 template to your Windows 2003 server
nodes.
a. Click Applications if not already selected.
b. Click SAM Settings.
c. Click Manually Assign Application Monitors.
d. Select Windows in the Show only list.
e. Select Windows Server 2003-2008, and then click Next.
f. Browse to your Windows 2003 nodes, select all of them, and then click
Next.
g. Enter sysadmin in the Credential Name field.
h. Enter your administrator user name in the User Name field.

157

Chapter 3: Common Tasks with SolarWinds SAM

i. Enter your password in the Password and Confirm Password fields.
j. Click Test.
k. If the test fails, see Troubleshooting the Windows 2003-2008 Template.
l. Click Assign Application Monitors, and then click Done.
4. Change the Disk Queue Length warning threshold of the Windows 20032008 template to >2.
a. Click SAM Settings.
b. Click Manage Templates.
c. Select Windows in the tag group column.
d. Check the Windows Server 2003-2008 check box.
e. Click Edit.
f. Click [+] to expand the Disk Queue Length group.
g. Enter greater than 2 for the Statistic Warning Threshold, and then click
Submit.
Troubleshooting the Windows 2003-2008 Template.
Verify that you are entering the user name and password of an administrator-level
account. If you think you have entered an incorrect credential, correct the mistake
and then retest.
Note: Windows Performance Counters use RPC for communication which runs
over TCP port 445.
Verify that the monitored server allows remote WMI connections. Consult the WMI
Troubleshooting Guide if you are unsure whether the monitored server allows
remote WMI connections. The guide is available from:
[Link]
For information about troubleshooting the Windows performance counters, refer to
the KB article How can I troubleshoot SolarWinds SAM performance monitoring
and Windows performance counters?:
[Link]

Monitoring IIS Application Pools

You maintain a web server that hosts five different web sites through Internet
Information Services (IIS) 6.0 using application pools to separate each web site.
Everything was fine at first, but the average load time for the web pages has
doubled as business has grown, and you suspect it may be time to move at least
one of the web sites to a new server.

158

Deciding What to Monitor

Deciding What to Monitor

Internet Information Services 6.0 runs each application pool in a new instance of
[Link]. Monitoring the five [Link] instances individually will let you see
which web site is using the most system resources. You can then make a more
informed decision as to which web site you should move to the new server.
Note: [Link] is running only if there are HTTP requests made to a server. To
keep [Link] running if no HTTP requests are made to that server, add an
HTTP Monitor to the same application. The HTTP Monitor will then check the
same website and generate HTTP requests, thereby keeping [Link] running.
What needs to be monitored:
Five instances of [Link], differentiated by application pool. SolarWinds SAM
can monitor them separately if you specify the application pool names in the
component monitors.
1. Log on to the SolarWinds Web Console.
2. Click Applications if not already selected.
3. Add the web server to the SolarWinds database.
a. Click Add a Node.
b. Type the hostname or IP address of the Intranet web server.
c. Check the ICMP (Ping only) check box and then click Next.

159

Chapter 3: Common Tasks with SolarWinds SAM

d. In the Add Application Monitors page, click Next.
e. In the Change Properties page, Click OK, Add Node.
4. Find the [Link] process on the web server.
a. Click Applications if not already selected.
b. Click SAM Settings.
c. Click Component Monitor Wizard.
d. Select Process Monitor WMI as the monitor type, and then click
Next.
e. Click Browse, select the web server, and then click Select.
f. Enter WebServerAdmin in the Credential Name field.
g. Enter your administrator user name in the User Name field.
h. Enter your password in the Password and Confirm Password fields.
i. Click Next.
j. Wait for the process list to load.
k. Click the last page button to view the last page.
l. Check the check box next to [Link], and then click Next.
m. Change Monitor Name to Webpool1.
n. Enter webpool1 in the Command Line Filter field.
o. Change the CPU Warning Threshold to greater than 40.
p. Change the CPU Critical Threshold to greater than 50.
q. Click Add Another Component.
r. Repeat steps d through q, changing the Monitor Name and Command
Line Filter fields appropriately for the four remaining webpool filters.
s. After creating the monitors for all five [Link] instances, click Next.
t. Select New Application Monitor.
u. Type Web Server Application Pools as the Application Monitor Name, and
then click Next.
v. Select the web server node, and then click Next.
w. Review the list of component monitors to create, and then click OK,
Create.

Scanning for Applications Worth Monitoring

You already use SolarWinds SAM for monitoring applications critical to your own
job functions. Now, you want to discover and monitor other applications that are
hosted in your organization's network.

160

What needs to be monitored:

What needs to be monitored:

You decide to scan for Windows and IIS because you have the Windows
administrator password to access many computers on the network and you have
a hunch at least a few of them are running IIS.
All the computers in your network are already in the SolarWinds database, so
there is no need to add them.
The administrator user name and passwords are:
User Name: WAREHOUSE\Administrator
Password: H0merSamps0n
User Name: IT\Administrator
Password: FourLights
1.
2.
3.
4.
5.

Log on to the SolarWinds Web Console.

Click Applications if not already selected.
Click SAM Settings.
Click Scan Nodes for Applications.
Select nodes:
a. Click [+] to expand the node groups.
b. Select the nodes you want to scan, and then click Next.
6. Select applications to find.
a. Uncheck all applications except:
l Internet Information Services
l Windows Server 2003-2008.
b. Click Next.
7. Enter the credentials for the servers you are scanning:
a. Click Add Credential.
b. Type Warehouse Admin in the Credential Name field.

161

Chapter 3: Common Tasks with SolarWinds SAM

8.
9.
10.
11.

c. Type WAREHOUSE\Administrator in the User Name field.

d. Type H0merSamps0n in both the Password and Confirm Password
fields.
e. Click Submit.
f. Click Add Credential.
g. Type IT Admin in the Credential Name field.
h. Type IT\Administrator in the User Name field.
i. Type FourLights in the both the Password and Confirm Password
fields.
j. Click Submit.
k. Click Next.
Click Start Scan.
Click View SAM Summary Page.
Click View results (near the top of the page) after the SAM scan is complete.
Review the results of the scan.

Monitoring a Specific URL

To monitor a specific URL, follow the step outlined below:
1. Login to the Web Console and navigate to Settings.
2. Click Manage Nodes and then click Add Node.
3. Enter the URL you want to monitor (eg: [Link]) and select No
Status: External Node, as highlighted below:

162

To monitor a specific URL, follow the step outlined below:

4. Click Next and then select Web Pages from the drop-down menu.

5. Check Web Link and select Inherit credentials from Template. Click
Test and then click Next.

6. On the Change Properties page, review properties you wish to change and
then click, OK, Add Node.

163

Chapter 3: Common Tasks with SolarWinds SAM

7. Navigate to the Node Details page to review the results. To do this, click
the Home tab then drill down to your specific node in the All Nodes
resource.

Monitoring VMware Performance Counters

You want to ensure the health of your VMware environment.
What needs to be monitored:
You want to create an Application Monitor that uses VMware performance
counters provided by the VMware wizard to monitor the health of various aspects
of your VMware environment.
To create a new Application Monitor using the browsing method to select
the desired VMware performance counters:
1.
2.
3.
4.
5.

6.
7.
8.
9.

10.
11.
12.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Component Monitor Wizard underneath Getting Started with SAM.
Select one of the following component monitor types, depending on
whether you want to browse for ESX or vCenter performance counters:
VMware ESX Performance Counter MonitorVMware vCenter Performance Counter Monitor
Click Next.
Type the IP address of the VMware node you want to browse, or click
Browse, select the node from the list, and click SELECT.
If suitable credentials already exist, choose the credential from the
Choose Credential list.
If suitable credentials do not exist, choose <New Credential> from the
Choose Credential list, and then add the new credential by filling out the
credential details.
Click Next.
Select whether you want to monitor A single system or Multiple systems.
Choosing A single system will provide specific counters that apply to the
target system only.
Note: This option provides all available performance counters with
instances for the specified Entity Type. Since the performance counters
selected may contain instances, the Application Monitor or template created based on them cannot be considered as generic, and may only be
assigned to the specific target node you specified in step 7 above.
Choosing Multiple systems will provide more generic counters that can
164

To create a new Application Monitor using the browsing method to select the
be applied to multiple systems.
Note: This option provides only aggregate performance counters (without
instances). Therefore the Application Monitor or template created based on
them can be considered as generic and assigned to different ESX/vCenter
target hosts. In this case, monitors in the application or template created
will contain the special ${VMWARE_ENTITY_NAME} variable in the Entity
Name field of the monitor. When the monitor runs, this variable will be
resolved to the first available Entity on a target host with the desired Entity
Type (for example, the first Host System).
13. Select the desired VMware Entity Type to monitor:
l Cluster Compute Resource (only available if the VMware vCenter Performance Counter Monitor type is selected in step 5) Data object that
aggregates the computation resources of its associated Host System
objects into one single computation resource for use by virtual machines.
The cluster services such as HA (High Availability), DRS (Distributed
Resource Scheduling), and EVC (Enhanced vMotion Compatibility),
enhance the usefulness of this single computation resource. This Entity
Type is specific to vCenter systems.
l Host System Managed object type that provides access to a virtualization
host platform.
l Resource Pool Represents a set of physical resources which may be a
single host, a subset of a host's resources, or resources spanning multiple
hosts. You can subdivide Resource pools by creating child resource pools.
In order to run, a virtual machine must be associated as a child of a resource
pool. In a parent/child hierarchy of resource pools and virtual machines, the
root resource pool is the single resource pool that has no parent pool.
l Virtual Machine Managed object type for manipulating virtual machines,
including templates that can be repeatedly deployed as new virtual
machines. This object type provides methods for configuring and controlling
a virtual machine.
14. If you selected the A single system option in step 11, select the desired
VMware Entity to monitor.
15. Select the desired Performance Object (group) to monitor. For example, if
you want to monitor CPU counters, select CPU.
16. Select the check boxes next to the counters to monitor for the selected Performance Object.
Note: To select all the counters listed, select the check box next to
Counter.

165

Chapter 3: Common Tasks with SolarWinds SAM

The selected counters are listed in the Selected items list with a red X
next to each one. To delete an item, click the red X next to the item and it
will be removed from the list.
17. If you want to select counters from an additional Performance Object,
select the next Performance object and then add the desired counters for it.
18. When you are finished selecting counters, click Next.
19. If you selected the A single system option in step 12, select the desired
counter instances to monitor:
a. Use the Group By dropdown to display the counters for a particular Performance Object, or select All Counters.
b. Click the name of the desired counter to choose its instances.
c. Select the check box(es) next to the desired instance(s) to monitor.
Note: To select all the instances listed, select the check box next to
Instance Name.
The selected instances are then displayed in the Selected items list
with a red X next to each one. To delete an item, click the red X next to
the item and it will be removed from the list.
d. When you are finished selecting counter instances, click Next.
20. The Edit Properties page is displayed with the component monitors that
have been created for each of your selected counters or counters/instances.
Here you can modify settings such as the Monitor Name, which defaults to
the counter name that was selected. This is only a descriptive label, and
can be modified as desired.
If you chose the Multiple systems option in step 11, you can see the
special ${VMWARE_ENTITY_NAME} variable in the Entity Name field of the
monitor. When the monitor runs, this variable will be resolved to the first
available Entity on a target host with the desired Entity Type (for example,
the first Host System).
You also need to configure your warning and critical thresholds for
response time and statistic.
21. When you are finished editing monitor properties, click Next.
22. The Add to Application Monitor or Template page is displayed with the
Component list collapsed. Click [+] next to Component list to expand the
list of counters or counters/instances to be added.
23. Select New Application Monitor. Then enter a name for the new Application Monitor, for example: VMware Disk and CPU Monitor.
You can change the name of the Application Monitor up to and including
step 26.

166

Monitoring and Restarting Stopped Windows Services

24. If you selected the Multiple systems option in step 11, expand the list of
nodes and select the nodes to monitor. Only VMware ESX and vCenter
nodes are displayed.
25. Click Next.
26. Click OK, Create.
27. Click View SAM Summary Page.
28. Your new VMware monitor appears in the tree view for the All Applications
resource. The polling results for the new monitor are updated after a few
minutes.

Monitoring and Restarting Stopped Windows Services

You want to ensure the health of your Windows server by monitoring the services
that are running. If any services are stopped, they should be restarted.
What needs to be monitored:
You want to create an Application Monitor that monitors Windows services. You
also want to create an alert that attempts to restart any services that are stopped
and sends an email.
To create a new Application Monitor template using the browsing method to
select the desired Windows services and then assign it to the desired
nodes:
1.
2.
3.
4.
5.
6.
7.
8.
9.

10.
11.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Component Monitor Wizard underneath Getting Started with SAM.
Select the following component monitor type:
Windows Service Monitor
Click Next.
Type the IP address of the Windows node you want to browse, or click
Browse, select the node from the list, and click SELECT.
If suitable credentials already exist, choose the credential from the
Choose Credential list.
If suitable credentials do not exist, choose <New Credential> from the
Choose Credential list, and then add the new credential by filling out the
credential details.
Click Next.
Browse the list of services and check the boxes for the services to monitor.

167

Chapter 3: Common Tasks with SolarWinds SAM

12. Adjust thresholds as desired.
13. Click Next.
14. Ensure that New Application Monitor Template Name is selected and
then enter a name for your new template, for example CustomWindowsServices.
15. Click Next.
16. Select the boxes for the desired nodes to monitor and click Next.
17. Click OK, Create to create the assigned Application Monitor.
To create an alert that restarts any stopped Windows services and sends an
email:
1. Click Start > All Programs > SolarWinds Orion > Alerting, Reporting,
and Mapping > Advanced Alert Manager.
2. Click Configure Alerts.
3. Scroll to the bottom of the list in the Manage Alerts dialog, and check the
box for Restart a service.
4. If you would also like to send an e-mail notification for the service
restart:
a. Highlight Restart a service and click Edit.
b. Select the Trigger Actions tab and then click Add New Action.
c. Select Send an E-Mail / Page and click OK.
d. Complete the e-mail info and click OK.
e. Click OK.
5. Click Done.
For more information about restarting Windows services with an alert action, see
Restarting Windows Services with an Alert Action on page 738.

Creating a Custom Component Availability Report

The following procedure generates an example report of component average
availability information over the previous week. The final report is sorted so that
the worst items are viewed last. Components are listed in order of decreasing
availability.
Open Report Writer by clicking Start> All Programs> SolarWinds Orion>
Alerting, Reporting, and Mapping> Report Writer.
Note: At any point during the creation of a report (or perhaps at many points), you
may save what you have done by clicking File> Save. The first time you save
you must give your report a filename or accept the default, which will be the report
title that you assign in the following procedure.

168

To generate an example report of component availability information:

To generate an example report of component availability information:
1. Click File> New Report.
2. The example calls for a report on component availability over the past
week, so select APM: Historical Daily Component Availability, and
then click OK.
3. Type My Reports in the Report Group field.
4. Enter Last Weeks Component Availability as the Report Title.
5. Select Portrait for the paper orientation.
6. Click the Select Fields tab.
7. Click Browse (...), and then select Add a new field.
8. Click the Field asterisk, and then select Date/Time (Daily Component
Availability Filtering Only)> DateTime.
9. Click Browse (...), and then select Add a new field.
10. Click the Field asterisk, and then select Network Nodes> Node
Details>Node Name.
11. Click Browse (...), and then select Add a new field.
12. Click the Field asterisk, and then select Historical Daily Component
Availability> Application> Application Name.
13. Click Browse (...), and then select Add a new field.
14. Click the Field asterisk, and then select Historical Daily Component
Availability> Component> Component Name.
15. Click Browse (...), and then select Add a new field.
16. Click the Field asterisk, and then select Historical Daily Component
Availability> Component> ComponentAvailability.
17. On the line for Component Availability, click the function asterisk and
then select Average.
18. Click Preview to run the SQL query and view the report data in the Preview window.
19. Click Design in the toolbar to return to design mode.
20. Click the Field Formatting tab.
21. Select DateTime from the field list.
22. Change the Column Header entry to Date/Time.
23. Select Application_Name from the field list.
24. Change the Column Header entry to Application Name.
25. Select Component_Name from the field list.
26. Change the Column Header entry to Component Name.
27. Select Average_of_ComponentAvailability from the field list.
28. Change the Column Header entry to Average Component Availability.
Note: Column widths are adjustable. To change a column width, place
your cursor on the column divider and drag it to a different position.

169

Chapter 3: Common Tasks with SolarWinds SAM

29. Click Preview to run the SQL query and view the report data in the Preview window.
30. Click Design in the toolbar to return to design mode.
31. Click the Select Fields tab.
32. Click the sort asterisk on the Component Availability field line, and then
select descending.
33. Click Preview to run the SQL query and view the report data in the Preview window.
34. Click Design in the toolbar to return to design mode.
35. Click the Time Frame tab.
36. Select Relative Time Frame, type 7 in the text field, and then select Days
from the list.
37. If you want to break down the report day-by-day, click the Summarization tab and specify your choices.
38. If you want to filter your report, click the Filter Results tab and specify filter rules.
39. Click File> Save to save your work.

Monitoring Large Directories

You already use the Directory Size monitor in SolarWinds SAM for monitoring
small and medium-sized directories. Now you need to monitor a very large
directory.
You discover the Directory Size monitor has problems monitoring the very large
directory, which contains hundreds or even thousands of files, because the
monitor timeout may lapse before the target computer can finish computing the file
sizes and sending the response.
In order to work around this issue, you decide to use the Windows Script monitor
instead to execute a Visual Basic script that uses the [Link]
to calculate the directory size.
What needs to be monitored:
You decide to monitor the very large directory using the Windows Script monitor,
because this method should be as fast as if you view the folder properties in
Windows Explorer to get the size and avoid the timeout issues.
1.
2.
3.
4.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Create a New Template underneath Application Monitor Templates.

170

What needs to be monitored:

5. Type a name for your template in the Template Name field, for example
Large Directory Monitor.
6. If you want to turn on extended debug information to assist Customer
Support, expand Advanced and then set Debug logging On and specify
the Number of log files to keep.
Here you can also select either 32bit or 64bit from the dropdown list
entitled, Platform to run polling job on.
Note: Do not turn on Debug logging unless directed by Customer Support.
7. Click Add Component Monitor.
8. Expand the Custom Component Monitors group, and then check Windows Script Monitor.
9. Click Submit.
10. Select credentials with appropriate permissions to run the script on the
SolarWinds SAM server, and that also has appropriate permissions to do
whatever else the script requires.
11. Copy the following Visual Basic script to get the directory size into the
Script Body field:
Dim folderPathfolderPath = [Link](0)Set fs =
[Link] ("[Link]")Set folder
= [Link](folderPath)[Link] "Message: Folder " &
folderPath & " is " & [Link] & " bytes large"
[Link] "Statistic: " & [Link]

The VB code does the following:

a. Reads the first argument passed to the script (the UNC pathname for
the directory to monitor) and stores it in folderPath.
b. Creates the [Link] and stores it in fs.
c. Gets the folder name from the saved command line argument and
stores it in folder.
d. Displays the message with the folder name and the folder size.
e. Displays the statistic (folder size in bytes).
Note: The script does no error checking, such as handling the case if
the folder does not exist.
12. Type the UNC pathname for the directory name to monitor into the Script
Arguments field.
You can use the token ${IP} and the IP address will be filled in with the IP

171

Chapter 3: Common Tasks with SolarWinds SAM

address of the target node to which the monitor is assigned when the Windows
Script monitor runs.
For example, if you type the following UNC pathname for the directory name in
the Script Arguments:
\\${IP}\c$\my_large_directory

the VBscript will get the size of the directory c:\my_large_directory on the node to
which the Windows Script monitor is assigned.
13. Specify the critical and warning thresholds appropriately based on the
desired directory size.
14. Click Submit.
15. Create an assigned Application Monitor by assigning the Large Directory
Monitor template to the desired node to monitor.
a. Click the Applications tab.
b. Click SAM Settings.
c. Click Manually Assign Application Monitors underneath Getting Started with SAM.
d. Select All in the Show only list.
e. Click Large Directory Monitor and then Next.
f. Click Manually Assign Application Monitors underneath Getting Started with SAM.
g. Select All in the Show only list.
h. Click Large Directory Monitor and then click Next.
i. Browse to the desired node to monitor, select it, and then click Next.
j. Enter itadmin in the Credential Name field.
k. Enter your administrator user name in the User Name field.
l. Enter your password in the Password and Confirm Password fields.
m. Click Test.
n. If the test fails, see Troubleshooting the Windows 2003-2008 Template..
o. Click Assign Application Monitors, and then click Done.
Troubleshooting the Large Directory Monitor
Verify that you are entering the user name and password of an administrator-level
account. If you think you have entered an incorrect credential, correct the mistake
and then retest.
If you made a mistake with the spelling of the directory name, correct it and then
retest.

172

Troubleshooting the Large Directory Monitor

173

Chapter 4:
Managing the Web Console
The SAM Web Console is an integral part of the SolarWinds family of products
that can be configured for viewing from virtually any computer connected to the
Internet. You can also customize the web console for multiple users and store
individually customized views as user profiles. Administrator functions are
accessed by clicking Settings in the top right of all SolarWinds Web Console
views.
The SolarWinds Web Console administrator manages the SolarWinds Website
using the commands listed in the various categories on the Settings page.
You can manage SolarWinds SAM nodes, groups, accounts, alerts, views, and
settings. You can also manage the navigation and look of SolarWinds SAM and
view information about available product updates. This guide is designed to
mirror the SAM interface, as shown below.
Note: If links appear not to work or misdirect you, clear your web cache which can
be done by clicking the Clear Web Cache button at the top right of the Settings
page, or by going through your browser's Options menu.

174

Chapter 4: Managing the Web Console

To manage the SolarWinds Web Console, navigate to the Settings page:

1. Log on to your SolarWinds Web Console with an Administrator account.
Note: Initially, Admin is the default administrator user ID with a blank password. You can change the password later using the Account Manager. For
more information, see "Managing Accounts" on page 207.
2. Click Settings near the top right of the SolarWinds Web Console to display the Settings page.

175

Refer to the sections that follow for details about the administrative commands
Refer to the sections that follow for details about the administrative commands available in each category:
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l

Getting Started with SolarWinds

Discovery Central
Network Sonar Discovery
Add a Node
Node & Group Management
Manage Nodes
Virtualization Settings
Manage Dependencies
Manage Groups
Accounts
Manage Accounts
Account List
Customize
Customize Menu Bars
Color Scheme
External Websites
Manage Alerts
Manage Advanced Alerts
Product Updates
Available Product Updates
SolarWinds Product Team Blog
Views
Manage Views
Add New View
Views by Device Type
Views by Application Type
Settings
Web Console Settings
Polling Settings
SAM Settings
SolarWinds Thresholds
Virtualization Thresholds
Details
Database Details
Polling Engines
Orion Core Details
License Details

176

Chapter 4: Managing the Web Console

Getting Started with SolarWinds

This section describes how to get nodes recognized by SAM. For specific
information on the discovery options, refer to the following sections:
l
l

Discovery Central
Network Sonar DiscoveryClick Network Sonar Discovery on the Settings
page to discover a range of nodes in your SolarWinds SAM. For more
information, refer to Network Sonar Discovery on page1.
Add a NodeClick Add a Node on the Settings page to add a single device
to your SolarWinds SAM. For more information, see "Adding Nodes for
Monitoring" on page 1.

Discovery Central
Click Discovery Central on the Settings page to view a centralized overview of
the types and number of network objects you are monitoring with your currently
installed SolarWinds products.
Refer to Discovering and Adding Nodes on a Network on page 266.
Network Sonar Discovery
Click Network Sonar Discovery on the Settings page to discover a range of
nodes in your SolarWinds SAM.
For more information, refer to Network Sonar Discovery on page267.
Add a Node
Click Add a Node on the Settings page to add a single device to your
SolarWinds SAM.
For more information, see "Adding Nodes for Monitoring" on page 188.

Node & Group Management

The Node & Group Management category gives you access to the commands for
managing nodes, groups, and dependencies.
Refer to the following sections for more information:
l

Manage NodesClick Manage Nodes on the Settings page to add, view,

and manage all nodes and resources managed or monitored by your
SolarWinds SAM installation. For more information, see "Note: If you run
the Configuration Wizard after editing this setting, your changes may be
overwritten." on page 1.
Virtualization Settings

177

Virtualization Settings
Manage DependenciesClick Manage Dependencies on the Settings page
to manage dependencies for your SolarWinds SAM. For more information,
see "Managing Groups and Dependencies" on page 1.
l Manage GroupsClick Manage Groups on the Settings page to manage
groups for your SolarWinds SAM. For more information, see "Managing
Groups and Dependencies" on page 1.
Manage Nodes
l

Click Manage Nodes on the Settings page to add, view, and manage all nodes
and resources managed or monitored by your SolarWinds SAM installation.
For more information, see "" on page 187.

Virtualization Settings
Click Virtualization Settings on the Settings page to open the Virtualization
Settings view. Here you can view a list of currently monitored VMware ESX
Servers, VMware credentials, as well as Hyper-V information.
For more information, refer to Virtualization on page 319.
Manage Dependencies
Click Manage Dependencies on the Settings page to manage dependencies for
your SolarWinds SAM.
For more information, see "Managing Groups and Dependencies" on page 289.
Manage Groups
Click Manage Groups on the Settings page to manage groups for your
SolarWinds SAM.
For more information, see "Managing Groups and Dependencies" on page 289.

Accounts
The Accounts category gives you access to the commands for managing
accounts, permissions, and views.
Refer to the following sections for more information:
l
l

Manage Accounts
Account List

Manage Accounts
Click Manage Accounts on the Settings page to manage user accounts,
permissions, and views.

178

Chapter 4: Managing the Web Console

For more information, see "Managing Accounts" on page 298.

Account List
Click Account List on the Settings page to open the SolarWinds Website
Accounts view, providing an immediate overview of web console user account
settings.
You may use this view to make changes to multiple accounts simultaneously and
immediately by clicking to check or clear options. Clicking an Account user
name opens the Account Manager for the selected account.
For more information, see "Managing Accounts" on page 298.

Customize
The Customize category provides commands to customize the navigation and
appearance of your SolarWinds Web Console.
Refer to the following sections for more information:
l
l
l
l

Customize Menu Bars

Color Scheme
External Websites
Customized SAM Tabbed Sub-Views

Customize Menu Bars

Click Customize Menu Bars on the Settings page to configure the menu bars
seen by individual users.

Color Scheme
Click Color Scheme on the Settings page to select a default color scheme for
resource title bars.
For more information, see "Changing the Web Console Color Scheme" on page
219

External Websites
Click External Websites on the Settings page to designate any external website
as a SolarWinds Web Console view, appearing in the Views toolbar.
For more information, see "Creating and Editing External Website Views" on
page 224.

179

Customized SAM Tabbed Sub-Views

Customized SAM Tabbed Sub-Views

Sam allows you to add vertical tabs on any page in the web console, allowing
you to customize the data you view.
To enable SAM Sub-Views:
1. From the web console, click Customize Page in the upper-right hand
corner of the screen.
2. Check Enable Left Navigation.
3. The following screen appears:

4. To add a tab, click Add tab.

At this point, you can customize each sub-view tab with its own resources just as
you would for any other view.
For more information see, "Editing Views" on page 1.

Manage Alerts
The Manage Alerts category gives you access to the commands that allow you to
edit, disable, enable, or delete currently configured advanced alerts.
Refer to the following section for more information:
l

Manage Advanced Alerts

180

Chapter 4: Managing the Web Console

Manage Advanced Alerts

Click Manage Advanced Alerts on the Settings page to view, edit, enable,
disable, and delete advanced alerts.
Editing Alerts
To edit an alert:
1. Select the check box for the alert you want to edit.
2. Click Edit.
3. Modify the settings for the alert and then click OK.
Enabling Alerts
To enable an alert:
1. Select the check box(es) for the alert(s) you want to enable.
2. Click Enable.
Disabling Alerts
To disable an alert:
1. Select the check box(es) for the alert(s) you want to disable.
2. Click Disable.
Deleting Alerts
To delete an alert:
1. Select the check box(es) for the alert(s) you want to delete.
2. Click Delete.
3. Click Yes to confirm the alert deletion.
Creating New Alerts and Configuring Advanced Alerting Options
To create new alerts or configure advanced alerting options:
1. Click Start > All Programs > SolarWinds Orion > Alerting, Reporting
and Mapping > Advanced Alert Manager.
For information about creating and configuring alerts using the Advanced Alert
Manager, see Creating Alerts on page722.

181

Product Updates

Product Updates
The Product Updates category provides commands to get up-to-date information
about using and upgrading SolarWinds SAM.
Refer to the following sections for more information:
l
l

Available Product Updates

SolarWinds Product Team Blog

Available Product Updates

Click Available Product Updates on the Settings page to configure regular
checks for SolarWinds SAM updates that can include version upgrades and
service packs.

SolarWinds Product Team Blog

Click SolarWinds Product Team Blog on the Settings page to view regular
posts from members of the SolarWinds product team to help you take full
advantage of features provided by SolarWinds SAM and its modules.

Views
The Views category gives you access to the commands that allow you to manage
individual web console views as well as views for device and application types.
Refer to the following section for more information:
l
l
l
l
l

Manage Views
Add New View
Views by Device Type
Views by Application Type
Customizing Views

Manage Views
Click Manage Views on the Settings page to add, edit, copy, or remove individual
web console views.
For more information see Customizing Views" on page 204.

Add New View

Click Add New View on the Settings page to add a custom view with the
information you want to view.

182

Chapter 4: Managing the Web Console

For more information see Customizing Views" on page 204.

Views by Device Type

Click Views by Device Type on the Settings page to designate default views for
network nodes.
For more information, see "Views by Device Type" on page 209.

Views by Application Type

Click Views by Application Type on the Settings page to specify a custom or a
default application details view for each application type.
For information, see Views by Application Type on page262.

Settings
The Settings category gives you access to the commands that allow you to
manage configuration settings for the Web Console, polling, SAM, and
thresholds.
Refer to the following sections for more information:
l
l
l
l

Web Console Settings

Polling Settings
SolarWinds Thresholds
SolarWinds Thresholds

Web Console Settings

Click Web Console Settings on the Settings page to customize the function and
appearance of both the SolarWinds Web Console and the charts that are
displayed as resources in SolarWinds Web Console views.
For more information, see "Customizing Charts in the SolarWinds Web Console"
on page 220.

Polling Settings
Click Polling Settings on the Settings page to define the configuration of polling
intervals, timeouts, statistics calculations, and database retention settings for your
SolarWinds SAM polling engine.
For more information, see "SolarWinds Polling Settings" on page 312.

183

SAM Settings

SAM Settings
Click SAM Settings on the Settings page to configure SolarWinds SAM and its
templates and component monitors.
For more information refer to SolarWinds SAM Settings on page258.

SolarWinds Thresholds
Click SolarWinds Thresholds on the Settings page to configure SolarWinds
SAM threshold settings.
For more information, see "SolarWinds General Thresholds" on page 202.

Virtualization Thresholds
Click Virtualization Thresholds on the Settings page to configure SolarWinds
SAM virtual threshold settings for VMware and Hyper-V objects.
For more information, see "SolarWinds General Thresholds" on page 202.

Details
The Details category gives you access to the commands that allow you to view
configuration details for the database, polling engines, licenses, and modules.
Refer to the following sections for more information:
l
l
l
l

Database Details
Polling Engines
Orion Core Details
License Details

Database Details
Click Database Details on the Settings page to display details about the SQL
Server database currently used. For more information, see "Data and Database
Settings" on page 262.

Polling Engines
Click Polling Engines on the Settings page to show the status and selected
configuration information for each currently operational polling engine. For more
information, see "Managing SolarWinds SAM Polling Engines" on page 311.

184

Chapter 4: Managing the Web Console

Orion Core Details

Click Orion Core Details on the Settings page to display an information-only
page that displays details about your installation of the common components and
resources that all SolarWinds products share, including information about your
SolarWinds server, monitored object counts, and the version numbers of the
executables and DLLs required by any and all installed SolarWinds products.

License Details
Click License Details on the Settings page to display details about both your
SolarWinds SAM license and your monitored network.
This page also shows the version of the applications that you are running and the
versions of associated DLLs.

Navigating the SolarWinds Web Console

The SolarWinds Web Console offers two primary methods of navigation: top-level
web console tabs and view-level breadcrumbs. The following sections describe
how these navigation methods are used:
Using Web Console Tabs
Using and Disabling Web Console Breadcrumbs

l
l

Using Web Console Tabs

In the case of a basic SolarWinds SAM installation, the SolarWinds Web Console
displays the following tabs:
Home
The Home tab provides a menu bar of links to views aiding you in general
network management and monitoring. Information, like events and Top 10
lists, and technologies, like alerts, used to generate the views linked from
the Home menu are generally available to all SolarWinds modules. By
default, the SolarWinds Summary Home view displays when you click
Home from any view in the web console.
Applications
If you are viewing the SolarWinds Web Console on a server on which
SolarWinds SAM is installed, the Applications tab opens a menu of default
views for some of the many different types of applications SolarWinds SAM

185

Using and Disabling Web Console Breadcrumbs

can monitor. The SAM Summary Home view displays by default when you
click Home from any web console view.
Virtualization
The Virtualization tab provides access to specific views and resources that
are tailored for monitoring virtual devices.

Using and Disabling Web Console Breadcrumbs

As you navigate web console views, your location is recorded as a series of links,
or breadcrumbs, to the views you have opened. Each breadcrumb offers the
following navigation options:
Clicking a breadcrumb opens the corresponding view directly.
Clicking > next to a breadcrumb opens a clickable list of all other views at the
same navigation level in the web console. For example, if you are on a Node
Details view, clicking > displays a list of other monitored nodes.
Note: Only the first 50 monitored nodes, listed in alphanumeric order by IP
address, are displayed.
Customizing Web Console Breadcrumbs
Dropdown breadcrumb lists are customizable, as shown in the following
steps.
To customize the items in a breadcrumb dropdown:
1. Click > at an appropriate level in a breadcrumb to open the dropdown.
2. Click Customize this list.
3. Select a criterion from the menu, and then click Submit.
Note: All items in the customized list will be identical for the selected criterion.
Disabling Web Console Breadcrumbs
To ensure access is appropriately restricted for account-limited users, you may
want to disable breadcrumbs, as indicated in the following procedure.
To disable web console breadcrumb navigation:
1. Log on to your SolarWinds server using an account with administrative
access.
2. Open [Link] (default location C:\Inetpub\SolarWinds\) for editing.
3. In the <appsettings> section, locate the following setting:
<add key=DisableBreadCrumbs value=false/>

186

Chapter 4: Managing the Web Console

4. Change false to true, as follows:
5.

<add key=DisableBreadCrumbs value=true/>

Save [Link].

Note: If you run the Configuration Wizard after editing this setting, your
changes may be overwritten.

Managing Nodes from the Web Console

The SolarWinds Web Console administrator manages the SolarWinds Website
using the commands listed in the various categories on the Settings page. From
the Web Console, the administrator can manage nodes, groups, accounts, alerts,
views, and settings. The administrator can also manage the look and feel of
SolarWinds SAM and view information about available product updates.
To manage the SolarWinds Web Console, navigate to the Settings page:
1. Log on to your SolarWinds Web Console with an Administrator account.
Note: Initially, Admin is the default administrator user ID with a blank password. You can change the password later using the Account Manager. For
more information, refer to Managing Accounts" on page 207.
2. Click Settings at the top right of the SolarWinds Web Console to display
the Settings page.
Note: The Node Management feature is accessible by clicking Manage
Nodes either in the header of any All Nodes resource or in the Node &
Group Management grouping of the Website Administration page. The All
Nodes resource is included on the SolarWinds Summary Home view by
default, but you can include it on any other web console view as well. Confirm that the All Nodes resource is available on an appropriate Web Console view before continuing. For more information about adding resources
to SolarWinds Web Console views, see Editing Views on page205.
Refer to the following sections for more information:
l
l
l
l
l
l
l
l
l

Unmanaging Nodes
Adding Nodes for Monitoring
Deleting Nodes from Monitoring
Viewing Node Data in Tooltips
Editing Node Properties
Promoting a Node from ICMP to SNMP Monitoring
Viewing Node Resources
Setting Node Management States
Unscheduled Node Polling and Rediscovery

187

Unmanaging Nodes
l
l

Monitoring Windows Server Memory

Scheduling a Node Maintenance Mode Time Period

Unmanaging Nodes
If you need to deactivate nodes for a period of time, you can do so by unmanaging
them. Changes you make to the managed or unmanaged status of a node takes
affect after the next polling cycle.
To unmanage a node:
1.
2.
3.
4.
5.
6.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Home tab.
Click Settings.
Click Manage Nodes.
Check the nodes you want to unmanage.
Click Unmanage and follow the prompts as needed.

Adding Nodes for Monitoring

The following procedure details the steps required to add a device for monitoring
in the SolarWinds Web Console.
To add a device for monitoring in the SolarWinds Web Console:
1. Log in to the SolarWinds Web Console as an administrator.
2. Click Settings in the top right of the web console.
3. Click Manage Nodes in the Node & Group Management grouping of the
SolarWinds Website Administration page.
4. Click Add Node on the Node Management toolbar.
5. Provide the hostname or IP Address of the node you want to add in the
Hostname or IP Address field.
6. If the IP address of the node you are adding is dynamically assigned,
check Dynamic IP Address.
7. If you only want to use ICMP to monitor node status, response time,
or packet loss for the added node, check ICMP (Ping only).
8. If you want to add an External node to monitor a hosted application
with SolarWinds Server & Application Monitor, select No Status:
External Node.
Note: The External status is reserved for nodes hosting applications that
are to be monitored with SolarWinds Server & Application Monitor.
SolarWinds SAM will not collect or monitor any data about a node itself, if it
is marked as External.

188

Chapter 4: Managing the Web Console

9. If you want to monitor Windows Servers using WMI and ICMP, select Windows Servers: WMI and ICMP.
10. If you are adding a VMware device, check Poll for VMware to ensure
that SolarWinds SAM acquires any data the VMware device provides to
SNMP polling requests, and then complete the following steps to provide
required vCenter or ESX Server credentials. For more information, see Virtualization" on page 319.
a. Select an appropriate vCenter or ESX credential.
Notes:
l If you are creating a new credential, select <New Credential>.
l If you are editing an existing credential, select the credential
you want to edit.
l SolarWinds recommends against using non-alphanumeric characters in VMware credential names.
b. If you are creating a new credential, provide a Credential name.
c. Provide an appropriate User name and a Password, and then provide
the password again in the Confirm password field.
d. Click Test to confirm the VMware credentials you have provided.
11. If you want to use SNMP and ICMP to monitor the added node, complete the following steps:
a. Select the Most Devices and the SNMP Version for the added node.
Notes:
l SolarWinds uses SNMPv2c by default. If the device you are
adding supports or requires the enhanced security features of
SNMPv3, select SNMPv3.
l If SNMPv2c is enabled on a device you want SolarWinds SAM to
monitor, by default, SolarWinds SAM will attempt to use
SNMPv2c to poll for performance information. If you only want
SolarWinds SAM to poll using SNMPv1, you must disable
SNMPv2c on the device to be polled.
b. If you have installed multiple polling engines, select the Polling
Engine you want to use to collect statistics from the added node.
Note: This option may not be available if you are only using one polling
engine to collect information from your network.
c. If the SNMP port on the added node is not the SolarWinds default
of 161, provide the actual port number in the SNMP Port field.
d. If the added node supports 64bit counters and you want to use
them, check Allow 64bit counters.
Note: SolarWinds fully supports the use of 64-bit counters; however,
these high capacity counters can exhibit erratic behavior depending on

189

To add a device for monitoring in the SolarWinds Web Console:

12.

13.

14.
15.
16.

17.
18.

19.
20.

21.

manufacturer implementation. If you notice peculiar results when using

these counters, use the Node Details view to disable the use of 64-bit
counters for the device and contact the hardware manufacturer.
If you want SolarWinds to use SNMPv2c to monitor the added node,
provide valid community strings for the added node.
Note: The Read/Write Community String is optional, but SolarWinds does
require the public Community String at a minimum, for node monitoring. If
you want to use read/write SNMPv3 credentials, complete the following
steps in the Read / Write SNMPv3 Credentials area.
If you want SolarWinds to use SNMPv3 to monitor the added node,
provide the following SNMP Credentials, Authentication, and Privacy/Encryption settings:
SNMPv3 Username, Context, Authentication Method, and Password.
Note: If this password is a key, check Password is a key.
SNMPv3 Privacy/Encryption Method and Password.
Note: If this password is a key, check Password is a key.
If you want to save the provided credentials as a Credential Set in the
Credential Set Library, provide a Name, and then click Save.
If you want to delete a currently saved credential set, select the set to
delete, and then click Save.
If you are using SNMP to communicate with your added node, click
Validate SNMP after entering all credentials to confirm your SNMP settings.
Click Next.
Check the objects for the added node that you want SolarWinds to monitor
or manage. The following options are available in the Selection toolbar:
l Clicking All selects all listed devices for monitoring.
l Clicking None clears any checked devices.
l Clicking All Volumes selects all listed volumes for monitoring.
After you have selected objects for monitoring, click Next.
If you want to edit the SNMP settings you provided earlier, change the
appropriate values in the SNMP area of the Change Properties page, and
then click Validate SNMP to confirm your new settings.
If you want to edit the default polling settings for your added node,
change the Node Status Polling or Collect Statistics Every values in the
Polling area of the Change Properties page, as appropriate.
Note: The Node Status Polling value refers to the number of seconds,
between the node status checks that SolarWinds performs on the added
node. The Collect Statistics Every value refers to the period of time

190

Chapter 4: Managing the Web Console

between updates SolarWinds makes to display statistics for the added
node.
22. If you have defined any custom properties for a monitored node,
provide appropriate values for the added node in the Custom Properties
area of the Change Properties page.
Note: The Custom Properties area is empty if you have not defined any
custom properties for monitored network objects.
23. Click OK, Add Node when you have completed properties configuration.
24. If you have successfully added the node, click OK on the dialog.

Deleting Nodes from Monitoring

The following procedure allows you to delete nodes from monitoring.
Warning: Deleting nodes from monitoring in the web console automatically stops
monitoring of all applications and volumes on the deleted nodes.
To delete a node from monitoring in the SolarWinds Web Console:
1. Log in to the SolarWinds Web Console as an administrator.
2. Click Settings in the top right of the web console.
3. Click Manage Nodes in the Node & Group Management area of the
SolarWinds Website Administration page.
4. Locate the node to delete using either of the following methods:
l Use the search tool above the node list to search your SolarWinds
database for the node you want to delete.
l Select an appropriate Group by: criterion, and then click the appropriate group including the node to delete.
5. Check the node to delete in the list, and then click Delete on the toolbar.

Deleting Applications or Volumes from Monitoring

You can select multiple applications on different nodes for simultaneous deletion.
The search tool above the node list can aid you in finding the proper device to
delete.
1. If you want to delete a monitored application or volume, use the following steps:
a. Locate the application to delete using either of the following methods:
l Use the search above the node list to search your SolarWinds
database either for the object to delete or for its parent object to
delete.
l Select a Group by: criteria, and then click the appropriate group
including the parent node of the object to delete.

191

Viewing Node Data in Tooltips

b. If you have a list of node results, click [+] to expand the parent node
of the object you want to delete.
c. Check the object to delete, and then click Delete on the toolbar.
2. Click OK to confirm deletion.

Viewing Node Data in Tooltips

Node tooltips in SolarWinds SAM provide immediate status overviews of
monitored nodes. To get a quick overview of any monitored node in the web
console, hover over the device name. The information in the following tables
displays immediately.
Node Data
Node Status

Current status of the node. (up, down, warning, unmanaged, or

unreachable)

IP Address

The IP address currently assigned to the selected node

Machine Type The vendor icon and vendor description of the selected node
Average
Response
Time

The measured average response time of the selected node as

of the last node poll

Packet Loss

The percent of all transmitted packets that are lost by the

selected node as of the last node poll

CPU Load

The percent of available processing capacity on the selected

node that is currently used as of the last node poll

Memory Used The percent of available memory on the selected node that is
currently used as of the last node poll

Editing Node Properties

The following procedure provides the steps required to edit monitored object
properties using the Node Management utility of the SolarWinds Web Console.
To edit object properties in the SolarWinds Web Console:
1. Log in to the SolarWinds Web Console as an administrator.
2. Click Settings at the top right of the web console, and then click Manage
Nodes in the Node & Group Management grouping.

192

Chapter 4: Managing the Web Console

3. Locate the object to edit using either of the following methods:
l Use the search tool above the node list to search your SolarWinds
database for either the object you want to edit or the parent node of
the volume you want to edit.
l Select an appropriate Group by criteria, and then click the appropriate group including either the node to edit or the parent of the
object to edit.
4. If you want to edit the properties of a monitored node, check the node
you want to edit, and then click Edit Properties.
5. If you want to edit the properties of a monitored object, click [+] next to
the parent node of the object you want to edit, check the object you want to
edit, and then click Edit Properties.
6. If you are editing the SNMP properties of a node, click Test after providing new settings to confirm they are valid for the edited node.
7. If the selected node is a VMware ESX Server and you want to poll it for
data using the VMware API, confirm that Poll for VMware is checked.
8. If you want to poll for ESX data using an existing ESX credential,
select the appropriate credential from the VMware credentials dropdown
menu.
9. If you want to poll for ESX data using a new ESX credential, complete
the following steps:
a. Select <New Credential> in the Choose Credential dropdown menu,
and then provide a new credential name in the Credential Name field.
Note: SolarWinds recommends against using non-alphanumeric characters in VMware credential names.
b. Add the credential User name and Password, as necessary.
c. Confirm the password and then click Validate VMware to confirm the
credentials you have provided are valid for the edited node.
10. Edit additional device properties as needed, and then click Submit.

Promoting a Node from ICMP to SNMP Monitoring

After adding a node to the SolarWinds database as an ICMP only node, you may
need to promote the node to SNMP to start collecting additional statistics. The
Node Management utility of the SolarWinds Web Console can easily promote
your node to SNMP without any loss of historical data.
Note: Once you promote a node from SNMP to WMI, you cannot go back to
polling via ICMP.

193

To promote an ICMP only node to SNMP:

To promote an ICMP only node to SNMP:
1. Log in to the SolarWinds Web Console as an administrator.
2. Click Settings in the top right of the web console and then click Manage
Nodes in the Node & Group Management grouping of the SolarWinds
Website Administration page.
3. Locate the device to promote using either of the following methods:
l Use the search tool above the node list to search your SolarWinds
database for the node you want to promote.
l Select an appropriate Group by criteria, and then click the appropriate group including the node to promote.
4. Click Edit Properties, and then select Most Devices: SNMP and ICMP.
5. In the SNMP area, select the SNMP Version for the promoted node.
Note: SolarWinds uses SNMPv2c by default. If the promoted device supports or requires the enhanced security features of SNMPv3, select
SNMPv3.
6. If you have installed multiple polling engines, select the Polling Engine
you want to use to collect statistics from the added node.
Note: This option may not be available if you are only using one polling
engine to collect information from your network.
7. If the SNMP port on the added node is not the SolarWinds default of
161, provide the actual port number in the SNMP Port field.
8. If the added node supports 64 bit counters and you want to use them,
check Allow 64 bit counters.
Note: SolarWinds fully supports the use of 64-bit counters; however, these
high capacity counters can exhibit erratic behavior depending how they
are used. If you notice peculiar results when using these counters, use the
Edit Properties view to disable the use of 64-bit counters on the device in
question, and then contact the hardware manufacturer.
9. If you want to use SNMPv2c to monitor the promoted node, provide
valid community strings for the added node.
Note: The Read/Write Community String is optional, but SolarWinds
does require the public Community String, at minimum, for node monitoring.
10. If you want to use SNMPv3 to monitor the promoted node, provide the
following SNMPv3 credential settings:
l SNMPv3 User name and Context
l SNMPv3 Authentication Method and Password/Key

194

Chapter 4: Managing the Web Console

SNMPv3 Privacy/Encryption Method and Password/Key
Note: Read/Write SNMPv3 Credentials are optional, but the public
Community String is required, at a minimum, for node monitoring.
If you want to edit an existing SNMPv3 credential set, select the name
of your set from the Saved Credential Sets list, and then edit the stored
settings.
If you want save the provided SNMPv3 credentials as a credential set,
provide a Name for your new credential set, and then click Save.
Click Validate SNMP after entering all required credentials to confirm your
SNMP settings.
If you want to change the default polling settings for your promoted
node, edit the Node Status Polling or Collect Statistics Every values in
the Polling area, as appropriate.
Note: The Node Status Polling value refers to the period of time, in
seconds, between the node status checks SolarWinds performs on the promoted node. The Collect Statistics Every value refers to the period of
time between updates SolarWinds makes to displayed statistics for the promoted node.
If you have defined any custom properties for monitored nodes,
provide appropriate values for the promoted node in the Custom Properties.
Click Submit when you have completed properties configuration for your
promoted node.
If you have successfully added the node, click OK on the dialog.
l

11.

12.
13.
14.

15.

16.
17.

Promoting a Node to WMI Monitoring

After adding a node to the SolarWinds database as an ICMP or SNMP node, you
may need to promote the node to WMI to start collecting additional statistics. The
Node Management utility of the SolarWinds Web Console can easily promote
your node to WMI without any loss of historical data.
Note: Once you promote a node to WMI, you cannot go back to polling via ICMP.
Also, this option is only available in SAM 5.0 and above.
To promote a node to WMI:
1. Log in to the SolarWinds Web Console as an administrator.
2. Click Settings in the top right of the web console and then click Manage
Nodes in the Node & Group Management grouping of the SolarWinds
Website Administration page.

195

Viewing Node Resources

3. Locate the device to promote using either of the following methods:
l Use the search tool above the node list to search your SolarWinds
database for the node you want to promote.
l Select an appropriate Group by criteria, and then click the appropriate group including the node to promote.
4. Click Edit Properties, and then select, Windows Servers: WMI and ICMP.
5. Select existing WMI credentials, or create new credentials.
6. Optionally, you can click the Test button for verification.
7. If you want to change the default polling settings for your promoted
node, edit the Node Status Polling or Collect Statistics Every values in
the Polling area, as appropriate.
Note: The Node Status Polling value refers to the period of time, in
seconds, between the node status checks SolarWinds performs on the promoted node. The Collect Statistics Every value refers to the period of
time between updates SolarWinds makes to displayed statistics for the promoted node.
8. If you have defined any custom properties for monitored nodes,
provide appropriate values for the promoted node in the Custom Properties.
9. Click Submit when you have completed properties configuration for your
promoted node.
10. If you have successfully added the node, click OK on the dialog.

Viewing Node Resources

The List Resources feature of the SolarWinds Web Console Node Management
utility allows you to immediately see all monitored volumes and charts on a
selected node, as shown in the following procedure.
To view a list of all resources present on a node:
1. Log in to the SolarWinds Web Console as an administrator.
2. Click Settings in the top right of the web console.
3. Click Manage Nodes in the Node & Group Management grouping of the
SolarWinds Website Administration page.
4. Locate the node to view using either of the following methods:
l Use the search tool above the node list to search your SolarWinds
database for the node you want to view.
l Select an appropriate Group by criteria, and then click the appropriate group including the node to view.
5. Check the node you want to view from the list, and then click List
Resources on the Node Management toolbar.

196

Chapter 4: Managing the Web Console

Setting Node Management States

Monitored devices are regularly polled for operational status. Collected statistics
are displayed in the SolarWinds Web Console. Using the Node Management
feature of the SolarWinds Web Console, the management status of monitored
nodes, is easily set or changed, allowing you to either temporarily suspend data
collection or resume polling and statistics collection, as necessary. The following
procedure sets or changes management states for monitored nodes in the
SolarWinds Web Console.
Note: Setting a node to an unmanaged state automatically suspends the
management on the selected node.
To set or change the management state of a node:
1. Log in to the SolarWinds Web Console as an administrator.
2. Click Settings in the top right of the web console.
3. Click Manage Nodes in the Node & Group Management grouping of the
SolarWinds Website Administration page.
4. Locate the node to manage using either of the following methods:
l Use the search tool above the node list to search your SolarWinds
database for the device you want to manage.
l Select an appropriate Group by criteria, and then click the appropriate group including the node to manage.
5. Check the node to change, and then click Unmanage or Remanage, as
appropriate, for the selected node.
6. If you have selected Unmanage, provide start and end times and dates
for your management suspension, and then click OK.

Unscheduled Node Polling and Rediscovery

SolarWinds SAM polls devices for statistics and status regularly, according to the
polling settings available for configuration on the Polling Settings view in the
SolarWinds Web Console. For more information, see SolarWinds Polling
Settings on page312. Sometimes, however, it may be necessary to conduct an
unscheduled poll or rediscovery of a monitored device. The Node Management
utility gives you this ability, as shown in the following procedure.
To perform an unscheduled poll or rediscovery:
1. Log in to the SolarWinds Web Console as an administrator.
2. Click Settings in the top right of the web console.

197

Unmanage Scheduling Utility

3. Click Manage Nodes in the Node & Group Management grouping of the
SolarWinds Website Administration page.
4. Locate and check the node you want to poll or locate and check the node
to rediscover, using either of the following methods:
l Use the search tool above the node list to search your SolarWinds
database.
l Select an appropriate Group by criteria, and then click the appropriate group including the node you want to poll or the node you want
to rediscover.
5. If you want to poll the selected node, click More Actions> Poll Now.
6. If you want to rediscover the selected node, click More Actions>
Rediscover.
Note: When you click Poll Now, this reschedules a job to run "now" in the
job scheduler, meaning, if the job scheduler is already full, the job may not
executeimmediately, but it will execute sooner than the next scheduled
poll cycle.
Depending upon how many components are in a given template, and the type of
component monitors that make up a template, it is not unusual for polling to take
several minutes for the process to fully complete. To see this behavior, click Edit
Application Monitor on the Application Details page and then clickTest All.

Unmanage Scheduling Utility

Starting and stopping nodes, applications, and interfaces on a schedule is a task
best suited for the Unmanage Scheduling Utility. This can be found at Start >
SolarWinds Orion > Advanced Features > Unmanage Scheduling Utility.

To schedule tasks to be stopped:

1. Select either New Task or open an existing task by clicking Edit Task.
2. Click Add Items.
3. Click on the Web tab.

198

Chapter 4: Managing the Web Console

4. Select the items you want to schedule to be stopped by checking the check
box next to the item name.
5. Click Add.
6. Select the length of time you would like the selected item to be stopped.
7. Click OK.
8. Optionally, you can click Save Task to save your selections for future use.
To view the details of a selected item's schedule, simply check its box and its
details will appear in the Task Item Properties pane on the right.

From this view, you can change the settings of the item's schedule by selecting
an item and clicking Set Duration. Additionally, you can delete an item from the
unmanage schedule by selecting it and clicking Delete Checked Items.
Note: It is possible to create a conflict of schedules if you choose the same item
to be stopped using both the web console and the Unmanage Scheduling Utility
with different durations.

Monitoring Windows Server Memory

When SolarWinds SAM polls a Windows server for CPU load and memory
utilization, it pulls the amount of physical memory to define the 100% level, and
then it totals the amount of memory in use by each allocation to compute what
percentage of the physical memory is in use. This can result in memory utilization

199

Scheduling a Node Maintenance Mode Time Period

readings over 100%, as many applications pre-allocate memory and swap before
it is actually needed. To work around this, you can also add physical memory as a
volume for these servers within SolarWinds. When monitored as a volume, the
values will be more in line with your expectations.

Scheduling a Node Maintenance Mode Time Period

When you need to perform maintenance on a node or its components, such as
upgrading firmware, installing new software, or updating security, you may want
to discontinue polling while the device is down for maintenance. Disabling
polling, or setting a node status as Unmanaged, while performing node
maintenance, maintains the accuracy of your data and prevents unnecessary alert
messages. For more information about disabling node polling to perform node
maintenance, see Setting Node Management States on page197.

Administrative Functions of the SolarWinds Web

Console
The following sections describe the primary administrative functions performed by
a SolarWinds Web Console administrator.
l
l
l

Changing an Account Password

Viewing Secure Data on the Web
Handling Counter Rollovers

Changing an Account Password

SolarWinds Web Console administrators may change user account passwords at
any time, as shown in the following procedure.
Note: In environments where security is a priority, SolarWinds recommends
against providing a view where users may change their own web console
account passwords.
To change an account password:
1. Log in to the web console as an administrator.
2. Click Settings in the top right corner of the web console.
3. Click Manage Accounts in the Accounts grouping of the SolarWinds Website Administration page.
4. Select the user account with the password you want to change, and then
click Change Password.

200

Chapter 4: Managing the Web Console

5. Complete the New Password and Confirm Password fields, and then click
Change Password.
6. Click Continue when the password is successfully changed.

Viewing Secure Data on the Web

In the interest of security, sensitive network information, such as community
strings, logins, and passwords, is not viewable in the web console. However, if
you have secured your network, you may check Allow Secure Data On Web
(advanced) in the Calculations & Thresholds area of the SolarWinds Polling
Settings page to allow the passage of community strings through the web
console.
Note: This setting does not affect the display of custom reports that you export to
the web. For more information see Creating and Viewing Reports on page772.

Handling Counter Rollovers

The Counter Rollover setting configures SolarWinds SAM to properly handle
counter rollovers. SolarWinds SAM is capable of handling either 32-bit or 64-bit
counters, but, by default, SolarWinds SAM assumes counters are 32-bit. 32-bit
counters have a maximum value of 232, or 4,294,967,296, and 64-bit counters, if
they are supported by your network devices, have a maximum value of 264, or
18,446,744,073,709,551,616.
Note: The 32-bit counters option is designated as Method 1 in the Counter
Rollover field on the SolarWinds Polling Settings page.
The following procedure designates the type of counter used by SolarWinds
SAM.
To designate the type of counter used by SolarWinds SAM:
1. Log in to the web console as an administrator.
2. Click Settings in the top right of the web console, and then click Polling
Settings in the Settings grouping of the SolarWinds Website Administration page.
3. If you are using 64bit counters, select Method 2 in the Counter Rollover
field in the Calculations & Thresholds area.
Notes:
l If Method 2 is selected, SolarWinds SAM will intentionally skip a poll
if a polled value is less than the previous polled value to permit counting to 264.

201

SolarWinds General Thresholds

SolarWinds fully supports the use of 64-bit counters; however, these
64-bit counters can exhibit erratic behavior in some implementations. If you notice peculiar results when using these counters,
disable the use of 64-bit counters for the problem device and contact
the device manufacturer.
4. If you are using of 32bit counters, select Method 1 in the Counter
Rollover field in the Calculations & Thresholds area.
Note: If Method 1 is selected, when a rollover is detected, the time between
polls is calculated as (232 Last Polled Value) + Current Polled Value.
l

SolarWinds General Thresholds

Many of the resources available in the SolarWinds Web Console are capable of
displaying error and warning conditions for the devices on your network. Errors
and warnings display in the SolarWinds Web Console. SolarWinds SAM uses the
values provided on the thresholds pages to determine when and how to display
errors and warnings in the SolarWinds Web Console. The following sections
provide more information about threshold types and configuration:
l
l

SolarWinds General Threshold Types

Setting SolarWinds General Thresholds

SolarWinds General Threshold Types

The following device conditions may be configured as SolarWinds General
Thresholds:
CPU Load
Monitored network devices experiencing CPU loads higher than the value
set for the High Level display in High CPU Load reports and resources.
Gauges for these devices also display as bold red. Monitored network
devices experiencing a CPU load higher than the value set for the Warning
Level, but lower than the value set for the High Level, display as red in
High CPU Load reports and resources. Gauges for these devices also
display as red.
Disk Usage
Monitored network devices experiencing a disk usage higher than the value
set for the High Level display as bold red in Disk Usage reports and
resources. Monitored network devices experiencing a disk usage higher

202

Chapter 4: Managing the Web Console

than the value set for the Warning Level, but lower than the value set for the
High Level, display as red in High Disk Usage reports and resources.
Percent Memory Used
Monitored network devices experiencing a percent memory usage higher
than the value set for the Error Level display in High Percent Utilization
reports and resources. Gauges for these devices also display as bold red.
Monitored network devices experiencing a percent memory usage higher
than the value set for the Warning Level, but lower than the value set for the
Error Level, display in High Percent Utilization reports and resources.
Gauges for these devices also display as red.
Percent Packet Loss
Monitored network devices experiencing a percent packet loss higher than
the value set for the Error Level display in High Percent Loss reports and
resources. Gauges for these devices also display as bold red. Monitored
network devices experiencing a percent packet loss higher than the value
set for the Warning Level, but lower than the value set for the Error Level,
display in High Percent Loss reports and resources. Gauges for these
devices also display as red.
SolarWinds SAM calculates percent packet loss using ICMP ping requests
made on the Default Poll Interval. SolarWinds pings monitored devices and
records the results of the ten most recent ping attempts. Percent packet loss
is expressed as the number of failed ping requests, X, divided by the
number of ping requests, 10. For more information about the Default Poll
Interval, see SolarWinds Polling Settings on page312.
For example, if, at a given point in time, the last ten ping requests made of a
selected device resulted in 2 failures and 8 successes, the percent packet
loss for the selected device at the given time is reported as 2/10, or 20%.
Response Time
Monitored devices experiencing response times longer than the value set
for the Error Level display in High Response Time reports and resources.
Gauges for these devices also display as bold red. Devices experiencing
response times longer than the value set for the Warning Level, but shorter
than the value set for the Error Level, also display in High Response Time
reports and resources. Gauges for these devices also display as red.
SolarWinds SAM calculates response time using ICMP ping requests made
on the Default Node Poll Interval. SolarWinds pings monitored devices and

203

Setting SolarWinds General Thresholds

records the results of the ten most recent ping attempts. Average Response
Time is expressed as the average response time of these last 10 ping
requests. If SolarWinds SAM does not receive a ping response within the
Default Poll Interval, SolarWinds SAM will attempt to ping the
nonresponsive device once every 10 seconds for the period designated as
the Warning Interval. For more information, see SolarWinds Polling
Settings on page312.

Setting SolarWinds General Thresholds

The following procedure configures SolarWinds General Thresholds.
To set SolarWinds SAM thresholds:
1. Log in to the SolarWinds Web Console as an administrator.
2. Click Settings in the top right of the web console.
3. Click SolarWinds Thresholds in the Settings group of the SolarWinds
Website Administration page.
Note: For more information about SolarWinds General Thresholds, see
SolarWinds General Threshold Types on page202.
4. Provide appropriate values for Error Level, High Level, or Warning Level
for selected thresholds.

Customizing Views
SolarWinds Web Console views are configurable presentations of network
information that can include maps, charts, summary lists, reports, events, and
links to other resources. Customized views can then be assigned to menu bars.
Note: In environments where security is a priority, SolarWinds recommends
against providing a view where users may change their own web console
account passwords.
Refer to the following sections for more information:
l
l
l
l
l
l
l
l
l

Creating New Views

Editing Views
Configuring View Limitations
Copying Views
Deleting Views
Views by Device Type
Resource Configuration Examples
Customizing Web Console Menu Bars
Changing the Web Console Color Scheme

204

Chapter 4: Managing the Web Console

l
l
l
l
l
l
l

Changing the Web Console Site Logo

Configuring the Available Product Updates View
Updating your SolarWinds Installation
Customizing Charts in the SolarWinds Web Console
Custom Node Charts
Custom Volume Charts
Custom Chart View

Creating New Views

You can customize the SolarWinds Web Console for individual users by logging
in as an administrator and creating new views as shown in the following
procedure.
Note: In environments where security is a priority, SolarWinds recommends
against providing a view where users may change their own web console
account passwords.
To create a new view:
1. Click Settings in the top right of the web console.
2. Click Manage Views in the Views group of the SolarWinds Website Administration page.
3. Click Add.
4. Enter the Name of New View.
5. Select the Type of View.
Note: The Type of View selection affects how the view is made accessible to users, and your choice may not be changed later. For more information, see Views by Device Type on page183.
6. Click Submit.
After you have created a new view, the Customize Your View page opens. For
more information, see Editing Views on page205.

Editing Views
The SolarWinds Web Console allows administrators to configure views for
individual users. The following steps are required to configure an existing view.
To edit an existing view:
1. Click Settings in the top right of the web console.
2. Click Manage Views in the Views group of the SolarWinds Website Administration page.

205

To edit an existing view:

3. Select the view you want to customize from the list, and then click Edit.
4. If you want to change the column layout of your view, complete the following steps.
a. Click Edit to the right of the column widths.
b. Select the number of columns under Layout.
c. Provide the width, in pixels, of each column in the appropriate fields,
and then click Submit.
5. If you want to add a resource, repeat the following steps for each
resource:
a. Click [+] next to the column in which you want to add a resource.
b. Click [+] next to a resource group on the Add Resources page to
expand the resource group, displaying available resources.
c. Check all resources you want to add.
d. If you have completed the addition of resources to the selected
view, click Submit.
Notes:
l Resources already in your view will not be checked on this page
listing all web console resources. It is, therefore, possible to pick
duplicates of resources you are already viewing.
l Some resources may require additional configuration. For more
information, see Resource Configuration Examples on
page209.
l Several options on the Add Resources page are added to the list
of resources for a page, but the actual configuration of a given
map, link, or code is not added until the page is previewed.
6. If you want to delete a resource from a column, select the resource, and
then click X next to the resource column to delete the selected resource.
7. If you want to copy a resource in a column, select the resource, and
then click next to the resource column to delete the selected resource.
8. If you want to rearrange the order in which resources appear in your
view, select resources, and then use the arrow keys to rearrange them.
9. If you have finished configuring your view, click Preview.
Note: A preview of your custom web console displays in a new window. A
message may display in the place of some resources if information for the
resource has not been polled yet. For more information, see Resource
Configuration Examples on page209.
10. Close the preview window.
11. When done, click Done.
Notes:

206

Chapter 4: Managing the Web Console

For more information about adding a customized view to menu bars

as a custom item, see Customizing Web Console Menu Bars on
page217.
For more information about assigning your customized view as the
default view for a user, see Editing User Accounts on page299.

Configuring View Limitations

As a security feature, the web console gives administrators the ability to apply
device-based view limitations. The following views and limitations are available:
Managed Views that
Support Limitations

Available Limitations

SAM Application Details

Single Network Node

System Contact Pattern

SAM Component Details

Group of Nodes

Single Machine Type

SAM Summary

Node Name Pattern

Single Hardware
Manufacturer

Cluster Details

System Name Pattern IP Address Pattern

Current Top 10 Lists

Group of Machine
Types

Group of Volumes

Custom Summary

Machine Type
Pattern

Single Group

Datacenter Details

Hardware
Manufacturer

Group of Groups

ESX Host Details

Device Status

Group Name Pattern

Group Details

System Location

Application Name Pattern

Group Summary

System Location
Pattern

Group of Application
Names

Node Details

System Contact

Specific Applications

SolarWinds Summary
Home

207

To enable a view limitation:

Customize Problem
Areas
Virtual Center Details
Virtualization summary
Volume Details

The following procedure configures a view limitation:

To enable a view limitation:
1. Click Settings in the top right of the web console, and then click Manage
Views in the Views group of the SolarWinds Website Administration page.
2. Select the view to which you want to add a limitation, and the click Edit.
3. In the View Limitation area of the Customize View page, click Edit.
4. Select the type of view limitation you want to apply, and then click
Continue.
5. Provide or check appropriate strings or options to define the device types
to include or exclude from the selected view, and then click Submit.
Note: The asterisk (*) is a valid wildcard. Pattern limitations restrict views
to devices for which the corresponding fields include the provided string.

Copying Views
When you want to create multiple views based on the same device type, copying
views allows you to create one view, and then use that view as a template to
create other new views. The following steps copy an existing view.
To copy a view:
1.
2.
3.
4.

Click Settings in the top right of the web console.

Click Manage Views in the Views group.
Select the view you want to copy, and then click Copy.
If you want to edit a copied view, follow the procedure in the Editing
Views section on page205.

Deleting Views
The following steps delete an existing view.

208

Chapter 4: Managing the Web Console

To delete an existing view:
1. Click Settings in the top right of the web console.
2. Click Manage Views in the Views grouping of the SolarWinds Website
Administration page.
3. Select the view you want to delete, and then click Delete.

Views by Device Type

There are vast differences among network objects and the statistics they report,
but the SolarWinds Web Console can make it easier to view network data by
displaying object details by device type, giving you the ability to have a different
view for each unique type of device you have on your network, including routers,
firewalls, and servers. The following steps assign a view by any available device
type.
To assign a view by device type:
1. Click Settings in the top right of the web console, and then click Views by
Device Type in the Views group of the SolarWinds Website Administration
page.
2. Select available Web Views for the different types of devices that
SolarWinds is currently monitoring or managing on your network.
3. Click Submit.

Resource Configuration Examples

Several resources that may be selected from the Add Resources page require
additional configuration. Included in this section are examples of these resources
and the steps that are required for their proper configuration.
Selecting a Network Map
Network maps created with SolarWinds Network Atlas can give a quick overview
of your network, right from the main web console view.
Note: Clicking the resource title in the title bar menu displays the resource by
itself in a browser window.
The following procedure adds a network map to the SolarWinds Web Console.
To add a network map to the web console:
1. Create a new view or edit an existing view.
Note: For more information, see Customizing Views on page204.

209

Displaying a List of Objects on a Network Map

2. Select the view to which you want to add the map, and then click Edit.
3. Click [+] next to the view column in which you want to display the new
map.
4. Click [+] next to Network Maps, check Network Map, and then click Submit.
5. Click Preview on the Customize Your View page.
6. Click Edit in the Network Map resource title bar.
7. If you do not want to use the default title provided, enter a new Title for
the title bar of the added map.
8. If you want a subtitle, enter a new Subtitle for the added map.
Note: Titles and subtitles may be entered as either text or HTML.
9. Select from the list of available maps.
10. Select the Scale at which you want to display the map.
Note: If you leave the Scale field blank, the map will display at full scale,
based on the size of the column in which the map displays.
11. Click Submit.
Displaying a List of Objects on a Network Map
When your web console view includes a network map, it can be helpful to
maintain a list of network objects that appear on the map. The following
procedure enables a resource listing network map objects.
Note: Clicking the resource title displays the resource in a new browser window.
To display a list of network map objects:
1. Create a new view or edit an existing view.
Note: For more information, see Customizing Views on page204.
2. Select the view to display the list of network map objects, and then click
Edit.
3. Click [+] next to the view column in which you want to display the new list
of network map objects.
4. Click [+] next to Network Maps, check List of Objects on Network Map,
and then click Submit.
5. Click Preview on the Customize Your View page.
6. Click Edit in the title bar of the List of Objects on Network Map resource.
7. If you do not want to use the default title provided, enter a new Title for
the header of the objects list.
8. If you want a subtitle, enter a new Subtitle for the added objects list.
Note: Titles and subtitles may be entered as either text or HTML.

210

Chapter 4: Managing the Web Console

9. Select from the list of available maps for the objects that you want to populate your list, and then click Submit.
Displaying a Custom List of Maps
The web console allows you to populate a custom view with a list of available
network maps. Each map in your custom list, when clicked, opens in a new
window. The following procedure enables a custom network maps list resource.
Note: Clicking the resource title displays the resource in its own browser window.
To display a custom list of maps:
1. Create a new view or edit an existing view.
Note: For more information, see Customizing Views on page204.
2. Select the view to which you want to add the custom list of network maps,
and then click Edit.
3. Click [+] next to the view column in which you want to display the custom
list of network maps.
4. Click [+] next to Network Maps.
5. Check Custom List of Maps, and then click Submit.
6. Click Preview on the Customize Your View page, and then click Edit in
the title bar of the Custom List of Maps resource.
7. If you do not want to use the default title provided, enter a new Title for
the header of the maps list.
8. If you want a subtitle, enter a new Subtitle for the custom list of maps.
Note: Titles and subtitles may be entered as either text or HTML.
9. Check the maps you want to include in your maps list.
10. Click Submit.
Displaying an Event Summary - Custom Period of Time
You may want your web console view to display an event summary for a specified
period of time. The following procedure details the steps to include an event
summary in your web console.
Note: Clicking the resource title in the title bar menu displays the resource by
itself in a browser window.
To display an event summary:
1. Create a new view or edit an existing view.
Note: For more information about creating a new view or editing an existing view, see Customizing Views on page204.

211

Specifying User-Defined Links

2.
3.
4.
5.
6.
7.
8.

Select the view to include the event summary, and then click Edit.
Click [+] next to the view column that will display the event summary.
Click [+] next to Events.
Check Event SummaryCustom Time Period, and then click Submit.
Click Preview on the Customize Your View page.
Click Edit in the title bar of the Event Summary resource.
If you do not want to use the default title provided, enter a new Title for
the header of the event summary.
Note: Titles may be entered as either text or HTML.
9. Select the time period for displaying events from Display Events for the
following Time Period.
10. Click Submit.
Specifying User-Defined Links
The User-Defined Links option may be used to create quick access to external
websites or customized views. URLs of your customized views can be copied
from their preview pages and pasted in a User-Defined Links field. The following
steps enable user-defined links from within your web console.
Note: Clicking the resource title in the title bar menu displays the resource by
itself in a browser window.
To enable a user-defined links resource:
1. Create a new view or edit an existing view.
Note: For more information, see Customizing Views on page204.
2. Select the view to which you want to add the user-defined links resource.
3. Click Edit.
4. Click [+] next to the view column to display the user-defined links resource.
5. Click [+] next to Miscellaneous
6. Check User Defined Links.
7. Click Submit.
8. Click Preview on the Customize Your View page.
9. Click Edit in the title bar of the User Defined Links resource.
10. If you do not want to use the default title provided, enter a new Title for
the links list.
11. If you want a subtitle, enter a new Subtitle for the links list.
Note: Titles and subtitles may be entered as either text or HTML.
12. Enter the following information for each link you want to define:

212

Chapter 4: Managing the Web Console

a. A link Name and the URL of your link.
b. If you want your links to open in a new browser window, check
Open in New Window.
13. Click Submit.
Specifying Custom HTML or Text
In situations where you have static information that you want to provide in the web
console, use the Custom HTML or Text option. The Custom HTML or Text
option may also be used to create quick access to your customized views. The
following procedure will create a static content area within your web console for
displaying text or HTML content.
Note: Clicking the resource title displays the resource in a new browser window.
To specify custom HTML or text:
1. Create a new view or edit an existing view.
Note: For more information, see Customizing Views on page204.
2. Select the view to include the custom HTML or text.
3. Click Edit.
4. Click [+] next to the column to display the custom HTML or text.
5. Click [+] next to Miscellaneous, and then check Custom HTML or Text.
6. Click Submit.
7. Click Preview on the Customize Your View page.
8. Click Edit in the title bar of the Custom HTML or Text resource.
9. If you do not want to use the default title provided, enter a new Title for
the specified content area.
10. If you want a subtitle, enter a new Subtitle for the specified content area.
Note: Titles and subtitles may be entered as either text or HTML.
11. Enter content as either text or HTML into the Raw HTML field.
12. Click Submit.
Specifying a SolarWinds Report
The web console is able to incorporate reports that you have created in
SolarWinds Report Writer into any view. The following procedure will take a
report that you have created with Report Writer and include it within a web
console view.
Note: Clicking the resource title in the title bar menu displays the resource by
itself in a browser window.

213

To include a SolarWinds report:

To include a SolarWinds report:
1. Create a new view or edit an existing view.
Note: For more information, see Customizing Views on page204.
2. Select the view to which you want to add the report.
3. Click Edit.
4. Click [+] next to the view column in which you want to display the report.
5. Click [+] next to Report Writer.
6. Check Report from SolarWinds Report Writer.
7. Click Submit.
8. Click Preview on the Customize Your View page.
9. Click Edit in the title bar of the Report from SolarWinds Report Writer
resource.
10. If you do not want to use the default title provided, enter a new Title for
the included report.
11. If you want a subtitle, enter a new Subtitle for the included report.
Note: Titles and subtitles may be entered as either text or HTML.
12. Select a Report to include.
13. If you want to add a filter to the included report, enter an appropriate
query in the Filter Nodes field.
Note: Filter Nodes is an optional, advanced, web console feature that
requires some knowledge of SQL queries. Click [+] next to Show Filter
Examples to view a few example filters.
14. Click Submit.
Displaying a Custom List of Reports
The web console allows you to populate a custom view with a custom reports list.
When clicked from the list, each report opens in a new window. The following
procedure details the steps required to enable a custom list of network reports.
Note: Clicking the resource title displays the resource in a new browser window.
To display a custom list of reports:
1. Create a new view or edit an existing view. For more information, see Customizing Views on page204.
2. Select the view to which you want to add the custom list of reports, and
then click Edit.
3. Click [+] next to the column to display the custom list of reports.
4. Click [+] next to Report Writer.
5. Check Custom List of Reports, and then click Submit.

214

Chapter 4: Managing the Web Console

6. Click Preview on the Customize Your View page, and then click Edit in
the title bar of the Report from SolarWinds Report Writer resource.
7. If you do not want to use the default title provided, enter a new Title for
the header of the reports list.
8. If you want a subtitle, enter a new Subtitle for the custom list of reports.
Note: Titles and subtitles may be entered as either text or HTML.
9. Check the reports that you want to include in your custom list of reports.
Note: To allow a user to view a report included in the custom list, you must
set the report access for the account. For more information, see Configuring an Account Report Folder on page307.
10. Click Submit.
Filtering Nodes
Your SolarWinds Web Console can maintain a customizable node list for your
network. Node lists may be configured for specific views using SQL query filters.
The following steps set up node filtering for node lists included in web console
views.
Note: Clicking the resource title displays the resource in a new browser window.
To enable filtering on a node list:
1. Create a new view or edit an existing view.
Note: For more information, see Customizing Views on page204.
2. Select the view to which you want to add the node list
3. Click Edit.
4. Click [+] next to the view column in which you want to display the node list.
5. Click [+] next to Node Lists.
6. Check All NodesTable, and then click Submit.
7. Click Preview on the Customize YourView page, and then
8. Click Edit in the title bar of the All NodesTable resource.
9. If you do not want to use the default title provided, enter a new Title for
the node list.
10. If you want a subtitle, enter a new Subtitle for the node list.
Note: Titles and subtitles may be entered as either text or HTML.
11. If you want to filter your node list by text or IP address range, provide
the text or IP address range by which you want to filter your node list in the
Filter Text field, as shown in the following examples:
l Type Home in the Filter Text field to list all nodes with Home in the
node name or as a location.

215

Grouping Nodes
Type 192.168.1.* in the Filter Text field to list all nodes in the
[Link]-255 IP address range.
11. Select the property that is appropriate to the filter text provided above, as
shown in the following examples:
l If you typed Home in the Filter Text area, select Node Name or
Location to list nodes with Home in the node name or as a location.
l If you typed 192.168.1.* in the Filter Text area, select IP Address to
list only nodes in the [Link]-255 IP address range.
l If you want to apply a SQL filter to the node list, enter an appropriate query in the Filter Nodes (SQL) field.
Notes:
l

Filter Nodes (SQL) is an optional, advanced, web console

feature that requires some knowledge of SQL queries. Click
[+] next to Show Filter Examples to view a few example
filters.

By default, node list resources are designed to sort nodes

alphabetically by node caption. This configuration cannot be
overwritten using a SQL filter, so order by clauses included in
SQL filters are redundant and will result in Custom SQL filter
formatting errors.
13. Click Submit.
l

Grouping Nodes
Your SolarWinds Web Console can maintain a customizable node list for your
network. Node lists may be configured for specific views with node grouping. The
following steps set up node grouping for node lists included in web console
views.
Note: Clicking the resource title in the title bar menu displays the resource by
itself in a browser window.
To enable grouping on a node list:
1. Create a new view or edit an existing view.
Note: For more information, see Customizing Views on page204.
2. Select the view to which you want to add the node list, and then click Edit.
3. Click [+] next to the view column in which you want to display the node list.
4. Click [+] next to Node Lists.
5. Check an appropriate node list, and then click Submit.

216

Chapter 4: Managing the Web Console

6. Click Preview on the Customize YourView page.
7. Click Edit in the title bar of the All NodesTree (AJAX) resource.
8. If you do not want to use the default title provided, enter a new Title for
the node list.
9. If you want a subtitle, enter a new Subtitle for the node list.
Note: Titles and subtitles may be entered as either text or HTML.
10. Select up to three criteria, in specified levels, for Grouping Nodes within
your web console view.
11. If you want to apply a SQL filter to the node list, enter an appropriate
query in the Filter Nodes field.
Notes:
l Filter Nodes (SQL) is an optional, advanced, web console feature
that requires some knowledge of SQL queries. Click [+] next to
Show Filter Examples to view a few example filters.
l By default, node list resources are designed to sort nodes alphabetically by node caption. This configuration cannot be overwritten
using a SQL filter, so order by clauses included in SQL filters are
redundant and will result in Custom SQL filter formatting errors.
12. Click Submit.

Customizing Web Console Menu Bars

The menu bars displayed at the top of every page may be configured to display
various menu items. You can also define menu items and add them to custom
menu bars. For more information about customizing menu bars for individual
accounts, see Editing User Accounts on page299.
The following procedure customizes a web console menu bar:
To customize web console menu bars:
1. Click Settings in the top right of the web console.
2. Click Customize Menu Bars in the Customize grouping of the SolarWinds
Website Administration page.
3. If you want to modify an existing menu, click Edit beneath the menu bar
you want to modify, and then click and drag items between the Available
items list on the left and the Selected items list on the right until the Selected items list includes all the items you want to include in your edited
menu.
Note: Hover over any view title to read a description. Selected items display from left to right in the edited menu bar as they are listed from top to
bottom.

217

To customize web console menu bars:

4. If you want to create a new menu bar, complete the following steps:
a. Click New Menu Bar, and then provide a Name for the New Menu
Bar.
b. Click and drag the buttons you want to include in your new menu bar
from the Available items list on the left to their correct relative locations
in the Selected items list on the right.
Note: Hover over any view title to read a view description. Selected
items display from left to right in the new menu bar as they are listed
from top to bottom.
5. If you want to add menu items, complete the following steps:
a. Click Edit under the menu bar to which you are adding the new item.
b. Click and drag the items you want to include in your new menu from the
Available items list on the left to their correct relative locations in the
Selected items list on the right.
Notes:
l Hover over any view title to read a view description. Selected
items display from left to right in the new menu bar as they are listed from top to bottom.
l If you check Reports from the Select Menu Items page, you must
also enable reports for the accounts that use the menu bar. For
more information, see Configuring an Account Report Folder on
page307.
6. If you want to add a custom menu item, complete the following steps:
a. Click Edit under the menu bar to which you are adding the custom item.
b. Click Add.
c. Provide the Name, URL, and Description of your custom menu
item.
d. If you want the menu option to open in a new window, check
Open in a New Window.
e. Click OK.
7. If you want to delete a menu item, click and drag the item to delete from
the Selected items list on the right to the Available items list on the left.
Warning: Do not delete the Admin option from the Admin menu bar.
8. If you want to change the location of an item in your menu, click and
drag items to move them up and down in the Selected items list.
9. If you have finished editing your menu bar, click Submit.

218

Chapter 4: Managing the Web Console

Changing the Web Console Color Scheme

The overall color scheme of the SolarWinds Web Console may be changed to
any of several color schemes that are viewable by all users, as shown in the
following procedure.
To change the web console color scheme:
1. Click Settings in the top right of the web console.
2. Click Color Scheme in the Customize grouping.
3. Select the desired color scheme, and then click Submit.

Changing the Web Console Site Logo

The SolarWinds Web Console can be configured to display your logo instead of
the default SolarWinds banner across the top of every web console page. The
following steps change the default SolarWinds web console banner.
To change the web console banner:
1. Create an appropriately sized graphic to replace the SolarWinds logo.
Notes:
l The SolarWinds banner file is 271x48 pixels at 200 pixels/inch.
l The [Link] End User License Agreement prohibits the
modification, elimination, or replacement of either the [Link] logo and link on the menu bar or the SolarWinds copyright
line at the bottom of the page.
2. Place your graphic in the images directory.
Note: By default, it is in C:\Inetpub\SolarWinds\NetPerfMon\.
3. Log in to the web console as an administrator.
4. Click Settings in the top right of the web console.
5. Click Web Console Settings in the Settings grouping of the SolarWinds
Website Administration page.
6. Type the new logo image name as a replacement for [Link] in
the Site Logo URL field.

Configuring the Available Product Updates View

The SolarWinds Web Console can automatically check for the availability of any
updates to your currently installed SolarWinds products. By default, the web
console regularly checks for product updates automatically, as indicated by the
dates and times reported as Last Check and Next Check, but you can click
Check Now at any time to see an up-to-the-minute update. If updates are

219

To configure product updates:

available, a note is posted in the web console notification bar and updates are
listed in this view, where you can then select and download them as needed.
Note: For more information about downloading listed product updates, see
Updating your SolarWinds Installation on page220.
To configure product updates:
1. Log in to the web console as an administrator, and then click Settings in
the top right corner of the web console.
2. Click Available Product Updates in the Product Updates grouping.
3. If you want to disable the automatic check for product updates, clear
Check for product updates, and then click Save Settings.
4. If you want to ensure that updates are listed for all currently installed
SolarWinds products, including SolarWinds NPM, SolarWinds SAM,
and all SolarWinds modules, check Show all updates.
5. Click Save Settings.

Updating your SolarWinds Installation

If your Product Updates view is configured to list SolarWinds updates, you can
download them directly from the Product Updates view.
To update your SolarWinds installation:
1. Log in to the web console as an administrator, and then click Settings in
the top right corner of the web console.
2. Click Available Product Updates in the Product Updates grouping.
3. Click Check Now to refresh the updates list.
4. If there are any updates you want to ignore, check the updates to
ignore, and then click Ignore Selected.
5. Check the updates you want to apply, and then click Download Selected.
6. Save and then execute downloaded installers. For more information, see
either the [Link] file packaged with the downloaded update or review
related documentation available at [Link].

Customizing Charts in the SolarWinds Web Console

Clicking any chart opens the Custom Chart view in a new window, displaying the
selected chart with additional chart customization options. For more information
about the Custom Chart view, see Custom Chart View on page244.

220

Chapter 4: Managing the Web Console

You can also configure any custom chart resource in the SolarWinds Web
Console directly from the resource title bar either by selecting from the dropdown
menu of options or by clicking Edit to display the Edit Chart Title view, as
described in the following sections.
Chart Information:
l

If SAM is upgraded to version 6.0 or higher, legacy charts already assigned to

views will be upgraded.
Charts from earlier versions of SAM will be renamed to have the prefix
"Legacy" and must be added manually.

Custom Chart Resource Title Bar Options

The title bar menu of the custom chart resource provides the following options for
viewing chart data:
l
l

l
l

View chart data over the Last 7 Days or over the Last 30 Days
Select Edit Chart to view and modify chart settings.
Note: This is the same as clicking Edit in the title bar.
View Chart Data as an HTML format document
View Chart Data in Excel to see chart data in an Excel-compatible
format

Edit Chart Title View

Click Edit in the title bar of a custom chart resource to display the Edit Chart Title
view. This view provides the following options to configure your chart resource:
Select a Chart allows you to change the chart type displayed in the current
resource. Chart options are determined in accordance with the type of view
displaying the resource you are currently editing. For more information about
available node charts, see Custom Node Charts on page246. For more
information about available volume charts, see Custom Volume Charts on
page248.
The Time Period for the selected chart may be any of the following:
Last Hour

Last 2 Hours

Last 24 Hours Today

Yesterday

Last 7 Days

This Month

Last 30 Days Last 3 Months This Year

Last Month
Last 12 Months

The Sample Interval for the selected chart may be any of the following:

221

Exporting Views to PDF

Every Minute

Every 5 Minutes Every 10 Minutes Every 15 Minutes

Every 30 Minutes Every Hour

Every 2 Hours

Every 12 Hours

Every 7 Days

One a Day

Every 6 Hours

Notes:
l Each sample interval is represented on a chart by a single point or bar.
Data within a selected sample interval is summarized automatically.
l Due to limits of memory allocation, some combinations of time periods and
sample intervals require too many system resources to display, due to the
large number of polled data points. As a result, charts may not display if the
time period is too long or if the sample interval is too small.
The Trend Line option allows you to enable the trend line feature of SolarWinds
SAM charts. By enabling trend lines on SolarWinds SAM charts, you can see
potential future results as they are extrapolated from collected historical data.
Note: Due to the broad array of factors that can affect the performance of devices
on your network, trend lines provided on SolarWinds SAM charts are intended as
approximate predictions of future data only. For more information, see "95th
Percentile Calculations" on page 940.

Exporting Views to PDF

Many views in the SolarWinds Web Console may be exported directly to portable
document format (.pdf). Views that may be exported display Export to PDF in the
top right corner of the exportable view.
Note: The Export to PDF feature requires IIS Anonymous Access. Confirm that
the IUSR_SERVERNAME user is in the local Users group on your SolarWinds
server.
To export a view to PDF:
1.
2.
3.
4.

Open the web console view to export.

Click Export to PDF in the top right corner of the view.
If you are prompted to save the .pdf file, click Save.
Navigate to an appropriate location, provide an appropriate file name, and
then click Save.

222

Chapter 4: Managing the Web Console

Creating a Custom Summary View

The SolarWinds Custom Summary View enables you to create a fully customized
object-based view composed solely of resources you have selected. The
following procedure creates a custom summary view in the web console.
To create or edit a custom summary view in the web console:
1.
2.
3.
4.
5.

Click Home> Custom Summary.

Click Edit in any Custom Object Resource.
Provide a Title and Subtitle for the selected Custom Object Resource.
Click Select SolarWinds Object.
On the Select a network object window, use the Show only and Group by
selection fields, as appropriate, to filter the list of monitored objects.
6. Select the SolarWinds object on which you want to base the selected Custom Object resource, and then click Select SolarWinds object.
7. Select the type of information you want the custom resource to display
about the selected object, and then customize the resource, as indicated in
the following steps:
a. If you have selected an alerts resource, indicate whether or not you
want to display acknowledged alerts by checking or clearing Show
Acknowledged Alerts, as appropriate.
b. If you have selected a resource to which SQL filters may be
applied, edit available SQL filters as appropriate. For more information,
see Using Node Filters on page233.
c. If you have selected a resource with an AutoHide option, select
Yes or No to enable or to disable the Auto-Hide feature, respectively. If
enabled, the resource is automatically hidden if and when related data
is not present in the SolarWinds database.
d. If you have selected a sortable list resource, in the Sort By field select
the property by which you want the list sorted.
e. If you have selected a gaugestyle resource, select a gauge Style
and provide a Gauge Size.
f. If you have selected a chartstyle resource, select an appropriate
Time Period and Sample Interval, and then indicate whether or not
you want to show a Trend Line.
g. If you have selected a Universal Device Poller resource, select the
Universal Device Poller and Chart Format, and then configure all
other options as required for similar resource types.
8. Click Submit.
Note: For more information about customizing available resource types,

223

Creating and Editing External Website Views

click Help in the header of any resource on the Custom Summary view,
and then click the corresponding resource type.

Creating and Editing External Website Views

With the external website view feature, any SolarWinds SAM administrator can
select any external website and designate it as a SolarWinds Web Console view,
as shown in the following procedure.
To create or edit an external website view in the web console:
1. Click Settings in the top right of the web console.
2. Click External Websites in the Customize grouping of the SolarWinds
Website Administration page.
3. If you want to delete an existing external website, click Delete next to
the website you want to delete, and then click OK to confirm the deletion.
4. If you want to add a new external website, click Add.
5. If you want to edit an existing external website, click Edit next to the
name of the website you want to edit.
6. Provide a Menu Title for the external website to display in the Views toolbar.
7. If you want to include a heading within the view, provide an optional
Page Title to display within the view.
8. Provide the URL of the external website, in [Link] format.
9. Select the Menu Bar to which you want to add the new external website
link.
Note: For more information about customizing menu bars, see Customizing Web Console Menu Bars on page217.
10. Click OK.
11. Click Preview to view the external website as the web console will display
it.

Custom Object Resources in the SolarWinds Web

Console
The SolarWinds Web Console provides a Custom Object resource that enables
you to configure any of a wide array of resources to display performance data for
any specific monitored objects. The following sections provide more information
about editing a Custom Object resource, selecting monitored objects, and
configuring the data displayed in a Custom Object resource:

224

Chapter 4: Managing the Web Console

l
l
l

Editing a Custom Object Resource

Selecting Custom Objects and Resources
Available Custom Resources

Editing a Custom Object Resource

The following procedure edits a Custom Object resource.
To edit a Custom Object resource:
1. Click Edit in the header of a Custom Object resource.
2. Edit the resource Title and Subtitle as appropriate.
3. Click Select SolarWinds Object to select an appropriate monitored object.
For more information, see Selecting Custom Objects and Resources.
4. If you have completed your edits, click Submit.

Selecting Custom Objects and Resources

The following procedure selects a network object for a selected Custom Object
resource.
To select a custom monitored object for a Custom Object resource:
1. Click Edit in the header of a Custom Object resource.
2. Click Select SolarWinds Object.
3. In the Show only: field, select the type of object you want to monitor in the
Custom Object resource.
4. In the Group by: field, select an appropriate object grouping criterion.
Note: Defined custom properties are listed for all grouping types.
5. Click the object to monitor in the list on the left, and then select it in the
main pane grouping criterion.
6. Click Select SolarWinds Object.
7. Select the desired resource type in the Select object resource field, and
then configure options as required. For more information about available
resources, see Available Custom Resources.

Available Custom Resources

A Custom Object resource may be configured to provide the same data as any of
a number of SolarWinds Web Console resources for a selected network object:
Notes:

225

Integrating SolarWinds Engineers Toolset

l
l

Resource availability is dependent on the SolarWinds products installed.

For more information about any available custom resource, click Help in
the resource title to view the corresponding help topic.

Integrating SolarWinds Engineers Toolset

When you are browsing the SolarWinds Web Console from a computer that
already has a SolarWinds Toolset installed, SolarWinds SAM allows you to
launch Toolset tools directly from your web browser. Right-clicking any monitored
object listed in a SolarWinds Web Console running the Toolset Integration
displays a menu of available Toolset tools and functions. The following sections
detail the configuration of the available Toolset integration.
Note: For more information about the SolarWinds Engineers Toolset tools, see
[Link].
Refer to the following sections for more information:
l
l

Configuring a Toolset Integration

Adding Programs to a Toolset Integration Menu

Configuring a Toolset Integration

The following procedure configures SolarWinds Toolset for integration within the
SolarWinds Web Console.
Note: The first time the Toolset tools are accessed, a security warning may be
displayed. Click Yes to allow the Toolset integration.
To configure SolarWinds Toolset integration settings:
1. Right-click any monitored object displayed within the SolarWinds Web
Console.
2. Click Settings.
3. Click SNMP Community String.
Note: The first time you launch a tool requiring an SNMP community string
from the right-click menu, the SNMP Community String window displays.
4. If you want to delete any or all saved community strings, select the
strings that you want to delete, and then click Remove, or click Remove
All.
5. Click Menu Options, and then configure the right-click menu as follows:
a. If you want either to add menu items to the right-click menu or to
remove menu items from the right-click menu, move menu items
between the list of Available Menu Options on the left and Selected

226

Chapter 4: Managing the Web Console

Menu Options on the right by selecting items in either column and clicking the right and left arrows, as appropriate.
b. If you want to change the order of menu items, select items and then
click the up and down arrows next to the Selected Menu Options list.
c. If you want to add a separator between items, move the -----------menu option from the Available list to the Selected list, and then move
it to your preferred location within the Selected Menu Options list.
6. Click Automatic Menu Items.
7. Check either or both, if available, of the following options:
Automatically add sub-menu items to the MIB Browser (Query MIB)
menu option from the MIB Browers [Link] add
sub-menu items to the Real Time Interface Monitor menu option
from the Real Time Interface Monitor saved report types.
Note: These options expand the list of available menu items by incorporating menu links to MIB browser bookmarks and Real Time Interface
Monitor saved reports, respectively.

Adding Programs to a Toolset Integration Menu

The following procedure provides the steps required to add any external scripts or
applications to the SolarWinds Toolset integration menu.
To add a program to the SolarWinds Toolset Integration menu:
1. If you want to add an external script to the Toolset Integration menu,
save the script in an appropriate location on the install volume of your
SolarWinds server (e.g. <InstallVolume>:\\Scripts\).
2. If you want to add an external application to the Toolset Integration
menu, install the application in an appropriate location on the install
volume of your SolarWinds server (e.g. <InstallVolume>:\\Application\).
3. Open [Link], the Toolset Integration menu configuration
file, in a text editor.
Note: By default, [Link] is located in the following folder:
<InstallVolume>:\\Program Files\SolarWinds\Common\.
4. Save a copy of [Link] as SWToolset_Old.MenuOptions.
5. Add the following line between the <MenuOptions></MenuOptions> tags of the
[Link] file:
<MenuOption Visible="TRUE" Title="ApplicationName" BeginGroupp="FALSE" HasSubMenu="FALSE" ExecStringg="<InstallVolume>:\\Application\ExecutableFile" Icon="" Extra=""
Parent="" Required="4"/>

227

Web Console Configuration

Note: The string supplied for Title is the name for the added script or
application that will display in the menu. The string supplied for the
ExecString is the path to the script or application executable file.
6. Save the new [Link] to automatically update the Toolset
Integration menu.

Web Console Configuration

SolarWinds SAM has the ability to create, restore and clear your web console
configuration
Refer to the following sections for more information:
l
l

Creating a Web Console Configuration Backup

Restoring a Web Console Configuration Backup

Creating a Web Console Configuration Backup

The following procedure uses the SolarWinds Web Configuration
Backup/Restore utility to create a backup of your SolarWinds Web Console
configuration.
Note: The SolarWinds Web Configuration Backup/Restore utility does not create
a backup of the SolarWinds database. As a result, configuration backups do not
retain any of the network device data or statistics for any monitored network
objects.
To create a SolarWinds Web Console configuration backup:
1. Locate and run the [Link] utility, typically located at C:\Program
Files (x86)\SolarWinds\Orion.

2. Click Create Backup.

3. Name your backup and click Save.

Restoring a Web Console Configuration Backup

The following procedure uses the SolarWinds Web Configuration
Backup/Restore utility to restore a saved backup of your SolarWinds Web
Console configuration.
Warning: Do not restore web console configurations from any version of
SolarWinds SAM prior to the version currently installed.

228

Chapter 4: Managing the Web Console

To restore a SolarWinds Web Console configuration backup:
1. Locate and run the [Link] utility, typically located at C:\Program
Files (x86)\SolarWinds\Orion.

2. Select a Backup file from the list.

3. Choose either Merge or Overwrite for the restoration process.
4. Click Restore Backup.

Clearing a Web Console Configuration

The following procedure clears an existing SolarWinds Web Console
configuration.
Warning: Clearing a web console configuration deletes all existing user
accounts, account and view settings, and menu bar customizations. SolarWinds
recommends you create a backup of your current SolarWinds Web Console
configuration before you clear it to confirm that no issues arise as a result of the
deletion of your web console customizations.
To clear your SolarWinds Web Console configuration:
1. Locate and run the [Link] utility, typically located at C:\Program
Files (x86)\SolarWinds\Orion.

2. Click File > Clear Web Configuration.

3. Click Yes to confirm the deletion of your current web console configuration.

Logging in for the First Time as an Administrator

When you launch the SolarWinds Web Console, you are presented with a login
view requiring both a User Name and a Password.
To log in to the SolarWinds Web Console:
1. Launch the SolarWinds Web Console using either of the following methods:
l Click Start> All Programs> SolarWinds > Orion Web Console.
l Or launch a browser on your SolarWinds server and enter http:// ip_
address or [Link] where ip_address is the IP address of
your SolarWinds host server, or where hostname is the domain name
of your SolarWinds server.
2. Enter Admin as your User Name, and then click Login.
Notes: Until you set a password, you can log in as Admin with no Password. After your first login, you may want to change the Admin password.
For more information, see Changing an Account Password on page200.

229

Windows Authentication with Active Directory

Windows Authentication with Active Directory

As of SolarWinds Core version 2010.2, the SolarWinds Web Console can
authenticate Active Directory users and users who are members of Active
Directory security groups.
To enable Active Directory Windows authentication to the web console:
1. Install and configure Active Directory on your local network.
Notes:
l For more information about installing Active Directory on Windows
Server 2003, see the Microsoft Support article, How To Create an
Active Directory Server in Windows Server 2003.
l For more information about Active Directory on Windows Server
2008, see the Microsoft TechNet article, Active Directory Services.
2. If you want to enable automatic login for web console accounts using Windows Authentication, configure the SolarWinds Web Console as shown in
the following steps:
a. Click Start> All Programs> SolarWinds Orion> Configuration and
Auto-Discovery> Configuration Wizard.
b. Check Website, and then click Next.
c. After providing the appropriate IP Address, Port, and Website Root
Directory, select Yes Enable automatic login using Windows
Authentication.
d. Click Next, and then complete the Configuration Wizard.
3. Log in to the web console using the appropriate domain and user, providing Domain\Username or Username@Domain as the web console User name.

Using the Web Console Notification Bar

Below the web console menu bar, the SolarWinds notification bar provides
informational messages related to the following SolarWinds SAM features:
l

If you have configured the SolarWinds Web Console to check for product
updates, an announcement displays in the notification bar when an update,
including any upgrade, service pack, or hotfix, to SolarWinds SAM or any
other SolarWinds modules you currently have installed becomes available.
For more information about SolarWinds Product Updates, see Product
Updates" on page 182.
If you have configured the SolarWinds Web Console to store blog posts,
new and unread posts to the SolarWinds Product Team Blog are

230

Chapter 4: Managing the Web Console

announced in the notification bar. For more information about SolarWinds

Product Updates, see Product Updates" on page 182.
If you have currently configured a scheduled discovery, results display in
the notification bar when the discovery completes. For more information
about Scheduled Discovery, see Discovery Central."
If you are currently using SolarWinds SAM to monitor any VMware ESX or
ESXi Servers, the notification bar can display messages communicating the
number of ESX nodes found during any discovery, and, if any discovered
ESX nodes require credentials, the notification bar tells you. For more
information about managing ESX Servers, see Virtualization" on page 319.
For more information about any displayed notification bar message, click
More Details and a web console view relevant to the displayed message
opens.
To delete a posted message, either click Dismiss Message next to the displayed message, or properly address the situation mentioned in the posted
notification.
To remove the notification bar from your web console, click Close (X) at the
right end of the notification bar.

Using the SolarWinds Web Console Message

Center
The Message Center provides a single, customizable view in the web console
where, in a single table, you can review all events, alerts, traps and Syslog
messages on your network.
To view and configure the Message Center:
1. Click Home> Message Center.
2. If you only want to see messages for specific devices, select appropriate device properties in the Filter Devices area.
3. In the Filter Messages area, select the Time period for the messages you
want to review, and then provide the number of messages you want to
show.
4. If you want to show all messages, Including messages that have been
acknowledged, check Show acknowledged in the Filter Messages area.
5. If you only want to see certain types of messages, filter messages as
shown in the following steps:
a. If you want to view alerts, confirm that Show triggered alerts is
checked, and then select the type of alerts to display.

231

Suppressing Events
b. If you want to view event messages, confirm that Show event messages is checked, and then select the type of events to display.
c. If you want to view Syslog messages, confirm that Show syslog
messages is checked, and then select the Severity and Facility of the
Syslog messages you want to display.
d. If you want to view received traps, confirm that Show received traps
is checked, and then select the Trap type and Community String of
the traps you want to display.
e. If you want to view Audit Events, confirm that Show Audit Events is
checked, and then select the Action Type of the User you want to display.
6. Click Refresh to update the list of displayed messages.

Suppressing Events
There is no option within SAM to suppress event types from the web console;
however, suppression can be accomplished by modifying the database directly.
You can suppress specific events based on the event type. In order to do this,
refer to the following screenshot and steps:
Suppressing Events:
1. Open Microsoft SQL Server Management Studio.
2. Modify the [Link] types table.
3. Change the number in the Record column from 1 to 0 to suppress a specific event.
Note: SAM supports event suppression for every SAM event type (event
types from 500 to 532):

232

Chapter 4: Managing the Web Console

Using Node Filters

When you are managing or monitoring large numbers of network devices, node
list resources can easily become very large and difficult to navigate. Filters are
optional SQL queries that are used to limit node list displays for easier resource
navigation. SQL queries can be made on any predefined or custom properties.
For more information about defining custom properties, see Creating a Custom
Property on page924.
To apply a node filter:
1. Click Edit in any node list resource.
2. Provide an appropriate SQL query in the Filter Nodes (SQL) field, and
then click Submit.
The following are a few example filters with associated SQL queries.
Note: By default, node list resources are designed to sort nodes alphabetically by
node caption. This configuration cannot be overwritten using a SQL filter, so order
by clauses included in SQL filters are redundant and will result in Custom SQL
filter formatting errors.
Filter the results to only show nodes that are not Up:
Status<>1

233

Accessing Nodes Using HTTP, SSH, and Telnet

The following are valid status levels:
0 = Unknown
1 = Up

(current up/down status of the node is unknown)

(The node is responding to PINGs)

2 = Down

(The node is not responding)

3 = Warning

(The node may be responding, but the connection from the server to
the Node is dropping packets)
Only show Cisco devices: Vendor = 'Cisco'
Only show devices in Atlanta. (using a custom property named City):
City = 'Atlanta'

Only show devices beginning with "AX3-": Caption Like 'AX3-*'

Only show Nortel devices that are Down:
Vendor Like 'Nortel*' AND Status=2

Only show devices ending in '-TX': Vendor Like '*-TX'

Accessing Nodes Using HTTP, SSH, and Telnet

The SolarWinds Web Console supports the use of HTTP, SSH, and Telnet
protocols for remote device access if associated applications like PuTTy and
FiSSH on your SolarWinds server are properly registered. For more information,
see the MSDN article, Registering an Application to a URL Protocol. Launch
remote access applications from any Details view as follows:
l
l
l

To browse directly to the viewed device using a web browser, click

To open a secure shell (SSH) to a monitored device, click .
To open a Telnet session with a monitored device, click .

Using Integrated Remote Desktop

Sometimes it is necessary to console into a remote server to troubleshoot an
issue. This can be accomplished within the SolarWinds Web Console as follows:
Note: Press Ctrl+Alt+Break to enter/exit full screen mode.
To launch Integrated Remote Desktop:
1. Open the Node Details view for the server you want to view remotely.
Note: The easiest way to open the Node Details view is to click the remote
server you want to view in any All Nodes resource.
2. Click , located at the of the Node Details view.
Note: Depending on the security settings of your browser, you may be
234

Chapter 4: Managing the Web Console

asked to install an ActiveX control for remote desktop viewing. Follow all
prompts to install this required control.
3. Verify the Server IP address or hostname, select an appropriate Screen
Size, and then click Connect.

Using Audit Events

SAM offers the ability to audit itself. For example, you may want to know who
added a node to SAM and when. The Last XX Audit Events resource provides
this ability.
Note: This resource is only available for users with administrative rights.

The fields for this view are:

l
l
l

Date/Time: Displays the date and time of the listed event.

User: Displays the user who performed the event.
Action: Displays the action that was taken by the listed user.

From this view, you can click on either the user or the node which is linked to
more information about that particular item. Clicking All Audit Events will allow
you to select the audit events you want displayed, in addition to other selfexplanatory options.
Adding the Audit Events resource:
1. Click Customize Page in the top right corner of the web console.
2. Click the [+] in either column.
3. Search for "Audit."

235

Filtering Audit Events

4. Select the resource you want, and then click Add Selected Resources.
5. Click Done.
For more information, see Filtering Audit Events.

Filtering Audit Events

SAM allows you to filter Audit Events based on device, time, and message.
To Filter Audit Events:
1. Click All Audit Events.
2. Select the filters you want to apply by checking the appropriate boxes and
items from the dropdown menus, as highlighted below.
3. Click Apply.

Complete SAMAudit Event List:

l
l

All action types

User login

236

Chapter 4: Managing the Web Console

l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l

User logout
User account added
User account deleted
Alert acknowledged
Alert note changed
View added
View deleted
View edited
Custom property added
Custom property deleted
Custom property edited
List resources added
List resources deleted
List resources edited
Orion settings edited
Orion web settings edited
Group added
Group deleted
Group edited
Group member definition added
Group member definition deleted
Group member definition changed
Node added
Node deleted
Node managed
Node unmanaged
Node polling engine changed
Node edited
Interface added
Interface deleted
Interface managed
Interface unmanaged
Process terminated
Service state changed
Node rebooted
Application added
Application deleted
Application modified
Application managed
Application unmanaged
Application template added

237

Editing Audit Events:

l
l
l
l
l

Application template deleted

Application template modified
Credentials added
Credentials deleted
Credentials modified

Editing Audit Events:

Clicking Edit will allow you to choose what audit events you want displayed in
addition to selecting the time period for the events, as well as the number of
events to display.
1. Click Edit.
2. Check the events you want to be displayed in the resource.
3. Click Submit.

238

Chapter 5:
SolarWinds SAMCharts
Following is a list of the available charts within SAM:
l
l
l
l
l
l
l
l
l
l
l
l

Application Availability Chart

Custom Area Chart
Custom Bar Chart
Custom Chart View
Custom Line Chart
Custom Node Charts
Custom Volume Charts
Event Log Message Details
Min/Max Average Chart
Multiple Object Chart
Multiple Statistic Chart
Multi Chart

Application Availability Chart

This chart lets you visualize the amount of time an application was in a particular
state of availability. This chart is interactive. Hovering over any part of the chart
will provide detailed information.

The tooltip indicates the number of times the application was in a certain state.
For example, in the previous illustration, an application was polled 12 times in
one hour (every five minutes) and was deemed available (up) 10 times, in a
Critical state once, and in a Warning state once.

239

Chapter 5: SolarWinds SAMCharts

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
you can have the chart show a specific time range by dragging the mouse over a
small area of the chart, or by adjusting the sliders in the smaller chart below the
main chart.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders. The main view of the chart will
display the selected time period between the two sliders of the lower chart.
Note: The Export button will open the Custom Chart allowing you to export this
data to both MS Excel and HTML.

Custom Area Chart

The Custom Area Chart resource allows you to easily view data as shown in
percentage format. To customize it, simply click Edit in the upper right-hand
corner of the resource.

240

Custom Bar Chart

Use the check box in the legend as a toggle to show/hide data on the chart.
Clicking Export will allow you to export the data to either an HTML or Excel file.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.

Custom Bar Chart

The Custom Bar Chart resource allows you to easily view data as shown in
percentage format. To customize it, simply click Edit in the upper right-hand
corner of the resource.

241

Chapter 5: SolarWinds SAMCharts

Use the check box in the legend as a toggle to show/hide data on the chart.
Clicking Export will allow you to export the data to either an HTML or Excel file.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.

Component Availability Chart

The Component Availability Chart is a straightforward bar chart that provides a
visual representation of the percentage of availability of a selected component.

242

Component Availability Chart

Clicking the Edit button will provide a menu of components to choose from to
have represented on the chart, as the following illustration depicts:

Note: This option is only available on the Application Details page and not the
Component Details page. Clicking the chart itself, as opposed to the Edit button,
will bring up additional, self-explanatory options.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
you can have the chart show a specific time range by dragging the mouse over a

243

Chapter 5: SolarWinds SAMCharts

small area of the chart, or by adjusting the sliders in the smaller chart below the
main chart.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders. The main view of the chart will
display the selected time period between the two sliders of the lower chart.
Note: The Export button will allow you to export this data to both MS Excel and
HTML.

Custom Chart View

Charts in the SolarWinds Web Console are easily customizable. Clicking a chart
opens the Custom Chart view in a new window. The following sections describe
options that are available on the Custom Chart page to modify the presentation of
a selected chart.
Note: Click Refresh at any time to review changes you have made.
Printing Options
To print your customized chart, click Printable Version and a
printable version of your customized chart displays in the browser.
Chart Titles
Chart Titles are displayed at the top center of a generated chart. The
Chart Titles area allows you to modify the Title and Subtitles of your
generated chart.
Note: SolarWinds may provide default chart titles and subtitles. If you
edit any of the Chart Titles fields on the Custom Chart page, you can
restore the default titles and subtitles by clearing the respective fields,
and then clicking Submit.
Time Period
Predefined and custom time periods are available for generated
charts. You may designate the time period for a chart by either of the
following methods:
l

Select a predefined period from the Select a Time Period:

menu.

244

Sample Interval
l

Provide custom Beginning and Ending Dates/Times in the

appropriate fields in the Time Period area.

Sample Interval
The sample interval dictates the precision of a given chart. A single
point or bar is plotted for each sample interval. If a sample interval
spans multiple polls, data is automatically summarized and plotted as
a single point or bar on the chart.
Note: Due to limits of memory allocation and the large number of
polled data points, some combinations of time periods and sample
intervals may require too many system resources to display. As a
result, charts may not display if the time period is too long or if the
sample interval is too small.
Chart Size
Chart Size options configure the width and height, in pixels, of the
chart. You can maintain the same width/height aspect ratio, or scale
the chart in size, by entering a width in the Width field and then
entering 0 for the Height.
Font Size
Font sizes for generated charts are variable. The Font Size option
allows you to select a Small, Medium, or Large size font for your chart
labels and text.
Note: Font Size selections are maintained in the printable version of
your chart.
Data Export Options
The Display Data from Chart area provides the following options to
export chart data as either Excel-compatible Raw Data or as
HTML-formatted Chart Data:
l

To view chart data in an Excel-compatible format, click Raw

Data, and then follow the prompts, if provided, to open or save
the resulting raw data file.
To view HTML-formatted chart data in a new browser, click
Chart Data.

245

Chapter 5: SolarWinds SAMCharts

Custom Line Chart

The Custom Line Chart resource allows you to easily view data as shown in
percentage format. To customize it, simply click Edit in the upper right-hand
corner of the resource.

Use the check box in the legend as a toggle to show/hide data on the chart.
Clicking Export will allow you to export the data to either an HTML or Excel file.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.

Custom Node Charts

The following node-related charts, grouped by type, are available as resources
within the SolarWinds Web Console. To add any of these charts to a web console
view dealing with monitored nodes, add the Custom Node Chart resource to the

246

Availability
Node Details view. For more information about adding resources to SolarWinds
Web Console views, see Customizing Views on page204.
Availability
The following charts are available to display node availability information over
custom time periods for nodes monitored by SolarWinds.
l
l
l

Availability
AvailabilityAutoscale
Availability and Response Time

CPU Load
The following charts display CPU loading information over specified periods of
time for nodes monitored by SolarWinds.
l
l

Average CPU Load

Min/Max/Average CPU Load

Memory Usage
The following charts present memory usage information over custom time periods
for nodes monitored by SolarWinds.
l
l
l
l

Average Memory Usage

Memory/Buffer Failures
Min/Max/Average Memory Usage
Percent Memory Used

Packet Loss and Response Time

The following charts are available to display historical statistics about packet loss
and response time for nodes monitored by SolarWinds.
l
l
l
l
l
l
l

Availability and Response Time

Average Response Time
Average Response Time and Packet Loss
Min/Max/Average Response Time
Min/Max/Average Response Time and Packet Loss
Percent LossBar Chart
Percent LossLine Chart

247

Chapter 5: SolarWinds SAMCharts

Custom Volume Charts

The following volume-related charts, grouped by type, are available as resources
within the SolarWinds Web Console. To add any of these charts to a web console
view dealing with monitored volumes, add the Custom Volume Chart resource to
the Volume Details view. For more information about adding resources to
SolarWinds Web Console views, see Customizing Views on page204.
Allocation Failures
Shows the number of disk allocation failures that have occurred on the
selected volume.
Min/Max/Average Disk Usage
Shows both the total disk space available and the average amount of disk
space used on the selected volume. Bars are also included to show
minimum and maximum levels of disk usage.
Percent Disk Usage
Shows the total available disk space and the average amount of disk space
used, as a percentage of the total available, on the selected volume.
Volume Size
Shows the total disk space available on the selected volume.

Event Log Message Details

The Event Log Message Details resource allows you to read each message of
the event log in its entirety. This resource is found on the Component Details
page and can return the following information:
l
l
l
l
l
l
l
l

Number of events matching the criteria as defined by the user

Event type / Level (Error, Warning, Information, and so on).
Event code / Event ID
Log file (Application, Security, and so on).
Time generated
Computer name
User
Message

248

Event Log Message Details

Clicking on Show More will expand the resource to fill a separate screen.
Clicking on any message in this resource will bring up the entire message that
was created in the event log, as shown below:

Alerts with this resource can be used with the complete message text of events.
For more information see, "Other Syslog Variables" on page 890.
This collection of detailed data is enabled by default. To disable this, navigate to
the event log monitor component, as shown below:

249

Chapter 5: SolarWinds SAMCharts

Min/Max Average Chart

The Min/Max Average Chart has been updated from previous releases to show
more information and provide more flexibility. These charts can be found by
navigating to the Component Details page or the Application Details page.
Adding the Chart:
1.
2.
3.
4.

Navigate to the Component Details page or the Application Details page.

Click Customize Page in the top right corner of the web console.
Click the [+] in either column.
Select a category to group items by from the Group by dropdown menu:
Note: The Classic category reflects the tree views found in previous versions of SAM for this resource.
5. Select the charts you want, and then click Add Selected Resources.
6. Click Done.
Customizing the Chart
This chart can be customized to view the following data by clicking the Edit button
at the top-right of the chart. The available data to this chart are as follows:
l
l
l
l
l

CPU Load
Physical Memory
Virtual Memory
Response Time
Statistic Data

Clicking Edit also reveals several self-explanatory options. Clicking Export will
allow you to export the data to both Excel and HTML formats.
This resource is made up of three sections: the toolbar, the main chart, and the
lower chart. This allows you to visualize the selected data by viewing the
minimums, maximums, and averages of the data for a selected time period.

250

Zooming

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 Day, 1 Week, or 1 Month, as highlighted in
the above illustration. Alternatively, you can have the chart show a specific date
range by dragging the mouse over a small area of the chart, or by typing in
specific dates in the From and To fields, also highlighted.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders, highlighted above. The main
view of the chart will display the selected time period between the two sliders of
the lower chart.
Moving the mouse over the main chart will reveal a tooltip with more detailed
information about the specific time period the mouse is hovering over.
By default, all statistics are shown in the main chart. You can add or remove any
statistic from the chart by checking and unchecking any statistic from the legend
at the lower left of the resource.

Multiple Object Chart

The Multiple Object Chart resource allows you to simultaneously view data for
multiple objects on the same chart. Objects may be on the same node or on

251

Chapter 5: SolarWinds SAMCharts

different nodes.
Clicking Edit allows you to configure the characteristics of a selected multiple objects chart:

To add the Multiple Object Chart to your home page:

1.
2.
3.
4.

Click the Home tab to get to the Summary view.

Click Customize Page on the top right of the page.
Click the green [+] to the right of where you want to add this chart.
From Add Resources to SolarWinds Home Summary page, select and
expand Multiple Series Charts.
5. Check Multiple Object Chart, and then click Submit, and then click Done.
To configure the Multiple Object Chart:
1. Once the chart is on your Home Summary page, click Edit at the top right
of the chart.
2. From this page, you can have multiple options to choose from, including:
i. Title: This allows you to change the title of your chart.
ii. Subtitle: This allows you to add a subtitle to your chart.

252

Multiple Statistic Chart

iii. Choose Objects: This allows you to choose the type of objects to display from the dropdown menu provided. You can remove an object from
the list by clicking the red X to its right.
iv. Select a Chart: This allows you to chart various aspects of what you
intend to monitor.
v. Choose Objects: Click the Select SolarWinds Object button to choose
which objects you want charted based on your selection in step iii.
vi. Limit Series: Checking this box and setting the number of series will
limit the number of items displayed on the chart to the specified amount.
vii. Show Sum in Data Series: This allows you to chart the total of the other
objects graphed and is represented by its own plot line.
viii. Time Period: This allows you to set the range displayed on the chart.
ix. Sample Interval: This allows you to set the interval that this chart is
updated.

Multiple Statistic Chart

This chart provides the ability to graphically visualize multiple statistics
simultaneously, as well as view the statistics in the table below. The advantage of
this view is that you can easily determine how certain processes and services are
performing in relation to others. For example, you may notice that a spike in RAM
usage results in higher CPU usage. This charted information allows you to get a
quick overview of what is being monitored and may answer why certain
unexpected events are occurring.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons at the top of the chart. Alternatively, you can
have the chart show a specific time range by dragging the mouse over a small
area of the chart, or by adjusting the sliders in the smaller chart below the main
chart.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders. The main view of the chart will
display the selected time period between the two sliders of the lower chart.

253

Chapter 5: SolarWinds SAMCharts

The Multiple Statistic Chart can be added to either the Application Details
page or the SAM Component Details page.
To add the Multiple Statistic Chart to either page, take the following steps:
1. Drill down to either the Application Details page or the SAM Component
Details page.
2. Click Customize Page on the far top right of the page.
3. Click the green [+] to the right of the column in which you want to add this
chart.
4. Select and expand SAM Charts - Historical charts for SAM.
5. Check Multiple Statistic Chart, and then click Submit, then click Done.
To configure the Multiple Statistic Chart, take the following steps:
1. Once the chart is on your Details page, click Edit at the top right of the
chart.
2. From this page, you can have several options to choose from, including:
i. Title: This allows you to change the title of your chart.
ii. Select a Time Period: This allows you provide a range for your chart.
iii. Select a Sample Interval: This allows you to select how often the chart
is updated.

254

Multi Chart
iv. Chart All or Selected Statistics: This allows you to chart certain or all
aspects of what you intend to monitor.
For more information, see Creating a Windows Script Monitor

Multi Chart
This chart provides the ability to graphically visualize multiple statistics
simultaneously at the application level without the need to drill down into each
component monitor.
The advantage of this view is that you can easily determine how certain
processes are performing in relation to others. For example, you may notice that a
spike in RAM usage results in higher CPU usage. This charted information allows
you to get a quick overview of what is being monitored and may answer why
certain unexpected events are occurring.

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons at the top of the chart. Alternatively, you can
have the chart show a specific time range by dragging the mouse over a small
area of the chart, or by adjusting the sliders in the smaller chart below the main
chart.
The Multi Chart can be added from the Application Details page.

255

Chapter 5: SolarWinds SAMCharts

To add the Multi Chart to the Application Details page, take the following
steps:
1. Drill down to the Application Details page.
2. Click Customize Page on the far top right of the page.
3. Click the green [+] to the right of the column in which you want to add this
chart.
4. Search for "Multi Chart."
5. Check Multi Chart, and then click Add Selected Resources, then click
Done.
To configure the Multi Chart, take the following steps:
1. Once the chart is on your Application Details page, click either Edit, Select a
chart, or Configure this resource.

2. From this page, you have several options to choose from, including:
i) Title: This allows you to change the title of your chart.
ii) Subtitle: This allows you to change the subtitle of your chart.

256

Multi Chart
iii) Select components:

iv) Show Thresholds: This allows Warning and Critical Thresholds to

be displayed as yellow and red bands, respectively.
v) Default zoom range: Allows you to choose the time period of data
to be displayed.
vi) Amount of historical data to load: Allows you to select the
amount of historical data to be displayed.
vii) Sample interval: Allows you to set the polling time for the
components in this chart.

257

Chapter 6:
SolarWinds SAM Settings
You can configure Applications, Templates, and Component Monitors through the
SolarWinds Web Console by using the SAM Settings page.

To configure SolarWinds SAM:

1. Log on to your SolarWinds Web Console with an Administrator account.
Note: Initially, Admin is the default administrator user ID with a blank password.
2. Click the Applications tab.
3. Click SAM Settings.
Refer to the sections that follow for details about the administrative commands
available in each category:

258

Chapter 6: SolarWinds SAM Settings

l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l

Getting Started with SAM

Scan Nodes for Applications
Manually Assign Application Monitors
Component Monitor Wizard
Application Monitors
Manage Application Monitors
Application Monitor Templates
Manage Templates
Create a New Template
Component Monitors
Component Monitor Library
Manage Assigned Component Monitors
Manage Component Monitors within Templates
Application Detail Views
Views by Application Type
SAM Settings
Credentials Library
Data and Database Settings
License Summary
SAM License Summary
thwack Community
Shared thwack Templates
SAM thwack Forum

Getting Started with SAM

The Getting Started with SAM category gives you access to the commands that
allow you to start monitoring your applications or add new Application Monitors.
Refer to the following sections for more information:
l
l

Scan Nodes for Applications

Manually Assign Application Monitors

Scan Nodes for Applications

Click Scan Nodes for Applications on the SAM Settings page to scan nodes
and automatically add Application Monitors.
For more information, see Scanning Nodes for Applications on page393.

259

Manually Assign Application Monitors

Manually Assign Application Monitors

Click Manually Assign Application Monitors on the SAM Settings page to
assign Application Monitors to server nodes.
For more information, see Manually Assign Application Monitors on page260.

Component Monitor Wizard

Click Component Monitor Wizard on the SAM Settings page to pick the
processes, services, and performance counters you want from a list to create a
new template.
For more information, see Creating New Templates Using the Browsing Method:
on page397.

Application Monitors
The Application Monitors category gives you access to the commands that allow
you to actively monitor nodes using a collection of component monitors to
determine the overall health of applications.
For more information, see Managing Assigned Application Monitors on
page345.

Manage Application Monitors

Click Manage Application Monitors on the SAM Settings page to view, edit, and
delete assigned Application Monitors and their component monitors.
For more information, see Managing Assigned Application Monitors on
page345.

Application Monitor Templates

The Application Monitor Templates category gives you access to the commands
that allow you to edit, copy, export, import, delete, and create new templates.
For more information, see Managing Templates on page398.

Manage Templates
Click Manage Templates on the SAM Settings page to edit, copy, export, import,
and delete templates.
For more information, see Managing Templates on page398.

260

Chapter 6: SolarWinds SAM Settings

Create a New Template

Click Create a New Template on the SAM Settings page to create a new
application template and its component monitors.
For more information, see Creating New Templates on page396.

Component Monitors
Component monitors are the building blocks of SolarWinds SAM. This category
gives you access to the commands that allow you to monitor the status and
performance of different aspects of an application.
Refer to the following sections for more information:
l
l
l

Component Monitor Library

Manage Assigned Component Monitors
Manage Component Monitors within Templates

Component Monitor Library

Click Component Monitor Library on the SAM Settings page to view the
component monitors that are provided in the library for monitoring the status and
performance of different aspects of an application.
For more information, see Viewing the Component Monitor Library on page362.

Manage Assigned Component Monitors

Click Manage Assigned Component Monitors on the SAM Settings page to
view and manage assigned component monitors.
For more information, see Managing Assigned Component Monitors on
page362.

Manage Component Monitors within Templates

Click Manage Component Monitors within Templates on the SAM Settings
page to view and manage component monitors that are inside the Application
Monitor templates.
For more information, see Managing Templates on page398.

261

Application Detail Views

Application Detail Views

The Application Detail Views category gives you access to the command that
allows you to customize application detail views.

Views by Application Type

Click Views by Application Type on the SAM Settings page to customize
application detail views by application (template) type. You can choose between
displaying a generic view or a custom view for each application (template) type.

SAM Settings
The SAM Settings category gives you access to the commands that allow you to
view and manage the SAM Settings for credentials and data access.
l
l

For more information, see "SolarWinds SAM Settings" on page 258.

For more information, see Understanding the Credentials Library on
page341.
For more information, see "Data and Database Settings" on page 262.

Credentials Library
Click Credentials Library on the SAM Settings page to create, edit, and delete
the credential sets component monitors use to access protected system
resources.
For more information, see Understanding the Credentials Library on page341.

Data and Database Settings

Click Data and Database Settings on the SAM Settings page to set the
database maintenance interval:
The four options are as follows:
l
l
l
l
l

Detail Statistics Retention

Hourly Statistics Retention
Daily Statistics Retention
Event Log Message Retention
Baseline Data Collection Duration

262

Chapter 6: SolarWinds SAM Settings

Database Maintenance
The amount of data collected in the database is dependent upon the size of the
data collected as well as the number of applications and component monitors you
define.
Due to the volume of data collected, detailed statistics are stored in hourly
averages after a specified time period (7 days, by default). Hourly statistics are
compressed into daily statistics after a number of days (30 days, by default).
Detailed statistics retention is based on the individual polling intervals for each
component monitor. These settings allow you to set a length of time after which
SolarWinds SAM purges data from the database.
Note: Before modifying your database settings, consider noting your database
size and amount of data collection for a week. When the week is complete,
recheck your database size. This should help you forecast and plan for an
appropriate data compression and retention period.
To set the three Statistic Retention Intervals:
1. Log on to your SolarWinds Web Console with an Administrator account.
Note: Initially, Admin is the default administrator user ID with a blank password.
2. Click the Applications tab.
3. Click SAM Settings.
4. Click Data and Database Settings.
5. Specify the appropriate values for the SolarWinds SAM data retention settings.
Polling Engine Mode
Note: The option to change Polling Engine Modes has been removed for SAM
5.5 and higher. For more information, see
[Link]
The polling engine mode specifies the behavior of both the main polling engine
and any additional ones you may have.
To set the Polling Engine Mode (v5.2 and earlier):
1. Log on to your SolarWinds Web Console with an Administrator account.
Note: Initially, Admin is the default administrator user ID with a blank password.

263

License Summary
2. Click the Applications tab.
3. Click SAM Settings.
4. Click Data and Database Settings.
For more information, see "Managing the SolarWinds SAM Database" on page
903.

License Summary
The License Summary category gives you access to the command that allows
you to view the license information summary.
For more information, see "SAM License Summary" on page 264.

SAM License Summary

Click SAM License Summary on the SAM Settings page to see a comparison
between the number of active component monitors and the limit allowed by your
SolarWinds SAM license.

thwack Community
The thwack Community category gives you access to the commands that allow
you to view and download useful information from the thwack community for
SolarWinds users.
Refer to the following sections for more information:
l
l

Shared thwack Templates

SAM thwack Forum

Shared thwack Templates

Click Shared thwack Templates on the SAM Settings page to browse and use
application templates contributed by fellow administrators.
For more information, see Exporting and Importing Templates Locally or Using
Thwack on page402.

SAM thwack Forum

Click SAM thwack Forum on the SAM Settings page to browse the information
provided in the SAM thwack Forum.
For more information, visit [Link]

264

Chapter 6: SolarWinds SAM Settings

265

Chapter 7:
Discovering and Adding Nodes on a
Network
There are two methods to add nodes in SolarWinds SAM:
Add a Single Node*
* For more information, see Adding Nodes for Monitoring on page188.

Network Sonar Discovery

This chapter describes the process of discovering network devices and then
adding them to the SolarWinds database via Network Sonar Discovery.
The method recommended largely depends on the number of nodes to be added.
To discover and add a larger number of nodes across your enterprise, the
Network Sonar Discovery and Network Sonar Results wizards are available,
respectively. This chapter provides instructions for quickly populating your
SolarWinds SAM database with the nodes you want to monitor and manage with
SAM. The Web Console also provides an easy to use Web Node Management
wizard suited to discovering and adding individual nodes.
Refer to the following sections for more information:
l
l
l
l
l

Discovery Central
Network Sonar Discovery
Using the Network Sonar Results Wizard
Managing Scheduled Discovery Results
Using the Discovery Ignore List

Discovery Central
Discovery Central provides a centralized overview of the types and number of
nodes you are monitoring. You can also access Network Discovery and
Virtualization Discovery from within Discovery Central.

266

Chapter 7: Discovering and Adding Nodes on a Network

To access Discovery Central:
1. Click Settings at the top right of the SolarWinds Web Console.
2. Click Discovery Central in the Getting Started with SolarWinds category.
Note: Clicking Go to SolarWinds Home opens the SolarWinds Summary
Home view for your entire monitored network.
Refer to the following sections for more information:
l
l

Virtualization Discovery
Application Discovery

Virtualization Discovery
The Virtualization Discovery category displays information for both VMware and
Hyper-V infrastructures on your network. To use virtualization discovery, click
Network Sonar Discovery to discover multiple nodes or click Add A Single
Device to add a single node. For more information, see Polling for VMware
nodes Using the Network Sonar Wizard on page 328.

Application Discovery
SolarWinds SAM can scan nodes and automatically assign the Application
Monitors it deems suitable for each scanned node. You control the nodes to be
scanned, the application templates used in the scan, and the scanning
parameters that determine a match. For more information, see "Application
Discovery" on page 278.

Network Sonar Discovery

SolarWinds SAM employs the easy to use Network Sonar Wizard in order to aid
in the discovery of nodes on your network. Before using the Network Sonar
Wizard, consider the following points about network discovery in SAM:
l

The Network Sonar Wizard recognizes network devices that are already in
your SolarWinds database and prevents you from importing duplicate
devices.
CPU and Memory Utilization charts are automatically enabled for your Windows, Cisco Systems, VMware, and Foundry Networks devices.
The community strings you provide in the Network Sonar Wizard are only
used for SNMP GET requests, so read-only strings are sufficient.

267

To discover devices on your network from Discovery Central:

The following procedure steps you through the discovery of devices on your
network using the Network Sonar Wizard, automatically followed by the Network
Sonar Results Wizard:
To discover devices on your network from Discovery Central:
1. If the Network Sonar Wizard is not already open, click Start> All
Programs> SolarWinds > Configuration and Auto-Discovery>
NetworkDiscovery.
2. Click Network Sonar Discovery.

3. If you want to create a new discovery, click Add New Discovery.

4. If you have already defined a network discovery, a number of options
are available on the Network Sonar Discovery tab. Select one of the following:
l If you want to edit an existing discovery before using it, select
the discovery you want to edit, and then click Edit.
l If you want to use an existing discovery to rediscover your network, select the discovery you want to use, click Discover Now,
and then complete the Network Sonar Results Wizard after discovery completes. For more information about network discovery
results, see Using the Network Sonar Results Wizard on
page274.
l If you want to import some or all devices found in a defined discovery that you may not have already imported for monitoring,
select a currently defined discovery, and then click Import All Results. For more information about network discovery results, see
Using the Network Sonar Results Wizard on page274.
l If you want to import any newly enabled devices matching a
defined discovery profile, select a currently defined discovery, and
then click Import New Results. For more information about network
discovery results, see Using the Network Sonar Results Wizard on
page274.
l If you want to delete an existing discovery profile, select a currently defined discovery and then click Delete.
5. If the devices on your network do not require community strings
other than the default strings public and private provided, click Next on
the SNMP Credentials view.

268

Chapter 7: Discovering and Adding Nodes on a Network

6. If any of your network devices require community strings other than
public and private or if you want to use an SNMPv3 credential, complete
the following steps to add the required SNMP credential.
Note: Repeat the following procedure for each new community string. To
speed up discovery, highlight the most commonly used community strings
on your network, and then use the arrows to move them to the top of the
list.
a. Click Add New Credential, and then select the SNMP Version of your
new credential.
b. If you are adding an SNMPv1 or SNMPv2c credential, provide the
new SNMP Community String.
c. If you are adding an SNMPv3 credential, provide the following information for the new credential:
l User Name, Context, and Authentication Method
l Authentication Password/Key, Privacy/Encryption Method
and Password/Key, if required.
d. Click Add.
7. Click Next on the SNMP Credentials view.

8. If you want to discover any VMware VCenter or ESX Servers on your

network, confirm that Poll for VMware is checked, and then complete the
following steps to add or edit required VMware credentials.
Note: Repeat the following procedure for each new credential. To speed
up discovery, use the up arrow to move the most commonly used credentials on your network to the top of the list.
a. Click Add vCenter or ESX Credential.
b. If you are using an existing VMware credential, select the appropriate credential from the Choose Credential dropdown menu.
c. If you are adding a new VMware credential, select <New Credential> in the Choose Credential dropdown menu, and then provide
a new credential name in the Credential Name field.

269

To discover devices on your network from Discovery Central:

Note: SolarWinds recommends against using non-alphanumeric characters in VMware credential names.
d. Add or edit the credential User Name and Password, as necessary.
e. Confirm the password, and then click Add.
9. Click Next on the Local vCenter or ESX Credentials for VMware view.

10. If you want to discover devices located on your network within a specific range of IP addresses, complete the following procedure.

Note: Only one selection method may be used per defined discovery.
a. Click IP Ranges in the Selection Method menu, and then, for each IP
range, provide both a Start address and an End address.
Note: Scheduled discovery profiles should not use IP address ranges
that include nodes with dynamically assigned IP addresses (DHCP).
b. If you want to add another range, click Add More, and then repeat
the previous step.
Note: If you have multiple ranges, click X to delete an incorrect range.
c. If you have added all the IP ranges you want to poll, click Next.
11. If you want to discover devices connected to a specific router or on a
specific subnet of your network, complete the following procedure:
Note: Only one selection method may be used per defined discovery.

270

Chapter 7: Discovering and Adding Nodes on a Network

a. Click Subnets in the Selection Method menu.
b. If you want to discover on a specific subnet, click Add a New Subnet, provide both a Subnet Address and a Subnet Mask for the
desired subnet, and then click Add.
Note: Repeat this step for each additional subnet you want to poll.
c. If you want to discover devices using a seed router, click Add a
Seed Router, provide the IP address of the Router, and then click
Add.
Notes:
l Repeat this step for each additional seed router you want to use.
l Network Sonar reads the routing table of the designated router
and offers to discover nodes on the Class A network ([Link]
mask) containing the seed router and, if you are discovering
devices for a SolarWinds SAM installation, the Class C networks
([Link] mask) containing all interfaces on the seed router,
using the SNMP version chosen previously on the SNMP Credentials page.
l Networks connected through the seed router are NOT automatically selected for discovery.
d. Confirm that all networks on which you want to conduct your network
discovery are checked, and then click Next.
12. If you already know the IP addresses or hostnames of the devices
you want to discover and include in the SolarWinds database, complete the following procedure:
a. Click Specific Nodes in the Selection Method menu.
b. Type the IPv4 or IPv6 addresses or hostnames of the devices you want
to discover for monitoring into the provided field.
Note: Type only one address or hostname per line.
c. Click Validate to confirm that the provided addresses and hostnames
are assigned to SNMP-enabled devices.
d. If you have provided all the addresses and hostnames you want to
discover, click Next.
13. Configure the options on the Discovery Settings view, as detailed in the following steps:
a. Provide a Name and Description to distinguish the current discovery
profile from other profiles you may use to discover other network areas.

271

To discover devices on your network from Discovery Central:

Note: This Description displays next to the Name in the list

of available network discovery configurations on the
Network Sonar view.
b. Position the slider or type a value, in ms, to set the SNMP Timeout.
Note: If you are encountering numerous SNMP timeouts during Network Discovery, increase the value for this setting. The SNMP Timeout
should be at least a little more than double the time it takes a packet to
travel the longest route between devices on your network.
c. Position the slider or type a value, in ms, to set the Search Timeout.
Note: The Search Timeout is the amount of time Network Sonar Discovery waits to determine if a given IP address has a network device
assigned to it.
d. Position the slider or type a value to set the number of SNMP Retries.
Note: This value is the number of times Network Sonar Discovery will
retry a failed SNMP request, defined as any SNMP request that does
not receive a response within the SNMP Timeout defined above.
e. Position the slider or type a value to set the Hop Count.
Note: If the Hop Count is greater than zero, Network Sonar Discovery
searches for devices connected to any discovered device. Each connection to a discovered device counts as a hop.
f. Position the slider or type a value to set the Discovery Timeout.
Note: The Discovery Timeout is the amount of time, in minutes, Network Sonar Discovery is allowed to complete a network discovery. If a

272

Chapter 7: Discovering and Adding Nodes on a Network

14.

15.
16.
17.

discovery takes longer than the Discovery Timeout value provided, the
discovery is terminated.
If you only want to use SNMP to discover devices on your network,
check Use SNMP only.
Note: By default, Network Sonar uses ICMP ping requests to locate
devices. Most information about monitored network objects is obtained
using SNMP queries.
If multiple SolarWinds polling engines are available in your environment, select the Polling Engine you want to use for this discovery.
Click Next.
If you want the discovery you are currently defining to run on a regular schedule, select either Custom or Daily as the discovery
Frequency, as shown in the following steps:
Notes:
l Scheduled discovery profiles should not use IP address ranges that
include nodes with dynamically assigned IP addresses (DHCP).
l Default Discovery Scheduling settings execute a single discovery of
your network that starts immediately, once you click Discover.
l Results of scheduled discoveries are maintained on the Scheduled
Discovery Results tab of Network Discovery. For more information
about managing scheduled discovery results, see Managing Scheduled Discovery Results on page275.
a. If you want to define a custom discovery schedule to perform the
currently defined discovery repeatedly in the future, select Custom
and then provide the period of time, in hours, between discoveries.
b. If you want your scheduled discovery to run once daily, select
Daily, and then provide the time at which you want your discovery to
run every day, using the format HH:MM AM/PM.
18. If you do not want to run your network discovery at this time,
select No, dont run now, and then click Save or Schedule,
depending on whether you have configured the discovery to run
once or on a schedule, respectively.
19. If you want your Network Sonar discovery to run now, click Discover to start your network discovery.

273

Using the Network Sonar Results Wizard

Note: Because some devices may serve as both routers and

switches, the total number of nodes discovered may be less than
the sum of reported routers discovered plus reported switches discovered.

Using the Network Sonar Results Wizard

The Network Sonar Results Wizard directs you through the selection of nodes for
monitoring opens whenever discovery results are requested. This will happen
either when the Network Sonar Wizard completes or when Import All Results or
Import New Results is clicked for a selected discovery.
The following steps detail the selection of discovered nodes for monitoring in
SolarWinds SAM.
To select the results of a network discovery for monitoring in SAM:
1. On the Device Types to Import page, check the device types you want to
monitor, and then click Next.
Note: If you are not sure if you want to monitor a specific device type,
check the device type in question. Later, you can delete the device using
Web Node Management.
2. On the Volume Types to Import page, check the volume types you want to
monitor, and then click Next.
Note: If you are not sure you want to monitor a specific volume type, check
the volume type in question. Later, you can delete the volume of the selected type using Web Node Management.
3. If you want to import nodes, even when they are already known to be
polled by another polling engine, check the option in the Allow

274

Chapter 7: Discovering and Adding Nodes on a Network

Duplicate Nodes section. For more information about working with multiple polling engines, see Managing SolarWinds SAM Polling Engines on
page311.
4. If there are any devices on the Import Preview that you do not ever
want to import, check the device to ignore, and then click Ignore. Selected nodes are added to the Discovery Ignore List. For more information,
see Using the Discovery Ignore List on page276.
5. Confirm that the network objects you want to monitor are checked on the
Import Preview page, and then click Import.
Note: Imported devices display in the All Nodes resource.

Managing Scheduled Discovery Results

The Scheduled Discovery Results tab of Network Discovery provides a list of all
recently discovered, changed, or imported devices on your monitored network.
Results are compared between discoveries and results are listed on this tab. The
following procedure provides guidelines for managing discovery results.
To manage scheduled discovery results:
1. Click Start> All Programs> SolarWinds > Configuration and AutoDiscovery> NetworkDiscovery.
2. Click Scheduled Discovery Results.
3. Select the type of devices you want to view from the Status menu in the left
pane. The following options are available:
o Select Found to view all devices discovered by a scheduled discovery.
o Select Changed to view all devices that have changed between
recent scheduled discoveries. Changes include the addition of
device configuration changes.
o Select Imported to view all devices you have recently imported to
your SolarWinds database. For more information about importing
devices, see Using the Network Sonar Results Wizard on
page274.
o Select Ignored to view all devices you have added to your Discovery Ignore List. For more information about the Discovery Ignore
List, see Using the Discovery Ignore List on page276.
o Select Found and Changed to view a combined list of all devices
found or changed as described above.

275

Using the Discovery Ignore List

Select All except Ignored to view all discovered, changed or imported devices you have not already designated as Ignored, as
detailed above.
4. If you want to apply a grouping criterion to organize your listed results, select an appropriate criterion from the Group by menu in the left
pane.
5. If there are changed or discovered nodes in the results list that you
want to add to your SolarWinds database, check them and then click
Import Nodes.
6. If there are devices you want SolarWinds SAM to ignore in future discoveries, regardless of discovered updates or changes, check the
nodes to ignore, and then click Add to Ignore List. For more information
about the Discovery Ignore List, see Using the Discovery Ignore List on
page276.
o

Using the Discovery Ignore List

Often, devices are found during a network discovery that you never intend to
monitor with SolarWinds SAM. The Discovery Ignore List is a record of all such
devices on your network. By placing a device on the Discovery Ignore List you
can minimize the SNMP processing load associated with discovering devices
that you never intend to monitor.
To manage devices on the Discovery Ignore List:
1. Click Start> All Programs> SolarWinds> Configuration and AutoDiscovery> NetworkDiscovery.
2. If you want to view the current Discovery Ignore List, click Discovery
Ignore List.
3. If you want to add devices to the Discovery Ignore List, complete the
following procedure:
a. Click Scheduled Discovery Results.
b. Check devices you want to ignore, and then click Add to Ignore List.
4. If you want to remove devices from the Discovery Ignore List, complete the following procedure:
a. Click Scheduled Discovery Results, and then
b. Check the devices you want to remove from the list.
c. Click Remove from Ignore List.
d. Confirm that you want to stop ignoring the selected items by clicking
OK.

276

Chapter 7: Discovering and Adding Nodes on a Network

After the Network Sonar Wizard completes the node discovery and imports the
results, you are taken directly to the Application Discovery Wizard to discover
applications to monitor on the nodes.
For more information, see "Application Discovery" on page 278.

277

Chapter 8:
Application Discovery
SolarWinds SAM can scan nodes and automatically assign the Application
Monitors it deems suitable for each scanned node. You control the nodes to be
scanned, the application templates used in the scan, and the scanning
parameters that determine a match.
To Access Application Discovery:
1. Click Settings at the top right of the SolarWinds Web Console.
2. Now click Discovery Central in the Getting Started with SolarWinds category.
3. In the Application Discovery category, click Discover Applications to
begin using the wizard-like interface.
For more information, see "Add Application Monitors" on page 280.
Select Nodes
1. Click [+] in the list to expand the node groups and to select the nodes you
want to scan.
2. When you are finished selecting nodes, click Next.
Select Applications
To keep the scanning time to a minimum, we recommend you initially
scan for a limited number of application templates. To see more
application templates, select a different template group from the Show
Only list.
To adjust the template assignment criteria, expand Advanced Scan
Settings and move the slider to the desired setting:
Exact Match
All the components must match to assign the template.
Strong Match
Most of the components must match to assign the template.

278

Chapter 8: Application Discovery

Partial Match
Some of the components must match to assign the template.
Minimal Match
At least one component must match to assign the template.
When you are finished selecting applications, click Next.
Enter Credentials
Some application templates require credentials either to access
restricted resources, or to run within the context of a specific user. To
scan for these templates, add the necessary credentials to the list. If a
template you are scanning for requires credentials, the credentials in
this list are tried in the order in which they appear.
Warning: Credentials are tried several times over the course of a
scan, so an incorrect password is likely to lock out an account. To
avoid potential account lockouts that affect actual users, we
recommend you create and use service accounts. A service account is
an account created specifically for the purpose of providing
credentials to use for SolarWinds monitoring. With service accounts,
no actual user is affected by an account lockout if a password should
be entered incorrectly.
If you have domains sharing user names with different passwords, we
recommend you run separate application discoveries for each domain.
When you are finished entering credentials, click Next.
Review and Start Scan
Review the summary for the scan. If the automatic discovery matches
templates that are already assigned to the node, by default the
template is not assigned a second time. If you want to assign duplicate
templates, select Yes, Assign Anyway from the Do you want to
assign duplicates list.
Click Start Scan to begin the scan. The scan runs in the background.
If you like, click View progress near the light bulb icon toward the top
of the page to view the progress of the scan. You are notified by a
message near the top of the window when scanning is completed.
Click View Results to see the results of the scan. Click View SAM

279

Add UX Monitors
Summary Page (or > SAM Application Summary) to display the
SAM summary page.
Add UX Monitors
You cannot scan for user experience (UX) monitors, but you can
assign them to nodes manually. Adding monitors from this page does
not affect your scan.

Add Application Monitors

After adding individual nodes, you are prompted by the Add Application
Monitors page to add applications for monitoring the desired application(s) on
the new node as described below.
To add Application Monitors on the Add Application Monitors page:
1. Use the Show Only list to select the desired category for the Application
Monitors you want to add.
2. Check the check box next to the Application Monitor(s) you want to assign.
3. The selected Application Monitor(s) are added to the list of Selected applications.
4. If you change your mind and want to delete an application, click the
red X next to the name of the application in the Selected applications list.
5. If suitable credentials already exist, choose the credential from the
Choose Credential list.
6. If suitable credentials do not exist, choose <New Credential> from the
Choose Credential list, and then add the new credential by filling out the
credential details.
7. Click Test to test the credentials and component monitors against the test
node.
8. If the test fails, troubleshoot the problem based on the error messages,
and then retest the node.
9. Click Next.
10. On the Change Properties page, modify any of the information as
needed, such as the Node Status Polling interval (in seconds) and the
Collect Statistics Every frequency (in minutes).
11. Click OK, Add Node.

280

Chapter 8: Application Discovery

Reading the Application Summary

The SAM Application Summary is the first view displayed after launching Server
& Application Monitor. This view provides insight into application health and
performance conditions over your entire network. The resources listed in this
section are the default views included in the SAM Application Summary.

Active Application Alerts

This resource provides the current application-specific alerts, including the time
the alert fired, the name of the application that caused the alert, and the alert
message. Click the Network Node to see the SolarWinds Node Details view.
Click the Application Name to see the SAM Application Details view.

Application Health Overview

This resource provides a status overview of all your assigned application
monitors. Click a status to list the assigned application monitors in that status.

The following statuses are depicted on the Application Health Overview:

Application Up
Assigned application monitors with all component monitors responding and
operating within their thresholds.
Application Critical
Assigned application monitors with at least one component monitor
operating past the critical threshold.

281

Applications with Problems

Application Down
Assigned application monitors with at least one unresponsive component
monitor.
Application Warning
Assigned application monitors with at least one component monitor
operating past the warning threshold.
Other
Assigned application monitors that are suspended due to licensing
restrictions.
Unknown
Assigned application monitors with status that cannot yet be determined.

Applications with Problems

This resource lists the assigned application monitors reporting any status other
than up.

Last 25 Application Events

This resource provides a list of application-centric events from the time period you
specify. The default time period shows the last 25 application events. Clicking
Edit allows you to change the time period, limiting the events displayed in the
resource.

282

Chapter 8: Application Discovery

Thwack Latest Application Templates

This resource lists the newest application monitor templates that have been
added to the Thwack community web site. Click a template to open its download
web page.

Top 10 Components Monitored by Response Time

This resource provides a list of the component monitors with the slowest
response time.

Top 10 Processes Monitored by CPU Load

This resource provides a list of the component monitors consuming the most
CPU.

Top 10 Processes Monitored by Physical Memory

This resource provides a list of the component monitors consuming the most
physical memory.

283

Top 10 Processes Monitored by Virtual Memory

Top 10 Processes Monitored by Virtual Memory

This resource provides a list of the component monitors consuming the most
virtual memory.

Top XX Monitored Processes by I/O Reads/Sec

This resource displays the total number of I/O Read operations per second.

Fields:
l

Process Name: Displays the name of the listed process. Clicking a process in the list will take you to the Component Details page for that process.
Application Name: Displays the name of the listed application that contains the listed process. Clicking an application in the list will take you to
the Application Details page for that application.

284

Chapter 8: Application Discovery

Network Node: Displays the name of the listed node that contains the listed application and process. Clicking a node in the list will take you to the
Node Details page for that node.
IO Reads: Displays the current rate of Input/Output reads.

Note: Clicking Edit will allow you to change the Title, Sub-Title, and Maximum
Number of Monitors to Display.
Hovering the mouse over any part of this resource will reveal a tooltip with
detailed information about the item listed.
For more information, see the following:
l
l

Top XX Monitored Processes by I/O Writes/Sec

Top XX Monitored Processes by I/O Total Operations/Sec

Top XX Monitored Processes by I/O Writes/Sec

This resource displays the total number of I/O Write operations per second.

Fields:
l

Process Name: Displays the name of the listed process. Clicking a process in the list will take you to the Component Details page for that process.
Application Name: Displays the name of the listed application that contains the listed process. Clicking an application in the list will take you to
the Application Details page for that application.
Network Node: Displays the name of the listed node that contains the listed application and process. Clicking a node in the list will take you to the
Node Details page for that node.
IO Writes: Displays the current rate of Input/Output writes.

285

Top XX Monitored Processes by I/O Total Operations/Sec

Note: Clicking Edit will allow you to change the Title, Sub-Title, and Maximum
Number of Monitors to Display.
Hovering the mouse over any part of this resource will reveal a tooltip with
detailed information about the item listed.
For more information, see the following:
l
l

Top XX Monitored Processes by I/O Reads/Sec

Top XX Monitored Processes by I/O Total Operations/Sec

Top XX Monitored Processes by I/O Total Operations/Sec

This resource displays the total number of I/O operations per second.

Fields:
l

Process Name: Displays the name of the listed process. Clicking a process in the list will take you to the Component Details page for that process.
Application Name: Displays the name of the listed application that contains the listed process. Clicking an application in the list will take you to
the Application Details page for that application.
Network Node: Displays the name of the listed node that contains the listed application and process. Clicking a node in the list will take you to the
Node Details page for that node.
Total IOPS: Displays the current rate of Input/Output.

Note: Clicking Edit will allow you to change the Title, Sub-Title, and Maximum
Number of Monitors to Display.
Hovering the mouse over any part of this resource will reveal a tooltip with
detailed information about the item listed.
For more information, see the following:

286

Chapter 8: Application Discovery

l
l

Top XX Monitored Processes by I/O Reads/Sec

Top XX Monitored Processes by I/O Writes/Sec

Server Warranty Summary

This resource displays warranties currently expired and set to expire on the
current node. This is done by SAM periodically checking the status of each
server's warranty against Dell, HP, and IBM's online warranty validation servers.
Clicking a node in the summary list will take you the Node Details view for that
node. You can expand and collapse the tree views by clicking [+] and [-]
respectively.
You can visually see warranties nearing their expiration dates by examining the
dates in the Expiration Date column. Also, if a warranty expiration date crosses a
Warning or Critical threshold, progress bars will appear as yellow and red,
respectively. Clicking Edit will allow you to customize threshold values as well as
filter the warranties you want displayed.

287

Server Warranty Summary Alerts

l
l

Expired Warranties: Lists the nodes that currently have expired warranties.
Warranties Due to Expire: Lists the nodes that have warranties nearing
their expiration date.
Next 5 Warranties Set to Expire: Lists the top five warranties nearing their
expiration date.

Clicking Edit will allow you to fine tune the information displayed in this resource,
as shown below:

Server Warranty Summary Alerts

One alert is included with Server Warranty Summary:
1. Alert me when a node warranty expires in 30 days - Disabled by default

288

Chapter 9:
Managing Groups and Dependencies
Groups and dependencies enable you to more effectively manage your network.
Groups give you the ability to logically organize monitored objects, regardless of
device type or location, and dependencies allow you to more faithfully represent
what can actually be known about the nodes of your network, eliminating false
positive alert triggers and providing more accurate insight into the state of your
nodes.
Groups contain SolarWinds objects that report a status such as nodes, volumes,
applications, and even other groups. You create, delete, and modify groups from
the Manage Groups page.
Note: Nesting a group within another does not create a strict parent/child
relationship. You can include any group as a member in any number of other
groups.
To access the Manage Groups page:
1. Log on to the SolarWinds Web Console.
2. Click Settings in the top right of the web console.
3. Click Manage Groups in the Node & Group Management grouping of the
SolarWinds Website Administration page.
The following sections provide more information about creating and managing
groups in SAM:
l
l

Creating Groups
Managing the Display of Group Status

Creating Groups
Creating a group is a straightforward process of selecting the SolarWinds objects
you want the group to contain. At creation time, you can also decide how you
want SolarWinds to roll up the status of the group members.

289

Chapter 9: Managing Groups and Dependencies

It is also possible to specify group members on the basis of shared properties by
adding them with a dynamic query. SolarWinds objects added through dynamic
queries are automatically added or removed from the group.
Refer to the following sections for more information:
l
l
l
l

Editing Groups
Managing Group Members
Deleting Groups
Managing the Display of Group Status

To create a new group:

1. Click Start> All Programs> SolarWinds> Orion Web Console.
2. Click Settings in the top right of the web console.
3. Click Manage Groups in the Node & Group Management grouping of the
SolarWinds Website Administration page.
4. Click Add New Group.
5. Enter a name for the group in the Name field, and then expand Advanced.
6. If you want the group to roll up the worst status of the group
members, select Show Worst Status.
7. If you want the group to roll up the best status of the group members,
select Show Best Status.
8. If you want the group to display a warning status if the group members have a mixture of different statuses, select Mixed Status shows
warning.
9. Click Next.
10. If you want to individually select group members, follow these steps:
a. In the Show Only list, select the type of SolarWinds object you want to
add as a group member.
b. Check the check box of the SolarWinds object and then click Add to
Group.
11. If you want to dynamically select group members based on shared
properties, follow these steps:
a. Click Add dynamic query.
b. Type a name for the query in the Dynamic query object name
field.
c. Select a SolarWinds object type in the SolarWinds Object is
list.
d. Click Add Condition to specify further selection properties.
Note: Use the question mark (?) character as a multiple

290

Editing Groups
character wildcard. Use the underscore (_) character as a
single character wildcard.
e. Click Preview to verify that the dynamic query is selecting your
intended objects.
f. Click Save.
12. Continue adding individual SolarWinds objects or dynamic queries until
you have finished building your group.
13. Click Create Group.

Editing Groups
You can edit the properties of an existing group or add and remove objects.
These are separate editing tasks.
To edit properties of an existing group:
1. Click Start> All Programs> SolarWinds > Orion Web Console.
2. Click Settings in the top right of the web console.
3. Click Manage Groups in the Node & Group Management grouping of the
SolarWinds Website Administration page.
4. Check the group you want to edit, and then click Edit Properties.
5. Edit the Name and Description of the selected group, as appropriate.
6. If you want to manage the members of the selected group, click Add &
Remove Objects. For more information about managing group members,
see Managing Group Members on page291.
Note: Expand the Contains summary for the selected group to see all
member objects in the group.
7. If you want to configure the calculation of displayed group status or
the frequency with which group status is refreshed, expand
Advanced, select a Status rollup mode, and then provide a Refresh frequency.
Note: For more information about status rollup for groups, see Managing
the Display of Group Status on page292.
8. Click Submit.

Managing Group Members

The following procedure manages the objects included within a defined group.

291

Chapter 9: Managing Groups and Dependencies

To add and remove the objects of an existing group:
1. Click Start> All Programs> SolarWinds > Orion Web Console.
2. Click Settings in the top right of the web console, and then click Manage
Groups in the Node & Group Management grouping of the SolarWinds
Website Administration page.
3. Check the group you want to edit, and then click Add & Remove Objects.

Deleting Groups
Deleting an existing dependency is a straightforward process, as shown in the
following procedure.
To delete a group:
1. Click Start> All Programs> SolarWinds > Orion Web Console.
2. Click Settings in the top right of the web console, and then click Manage
Groups in the Node & Group Management grouping of the SolarWinds
Website Administration page.
3. Check the group you want to delete, and then click Delete.

Managing the Display of Group Status

The status of any particular group is determined by the status of the members of
the group. There are three methods for determining the status displayed for a
selected group of monitored objects:
Note: For more information about object states in SolarWinds, see Status Icons
and Identifiers on page938.
Show Best Status is most useful for displaying groups that are defined as
collections of redundant or backup devices. The following table indicates how
the Show Best Status option operates:
Note: Compare Group Status results under the Show Best Status option with
results for the same groups of objects under the Show Worst Status option.
Object States
(Up, Warning, Down)
(Warning, Down)
(Warning, Down, Unknown)

Group Status
(Up)
(Up)
(Warning)

292

To configure the method used to determine the status of a selected group:

Show Worst Status ensures that the worst status in a group of objects is
displayed for the whole group. The following table indicates how the Show Worst
Status option operates:
Object States

Group Status

(Up, Warning, Down)

(Down)

(Warning, Down)

(Warning)

(Warning, Down, Unknown)

(Down)

Mixed Status shows Warning ensures that the status of a group displays the
worst warning-type state in the group. If there are no warning-type states, but the
group contains a mix of up and down states, then a Mixed Availability ( ) warning
status is displayed for the whole group. The following table indicates how the
Mixed Status shows Warning option operates:
Object States Group Status
(Critical)
(Critical)
(Mixed Availability)
The following procedure configures the method used to determine group status.
To configure the method used to determine the status of a selected group:
1. Click Start> All Programs> SolarWinds > SolarWinds Web Console.
2. Settings in the top right of the web console, and then click Manage
Groups in the Node & Group Management grouping of the SolarWinds
Website Administration page.
3. Check the group you want to edit, and then click Edit Properties.
4. Expand Advanced, and then select a Status rollup mode, as follows:
a. If you want the group to roll up the worst status of the group members, select Show Worst Status.
b. If you want the group to roll up the best status of the group members, select Show Best Status.
c. If you want the group to display a warning status if the group members have a mixture of different statuses, select Mixed Status
shows warning.

293

Chapter 9: Managing Groups and Dependencies

5. Click Submit.

Managing Dependencies
Dependencies in SolarWinds allow you to account for topological constraints on
your network. These constraints may be either the result of the design of a
specific device, or the result of the physical architecture of your network itself.
SolarWinds offers an Unreachable status to account for the case when a device
may appear to be down when its status is actually indeterminate, due to another
device being down or unresponsive.
Likewise, SolarWinds also makes it possible to define dependencies among
distinct devices, as in the case of a subnet of devices on your network that
depends on a single WAN link to connect with the rest of your network. In this
case, if you have defined a group consisting of the devices in this dependent
subnet, you can then define a dependency where the dependent subnet is a child
group to the parent router that is serving as the WAN link to the rest of your
network. For more information about groups, see Managing Groups and
Dependencies" on page 289.
The power of dependencies becomes evident when considering alerts. If you
have an alert configured to trigger when a monitored object is down, you only
want that alert to trigger if a monitored objects is positively down. In other words,
you do not want an down object alert to trigger for an object that is not actually
down. Without dependencies, all monitored objects on a monitored node that is
unresponsive to ICMP queries will also report as down. With dependencies in
use, these child objects will instead display as Unreachable, saving you the
hassle of sorting through numerous false alerts resulting from the failure of a
single node to respond promptly to a status query.
Refer to the following sections for more information:
l
l
l
l

Creating a Dependency
Editing a Dependency
Deleting a Dependency
Viewing Alerts on Child Objects

Creating a Dependency
Creating a new dependency is a straightforward process of selecting the parent
and children objects, as shown in the following procedure.

294

To create a dependency:
To create a dependency:
1. Click Start> All Programs> SolarWinds > SolarWinds Web Console.
2. Click Settings in the top right of the web console, and then click Manage
Dependencies in the Node & Group Management grouping of the
SolarWinds Website Administration page.
3. Click Add new dependency.
4. On the Select Parent page, complete the following steps:
a. Use the Show only: and Group by: selection fields to customize the
list of displayed objects and groups.
Note: The properties listed in the Group by selection field are
dynamic.
b. Select the parent object or group in the main pane, and then click Next.
Note: If you want to define a dependency so that the reported states of
child objects are dependent on the status of multiple parent objects, create a group including all parent objects, and then select it on this view.
For more information, see Creating Groups on page289.
5. On the Choose Child page, complete the following steps:
a. Edit the Dependency name, as appropriate.
b. Use the Show only: and Group by: selection fields to customize the
list of displayed objects and groups.
Note: Properties listed in the Group by: selection field are dynamically
dependent on the selection in the Show only: field.
c. Select the child object or group in the main pane, and then click Next.
Note: If you want to define a dependency so that the reported states of
multiple child objects are dependent on the status one or more parent
objects, create a group including all child objects, and then select it on
this view. For more information, see Creating Groups on page289.
6. On the Review Dependency view, review the current settings for the configured dependency.
Notes:
l If any advanced alerts are configured on parent or child objects,
they will be listed on this view. Click [+] to expand alert details.
l In the event that a parent object is down, all alerts configured on any
child objects in a dependency on the down parent object are automatically suppressed.
7. Click Submit to accept the dependency definition.

295

Chapter 9: Managing Groups and Dependencies

Editing a Dependency
Editing an existing dependency is a straightforward process, as shown in the
following procedure.
To edit an existing dependency:
1. Click Start> All Programs> SolarWinds> SolarWinds Web Console.
2. Click Settings in the top right of the web console, and then click Manage
Dependencies in the Node & Group Management grouping of the
SolarWinds Website Administration page.
3. Check the dependency you want to edit, and then click Edit.
4. On the Select Parent page, complete the following steps:
a. Use the Show only: and Group by: selection fields to customize the
list of displayed objects and groups.
Note: Properties listed in the Group by: selection field are dynamically
dependent on the selection in the Show only: field.
b. Select the parent object or group in the main pane, and then click Next.
Note: If you want to define a dependency so that the reported states of
child objects are dependent on the status of multiple parent objects, create a group including all parent objects, and then select it on this view.
For more information, see Creating Groups on page289.
5. On the Choose Child page, complete the following steps:
a. Edit the Dependency name, as appropriate.
b. Use the Show only: and Group by: selection fields to customize the
list of displayed objects and groups.
Note: Properties listed in the Group by: selection field are dynamically
dependent on the selection in the Show only: field.
c. Select the child object or group in the main pane, and then click Next.
Note: If you want to define a dependency so that the reported states of
multiple child objects are dependent on the status one or more parent
objects, create a group including all child objects, and then select it on
this view. For more information, see Creating Groups on page289.
6. On the Review Dependency view, review the current settings for the configured dependency.
Notes:
l If any advanced alerts are configured on parent or child objects,
they will be listed on this view. Click [+] to expand alert details.
l If a parent object is down, all alerts configured on any child objects
in a dependency on the down parent object are automatically suppressed.

296

Deleting a Dependency
7. Click Submit to accept the dependency definition.

Deleting a Dependency
Deleting an existing dependency is a straightforward process, as shown in the
following procedure.
To delete an existing dependency:
1. Click Start> All Programs> SolarWinds> SolarWinds Web Console.
2. Click Settings in the top right of the web console, and then click Manage
Dependencies in the Node & Group Management grouping of the
SolarWinds Website Administration page.
3. Check the dependency you want to delete, and then click Delete.
4. Click Yes to confirm deletion of the selected dependency.

Viewing Alerts on Child Objects

In the event that a parent object is down, all advanced alerts configured on any
child objects in a dependency on the down parent object are automatically
suppressed. The following procedure displays all advanced alerts currently
configured on any child objects in a selected dependency.
To view alerts on child objects in a selected dependency:
1. Click Start> All Programs> SolarWinds > SolarWinds Web Console.
2. Click Settings in the top right of the web console.
3. Click Manage Dependencies in the Node & Group Management grouping
of the SolarWinds Website Administration page.
4. Check the dependency that includes the child object on which the alerts
you want to view are configured, and then click Alerts on Child.

297

Chapter 10:
Managing Accounts
SolarWinds Web Console user accounts, permissions, and views are established
and maintained with the SolarWinds Account Manager. When Advanced
Customization is enabled on the SolarWinds Website Settings page, you can use
Account Manager to customize menu bars and views for different users. For more
information, see Customizing Views" on page 204.
Notes:
l This guide assumes that Advanced Customization has been enabled. If it
has not been enabled, the range of options available on the pages referenced in the following sections is much more limited. For more information, see Setting Account Limitations on page303.
l To prevent issues with web console accounts, your SQL Server should not
be configured with the no count connection option enabled. The no count
option is set in the Default connection options area of the Server
Properties> Connections window of SQL Server Management Studio
Refer to the following sections for more information:
l
l

Creating Accounts
Editing User Accounts

Creating Accounts
New SolarWinds Web Console user accounts may be created by any web
console administrator. The following procedure creates a new web console user
account.
To create a new user account:
1. Log in to the SolarWinds Web Console as an administrator.
2. Click Settings in the top right of the web console.
3. Click Manage Account in the Accounts grouping of the SolarWinds Website Administration page.
4. Click Add New Account.

298

Chapter 10: Managing Accounts

5. Select the type of account you want to add, and then click Next.
6. If you selected SolarWinds individual account, complete the following
steps:
a. Provide a User Name and a Password for the SolarWinds individual
account.
b. Confirm the password, and then click Next.
c. Define user settings and privileges, as appropriate. For more information, see Editing User Accounts on page299.
7. If you selected Windows individual account, complete the following
steps:
a. Provide the User Name and Password for a user that has administrative access to your Active Directory or local domain.
b. In the Search for Account area, enter the User name of the Active Directory or local domain user for whom you want to create a new web console account, and then click Search.
c. In the Add Users area, select the users for whom you want to create
new web console accounts, and then click Next.
8. If you selected Windows group account, complete the following steps:
a. Provide the User Name and Password for a user that has administrative access to your Active Directory or local domain.
b. In the Search for Account area, enter the Group name of the Active Directory or local domain group for which you want to create a new web
console account, and then click Search.
c. In the Add Users area, select the users for whom you want to create
new web console accounts, and then click Next.
When the new account is created, the Edit User Account view displays, showing
all configurable account options. For more information about editing account
settings, see Editing User Accounts on page299.

Editing User Accounts

The Edit User Account page provides options for configuring web console user
accounts. On the Edit User Account page, administrators can disable an account,
set an account expiration date, grant administrator and node management rights,
set user view limitations, define a default menu bar, and set several other defaults
defining how a user account views and uses the SolarWinds Web Console.

299

User Account Access Settings

The following sections and procedures detail the configuration of user accounts.
Note: To reset a password, click Change Password at the bottom of the page.
l
l
l
l
l
l

User Account Access Settings

Setting Account Limitations
Defining Pattern Limitations
Setting Default Account Menu Bars and Views
Configuring an Account Report Folder
Configuring Audible Web Alerts

User Account Access Settings

The following procedure is a guide to setting user account access.

300

Chapter 10: Managing Accounts

To edit a user account:
1. Log in to the SolarWinds Web Console as an administrator.
2. Click Settings in the top right of the web console.
3. Click Manage Accounts in the Accounts grouping of the SolarWinds Website Administration page.
4. Select the account that you want to edit, and then click Edit.
5. Set Account Enabled to Yes or No, as appropriate.
Note: Accounts are enabled by default, and disabling an account does not
delete it. Account definitions and details are stored in the SolarWinds database in the event that the account is enabled at a later time.
6. If you want the account to expire on a certain date, click Browse ()
next to the Account Expires field, and then select the account expiration
date using the calendar tool.
Note: By default, accounts are set to Never expire. Dates may be entered
in any format, and they will conform to the local settings on your computer.
7. If you want to allow the user to remain logged-in indefinitely, select
Yes for the Disable Session Timeout option.
Note: By default, for added security, new user accounts are configured to
timeout automatically.
8. If you want to grant administrator rights to the selected account, set
Allow Administrator Rights to Yes.
Notes:
l Granting administrator rights does not also assign the Admin menu
bar to a user. If the user requires access to Admin options, they must
be assigned the Admin view. For more information, see Setting
Default Account Menu Bars and Views on page305.
l Administrator rights are not granted by default, but they are required
to create, delete, and edit accounts. User accounts without administrator rights cannot access Admin page information.
9. If you want to allow the user to manage nodes directly from the
SolarWinds Web Console, set Allow Node Management Rights to Yes.
Note: By default, node management rights are not granted.
10. If you want to allow the user to customize views, set Allow Account to
Customize Views to Yes.
Note: By default, customized view creation is not allowed. Changes made
to a view are seen by all other users that have been assigned the same
view.
11. Designate whether or not to Allow Account to Clear Events and
Acknowledge Alerts.

301

Configuring Audible Web Alerts

12. Select whether or not to Allow Browser Integration.
Note: Browser integration can provide additional functionality, including
access to right-click menu options, depending on client browser capabilities.
13. If you want to enable audible alerts through the client browser, select
a sound from the Alert Sound list.
Note: By default, sounds are stored in the Sounds directory, located at
C:\Inetpub\SolarWinds\NetPerfMon\Sounds. Sounds in .wav format that are
added to this directory become available as soon as the Edit User Account
page refreshes.
14. Provide the maximum Number of items in the breadcrumb list.
Note: If this value is set to 0, all available items are shown in breadcrumb
dropdown lists.

Configuring Audible Web Alerts

When browsing the SolarWinds Web Console, audible alerts can be sounded
whenever new alerts are generated. When enabled, you will receive an audible
alert the first time, after login, that an alert is displayed on the page. This alert may
come from either an alert resource or the Alerts view. You will not receive audible
alerts if the Alerts view or the alert resource you are viewing is empty.

Following the initial alert sound, you will receive an audible alert every time an
alert is encountered that was triggered later than the latest alert that has already
been viewed.
For example, a user logs in and sees a group of alerts with trigger times ranging
from 9:01AM to 9:25AM, and the user receives an audible alert. If the user
browses to a new page or allows the current page to auto-refresh, a new alert
sounds if and only if an alert triggered later than 9:25AM is then displayed.

302

Chapter 10: Managing Accounts

To enable audible web alerts:
1. Log in to the SolarWinds Web Console as an administrator.
2. Click Settings in the top right of the web console.
3. Click Manage Accounts in the Accounts grouping of the SolarWinds Website Administration page.
4. Select the account you want to configure.
5. Click Edit.
6. Select the sound file you want to play when new alerts arrive from the Alert
Sound list.
Note: By default, sounds are stored in the Sounds directory, located at
C:\Inetpub\SolarWinds\NetPerfMon\Sounds. Sounds in .wav format that are
added to this directory become available as soon as the Edit User Account
page refreshes.
7. Click Submit.

Setting Account Limitations

Account limitations may be used to restrict user access to designated network
areas or to withhold certain types of information from designated users. The
following procedure sets user account limitations.

To set user account limitations:

1. Log in to the SolarWinds Web Console as an administrator.
2. Click Settings in the top right of the web console, and then click Manage
Accounts in the Accounts group of the SolarWinds Website Administration page.
3. If you want to limit an individual user account, complete the following
steps:
a. On the Individual Accounts tab, check the account you want to limit.
b. Click Edit.
c. Click Add Limitation in the Account Limitations section.
d. Select the type of limitation to apply, and then click Continue.
Notes:
l Because SolarWinds NetFlow Traffic Analyzer (NTA) initially
caches account limitations, it may take up to a minute for

303

To set user account limitations:

account limitations related to SolarWinds NTA to take effect in
SolarWinds NTA.
l Account limitations defined using the Account Limitation Builder
display as options on the Select Limitation page. Account limitations can be defined and set using almost any custom properties. For more information, see Creating Account Limitations
on page719.
e. Define the limitation as directed on the Configure Limitation page that
follows. For more information about defining pattern-type limitations,
see Defining Pattern Limitations on page305.
4. If you want to limit a group account, complete the following steps:
Note: Limitations applied to a selected group account only apply to the
group account and not, by extension, to the accounts of members of the
group.
a. On the Groups tab, check the group account you want to limit.
b. Click Edit.
c. Click Add Limitation in the Account Limitations section.
d. Select the type of limitation to apply, and then click Continue.
Notes:
l Because SolarWinds NetFlow Traffic Analyzer (NTA) initially
caches account limitations, it may take up to a minute for
account limitations related to SolarWinds NTA to take effect in
SolarWinds NTA.
l Account limitations defined using the Account Limitation Builder
display as options on the Select Limitation page. Account limitations can be defined and set using almost any custom properties. For more information, see Creating Account Limitations
on page719.
e. Define the limitation as directed on the Configure Limitation page that
follows. For more information about defining pattern-type limitations,
see Defining Pattern Limitations on page305.
5. Click Add Limitation in the Account Limitations section.
6. Select the type of limitation to apply from the list, and then click Continue.
Notes:
l Account limitations defined using the Account Limitation Builder display as options on the Select Limitation page. Account limitations
can be defined and set using almost any custom properties. For
more information, see Creating Account Limitations on page719.
l Because SolarWinds NetFlow Traffic Analyzer (NTA) initially
caches account limitations, it may take up to a minute for account

304

Chapter 10: Managing Accounts

limitations related to SolarWinds NTA to take effect in SolarWinds
NTA.
7. Define the limitation as directed on the Configure Limitation page that follows. For more information about defining pattern-type limitations, see
Defining Pattern Limitations on page305.

Defining Pattern Limitations

Pattern limitations may be defined using OR, AND, EXCEPT, and NOT operators
with _ and * as wildcard characters. The following examples show how to use
available operators and wildcard characters:
Note: Patterns are not case sensitive.
foo matches

only objects named "foo.

foo_ matches

all objects with names consisting of the string "foo" followed by only
one additional character, like foot or food, but not seafood or football.
foo* matches

all objects with names starting with the string "foo, like football or
food, but not seafood.
*foo* matches

all objects with names containing the string "foo, like seafood or

Bigfoot.
*foo* OR *soc* matches

all objects containing either the string "foo" or the string

"soc, including football, socks, soccer, and food.
*foo* AND *ball* matches

all objects containing both the string "foo" and the string
"ball, including football but excluding food.
*foo* NOT *ball* matches

all objects containing the string "foo" that do not also

contain the string "ball, including food but excluding football.
*foo* EXCEPT *ball* matches

all objects containing the string "foo" that do not also

contain the string "ball, including food but excluding football.
You may also group operators using parentheses, as in the following example.
(*foo* EXCEPT *b*) AND (*all* OR *sea*) matches seafood and footfall, but not football

or

Bigfoot.

Setting Default Account Menu Bars and Views

The Default Menu Bar and Views section provides several options for configuring
the default menu bar and views for your user account. The following procedure is
a guide to setting these options.

305

To set default menu bar and view options:

To set default menu bar and view options:

1. Log in to the SolarWinds Web Console as an administrator.
2. Click Settings in the top right of the web console, and then click Manage
Accounts in the Accounts grouping of the SolarWinds Website Administration page.
3. Select the account that you want to configure, and then click Edit.
4. Scroll down to Default Menu Bar and Views.
5. Select a Home Tab Menu Bar from the available list.
Note: This is the default menu bar displayed when you click Home in the
SolarWinds Web Console. If you are editing a user account that must have
administrator privileges, set the Home Tab Menu Bar to Admin.
6. Select an Application Tab Menu Bar from the available list.
Note: This is the default menu bar displayed when you click Applications
in the SolarWinds Web Console. If you are editing a user account that must
have administrator privileges, select Admin.
7. Select a Virtualization Tab Menu Bar from the available list.
Note: This is the default menu bar displayed when you click Virtualization
in the SolarWinds Web Console. If you are editing a user account that must
have administrator privileges, select Admin.
8. If you have installed any additional SolarWinds modules, select a
SolarWinds Module Tab Menu Bar from each available list.
Note: This step configures the default menu bar displayed when you click
the tab corresponding to an installed module in the SolarWinds Web

306

Chapter 10: Managing Accounts

9.

10.

11.
12.

13.

14.

15.

Console. If you are editing an account that must have administrator privileges, select Admin.
Select a Home Page View.
Note: If no Home Page View is specified, the default is designated to be
the same as the page that is specified in the Default Summary View field
below.
If the Home Page View you have selected refers to a specific network
device, select a Default Network Device by clicking Edit and selecting
from the list of available devices on the next page.
Note: If the Home Page View you have selected does not require a specific network device, SolarWinds will select a device to display, automatically.
Select a Default Summary View for the account.
Note: This is typically the same as the Home Page View.
If you want all reports to be available for the account, select \Reports
from the Report folder list in the Default Menu Bars and Views area.
Note: If you are creating a new user, you must designate the Report
Folder the new account is to use to access SolarWinds reports. By default,
no report folder is configured for new users. The Reports directory is located in the SolarWinds SAM installation directory:
C:\ProgramFiles\SolarWinds\Orion\.
If you want to designate default Node, Volume, and Group Details
Views for this account, expand SolarWinds General Settings, and then
select appropriate Node Detail, Volume Detail, and Group Detail Views.
If you want to designate default Virtualization Summary Manager,
Cluster Details, and Datacenter Details Views for this account, expand
Integrated Virtual Infrastructure Monitor Settings, and then select appropriate default views.
Click Submit.

Configuring an Account Report Folder

Reports may be assigned to an account by creating sub-directories within the
Reports directory. Desired reports are included within the sub-directory, and the
sub-directories are then made available for assignment to an account. This
provides a level of security when reports are included in a view or added as
custom menu items. For more information, see Creating and Editing External
Website Views on page224.

307

To configure an account report folder:

To configure an account report folder:
1. Log in to the SolarWinds Web Console as an administrator.
2. Click Settings in the top right of the web console, and then click Manage
Accounts in the Accounts group of the SolarWinds Website Administration page.
3. Select the account you want to configure, and then click Edit.
4. If you want all reports to be available for the account, select \Reports
from the Report folder list in the Default Menu Bars and Views area.
Note: If you are creating a new user, you must designate the Report
Folder the new account is to use to access SolarWinds reports. Bydefault,
no report folder is configured for new users. The Reports directory is located in the SolarWinds SAM installation directory:
C:\ProgramFiles\SolarWinds\Orion\.
5. Click Submit.

Server & Application Monitor Settings

From here, you can select the SAM defaults for the following, as shown in the
illustration below:

l
l
l

Application Summary View Select the default view.

Application Details View Select the default view.
Components Details View Select the default view.

308

Chapter 10: Managing Accounts

SAM User Role Select User or Admin.

Note: The SAM User Role allows you to define a SAM Administrator role
independent of an Orion Administrator role.
Real Time Process Explorer Allows you to select whether or not a user
can use the Real Time Process Explorer.
Service Control Manager Allows you to select whether or not a user can
use the Service Control Manager.
Allow Service Actions Rights Allows you to select whether or not a user
can start and stop services.
Allow rebooting node Allows you to select whether or not a user can
reboot a node remotely from the Node Details page and via the Management resource.
Note: By default, this option is not selected,
Temperature Unit - Allows you to select the default temperature unit displayed; Fahrenheit or Celsius. This will affect all charts that display temperature for the current user.

Orion General Settings

From here, you can select the Orion defaults for the following, as shown in the
illustration below:

Node Details View - This view is used when details about a single Network Node are displayed.
Volume Details View - This view is used when details about a single physical or logical Volume are displayed.
Group Details View - This view is used when details about a single Group
are displayed.

Integrated Virtual Infrastructure Monitor Settings

From here, you can select the Integrated Virtual Infrastructure defaults for the
following, as shown in the illustration below:

309

Integrated Virtual Infrastructure Monitor Settings

Virtualization Manager Summary View - This view is the target of the

"VMware Summary" link in the page header.
Cluster Details View - This view is used when details about a single
Cluster are displayed.
Datacenter Details View - This view is used when details about a single
Data Center are displayed

310

Chapter 11:
Managing SolarWinds SAM Polling
Engines
To ensure that your polling engines are optimized to run at peak performance,
you will need to occasionally tune them. If you use more than one polling engine,
you will need to balance the load so that each engine can perform optimally.
Refer to the following sections for more information:
l
l
l
l
l
l
l

Viewing Polling Engine Status

Configuring Polling Engine Settings
SolarWinds Polling Settings
Calculating Node Availability
Using the Polling Engine Load Balancer
Setting the Node Warning Level
Managing Packet Loss Reporting

Viewing Polling Engine Status

The SolarWinds Web Console provides the Polling Engines view, giving you
immediate insight into the performance of all polling engines in your SolarWinds
installation.
To display the Polling Engine view:
1. Log in to the SolarWinds Web Console as an administrator.
2. Click Settings in the top right of the web console.
3. Click Polling Engines in the Details group.
For more information about configuring the settings on this view in addition to
configuring all other available polling engine variables, see Configuring Polling
Engine Settings on page312.

311

Chapter 11: Managing SolarWinds SAM Polling Engines

Configuring Polling Engine Settings

Settings for your SolarWinds SAM polling engine are configured on the
SolarWinds Polling Settings view within the SolarWinds Web Console.
To open the SolarWinds Polling Settings view:
1. Log in to the SolarWinds Web Console as an administrator.
2. Click Settings in the top right of the web console.
3. Click Polling Settings in the Settings group.

SolarWinds Polling Settings

The following poller settings are configurable on the SolarWinds Polling Settings
view.
Refer to the following sections for more information:
l
l
l
l

Polling Intervals
Polling Statistics Intervals
Network
Calculations & Thresholds

Polling Intervals
The following settings configure default polling intervals. To apply poller settings,
click ReApply Polling Intervals.
Default Node Poll Interval
Devices are regularly polled to determine status and response time on this
designated interval. By default, this interval is 120 seconds.
Default Volume Poll Interval
Volumes are regularly polled to determine status and response time on this
designated interval. By default, this interval is 120 seconds.
Default Rediscovery Interval
Your entire network is polled on this interval to detect any re-indexed
devices. Monitored network devices are also checked for IOS upgrades
permitting EnergyWise support. By default, this interval is 30 minutes.
Lock custom values

312

Polling Statistics Intervals

This option is enabled by default. Enabling this option automatically saves
any polling customizations made on the SolarWinds Polling Settings view.

Polling Statistics Intervals

The following settings configure default polling intervals for device statistics. To
apply poller settings, click ReApply Polling Statistic Intervals.
Default Node Statistics Poll Interval
Device performance statistics are regularly polled on this interval. By
default, this interval is 10 minutes.
Default Volume Statistics Poll Interval
Volume performance statistics are regularly polled on this interval. By
default, this interval is 15 minutes.

Network
The following settings configure ICMP and SNMP requests.
ICMP Timeout
All ICMP (ping) requests made by the SolarWinds poller time out if a
response is not received within the period designated. By default, this
period is 2500ms.
ICMP Data
This string is included within all ICMP packets sent by SolarWinds.
SNMP Timeout
All SNMP requests made by the SolarWinds poller time out if a response is
not received within the period designated. By default, this period is 2500ms.
SNMP Retries
If a response to an SNMP poll request made by the SolarWinds poller is not
received within the configured SNMP Timeout, the SolarWinds poller will
conduct as many retries as designated by this value. By default, this value is
2.

Calculations & Thresholds

The following settings designate methods for calculating availability and
transmission rate baselines, select the SolarWinds SAM node warning level and

313

Chapter 11: Managing SolarWinds SAM Polling Engines

counter type, and indicate security preferences for community strings and other
potentially sensitive information in the web console.
Availability Calculation (advanced)
This setting designates the type of calculation SolarWinds SAM performs to
determine device availability. For more information, see Calculating Node
Availability on page314.
Baseline Calculation (advanced)
Upon startup, SolarWinds can calculate a baseline for the transmission
rates of the various elements of your network. This baseline is used as a
starting point for any comparison statistics. For more information, see
Calculating a Baseline on page315.
Allow Secure Data on Web (advanced)
In the interest of security, sensitive information about your network is not
viewable in the SolarWinds Web Console. However, if your network is
properly secured, you may check this option to allow the viewing of
community strings and other potentially sensitive information within the web
console.
Note: This setting does not affect the display of custom reports that you
export to the web. For more information see Creating and Viewing Reports
on page772.
Node Warning Level
Devices that do not respond to polling within this designated period of time
display as Down in the web console. By default, this value is 120 seconds.
Counter Rollover
This option sets the type of counter SolarWinds SAM is to use. For more
information, see Handling Counter Rollovers on page201.

Calculating Node Availability

The Availability Calculation setting on the SolarWinds Polling Settings view
provides a choice between the following two methods for determining device
availability.

314

Node Status:
Node Status:
The default method is based upon the historical up or down status of the selected
node. The selected node is polled for status on the Default Node Poll Interval
defined on the SolarWinds Polling Settings view. For more information, see
SolarWinds Polling Settings on page312.
If the selected node responds to a ping within the default interval, the node is
considered up, and a value of 100 is recorded in the Response Time table of the
SolarWinds database. If the node does not respond to a ping within the default
interval, the node is considered down and a value of 0 is recorded in the
Response Time table of the SolarWinds database. To calculate node availability
over a selected time period, the sum of all Response Time table records for the
selected node over the selected time period is divided by the selected time
period, providing an average availability over the selected time period.
Percent Packet Loss:
The second method is a more complicated calculation that effectively bases the
availability of a selected node on its packet loss percentage. As in the Node
Status method, the selected node is polled for status. If it responds within the
Default Node Poll Interval defined on the SolarWinds Polling Settings view, a
value of 100 is averaged with the previous 10 availability records. For more
information, see SolarWinds Polling Settings on page312.
The result of the Percent Packet Loss calculation is a sliding-window average. To
calculate node availability over a selected time period, the sum of all results in the
Response Time table for the selected node over the selected time period is
divided by the selected time period, providing an average availability over time.
Note: The Percent Packet Loss method introduces a historical dependency into
each availability node record. In general, it is best to leave calculations based on
Node Status unless you specifically need node availability based on packet loss.

Calculating a Baseline
Much of the raw data that SolarWinds SAM polls from nodes is provided initially
as counter values. If you do not need statistics immediately, or if you do not want
SolarWinds SAM to calculate a baseline at startup, disable baseline calculation
at startup by setting the Baseline Calculation option on the SolarWinds Polling
Settings view to False. For more information, see Configuring Polling Engine
Settings on page312.

315

Chapter 11: Managing SolarWinds SAM Polling Engines

Note: Baseline calculation requires significant data gathering and processing.
Until baseline calculation is completed, both SolarWinds SAM server
performance and the CPU performance of some of network routers may be
adversely affected.

Using the Polling Engine Load Balancer

The Polling Engine Load Balancer is a useful tool for reassigning nodes to a new
polling engine, deleting an unused polling engine, and performing load balancing
between multiple polling engines. The tool is available within the Monitor Polling
Engines application, which is an advanced feature of SolarWinds SAM.
Reassigning nodes to new polling engines may be required in the following
situations:
l
l

Moving or renaming your SolarWinds SAM server

Merging two or more SolarWinds servers

If these or any other conditions present the need for reassignment, complete the
following procedure to reassign nodes to a new polling engine.
To reassign nodes to a different polling engine:
1. Click Start> All Programs> SolarWinds > Advanced Features>
SolarWinds Service Manager.
2. Click Shutdown Everything.
Note: Confirm that you stop the SolarWinds Network Performance Monitor
Service on all polling engines.
3. Click Start> All Programs> SolarWinds > Advanced Features> Monitor Polling Engines.
4. Click Servers> Poller Load Balancing.
5. Select the nodes you want to reassign.
Note: Use Shift+click to highlight multiple consecutive rows, and use
Ctrl+click to highlight multiple non-consecutive rows.
6. Click Polling Engines> Move Selected Nodes to *, substituting the target polling engine for *. The node is reassigned, and it reflects the name of
the polling engine in the polling engine column.
7. Click Start> All Programs> SolarWinds > Advanced Features>
SolarWinds Service Manager to restart SolarWinds services.

316

Setting the Node Warning Level

Setting the Node Warning Level

A device may drop packets or fail to respond to a poll for many reasons. Should
the device fail to respond, the device status is changed from Up to Warning. On
the SolarWinds Polling Settings view, you can specify the Node Warning Level,
which is the length of time a device is allowed to remain in the Warning status
before it is marked as Down. During the interval specified, the service performs
"fast polling" (ICMP) to continually check the node status.
Note: You may see events or receive alerts for down nodes that are not actually
down. This can be caused by intermittent packet loss on the network. Set the
Node Warning Interval to a higher value to avoid these false notifications. For
more information about packet loss reporting, see Managing Packet Loss
Reporting on page317.
To set the Node Warning Level:
1. Log in to the SolarWinds Web Console using an account with administrative rights.
2. Click Settings in the upper right of the web console, and then click Polling
Settings in the Settings group of the SolarWinds Website Administration
view.
3. In the Calculations and Thresholds group, set the Node Warning Level to
an appropriate interval, in seconds.
Note: The default Node Warning Level interval is 120 seconds.
4. Click Submit.

Managing Packet Loss Reporting

To manage the amount of network-wide packet loss reported by SolarWinds,
configure the Response Time Retry Count for your polling engine. This setting
designates the number of times SolarWinds retries ICMP pings on a monitored
device before packet loss is reported.
Note: This configuration change requires an insertion into your SolarWinds
database. If possible in your environment, SolarWinds recommends installing and
using the SQL Server Management Studio to perform this insertion.
To configure the Response Time Retry Count for your polling engine:
1. Create a full backup of your SolarWinds database.
2. On your SolarWinds server, click Start> All Programs> SolarWinds >
Advanced Features> SolarWinds Service Manager.

317

Chapter 11: Managing SolarWinds SAM Polling Engines

3. Click Shutdown Everything.
4. On your SolarWinds database server, click Start> All Programs>
Microsoft SQL Server> SQL Server Management Studio.
5. Select your SolarWinds database Server name.
6. Select an appropriate Authentication type, provide any required credentials, and then click Connect.
7. Expand Databases> SolarWindsDatabaseName> Tables.
8. Click New Query.
9. Type the following query into the empty SQL query field:
Note: Specify your own custom values for Maximum, CurrentValue, and
[Link] INTO [SolarWindsDatabaseName].[dbo].[Settings] (SettingID, Name, Description, Units, Minimum, Maximum, CurrentValue, DefaultValue)
VALUES (SWNetPerfMon-Settings-Response Time Retry Count, Response Time
Retry Count, Number of times SolarWinds retries ICMP pings on a monitored
device before reporting packet loss, , 1, Maximum, CurrentValue,

10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.

DefaultValue)
Click Execute.
Close SQL Server Management Studio.
On your SolarWinds server, click Start > Run, type regedit, and then click
OK.
Expand HKEY_LOCAL_MACHINE > SOFTWARE> [Link]>
SWNetPerfMon.
Right-click Settings, and then click New> String Value.
Enter Response Time Retry Count as the New Value.
Right-click Response Time Retry Count, and then click Modify.
In the Value data field, enter the CurrentValue provided in the query
above, and then click OK.
Close the Registry Editor.
Click Start> All Programs> SolarWinds > Advanced Features>
SolarWinds Service Manager.
Click Start Everything.

318

Chapter 12:
Virtualization
SolarWinds Integrated Virtual Infrastructure Monitoring (IVIM) built into
SolarWinds SAM lets you monitor today's modern network fabric of virtual
networks, virtualized data centers, and private clouds. The deep visibility into your
virtualized environments helps you ensure that network performance helps and
not hinders your virtualization projects
SAM is capable of monitoring VMware ESXi and ESX Servers versions 3.5 and
higher as well as Microsoft's Hyper-V up to and including Hyper-V 2012 R2.

Note: A node can either be a VMware ESX/vCenter server or Hyper-V server, not
both.

VMware Monitoring
Monitor your entire VMware virtual infrastructure from the highest to the lowest
level: vCenter datacenter cluster ESX hosts individual virtual
machines. Track availability and performance metrics including CPU, memory,
storage, and network bandwidth utilization
Virtual Machine Auto-Summary
Automatically discover identify and monitor new virtual machines added to any
VMware host server or updated during vMotion.

319

Chapter 12: Virtualization

Virtualization Alerting and Reporting
SolarWinds' native alerting and reporting capabilities extend seamlessly to your
virtual infrastructure.
Refer to the following sections for more information:
l
l
l
l
l
l

Requirements for Monitoring ESXi and ESX Servers

Managing VMware Credentials in the Web Console
Adding Virtual Servers for Monitoring
Virtualization Summary
Viewing ESX Host Details
Changing Polling Orders for ESX Servers

Requirements for Monitoring ESXi and ESX Servers

The following table provides minimal requirements for effectively using
SolarWinds SAM to monitor your VMware ESXi and ESX Servers.
Note: SolarWinds SAM uses the VMware API to poll most performance data from
devices running ESX Server versions 3.5 and 4.0. Before SAM can start polling
ESX Servers, you must ensure that you have created credentials on your ESX
Servers for the SAM polling engines. Information on how to do this can be found
here: KB Article 2177.
Credentials created for the SAM polling engines must have read-only rights, at
minimum.
Requirement

Description

SNMP

SolarWinds SAM uses SNMP to

monitor all ESXi and ESX Servers. For
more information about enabling
SNMP, refer to the following sections:
l

Enabling SNMP on VMware

ESXi
Enabling SNMP on ESX Server
Version 3.5
Enabling SNMP on ESX Server
Version 4.0
Creating ESX Server Credentials for SolarWinds SAM

320

Requirements for Monitoring ESXi and ESX Servers

VMware API

SolarWinds SAM uses the VMware

API to poll most performance data from
devices running ESXi and ESX Server
versions 3.5 and 4.0. For more
information about creating required
credentials, see Creating ESX Server
Credentials for SolarWinds SAM on
page326.

VMware Tools

VMware Tools must be installed on all

ESXi and ESX Servers you intend to
monitor. VMware Tools is not required
on virtual machines running on
monitored ESXi and ESX servers, but
additional information, including IP
addresses, are made available when
VMware Tools is installed on virtual
machines hosted by monitored ESXi
and ESX Servers.

The following table provides a summary of the methods used by SolarWinds SAM
to monitor VMware ESX Servers.
Notes:
l

Both SAM and NPM share the same VIM module, so their monitoring methods are identical.
VIM gathers Network utilization information via VMware API, but not individual interfaces (e.g. Interfaces under List Resources) or interface status
(Up/Down). Interface status is only available via SNMP, which is part of
NPM.
3.5

3i

4i

Detection as ESX Server VMware API

Volumes

SNMP N/A SNMP N/A

321

Chapter 12: Virtualization

Interfaces

SNMP N/A SNMP SNMP (partial)

CPU

SNMP N/A SNMP SNMP

Memory

SNMP N/A SNMP SNMP

Total Memory

VMware API

Guest VM List

VMware API

Enabling SNMP on VMware ESXi and ESX Servers

SolarWinds SAM uses SNMP to poll performance data from VMware ESXi and
ESX Servers. In order to make this performance data available to SolarWinds
SAM, you must enable SNMP on your VMware ESXi and ESX Servers, as
described in the following sections:
Note: VMware only makes a limited amount of information available to SNMP
queries for VMware ESXi and ESX Servers version 4.0 and higher. To access
additional information on these versions, SolarWinds SAM utilizes the VMware
API.

Enabling SNMP on VMware ESXi

The following procedure enables SNMP on VMware ESXi:
Note: The following procedure to enable SNMP requires the vSphere command
line interface (CLI). The vSphere CLI is not packaged with your ESXi Server by
default, so you will need to download it from VMware, as indicated.
To enable SNMP on VMware ESXi:
1. Download and install the VMware vSphere command line interface from the
VMware Download Center ([Link]
2. Use the vSphere CLI to view your ESXi server SNMP settings, as indicated
in the following procedure:
a. In the Perl\bin directory of your vSphere installation, execute the following script:
perl ..\..\bin\[Link] --server ip_address s
Notes:
l

C:\Program Files\VMware\VMware vSphere CLI\Perl\bin is

location of the vSphere Perl\bin directory.

322

the default

Enabling SNMP on ESX Server Version 3.5

Replace ip_address with the IP address of your ESXi server,
and replace cstring with the community string you are adding.
For most environments, the community string public should be
sufficient.
b. Enter an appropriate user name at the prompt.
l

Note: For most environments, root should be sufficient.

c. Enter the associated password at the prompt.
3. Use the vSphere CLI to enable SNMP on your ESXi server, as indicated in
the following procedure:
a. In the Perl\bin directory of your vSphere installation, execute the following script to add an appropriate community string:
perl ..\..\bin\[Link] --server ip_address -c cstring

Note: Replace ip_address with the IP address of your ESXi server,

and replace cstring with the community string you are adding. For
most environments, the community string public should be sufficient.
b. Enter an appropriate user name at the prompt.
Note: For most environments, root should be sufficient.
c. Enter the associated password at the prompt.
d. In the Perl\bin directory of your vSphere installation, execute the following script to enable SNMP:
perl ..\..\bin\[Link] --server ip_address E

Note: Replace ip_address with the IP address of your ESXi server.

e. Enter an appropriate user name at the prompt.
Note: For most environments, root should be sufficient.
f. Enter the associated password at the prompt.
4. Reboot your ESXi server to allow settings to take effect.

Enabling SNMP on ESX Server Version 3.5

The following procedure enables SNMP on ESX Server version 3.5.
Note: For more information about ESX Server 3.5 and ESX Server MIBs, see the
VMware document, Basic System Administration - ESX Server 3.5, ESX Server
3i version 3.5, VirtualCenter 2.5.

323

Chapter 12: Virtualization

To enable SNMP on ESX Server version 3.5:
1. Log in to your ESX Server using an account with administrative privileges.
2. Open [Link] in a text editor.
Notes:
l
l

The default location for [Link] is root/etc/snmp/[Link].

To use the default text editor, nano, in a default ESX Server version
3.5 environment, enter nano /etc/snmp/[Link] at the prompt.

3. Locate the rocommunity setting and replace the default community string
public with an appropriate read-only community string for your environment.
Note: Use commas to separate multiple community strings.
4. Save [Link], and then close your editor.
Note: If you are using nano, press Ctrl+X to close nano, and then enter Y to
save [Link].
5. Enter chkconfig snmpd on to enable SNMP when you reboot your ESX
Server.
6. Enter esxcfg-firewall -e snmpd to allow SNMP through the ESX Server
firewall.
7. Enter service snmpd start to start the SNMP service.
8. Confirm that SNMP polling is enabled on your ESX Server by entering the
following command:
snmpwalk -v1 -c cstring localhost .[Link].4.1.6876 | grep 6876.1

Note: Replace cstring with the community string you provided above.
9. After entering the snmpwalk command, your ESX Server should return
information similar to the following:
SNMPv2-SMI::enterprises.6876.1.1.0 = STRING: "VMware ESX Server"
SNMPv2-SMI::enterprises.6876.1.2.0 = STRING: "3.5.0"
SNMPv2-SMI::enterprises.6876.1.3.0 = OID: SNMPv2-SMI::enterprises.6876.[Link].0
SNMPv2-SMI::enterprises.6876.1.4.0 = STRING: "153875"

Note: The MIB OID SNMPv2-SMI::enterprises.6876.1.4.0 returns the build

number for your product, so it may not be the same as the build number
displayed above.

324

Enabling SNMP on ESX Server Version 4.0

Enabling SNMP on ESX Server Version 4.0

The following procedure enables both the system default SNMP daemon snmpd
and the proprietary VMware SNMP daemon vmware-hostd on VMware ESX Server
version 4.0:
Note: For more information about ESX Server 4.0 and ESX Server MIBs, see the
VMware document, vSphere Basic System Administration - Update 1, ESX 4.0,
ESXi 4.0, vCenter Server 4.0.
To enable SNMP on ESX Server version 4.0:
1. Log in to your ESX Server using an account with administrative privileges.
2. Open [Link] in a text editor.
Notes:
l
l

The default location for [Link] is root/etc/vmware/[Link].

To use the default text editor, nano, in a default ESX Server version
4 environment, enter nano /etc/vmware/[Link] at the prompt.

3. Locate the communities tag, and then replace the default community string
public with an appropriate read-only community string for your environment.
Note: Use commas to separate multiple community strings.
4. Locate the enable tag, and then confirm it is set to true.
5. Locate the port tag and confirm it is set to 171.
6. Locate the targets tag and confirm it is set to [Link]@162/cstring.
Note: Replace cstring with the community string you provided above.
7. Save [Link], and then close your editor.
Note: If you are using nano, press Ctrl+X to close nano, and then enter Y to
save [Link].
8. Enter service snmpd stop to confirm that the SNMP service is stopped.
9. Open [Link] in a text editor.
Notes:
l
l

The default location for [Link] is root/etc/snmp/[Link].

To use the default text editor, nano, in a default ESX Server version
4 environment, enter nano /etc/snmp/[Link] at the prompt.

Edit [Link] to include the following two lines:

10. view systemview included .[Link].4.1.6876

325

Chapter 12: Virtualization

proxy -v 1 -c cstring [Link]:171 .[Link].4.1.6876

Note: Replace cstring with the community string you provided above.
11. Save [Link], and then close your editor.
Note: If you are using nano, press Ctrl+X to close nano, and then enter Y to
save [Link].
12. Enter service mgmt-vmware restart to restart the mgmt-vmware service.
13. Enter service snmpd start to start the SNMP service.
14. Enter chkconfig snmpd on to enable SNMP when you reboot your ESX
Server.
15. Enter esxcfg-firewall -e snmpd to allow SNMP through the ESX Server
firewall.
16. Confirm that SNMP polling is enabled on your ESX Server by entering the
following command:
snmpwalk -v1 -c cstring localhost .[Link].4.1.6876 | grep 6876.1

Note: Replace cstring with the community string you provided above.
17. After entering the snmpwalk command, your ESX Server should return
information similar to the following:
SNMPv2-SMI::enterprises.6876.1.1.0 = STRING: "VMware ESX"
SNMPv2-SMI::enterprises.6876.1.2.0 = STRING: "4.0.0"
SNMPv2-SMI::enterprises.6876.1.4.0 = STRING: "208167"

Note: The OID SNMPv2-SMI::enterprises.6876.1.4.0 returns your product build

number, so it may not be the same as the build number above.

Creating ESX Server Credentials for SolarWinds SAM

SolarWinds SAM uses the VMware API to poll most of its performance data from
devices running ESX Server versions 3.5 and 4.0. You must create credentials on
your ESX Servers for the SolarWinds SAM polling engine, as shown in the
following procedure:
Note: Credentials created for the SolarWinds SAM polling engine must have
read-only rights as a minimum.

326

To create ESX Server credentials for SolarWinds SAM:

To create ESX Server credentials for SolarWinds SAM:
1. Log in to your ESX Server using an account with administrative privileges.
Note: Typically, the root user name and password is sufficient.
2. If you are prompted with an untrusted SSL certificate warning, click
Ignore to continue using the current SSL certificate.
3. Open the Users & Groups tab, and then click Users.
4. Right-click the Users view, and then click Add.
5. On the Add New user window, complete the following procedure:
Note: The User Name and Password provided in this step must be
provided either in your initial network discovery or whenever you use Web
Node Management to add the current ESX Server to SolarWinds SAM for
monitoring.

6.
7.
8.
9.
10.
11.

a. Provide both a Login and a User Name for the SolarWinds SAM
polling engine.
b. Enter and confirm a Password.
c. Click OK.
Open the Permissions tab.
Right-click the Permissions view, and then click Add Permission.
On the Assign Permissions window, click Add.
Select the user you just created, and then click Add.
Click OK on the Select Users and Groups window.
Select an appropriate role in the Assigned Role area, and then click OK on
the Assign Permissions window.

The credential you have created is now available to use for monitoring your ESX
Server. For more information about adding your ESX Server to the SolarWinds
database for monitoring, see Managing VMware Credentials in the Web
Console on page327.

Managing VMware Credentials in the Web Console

If you have to update the user name or password of a VMware credential, you can
do so from the VMware Credentials Library tab.
To update a VMware credential:
1.
2.
3.
4.

Log in to the web console.

Click Settings.
Click Virtualization Settings in the Node & Group Management section.
Click the VMware Credentials Library tab.

327

Chapter 12: Virtualization

5. Check the credential you need to update, and then click Edit Credential.
6. Make the necessary updates, and then click OK.

Adding Virtual Servers for Monitoring

VMware Vcenter, ESX servers, and Hyper-V virtual machines are added to the
SolarWinds database in the same ways other devices are added for monitoring in
the SolarWinds Web Console
Polling for VMware nodes Using the Network Sonar Wizard
The Network Sonar Wizard is the recommended method for adding VM Servers
for monitoring in the SolarWinds Web Console. With Network Sonar Discovery,
you can define all required credentials at once on the Local ESX Credentials for
Vmware view. For more information, see "Virtualization Discovery" on page 267.
Adding VMs from the Virtualization Assets Resource
1. Log in to the web console.
2. Point to the Virtualization tab and then click Virtualization Summary.
3. Click the [+] next to any ESX or Vcenter server listed in the Virtualization
Assets resource to expand the list of virtual machines.
4. Click a virtual machine that is not currently managed by SolarWinds.
Unmanaged VMs are listed in italic type.
5. Click Yes, Manage this Node.
6. If the VM is not running, manually enter the IP address of the VM in the
Hostname or IP Address field.
7. Check any additional options required to monitor the VM, and then click
Next.
8. Follow the remainder of the Add Node wizard to completion, and then click
OK, Add Node.

Virtualization Summary
The Virtualization Summary view shows the overall status of your virtualized
infrastructure.
To view the Virtualization Summary:
1. Log in to the SolarWinds Web Console.
2. Point to the Virtualization tab and then click Virtualization Summary.
The Virtualization Summary view is pre-configured to display the following
resources:

328

Viewing ESX Host Details

Top XX Hosts by CPU Load

Top XX Hosts by Number of Running

VMs

Top XX Hosts by Percent Memory

Used

Top XX Hosts by Network Utilization

VMware Assets

VMware Asset Summary

Hyper-V Assets

Hyper-V Asset Summary

To change the properties or contents of any resource, click Edit in the resource
box.

Viewing ESX Host Details

The ESX Host Details page is displayed when you click an ESX Host server in
the Virtualization Summary. This page is pre-configured to display the following
resources:
Active Alerts on this Node

Availability Statistics

Average Response Time & Packet

Loss Graph

Average Response Time & Packet

Loss Gauge

CPU Load & Memory Utilization Gauge Disk Volumes

ESX Host Details

Event Summary

List of Virtual Machines

Min/Max AverageCPU Load Graph

Node Details

Polling Details

Virtual Machine CPU Consumption

Virtual Machine Memory Consumption

Virtual Machine Network Traffic

To change the properties or contents of any resource, click Edit in the resource
box.

Changing Polling Orders for ESX Servers

If your VMware ESX hosts are controlled by VMware vCenter servers,
SolarWinds obtains the status of the ESX hosts from the vCenter server instead of
polling the ESX hosts directly.

329

Chapter 12: Virtualization

To poll the ESX servers directly you must change the Poll Through setting of the
ESX host from the Virtualization Settings page. From this page, you can also
disable and enable polling for ESX hosts and vCenter servers.
To poll a vCenter-managed ESX Host from the SolarWinds server:
1.
2.
3.
4.

Log in to the web console.

Click Settings.
Click Virtualization Settings in the Node & Group Management section.
Point to any column heading, click the upside-down triangle, and then click
Columns > Polling Through.
5. Select the ESX hosts you want to poll directly.
6. Click Poll Through > Poll ESX server directly.

Troubleshooting ESX Hardware Monitoring

When an ESX server returns the message, Unable to connect to remote server,
check the following:
l

Ensure CIM is enabled on the ESX server. To enable CIM on ESX/ESXi,

refer to the following section: "Hardware Monitoring and VMware" on page
836.
Ensure port 5989 is opened on the firewall

If the ESX server returns the message, Unable to establish session with all
provided credentials, check the following:
l
l

Verify the VMware credentials in the VIM are correct

Verify the account belongs to the root user group

Hyper-V Monitoring
SAM natively supports monitoring of Microsoft's Hyper-V server and its guests.
By default, the statistic collection interval is set to ten minutes.
Note: A node can either be a VMware ESX/vCenter server or Hyper-V server, not
both.

330

Requirements for Monitoring Hyper-V Servers

Requirements for Monitoring Hyper-V Servers

The following table provides minimal requirements for effectively using
SolarWinds SAM to monitor your Hyper-V Servers:
Requirement

Description

Hyper-V version

All versions of Hyper-V are

supported, up to and
including Hyper-V 2012 R2.

WMI

SolarWinds SAM uses WMI

to monitor all Hyper-V
Servers. SNMP is not
supported when monitoring
Hyper-V servers. For more
information about enabling
WMI, refer to the following
section: Testing Local WMI
Services on page 1326.
Note: If switching from SNMP
to WMI to monitor a Hyper-V
server, certain previously
monitored data will be lost as
a result of the protocol
change.
For example: If you have
NPM installed and are
monitoring an interface via
SNMP, switching to WMI to
monitor Hyper-V will cause
the interface's historical data
to be lost. You can either
monitor Hyper-V via WMI or
an interface via SNMP, not
both.

Number of Virtual

SolarWinds recommends

331

Chapter 12: Virtualization

Machines

fewer than 1,000 virtual

machines running on any one
Hyper-V server.

Configuring Hyper-V Servers for Discovery

For data collection and inspection of Microsoft Windows Hyper-V hosts through
Windows Management Instrumentation (WMI), each server running Hyper-V
requires:
1. A user account with elevated credentials
2. Changes to the firewall
The following table lists the discovery requirements in detail.
Item

Need

User
Account

Depending on your implementation, supply one of the following as

credentials for the credentials database:
l

For domain-based authentication, a domain account with

membership in the Administrators group on the monitored
application server.
For workgroup authentication, a built-in administrator
account on the monitored application server
For workgroup authentication, a local user account with membership in the Administrators group and the User Account
Control (UAC) setting "Run all administrators in Admin
Approval Mode" disabled on the monitored application
server.

Windows Ensure that core networking, Windows Management

Firewall
Instrumentation (WMI), and RPC traffic can traverse the firewall.
Modifying the Windows Firewall
You must allow core networking, WMI, and RPC traffic through the firewall of the
monitored server. The following procedure walks you through allowing this traffic
through the Windows Firewall on Windows 2008 R2.
Notes:
l

If you have restricted the range of dynamic RPC ports, you must ensure
that each host is able to access that port range.

332

Ensure the Core Networking rules are enabled

l

If you are connecting to Hyper-V hosts through a DMZ or hardware firewall,

you must open the corresponding rules and ports on the hardware.

To allow the correct traffic through the Windows firewall, you must perform the
following steps:
1. Ensure the core networking rules are enabled
2. Enable the Windows Management Instrumentation (DCOM-In) rule
3. Create a new rule to open the RPC ports
Ensure the Core Networking rules are enabled
You must ensure that the core networking rules are enabled to collect information
successfully from Hyper-V hosts.
Note: If the rule has a green icon with a checkmark in front of it, the rule is
enabled.
To allow core networking traffic through the Windows Firewall on Windows
2008 R2:
1. Log on to the computer you want to monitor with an administrator
account.
2. Navigate to Start> Administrative Tools>Windows Firewall with
Advanced Security.
3. Click Inbound Rules in the left navigation pane.
4. Ensure that all Core Networking rules are enabled. If not, select the
disabled rule and then click Enable Rule in the Action menu.
Enable the Windows Management Instrumentation (DCOM-In) rule
You must ensure that the Windows Management Instrumentation (DCOM-In)
rule is enabled to collect information successfully from Hyper-V hosts.
Note: After enabling the Windows Management Instrumentation (DCOM-In) rule,
common WMI checks indicate that WMI is not enabled. This is expected behavior.
To allow WMI traffic through the Windows Firewall on Windows 2008 R2:
1. Log on to the computer you want to monitor with an administrator
account.
2. Navigate to Start> Administrative Tools>Windows Firewall with
Advanced Security.
3. Click Inbound Rules in the left navigation pane.

333

Chapter 12: Virtualization

4. Click Windows Management Instrumentation (DCOM-In), and then
click Enable Rule in the Action menu.
Create a new firewall rule to open the RPC ports
You must open the RPC ports to collect information successfully from Hyper-V
hosts. This is best done by creating a new firewall rule.
To open the RPC ports on Windows 2008 R2:
1. Log on to the computer you want to monitor with an administrator
account.
2. Navigate to Start> Administrative Tools> Windows Firewall with
Advanced Security.
3. Click Inbound Rules in the left navigation pane.
4. Click Actions > New Rule
5. In Rule Type, select Custom and click Next.
6. Select This program path and enter %SystemRoot%\System32\[Link]
in the text box.
7. In Services, click Customize to ensure that Apply to all programs and
services is selected, and click OK.
8. Click Next
9. In Protocol type, select TCP.
10. In Local port, select RPC Dynamic Ports.
11. In Remote port, select All Ports.
12. Click Next.
13. Apply to any local and remote IP addresses and click Next.
14. In Action, ensure that Allow the connection is selected and click Next.
15. Select all profiles (Domain, Private, and Public) and click next.
16. Enter a name, such as SAM WMI Dynamic Ports.
17. Click Finish
The new rule will now appear in the list of inbound rules.

Enabling and Disabling Hyper-V Monitoring

Hyper-V monitoring is automatically enabled on WMI nodes after a Network
Sonar Discovery is run. For information on enabling WMI, see "Testing Local WMI
Services" on page 1326.
There are two ways to toggle Hyper-V monitoring; via the Manage Nodes page,
and through the Virtualization Summary resource.

334

List Resources Method:

Warning: If Hyper-V polling is disabled, all historical data will be lost. To retain
historical data, use the Virtualization Summary method and select Unmanage.
List Resources Method:
1. From the web console, click Settings in the upper right-hand corner of the
screen.
2. In the Node & Group Management resource, click Manage Nodes.
3. Select the desired node by checking it, and then click List Resources.
4. Check or uncheck Hyper-V, if available.

Virtualization Summary Method:

Warning: If Hyper-V polling is disabled, historical data will be lost. To retain
historical data, select Unmanage. When you choose to remanage the node, all
historical data will be available.
1. In the web console, click the Virtualization tab.
2. In the Virtualization Assets resource. Click Virtualization Settings.

3. In Virtualization Settings, click the Hyper-V tab.

4. Click List Resources.

335

Chapter 12: Virtualization

Note: You can temporarily enable/disable polling of Hyper-V by selecting

a node from the list and clicking either Disable Hyper-V Polling or Enable
Hyper-V Polling. If you check a disabled node, the Enable Polling button
will become enabled. The converse is also true.
5. Check or uncheck Hyper-V and then click Submit.

Accessing Hyper-V Details

Hyper-V is incorporated into multiple resources found in SAM's web console on
the Virtualization tab. Following is just one example:
Virtualization Assets:
With Hyper-V being native to SAM, you can drill down to the Node Details page
from this view. If the node in this view is not managed, you will be prompted to go
to the Add Node wizard to have this node managed.
Clicking Edit will allow you to filter the vendors that are shown in this view.

336

Virtualization Assets:

337

Chapter 13:
Building Component Monitors and
Templates
The following diagram illustrates the work flow involved in creating an application
to be monitored by SolarWinds Server & Application Monitor.

338

Chapter 13: Building Component Monitors and Templates

Refer to the following sections for more information:

l
l
l
l
l
l

Understanding Component Monitors and Application Monitor Templates

Choosing Component Monitors and Templates Based on Protocol
Requirements for Component Monitors and Templates that use WMI
Monitoring External Nodes
Understanding the Credentials Library
Using Application Monitor Templates

339

Certificate Credentials Library

l
l
l
l

l
l
l

Managing Assigned Application Monitors

Working with Component Monitors
Scripting Custom Component Monitors
Custom Application Monitor Template Example: Creating a SolarWinds
SAM Template
Conversion Value
Available Data Transformations
Certificate Credentials Library

Certificate Credentials Library

The Certificate Credentials Library allows you to import and store certificates for
use at a later time.
Typically, you need to associate credentials with component monitors and
templates to enable them to retrieve application data. For added security, SAM
offers the ability to store certificates in the Certificate Credentials Library.
Certificates can be used for authentication with Linux devices monitored in SAM.
Linux, Unix, and Nagios script monitors also support certificate based
authentication.
The PEM format (OpenSSH) is supported.

Adding a Certificate to the Library

To add a certificate to the library:
1. From the Web Console, navigate to Settings > SAM Settings > Certificate
Credentials Library.
2. Click Add New Credential.
3. Enter a name in the Credential Name field.
4. Enter a User Name in the User Name field.
5. Click Browse to load a private key from a file.
6. Enter a password in the Private key content password field.
7. Select the Private key type: either RSA or DSA.
8. Click Submit to save the certificate credential to the library.

Assigning Certificate Credentials

There are two ways to assign Certificate Credentials; when assigning a template
to a node, and when editing a template directly.
Which method should I use?

340

Chapter 13: Building Component Monitors and Templates

If every node uses unique private keys, then editing the application after it
has been assigned is the best option. Use method A.
If most or all of your nodes use the same private key, then you should edit
the credentials directly in the template. Use method B.

A.) When Assigning a Template to a Node:

1. Assign a template to a node.
2. When asked to choose credentials, select the Inherit credentials from
template option.
3. Click Assign Application Monitors.
4. Edit the template by clicking Edit next to the name of the template, as
shown below.

5. From here, you can select one or more Linux/Unix/Nagios script component monitors to edit by checking the boxes to the left of each monitor
and then clicking Multi-Edit.
6. Check the Authentication Type box and select Username and PrivateKey
from the dropdown menu.
7. Check the Credential for Monitoring box and select the credentials you
want to use from the dropdown menu, and then click Save.
B.) Editing a Template Directly:
1. Select the template you want to edit
2. Change the Authentication Type option to Username and PrivateKey for
each component monitor that should use this authentication type.
3. From the Credential for Monitoring field dropdown menu, select the credentials you want to use with your monitors, and then click Submit.

Understanding the Credentials Library

You typically need to associate credentials with component monitors to enable
them to retrieve application data. For example, to use a WMI monitor, you must
provide valid domain or computer credentials. Or, if your web server requires

341

To set up a user account on a SQL server

credentials, you must provide the appropriate credentials to access the protected
sections of your site.
You can work with credentials by:
l

Adding credentials to the Credentials Library for use later. See the section
Adding Credentials to the Credentials Library on page 343 for details.
Creating credentials on the spot (Quick Credentials) when editing templates and component monitors. See the section Using Quick Credentials
on page 344 for details.
Editing credentials. See the section Editing Credentials in the Credentials
Library on page 343 for details.
Deleting credentials. See the section Deleting Credentials from the Credentials Library on page 343 for details.

To set up a user account on a SQL server

1. Open Enterprise Manager.
2. In the console tree, double-click Microsoft SQL Servers, click SQL
Server Group, and then SQLComputerName (WindowsNT).
3. Double-click Databases, and then double-click your database of choice.
4. Right-click Users, and then click the New Database User menu.
5. Next to Login name, type:
domain\username
6. Next to User name, type your user name.
7. Select the Public check box, and then select all of the following objects:
o db_owner
o db_accessadmin
o db_securityadmin
o db_ddladmin
o db_datareader
o db_datawriter
o db_backupoperator
Important:
l

Do not select db_denydatareader or db_denydatawriter. These objects

allow members to deny Read or Write permissions to data in the database.

For more information, see [Link]

Notes:

342

Chapter 13: Building Component Monitors and Templates

l
l

SolarWinds Server & Application Monitor uses the same SNMP credentials that you entered during node discovery. There is no need to specify additional credentials for SNMP operations.
SolarWinds SAM stores credentials encrypted in the database.
The ability to Inherit Windows credentials from node is available in the
dropdown list.

Adding Credentials to the Credentials Library

Perform the following to add credentials for later use.
To add credentials from the Credential Library page:
1.
2.
3.
4.
5.
6.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Credentials Library.
Click Add New Credential.
Provide a friendly name for the credential set. SolarWinds Server & Application Monitor displays this name in the Credential for Monitoring field of
monitors that accept credentials.
7. Provide the user name and password, and then confirm the password and
click Submit. If you are providing windows credentials for accessing and
harvesting information through WMI, ensure you provide the account name
in the following syntax: domainOrComputerName\userName for domain
level authentication or userName for workgroup level authentication.
You can assign credentials to all the associated components of a template or
Application Monitor.

Editing Credentials in the Credentials Library

Perform the following to edit credentials for later use.
To edit an existing credential from the Credential Library page:
1. Click Edit for the desired credential.
2. Modify the information as needed.
3. Then click Submit.

Deleting Credentials from the Credentials Library

Perform the following to delete credentials from the Credentials Library.

343

To delete an existing credential from the Credential Library page:

To delete an existing credential from the Credential Library page:
1. Navigate to the Credentials Library: Admin > Settings > SAM Settings >
Credentials Library.
2. Click Delete for the desired credential.
3. Click OK to confirm the deletion.

Using Quick Credentials

Perform the following to use Quick Credentials:
To create and assign credentials using Quick Credentials when editing a
template or Application Monitor:
1. If the credential you want to assign does not exist, create it by following
these instructions:
a. Select <New Credential> in the Choose Credential field.
b. Type a name for the new credential in the Credential Name field.
c. Type the user name for the credential in the User Name field.
d. Type the password in the Password field, and type it again in the Confirm Password field.
2. If you want to assign an existing credential, select the credential from
the Choose Credential field.
3. Click Set Component Credentials to set this credential as the credential
for all the components in the Application Monitor or template.
Note: The ability to Inherit Windows credentials from node is available in
the dropdown list. Anywhere you have the option to specify credentials for
an application template or component monitor, you also have the the
option to utilize the existing WMI credentials already used to manage the
host.

344

Chapter 13: Building Component Monitors and Templates

Managing Assigned Application Monitors

You can manage Assigned Application Monitors by referring to the following
sections:
l
l
l
l
l
l

Application Discovery
Add Application Monitors
Editing an Assigned Application Monitor
Unmanaging Assigned Application Monitors
Remanaging Assigned Application Monitors
Deleting Assigned Application Monitors

Editing an Assigned Application Monitor

You can override the template inheritance relationship by editing the components
of an assigned Application Monitor. Any modifications you make to an
applications components or component properties are independent from the
template, including: adding new components and removing existing components
New components that you add to the application are not governed by the original
template used to create the application. Modified component properties override
the original template settings.
To edit an individual application:
1.
2.
3.
4.
5.
6.
7.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Application Monitors.
Click the group containing the application you want to edit.
Check the application you want to edit, and then click Edit Properties.
If you want to turn on extended debug information to assist Customer
Support, expand Advanced, set Debug logging On, and specify the Number of log files to keep.
Here you can also select either 32bit or 64bit from the dropdown list
entitled, Platform to run polling job on.
Note: Do not turn on Debug logging unless directed by Customer Support.
8. Click Override Template for each polling setting and specify the new
value.
9. Expand the component you want to modify, and then click Override Template and specify new values.

345

Unmanaging Assigned Application Monitors

10. If you want to add components unique to this specific application,
click Add Component Monitor.
Note: You can select multiple component monitors of the same type to be
added by entering a number in the field next to the check box for the component monitor and then checking the check box.
11. Click Submit to apply your changes.
Note: Custom Properties on Assigned Applications can be defined when
editing the Assigned Application, as shown below:

Unmanaging Assigned Application Monitors

If you need to deactivate assigned application monitors for a period of time, you
can do so by unmanaging them. Changes you make to the managed or
unmanaged status of an application take affect after the next polling cycle.
To unmanage assigned Application Monitors:
1.
2.
3.
4.
5.
6.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Application Monitors.
Click the group containing the application you want to unmanage.
Check the application(s) you want to unmanage, and then click Unmanage.
7. Specify the date / time when you want to begin the period when the application is unmanaged.
8. Specify the date / time when you want to end the period when the application is unmanaged.
9. Then click OK.

346

Chapter 13: Building Component Monitors and Templates

-or1. Log on to your SolarWinds Web Console with an Administrator account.
2. Click the Applications tab.
3. Click an assigned Application Monitor in any resource to view its SAM
Application Details View page.
4. Click Unmanage in the Application Details section.
5. Set the duration of the unmanaged state, and then click OK.
Note: Unmanaging a node in SolarWinds SAM automatically unmanages
its assigned SolarWinds SAM applications for the same duration.

Remanaging Assigned Application Monitors

Remanage an assigned Application Monitor in order to immediately resume
monitoring an unmanaged application.
To remanage assigned Application Monitors:
1.
2.
3.
4.
5.
6.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Application Monitors.
Click the group containing the application you want to remanage.
Check the application(s) you want to remanage, and then click
Remanage.

-or1. Log on to your SolarWinds Web Console with an Administrator account.

2. Click the Applications tab.
3. Click an assigned Application Monitor in any resource to view its SAM
Application Details view page.
4. Click Remanage in the Application Details section.

Deleting Assigned Application Monitors

Delete an assigned Application Monitor if you have no further need of it.
To delete assigned Application Monitors:
1.
2.
3.
4.
5.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Application Monitors.
Click the group containing the application you want to delete.

347

Application Monitor Thresholds

6. Check the application(s) you want to delete, and then click Delete.
7. You are prompted whether you want to delete the selected Application
Monitors. Click Yes to perform the delete operation.

Application Monitor Thresholds

In general, thresholds are markers that indicate certain levels have been reached.
Many component monitors used in SAM applications have thresholds that can be
adjusted and set.
Once set, thresholds can act as trigger points. For example, if you are monitoring
CPU usage, having a Critical threshold set at 90% would be typical. You can then
use this threshold as a trigger to send an email alert to inform you of the Critical
status once that threshold has been breached.
Normally, an administrator would need to monitor his applications for several
weeks in order to collect enough data to be used as a baseline. Once a baseline
has been established, the administrator can then make an educated guess as to
how he should set his Warning and Critical thresholds for his component
monitors. With this is mind, if thresholds are set too low, the administrator would
be getting alerts all the time. If set too high, problems can occur without the
administrator's knowledge.
Baseline data, as well as Warning and Critical thresholds for application
monitors, can be gathered and calculated automatically. The option to enter
thresholds manually remains available.
Note: By default, I/O thresholds of Windows Service Monitors are not set.
For more information, refer to the following sections:
l
l
l
l
l
l
l

Inheriting Thresholds
Automatic Calculation of Baseline Data
Applying Baseline Thresholds at the Template Level
Applying Baseline Thresholds at the Application Level
Latest Baseline Details
Understanding Latest Baseline Details
Understanding Sustained Thresholds

Inheriting Thresholds
Thresholds can be adjusted at the template level or on the individual component
monitor level of an application.

348

Chapter 13: Building Component Monitors and Templates

Threshold Adjustments at the Template Level
If adjusting thresholds on the template level, either manually entered or calculated
using baseline data, any changes made will trickle down to the component
monitor level for applications based on this template. This means the component
monitors within the application inherit the changes made in the template.

Threshold Adjustments at the Component Monitor Level

If you change thresholds at the component monitor level, only thresholds of the
individual component monitor will be affected. Thresholds on the parent template,
or other applications based on that parent template, will not be affected.

Automatic Calculation of Baseline Data

In general, baseline data is calculated on demand; however, seven days of data
is the recommended minimum amount of data needed for baseline calculations to
be considered accurate.

349

To Change the Amount of Data Used in Baseline Calculations:

Baseline data for macros, such as ${USE_BASELINE}, are automatically calculated
during nightly database maintenance.
Once thresholds are calculated and applied to component monitors, the
thresholds remain static until manually re-applied. This is not a moving baseline
that is calculated nightly based on the last seven days of data. A moving baseline
would mask data spikes and other anomalies that need to be highlighted.
Note: Thresholds set manually may yield more desirable results if you are
familiar with the nuances of your environment.
To Change the Amount of Data Used in Baseline Calculations:
1. From the web console, navigate to Settings > SAM Settings > Data &
Database Settings.

2. Enter a number of days, and then click Submit.

Note: The value for the Baseline Data Collection Duration field cannot exceed
the value defined for the Detail Statistics Retention field (located at the top of the
Data & Database Settings section).
For more information, see:
l
l

Baseline Threshold Macros .

Understanding Sustained Thresholds.

Multi-value Scripts and Thresholds

The format for using the Threshold macros with multi-value scripts is as follows:
l
l

${[Link]}
${[Link]}

350

Chapter 13: Building Component Monitors and Templates

351

Applying Baseline Thresholds at the Template Level

Applying Baseline Thresholds at the Template Level

Applying and editing thresholds at the template level will affect any and all
applications that are based on that template.
To Edit and Apply Baseline Thresholds for a Template:
1. From the web console, navigate to Settings > SAM Settings > Manage
Templates.
2. Check a template and click Edit from the toolbar.

3. If selecting only one component monitor, click [+] to expand the monitor
details.
a. Click Use Latest Baseline Thresholds, as shown:

Note: Once this box is checked, the Warning and Critical fields will
automatically populate with the macro, ${USE_BASELINE}.
b. Select the options for sustained thresholds, if desired:
Note: For more information, see Understanding Sustained
Thresholds.

352

Chapter 13: Building Component Monitors and Templates

4. If selecting more than one component monitor, select the monitors you
want by checking the boxes next to their names.
a. Click Multi-Edit.
Note: Multi-Edit will only become available when the selected component monitors are of the same type.

b. Check the Statistic Threshold check box on the pop-up window,

then check the Use thresholds calculated from baseline data
check box.
Note: The Use thresholds calculated from baseline data check
box will not become available until the Statistic Threshold check
box has been checked.

Note: Once the Use thresholds calculated from baseline data

box is checked, the Warning and Critical fields will automatically
populate with the macro, ${USE_BASELINE}.
c. Click Save.
5. When done, click Submit.

Applying Baseline Thresholds at the Application Level

Applying and editing thresholds at the application level will only affect the
component monitors of the current application.

353

To Edit and Apply Baseline Thresholds for an Application:

To Edit and Apply Baseline Thresholds for an Application:
1. From the web console, click the Applications tab.
2. In the All Applications resource, expand the tree and then click an application.
3. From the Application Details resource, click Edit Application Monitor.

4. If selecting only one Component Monitor, click [+] to expand the monitor
details.
a. Click Override Template.
Note: The current values for the thresholds will appear in the Warning and Critical fields
b. Click Use Latest Baseline Thresholds, as shown:

c. When applied, the values will change and a blue icon will appear
indicating that baseline thresholds are being used.

5. If selecting more than one component monitor, use the check boxes to
select the monitors you want to edit, and then click Multi-Edit.
a. Click Multi-Edit.
Note: Multi-Edit will only become available when the selected component monitors are of the same type.

354

Chapter 13: Building Component Monitors and Templates

b. Check the Statistic Threshold check box on the pop-up window,

then check the Use thresholds calculated from baseline data
check box.

Note: Once the second box is checked, the Warning and Critical
fields will automatically populate with the macro, ${USE_BASELINE}.
For more information, see "Understanding Latest Baseline Details"
on page 356.
c. Click Save.
6. When done, click Submit.
For more information, see Understanding Sustained Thresholds.

Latest Baseline Details

Details about how baseline data, as well as Warning and Critical thresholds are
calculated, can be found on the Latest Baseline Details page. This page details
the data collection and calculation process using several graphs and tables.
To View the Latest Baseline Details Page:
1. From the web console, click the Applications tab.
2. In the All Applications resource, expand the tree and then click an application.
3. From the Application Details resource, click Edit Application Monitor.

355

Understanding Latest Baseline Details

4. Find a component monitor in the list and click [+] to expand the monitor
details.
5. Click Override Template.
6. Click Latest Baseline Details.

Understanding Latest Baseline Details

The two tabbed charts and table below them detail how baseline statistics and
thresholds are calculated for individual component monitors based on the
collected data.

356

Chapter 13: Building Component Monitors and Templates

Note: Clicking Use Recommended Thresholds will not affect the chart.
Understanding the Occurrences Chart
The horizontal (X) axis displays the range of values collected by the current
component monitor during the data collection period. The vertical (Y) axis
displays the frequency of each value collected during the data collection period.
The three colors of the chart show the values of the component monitor during
different time periods: Day, Night, and All Hours. You can show or hide these
time periods by checking and un-checking their respective boxes in the legend.
You can have the chart show a specific time range by dragging the mouse over a
small area of the chart. Hovering over any area of the chart will provide a tooltip
with detailed information about that area of the chart.

357

Understanding the Metric Over Time Chart

If you zoom in, a Reset Zoom button will appear.

The yellow and red shading of the chart indicates the recommended Warning and
Critical thresholds, respectively. These shaded areas are taken from the values
recorded in the Latest Baseline Statistics table.
Note: The ability to check and un-check the boxes in the legend is for visual
purposes only and will not affect the values generated for calculated thresholds.
Understanding the Metric Over Time Chart
The horizontal (X) axis displays the time period for when the values were
collected for the current component monitor. The vertical (Y) axis displays the
range of all the values collected during the charted time.
In other words, the light blue bars show the range of values for the statistics
collected during the charted time period. The bottom of the bars indicates the
lowest statistic collected, or the minimum. The top of the bars indicates the
highest statistic collected, or the maximum. The blue line of the chart shows the
average values of the component monitor through time.
Using the legend, you can show or hide these statistics by checking and unchecking their respective boxes.
You can have the chart show a specific time range by dragging the mouse over a
small area of the chart or by using the sliders located at the bottom of the chart.
Hovering over any area of the chart will provide a tooltip with detailed information
about that area of the chart.

358

Chapter 13: Building Component Monitors and Templates

The yellow and red of the chart indicates the recommended Warning and Critical
thresholds, respectively. These shaded areas are taken from the values recorded
in the Latest Baseline Statistics table.
Note: The ability to check and un-check the boxes in the legend is for visual
purposes only and will not affect the values generated for calculated thresholds.
Understanding the Latest Baseline Statistics Table
Along with the minimum and maximum values displayed, the Latest Baseline
Statistics table at the bottom of the display shows the mean (average) baseline
statistics surrounded by three levels of standard deviation for both day and night
data. This table highlights the recommended Warning and Critical thresholds in
yellow and red, respectively.

In addition to using the recommended threshold values, you can hover the mouse
over any value in the table to bring up a tooltip dialog. The tooltip dialog allows
you to visualize, but not change, the value for the Warning or Critical threshold to
the value you are hovering over by simply clicking either link in the dialog.
Visualizing a value in this way will affect the chart above the table by
repositioning the shading indicating the Warning and Critical threshold areas.

359

Understanding Baseline Details and Setting Thresholds

Understanding Baseline Details and Setting Thresholds
The right column of this view provides information about the data's calculation
and usage and allows you to set thresholds.

In the Current Thresholds Settings area, you can manually change the values for
both the Warning and Critical thresholds, or use the recommended values by
clicking Use Recommended Thresholds.
Additionally, you can add logic for these thresholds by selecting an operator from
the dropdown list such as Greater Than, Less Than, Equal To, and so on. The
logical operator selected will apply to both the Warning and Critical thresholds
and cannot be separated. For example, if you select the Greater Than or Equal
to operator with a Warning threshold value of 80 and a Critical threshold of 90,
the thresholds will be considered met if the returned value for the current
performance counter meets or exceeds 80 for Warning or 90 for Critical.

Understanding Sustained Thresholds

The highlighted fields in the following illustration are available for configuring
sustained thresholds:

360

Chapter 13: Building Component Monitors and Templates

The following two tables demonstrate possible sustained threshold conditions

based on the illustration above and how the Warning and Critical conditions are
met:

Working with Component Monitors

Component monitors are the building blocks of SolarWinds SAM. Each monitors
the status and performance of a different aspect of an application.

361

Viewing the Component Monitor Library

You can perform the following activities to manage components using the
commands on the SAM Settings page:
l
l
l

Viewing the Component Monitor Library

Managing Assigned Component Monitors
Managing Component Monitors within Templates

Viewing the Component Monitor Library

The component monitors in the library are grouped by monitor type in the tree
view display. For each component monitor, two numbers are displayed.
The first number represents the number of Application Monitor templates
that contain the specified component monitor.
The second number represents the number of Application Monitors that contain the specified component monitor.

Expanding a component monitor shows two categories:

l

Application Monitor templates that contain the specified component monitor

Application Monitors that contain the specified component monitor

Expanding a category displays the names of the templates or Application

Monitors for the category, respectively. Clicking the name of a template or
Application Monitor takes you to a page where you can edit that item.

Managing Assigned Component Monitors

You can manage individual component monitors that have been assigned to
collect data on a single object such as a process, port, or performance counter.
Management operations are described in the following sections:
l
l
l

l
l

Creating a New Template with Assigned Component Monitors

Assigning Component Monitors to a Node
Copying Assigned Component Monitors to an Assigned Application Monitor
Copying Assigned Component Monitors to an Application Monitor Template
Editing Assigned Application Monitors
Deleting Assigned Application Monitors

362

Chapter 13: Building Component Monitors and Templates

Creating a New Template with Assigned Component Monitors
To quickly create a new template with assigned component monitors:
1.
2.
3.
4.
5.
6.
7.

8.
9.

10.
11.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Assigned Component Monitors.
Select the desired component type or assigned Application Monitor whose
component monitors you want to list.
Select the desired component monitor(s) to add to the new template.
Click Create New Template, specify the information for the new template,
and then click Submit.
Refer to the section Creating New Templates on page396 for details
about specifying the template information.
To add additional component monitor(s) to add to the new template, click
Add Component Monitor.
Expand the component groups and check all the additional component
monitors you want to add.
Note: You can select multiple component monitors of the same type to be
added by entering a number in the field next to the check box for the component monitor and then checking the check box.
Click Submit.
Configure the component monitor settings, and then click Submit.

The new template is added to the list of all Application Monitor Templates.
Assigning Component Monitors to a Node
To quickly assign component monitors to a node:
1.
2.
3.
4.
5.
6.
7.
8.
9.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Assigned Component Monitors.
Select the desired component type or assigned Application Monitor whose
component monitors you want to list.
Select the desired component monitor(s) to assign to a node.
Click Assign to Node.
Enter the name for the application, polling frequency, and polling timeout.
If you want to turn on extended debug information to assist Customer
Support, expand Advanced, set Debug logging On, and specify the Num-

363

Copying Assigned Component Monitors to an Assigned Application Monitor

ber of log files to keep. Here you can also select either 32bit or 64bit from
the dropdown list entitled, Platform to run polling job on.
Note: Do not turn on Debug logging unless directed by Customer
Support.
10. Click Next.
11. Select the nodes to which you want to assign the Application Monitor, and
then click Next.
12. If suitable credentials already exist, choose the credential from the
Choose Credential list.
13. If suitable credentials do not exist, choose <New Credential> from the
Choose Credential list, and then add the new credential by filling out the
credential details.
14. Click Test to test the credentials and component monitors against the test
node.
15. If the test fails, troubleshoot the problem based on the error messages,
and then retest the node.
16. If the test passes, click Assign Application Monitors.
Copying Assigned Component Monitors to an Assigned Application Monitor
To quickly copy component monitors to an assigned Application Monitor:
1.
2.
3.
4.
5.
6.
7.
8.
9.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Assigned Component Monitors.
Select the desired component type or assigned Application Monitor whose
component monitors you want to list.
Select the desired component monitor(s) to copy to an assigned Application Monitor.
Click Copy to Assigned Application Monitor.
Select the desired Application Monitor(s) to copy to and click Submit.
Click OK to acknowledge the successful copy.

Copying Assigned Component Monitors to an Application Monitor Template

To quickly copy component monitors to an Application Monitor template:
1. Log on to your SolarWinds Web Console with an Administrator account.
2. Click the Applications tab.
3. Click SAM Settings.

364

Chapter 13: Building Component Monitors and Templates

4. Click Manage Assigned Component Monitors.
5. Select the desired component type or assigned Application Monitor whose
component monitors you want to list.
6. Select the desired component monitor(s) to copy to an assigned Application Monitor.
7. Click Copy to Application Monitor Template.
8. Select the desired template(s) to copy to and click Submit.
9. Click OK to acknowledge the successful copy.
Editing Assigned Application Monitors
To edit the assigned Application Monitor for a component monitor:
1.
2.
3.
4.
5.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Assigned Component Monitors.
Select the desired component type or assigned Application Monitor whose
component monitors you want to edit.
6. Select the desired component monitor whose assigned Application Monitor you want to edit.
7. Click Edit Assigned Application Monitor.
8. Edit the desired settings and then click Submit. The edited Application
Monitor is displayed in the list of Assigned Application Monitors.
Deleting Assigned Application Monitors
To delete an assigned component monitor:
1.
2.
3.
4.
5.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Assigned Component Monitors.
Select the desired component type or assigned Application Monitor whose
component monitor(s) you want to delete.
6. Select the desired component monitor(s) that you want to delete.
7. Click Delete.
8. Click Yes to confirm the deletion of the component monitor(s).

Managing Component Monitors within Templates

You can manipulate and manage the component monitors that are inside the
Application Monitor templates in several ways:

365

Listing the Component Monitors Defined in a Template

l
l
l

Listing the Component Monitors Defined in a Template

Creating a New Template from Existing Component Monitors
Creating Assigned Application Monitors from Existing Component Monitors
Copying a Component Monitor

Listing the Component Monitors Defined in a Template

To quickly see the different component monitors within your templates:
1.
2.
3.
4.
5.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Templates.
Click Manage Component Monitors (within Templates), near the top
right corner of the window.
6. Select Template in the Group by list.
7. Select the desired template whose component monitors you want to list.
Creating a New Template from Existing Component Monitors
To create a new template that contains copies of existing component monitors:
1.
2.
3.
4.
5.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Templates.
Click Manage Component Monitors (within Templates), near the top
right corner of the window.
6. Check the check box next to the component monitors you want in the new
template.
7. Click Create New Template, specify the information for the new template,
and then click Submit.
Refer to the section Creating New Templates on page396 for details about
specifying the template information.

366

Chapter 13: Building Component Monitors and Templates

Creating Assigned Application Monitors from Existing Component Monitors
To create assigned Application Monitors from existing component monitors:
1.
2.
3.
4.
5.
6.
7.
8.
9.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Templates.
Click Manage Component Monitors (within Templates), near the top
right corner of the window.
Check the check box next to the component monitors you want in the
assigned Application Monitors.
Click Assign to Node.
Specify the name for the application, polling frequency, and polling
timeout.
If you want to turn on extended debug information to assist Customer
Support, expand Advanced, set Debug logging On, and specify the Number of log files to keep. Here you can also select either 32bit or 64bit from
the dropdown list entitled, Platform to run polling job on.
Note: Do not turn on Debug logging unless directed by Customer
Support.

10. Click Next.

11. Select the nodes for which you want to create the assigned Application
Monitors, and then click Next.
12. If suitable credentials already exist, choose the credential from the
Choose Credential list.
13. If suitable credentials do not exist, choose <New Credential> from the
Choose Credential list, and then add the new credential by filling out the
credential details.
14. Click Test to test the credentials and component monitors against the test
node.
15. If the test fails, troubleshoot the problem based on the error messages,
and then retest the node.
16. If the test passes, click Assign Application Monitors.

367

Copying a Component Monitor

Copying a Component Monitor
To copy a component monitor to a template or an assigned Application Monitor:
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Templates.
Click Manage Component Monitors (within Templates), near the top
right corner of the window.
Check the check box next to the component monitors you want to copy.
Click Copy to.
If you want to copy to an assigned Application Monitor, click Copy to
Assigned Application Monitor.
If you want to copy to a template, click Copy to Application Monitor
Template.
Check the check boxes next to the template or assigned Application Monitors to which you wish to copy the component monitors, and then click
Submit.

Choosing Component Monitors and Templates

Based on Protocol
If you have a choice between components or templates that return the needed
value using different protocols, consider the following guidelines for making your
choice, based on the protocol:
1. SNMP is the best protocol to use from the reliability and speed perspective. It is much faster and more reliable than both Performance counters and WMI, and it has lowest impact on system performance.
2. WMI calls can sometimes take a relatively long time, and they have a significant overhead.
RPC vs. WMI
The reason some SAM templates only use RPC is primarily customer demand.
RPC is generally considered more reliable. It also uses less overheard making it
faster than WMI and it is firewall friendly. There are distinct advantages and
disadvantages to both RPC and WMI, which is why SAM utilizes both methods
forretrievinginformation.

368

Chapter 13: Building Component Monitors and Templates

Web Service Monitoring

For custom web services that need to be monitored, SAMoffers the ability to
utilize the following technologies:
l

JSON: JavaScript Object Notation (JSON) is an open standard format that

uses human-readable text to transmit data objects consisting of attribute
value pairs. It is used primarily to transmit data between a server and web
application, as an alternative to XML.
Note: Inserted JSONcontent cannot exceed 1MB in size.
SOAP: Simple Object Access Protocol (SOAP) is a protocol used for
exchanging information in the implementation of web services in computer
networks. It relies on XML for its message format, and usually relies on other
application layer protocols. The SOAPmonitor is useful if you have custom
web services that need to be monitored.
Note: Currently, the SOAPmonitor within SAMcan return a status of either
Up or Down, or return a status of Warning or Critical based on response
time thresholds. This monitor also has the ability to search for the presence
of a string.

For more information, see:

l
l
l
l
l
l

Component Monitor Types

SOAP Component Monitor
SOAP Monitor
HTTP Monitor
HTTPS Monitor
JSON

JSON
JSONis accepted in the HTTPmonitor and HTTPS monitor, as shown below.
Following is an example of JSONcode:
{
"firstname": "Kate"
"lastname": "Asaff"
"age" : 29
"city" : "Austin"
}

369

SOAP Monitor

Notes:
l
l

Inserted JSONcontent cannot exceed 1MB in size.

SolarWinds Technical Support does not provide support for custom scripts.

For more information, see:

l
l

HTTP Monitor
HTTPS Monitor

SOAP Monitor
This page provides general information concerning the SOAPmonitor and how it
works. For information concerning the individual fields of the SOAPmonitor, see
SOAP Component Monitor.
Note: Currently, the SOAPmonitor within SAMcan return a status of either Up or
Down, or return a status of Warning or Critical based on response time
thresholds. This monitor also has the ability to search for the presence of a string.
Definitions:
l

SOAP: (Simple Object Access Protocol) is a protocol used for exchanging

information in the implementation of web services in computer networks. It
relies on XML for its message format, and usually relies on other application
layer protocols, most notably Hypertext Transfer Protocol (HTTP).
WSDL: (Web Services Description Language). The Web Services Description Language is an XML-based interface description language that is used
for describing the functionality offered by a web service.
XML: Extensible Markup Language is a markup language that defines a set
of rules for encoding documents in a format that is both human-readable
and machine-readable.

370

Chapter 13: Building Component Monitors and Templates

About the SOAPMonitor
Currently, the SOAPmonitor within SAMcan return a status of either Up or Down,
or return a status of Warning or Critical based on response time thresholds. This
monitor also has the ability to search for the presence of a string. You can test the
SOAP monitor in Edit mode. If the test poll throws a web exception (indicating
that there was a problem on the target) the response content is extracted and you
will be able to view the message to help identify the issue.

Configuring the SOAP Monitor

The are two ways to configure the SOAPmonitor:
l
l

Loading a WSDL file.

Manually entering XML.

Loading WSDLFiles
The SOAPmonitor within SAM currently supports the WSDL schema, which must
be exposed on a URL. Once the WSDL file is successfully loaded, the file will be
parsed automatically and the fields, highlighted below, will populate.
Once the WSDLfile has been successfully loaded, you can specify values for the
available arguments. There are two types of arguments, simple, and complex.
A simple argument is one where you can define the value directly. A
[Link] (e.g. structures, classes, list, and so on) must be user-defined
in the XML format. It is recommended that complex arguments be used only by
experienced users.
Note:The Advanced Settings are read-only and displays additional information.
Because the SOAP envelope is based on the WSDL schema, the Advanced
Settings values should not be changed.
The SOAP XML field contains the SOAP envelope which is generated by the
WSDL and dynamically changes as you make changes to the SOAP settings. In
this field you can check what will be sent to the web service.
Important: If changes are made to any of the base SOAP settings, the content of
the SOAP XML will be re-generated and your changes will be lost.

371

Loading WSDLFilesThe SOAPmonitor within SAM currently supports the WSDL

372

Chapter 13: Building Component Monitors and Templates

Manually Entering XML
The following is an example of a Complex argument and would be placed in the
Parameters field. SAMwill automatically take the code and place it where it
belongs in the envelope:
<tempPhoneNumber xmlns:ns2="[Link] xsi:type="ns2:Array"
ns2:arrayType="ns1:TemporaryPhoneNumber[3]">
<item xsi:type="ns1:TemporaryPhoneNumber">
<startDate xsi:type="xsd:int">37060</startDate>
<endDate xsi:type="xsd:int">37064</endDate>
<phoneNumber xsi:type="xsd:string">+1-212-5551234</phoneNumber>
</item>
<item xsi:type="ns1:TemporaryPhoneNumber">
<startDate xsi:type="xsd:int">37074</startDate>
<endDate xsi:type="xsd:int">37078</endDate>
<phoneNumber xsi:type="xsd:string">+1-212-5554321</phoneNumber>
</item>
<item xsi:type="ns1:TemporaryPhoneNumber">
<startDate xsi:type="xsd:int">37088</startDate>
<endDate xsi:type="xsd:int">37092</endDate>
<phoneNumber xsi:type="xsd:string">+1-212-5557890</phoneNumber>
</item>
</tempPhoneNumber>

XML can also be entered manually by typing or pasting XML.

373

Scripting Custom Component Monitors

For more information, see

Web Service Monitoring
SOAP Component Monitor

l
l

Scripting Custom Component Monitors

Ten output pairs can be returned when using script monitors. This new ability
greatly improves flexibility in the way information is returned.
A usage example using the PowerShell script monitor might go something like
this:
Imagine you have an Exchange PowerShell script. With multiple values returned,
you can get a mail traffic report broken down by day, hour, message size, and
number of recipients.
Note: If you exceed the maximum number of allowed output pairs of ten, the
remainder above the tenth output pair will simply be ignored.
The following sections provide information and guidance to help you create some
of the more complicated types of component monitors.
l
l

Creating a Linux/Unix Script Monitor

Creating a Windows Script Monitor

374

Chapter 13: Building Component Monitors and Templates

l
l

Creating a Nagios Script Monitor

Creating a Windows PowerShell Monitor

For general information about the settings for each component monitor, click the
More Information help link in the SolarWinds SAM component monitor
description.
Note: SolarWinds fully supports scripts written and provided by the company;
however, we do not provide customer support for custom scripts written by outside
sources. SolarWinds does provide sample scripts that we do support located at:
C:\Program Files\SolarWinds\Orion\APM\Sample-Script Monitors.
For information on using Data Transformations, refer to the following sections:
l
l

Conversion Value
Available Data Transformations

Creating a Linux/Unix Script Monitor

Linux/Unix Script component monitors allow you to execute a command line
script that can return statistical data. When collecting information for this monitor,
Server & Application Monitor runs the script with the credentials you define with
the Credential Library.
Note: A maximum of 10 output pairs can be returned. If you exceed the maximum
allowed, remove the excess output pairs or they will simply be ignored.
To adapt an existing Perl script to a Linux/Unix Script component monitor in
a new template:
1.
2.
3.
4.
5.
6.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Create a new template underneath Application Monitor Templates.
Type a name for your template in the Template Name field.
If you want to turn on extended debug information to assist Customer
Support, expand Advanced, set Debug logging On, and specify the Number of log files to keep.
Here you can also select either 32bit or 64bit from the dropdown list
entitled, Platform to run polling job on.
Note: Do not turn on Debug logging unless directed by Customer Support.
7. Click Add Component Monitor.
8. Expand the Custom Component Monitors group, and then check
Linux/Unix Script Monitor.

375

To adapt an existing Perl script to a Linux/Unix Script component monitor in a

9. Click Submit.
10. Select credentials with SSH permissions in the Credential for Monitoring
field.
11. Type a valid working directory in the Script Working Directory field
12. Click Edit to open the script dialog and enter your script into the Script
Body field.
13. Type the Linux command that runs the script in the Command Line field. It
should be similar to the following: perl ${SCRIPT} arg1 arg2.
Note: {SCRIPT} is replaced by the actual file name of the script after its deployed
to the target node. (A temporary file is created in temp directory for the script).

14. Click Get Script Output. SAM will then test the script by executing it and
parse its output, then return the values.
15. Click Save.
16. Specify the critical and warning thresholds.
17. Click Submit.
Here is a sample Perl script using the Linux/Unix component monitor returning
multiple output pairs, in this case, two: Note: The code in red shows where the
output pairs are defined.
#!/usr/bin/perl

if (@ARGV[0] =~ /\bhelp\b/)
{
print "[Link] SNMPver community hostname\n";
print "SNMPver - version of SNMP protocol\n";
print "community - community name of SNMP protocol\n";
print "hostname - Target host\n";

exit 1;

}
# Get hostname and trim newline
$localhost = `hostname`;
$localhost =~ s/\s*$//g;
$hostname = shift || $localhost;
$community = shift || "public";
$version = shift || "v1";

376

Chapter 13: Building Component Monitors and Templates

$results = "";
$MIB_TotalMemory = "UCD-SNMP-MIB::memTotalReal.0";
#$MIB_TotalMemory = "UCD-SNMP-MIB::memTotalReal.0";
$outres = "snmpget -$version -c $community $hostname $MIB_TotalMemory |";
open(OUTMEM,$outres) || die "Unable read pipe\n";
while ($line = <OUTMEM>) {
if ($line =~ /\bINTEGER\b/) {
$indval = index($line,"=");
$indval=inde($line,":",$indval);
$val = substr($line,$indval+1,length($line) - $indval);
$val =~ s/[a-zA-Z\/\n ]//

print "Message.1: Available memory at host \"$hostname\": $val in kB\n";

print "Statistic.1: $val\n";
print "Message.2: Again, the available memory at host \"$hostname\": $val in
kB\n";
print "Statistic.2: $val \n";
exit 0;
}
}
print "Statistic: 0\n";
exit 1;

Below is the output from this script:

Linux/Unix Scripts
Linux/Unix scripts are uploaded by SSH and then run on the target node using
the string from the Command Line field.

377

Example Scripts
You can use the following variable in the command line field:
${SCRIPT}
Replaced with the script body.
You can use the following variables in the script body field:
${IP}
Replaced with the target nodes IP address.
${USER}
Replaced with the user name from the credential.
${PASSWORD}
Replaced with the password from the credential.
Example Scripts
There are several sample scripts installed with SolarWinds SAM you can use to
create Linux/Unix script component monitors. These sample scripts are installed
on your SolarWinds SAM server, in the folder:
C:\ProgramFiles\SolarWinds\Orion\APM\SampleScriptMonitors\LinuxScripts

Scripts Must Report Status Through Exit Codes

Scripts must report their status by exiting with the appropriate exit code:
Exit Code

Meaning

Up

Down

Warning

Critical

Any other value Unknown

For example, if you want to inform SolarWinds SAM that a Script reports Up
status, you would exit the script using code similar to the following, where 0
reports Up:
[Link](0)

378

Chapter 13: Building Component Monitors and Templates

Scripts with Text Output
Scripts report additional details by sending text to the scripts standard output.
In APM 4.0.2 and earlier, each line of output contained a single detail in the
following format:
DetailType:Value

# Script output comment

Message: The directory contains too many files.
Statistic: 5

While this is still true, SAM now supports multiple values returned by a script
using the following format.
Statistic.Name1: xMessage.Name1: abc
Statistic.Name2: yMessage.Name2: abc

Detail
Type

Required Meaning

Statistic

Yes

A numeric value used to determine how the monitor

compares to its set thresholds. This must be an integer
value, (negative numbers are supported).
Statistic.Name1: 123Statistic.Name2: 456

Message No

An error or information message to be displayed in the

monitor status details. Note: Multi-line messages are
supported. To use this functionality print each line using
a separate command. For example:
Message.Name1: abc
Message.Name2: def

There is a limit of ten Statistic and Message pairs for the script. These can
be placed anywhere in the script output. The Statistic and Message names
you give must contain valid letters and/or numbers.
Note: A maximum of 10 output pairs can be returned. If you have exceeded the
maximum allowed, remove the excess output pairs or they will simply be ignored.

379

Creating a Windows Script Monitor

Sample output:
# Script comment: This shows two pairs. Ten pairs are possible.
[Link]: 31.08
[Link]: [Link] cpu usage
[Link]: 1234.56
[Link]: [Link] ram usage

For information on creating a Nagios Script Monitor, see " Creating a Nagios
Script Monitor" on page 387.

Creating a Windows Script Monitor

This component monitor runs a Windows script on the SolarWinds SAM server
and then processes the script's exit code and text output. This monitor has the
ability to return up to ten pairs, i.e.: 10 statistic values + 10 [optional] messages.
This is best used in conjunction with the "Multiple Statistic Chart."
Note: A maximum of 10 output pairs can be returned. If you exceed the maximum
allowed, remove the excess output pairs or they will simply be ignored.
Statistic
The statistic for this component monitor is the value returned by the script.
Field Descriptions
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Component Type
This describes the type of monitor you are using.
Enable Component
This option determines whether or not the component is enabled. Disabling
this component leaves it in the application as deactivated and does not
influence application availability or status.
Credential for Monitoring

380

Chapter 13: Building Component Monitors and Templates

Select a Windows credential that is both a user who can log on to the
SolarWinds SAM server, and has sufficient rights on the target node (which
may be the SAM server itself, depending upon your application) to do
whatever the script needs to do. For example, if the script does something
with WMI, the credentials also need WMI rights on the target node. If the
credential you need is not already present in the credentials list, use the
Quick Credentials section to add a new credential.
Script Engine
This field allows you to specify the scripting language to be used. The
default value is vbscript. Below is a list of scripting engines that the Windows
Script Host supports:
Name

File Extensions Availability

VBScript

.vbs

Installed by default

JScript

.js

Installed by default

PerlScript

.pls

Freeware

ooRexxScript

.rxs

Freeware

PythonScript

.pys

Freeware

TclScript

.tcls

Freeware

ActivePHPScript

.phps

Freeware

RubyScript

.rbs

Freeware

Object Rexx engine

Commercial

Delphi scripting engine

Commercial

Note: VBscript runs locally on the SAM server only. PowerShell uses
WINRM that runs over TCP ports5985 and 5986. All Linux, Unix, and
Nagios script monitors use SSH over TCP Port 22.
Roll-Up
This option allows you to choose how you would like the monitor to report
the returned results based on the output provided by the script. With the
ability to have multiple values returned, selecting how your scripts report

381

Creating a Windows Script Monitor

back to you offers more flexibility. The default selection is Show worst
status. For more information, see Managing the Display of Group Status on
page 292.
Script
This field allows you to enter the script you want to run on the target node.
To enter your script, click the Edit button that reveals the script editing
window.
Script Arguments
This field is in the script editing window and allows you to specify
arguments to pass to the script. You may include the variables ${IP},
${USER}, and ${PASSWORD}, which are replaced respectively by the IP
address of the target node, the credential user name, and the credential
password.
Body
This field is in the script editing window and allows you to enter your script
via typing or pasting.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"
Creating a Windows Script Monitor
You can create a Windows Script monitor to have SolarWinds SAM run a script
using Windows Script Host. Windows Script Host comes with VBScript and
Jscript, but can be extended with other scripting languages.
Scripts run on the SolarWinds SAM server and use the credentials you specify.
The script must both return an exit code and output a text string containing a
statistic value conforming to the specifications described later in this section.
Note: Format the Statistic value to use the same decimal separator as the
SolarWinds SAM server. The SolarWinds SAM server uses the decimal separator
set by its Microsoft Windows regional settings.

382

Chapter 13: Building Component Monitors and Templates

To adapt an existing Visual Basic script to a Windows Script Monitor in a
new template:
1.
2.
3.
4.
5.
6.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Create a New Template underneath Application Monitor Templates.
Type a name for your template in the Template Name field.
If you want to turn on extended debug information to assist Customer
Support, expand Advanced and then set Debug loggingOn and specify
the Number of log files to keep. Here you can also select either 32bit or
64bit from the dropdown list entitled, Platform to run polling job on.
Note: Do not turn on Debug logging unless directed by Customer
Support.

7. Click Add Component Monitor.

8. Expand the Custom Component Monitors group, and then check WindowsScript Monitor.
9. Click Submit.
10. Select credentials with the appropriate permissions to run the script on the
SolarWinds SAM server, and that also has appropriate permissions to do
whatever else the script requires.
11. Copy the Visual Basic script into the Script Body field.
12. Type any script arguments into the Script Arguments field.
13. Specify the critical and warning thresholds.
14. Click Submit.
Macros for Script Arguments
Specify script arguments in the Script Arguments field if needed. You can use the
following variables as script arguments:
${IP}
This is replaced with the target nodes IP Address.
${USER}
This is replaced with the user name from the credential set.
${PASSWORD}
This is replaced with the password from the credential set.

383

Scripts Must Report Status Through Exit Codes

Scripts Must Report Status Through Exit Codes
Scripts must report their status by exiting with the appropriate exit code:
Exit Code

Meaning

Up

Down

Warning

Critical

Any other value Unknown

For example, if you want to inform SolarWinds SAM that a VBScript reports Up
status, you would exit the script using code similar to the following, where 0
reports Up:
[Link](0)

Scripts with Text Output

Scripts report additional details by sending text to the scripts standard output.
In APM 4.0.2 and earlier, each line of output contained a single detail in the
following format:
DetailType:Value

# Script output comment

Message: The directory contains too many files.
Statistic: 5

While this is still true, SAM now supports multiple values returned by a script
using the following format.
Statistic.Name1: xMessage.Name1: abc
Statistic.Name2: yMessage.Name2: abc

384

Chapter 13: Building Component Monitors and Templates

Detail
Type

Required Meaning

Statistic

Yes

A numeric value used to determine how the monitor

compares to its set thresholds. This must be an integer
value, (negative numbers are supported).
Statistic.Name1: 123Statistic.Name2: 456

Message No

An error or information message to be displayed in the

monitor status details. Note: Multi-line messages are
supported. To use this functionality print each line using
a separate command. For example:
Message.Name1: abc
Message.Name2: def

There is a limit of ten Statistic and Message pairs for the script. These can be
placed anywhere in the script output. The Statistic and Message names you give
must contain valid letters and/or numbers.
Sample output:
# Script comment: This shows two pairs. Ten pairs are possible.
[Link]: [Link]: [Link] cpu usage
[Link]: [Link]: [Link] ram usage

Example Scripts
Below is a sample vbscript that returns two values; the total number of files in a
folder, and twice the total number of files in the same folder. The code that
represents these two values are bold, To use this script, copy and paste the
following code into the Script Body field. In the Scripts Arguments field, type in
C:\Windows, or any other folder you want to monitor.
Option Explicit
On Error Resume Next
Dim lstArgs, path, fso, objDir, objFiles, objFiles2
Set lstArgs = [Link]
If [Link] = 1 Then
path = Trim(lstArgs(0 ))

385

Example Scripts
Else
[Link] "Message: Usage: [Link] [Link] [pathToFiles]" &vbCRLF &"
[pathToFiles] Local or UNC Path"
[Link] "Statistic: 0"
[Link] "Message: Usage: [Link] [Link] [pathToFiles]" &vbCRLF &"
[pathToFiles] Local or UNC Path"
[Link] "Statistic: 0"
[Link](1 )
End If
Set fso = [Link]("[Link]" )
If [Link](path ) Then
Set objDir = [Link](path )
If(IsEmpty(objDir ) = True ) Then
[Link] "Message: Object Not Initialized"
[Link] "Statistic: 0"

[Link](1 )

End If
Set objFiles = [Link]
If(IsEmpty(objFiles ) = true) Then
[Link] "Message: Object Not Initialized"
[Link] "Statistic: 0"
[Link](1 )
End If
[Link] "[Link]: " & CInt([Link] ) & " files in this folder."
[Link] "[Link]: " & CInt([Link] )
[Link] "[Link]: " & CInt([Link]*2 ) & " = twice the number of
files in this folder."
[Link] "[Link]: " & CInt([Link]*2 )
[Link](0 )
Else
[Link]("Message: Folder Not Found" )
[Link] "Statistic: 0"
[Link](1 )
End If

386

Chapter 13: Building Component Monitors and Templates

There are several examples of Windows Script component monitors included in
templates. These include: File Count, File Modified, LDAP Connection Monitor,
Run 3rd Party Application, and Windows Event Log Count.
Sample scripts are installed on your SolarWinds SAM server, in the folder:
C:\ProgramFiles\SolarWinds\Orion\APM\SampleScriptMonitors\WindowsScripts

For another example of a Windows Script component monitor, see Monitoring

Large Directories on page 170.

Creating a Nagios Script Monitor

This component uses SSH to upload a Nagios script to a Linux/Unix server, runs
the Nagios script on the server and then processes the script's exit code and text
output. This monitor has the ability to return multiple values.
Note: A maximum of 10 output pairs can be returned. If you exceed the maximum
allowed, remove the excess output pairs or they will simply be ignored.
Return Codes
Nagios determines the status of a host or service by evaluating the return code.
The following table shows a list of valid return codes, along with their
corresponding service or host states.
Return Code Service State Host State
0

OK

Up

Warning

Up or Down/Unreachable

Critical

Down/Unreachable

Unknown

Down/Unreachable

___________________
If the Use Aggressive Host Checking option is enabled, return codes of 1 will result in a host

state of DOWN, otherwise return codes of 1 will result in a host state of UP.

Your Nagios script must exit with a valid return code and a line of text output. The
exit code determines the status of the component. If the exit code is 0 (OK), the
component status may be further modified by thresholds from the optional
statistics. To return up to ten optional statistics, separate the statistics from the
status message with the pipe (|) symbol using the following syntax:
statusMessage [|'statisticName'=value]

387

Field Descriptions
Below is an example of valid output with a status message and two statistics:
The script ran. | 'CPU%'=75.2 'MemoryRemainingInKB'=600784

Statistic
The statistic for this component monitor is the value returned by the script. For
more information, see [Link]
Field Descriptions
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Component Type
This describes the type of monitor you are using.
Enable Component
This option determines whether or not the component is enabled. Disabling
this component leaves it in the application as deactivated and does not
influence application availability or status.
Authentication Type
Select Username and Password or Username and Private Key. For more
information, see "Certificate Credentials Library" on page 340.
Credential for Monitoring
Select a credential that can access the Linux or Unix server over SSH and that
has sufficient rights to run scripts. If the credential you need is not already present
in the credentials list, use the Quick Credentials section to add a new credential.
Certificates are also supported. For more information, see "Certificate Credentials
Library" on page 340.
Port Number
This field allows you to specify the port number used for the SSH
connection. The default value is 22.
Script Working Directory
This field allows you to specify the working directory of the script process.
Check Type

388

Chapter 13: Building Component Monitors and Templates

This determines how the return code is evaluated.
Status Roll-Up
This option allows you to choose how you would like the monitor to report
based on the output provided by the script. The default selection is Show
worst status. For more information, see Managing the Display of Group
Status" on page 292.
Command Line
This field is in the script editing window and allows you to specify the shell
command run after the SSH connection is established. The default
command line value perl ${SCRIPT} arg1 arg2 attempts to run in a Perl
interpreter the script defined in the Body field using the parameters arg1
arg2.
Note: The length of the Command Line field is limited to 266 characters for
Solaris systems, minus the length of the ${SCRIPT} variable after being
resolved to a file name such as the following: APM_937467589.pl. Since
the length of the file name will typically be around 16 characters, this means
that the actual user Command Line input cannot be longer than 266 16, or
250 characters (not including the length of the 9 characters for the
${SCRIPT} variable itself). If you need to pass a longer command line to
the target node, you can create a shell script on the target node (for
example: [Link]) that contains the long command line and place the
call to this script in the Command Line field, for example: /opt/sw/[Link]
Body
This field is in the script editing window and allows you to enter your script
via typing or pasting.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

Creating a Windows PowerShell Monitor

With this, you can create a monitor that runs a Windows PowerShell script to
monitor specific performance information for troubleshooting a Windows process
that may be having issues.

389

What needs to be monitored:

Note: A maximum of 10 output pairs can be returned. If you exceed the maximum
allowed, remove the excess output pairs or they will simply be ignored.
What needs to be monitored:
The process you want to monitor is [Link], which enforces security on the
system for users who are logging on, changing passwords, and so forth. In
particular, you want to monitor the average number of read operations performed
to check for spikes.
You decide to use the Windows PowerShell monitor to run a PowerShell script
that uses the Get-WmiObject call to measure the average ReadOperationCount
for the [Link] process and monitor its value.
1.
2.
3.
4.
5.
6.

7.
8.
9.
10.

11.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Create a New Template underneath Application Monitor Templates.
Type a name for your template in the Template Name field, for example
[Link] PowerShell Monitor.
If you want to turn on extended debug information to assist Customer
Support, expand Advanced and then set Debug logging On and specify
the Number of log files to keep.
Here you can also select either 32bit or 64bit from the dropdown list
entitled, Platform to run polling job on.
Note: Do not turn on Debug logging unless directed by Customer Support.
Click Add Component Monitor.
Expand the Custom Component Monitors group, and then check Windows PowerShell Monitor.
Click Add..
Select the Credential for Monitoring with appropriate permissions to run
the script on the SolarWinds SAM server, and that also has appropriate permissions to do whatever else the script requires (in our case, to get the
average number of read operations performed on the target node).
Select the Execution Mode to use:
l Local Host can run scripts only locally, that is, on the SolarWinds
SAM server.
l Remote Host can execute scripts remotely (on the remote target
node to which the Windows PowerShell monitor is assigned) using
the Windows Remote Management (WRM) system component. WRM

390

Chapter 13: Building Component Monitors and Templates

should be configured separately to get it working with the Windows
PowerShell monitor.
12. Copy the following PowerShell script, which uses the Get-WmiObject call
to measure the average ReadOperationCount for the [Link] process, into
the Script Body field:
$avg = Get-WmiObject win32_process -ComputerName '${IP}' -Credential
'${CREDENTIAL}' |Where-Object {$_.Name -eq "[Link]" } | Measure-Object property ReadOperationCount -Average;
Write-Host 'Statistic: ' $[Link](0)

The PowerShell code does the following:

a. Reads the average ReadOperationCount information for the process [Link] from the computer whose IP address is specified by the variable
${IP}using the credential specified by the variable ${CREDENTIAL}.
Note: The user name from the Credential for Monitoring that is
specified is stored automatically in the ${CREDENTIAL} variable by the
monitor. Therefore the ${CREDENTIAL} variable should not be placed in
the Script Arguments field, since it is set automatically. When the
script is run by powershell, since no password has been provided, it
prompts for a password and the password from the Credential for
Monitoring that is specified is provided automatically by the Windows
Powershell monitor.
b. Writes the statistic information gathered by the script.
c. Exits the script.
Note: The script does no error checking.
13. Enter the following Script Arguments:
Use the token ${IP}and the IP address will be filled in with the IP address of
the target node. You can then access the value in the script body using the
variable ${IP}.
For example, if you type the following for Script Arguments:
${IP}

the PowerShell script will be able to access the IP address for the target
node using the variable ${IP} in the script body.
14. Select Run the script under specified account to enable impersonation
with the component's credentials. (This works only in local script execution
mode.)

391

Troubleshooting the [Link] PowerShell Monitor

15. Select Count Statistic as Difference to change the statistic to be the difference in query values between polling cycles.
16. Change the Statistic Warning Threshold to greater than 800.
17. Change the Statistic Critical Threshold to greater than 1000.
18. Click Set test node.
19. Browse the tree view, select the desired target node for the PowerShell
script, and then click Select.
20. Click Test.
21. If the test fails, see Troubleshooting the [Link] PowerShell Monitor.
22. If the test passes, click Submit.
23. Click All in the Select tag to filter by list.
24. Locate the [Link] PowerShell Monitor. Beneath the listed templates, locate
the Page control. Click the right arrow twice to scroll to page 3.
25. Click the check box next to [Link] PowerShell Monitor.
26. Click Assign to Node.
27. Expand the tree view and select the target node which you tested the script
with in step 18.
28. Click Next.
29. Since you already assigned credentials and tested them in the template,
check the check box next to Inherit credentials from template.
30. Click Test to confirm the credentials and component monitor against the
test node.
31. Click Assign Application Monitors.
32. Click Done.
Troubleshooting the [Link] PowerShell Monitor
Verify that you are entering the user name and password of an administrator-level
account. If you think you have entered an incorrect credential, correct the mistake
and then retest.
Make sure that the RPC server is available and that the Windows PowerShell
execution policy is not set to Restricted (the default setting). You can check the
execution policy by entering the following command at the PowerShell command
prompt:
Get-ExecutionPolicy

If you are having trouble using the Windows PowerShell Monitor, see the
following KB article for some useful tips:
[Link]

392

Chapter 13: Building Component Monitors and Templates

Using Application Monitor Templates

This section discusses the many operations you can perform in SolarWinds SAM
regarding the use and management of Application Monitor templates. The topics
include:
l
l
l
l
l
l
l
l

Scanning Nodes for Applications

Manually Assign Application Monitors
Creating New Templates
Copying Templates
Exporting and Importing Templates Locally or Using Thwack
Deleting Templates
Managing Component Monitors within Templates
Tagging Templates

Scanning Nodes for Applications

SolarWinds SAM can scan nodes for you and automatically assign the
Application Monitors it deems suitable for each scanned node. You control the
nodes to be scanned, the application templates used in the scan, and the
scanning parameters that determine a match.
To use the application discovery:
1.
2.
3.
4.
5.
6.
7.
8.
9.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Scan Nodes for Applications.
Follow the instructions in the Select Nodes Wizard.
Follow the instructions in the Select Applications Wizard.
Follow the instructions in the Enter Credentials Wizard.
Follow the instructions in the Review & Start Scan Wizard.
Follow the instructions in the Add UX Monitors Wizard.

Select Nodes
Click [+] in the list to expand the node groups and to select the nodes you want to
scan.
Select Applications
To keep the time it takes to scan to a minimum, we recommend you initially scan
for only a limited number of application templates. To see more application

393

Enter Credentials
templates, select a different template group from the Show Only list.
To adjust the template assignment criteria, expand Advanced Scan Settings
and move the slider to the desired setting:
Exact Match
All the components must match to assign the template.
Strong Match
Most of the components must match to assign the template.
Partial Match
Some of the components must match to assign the template.
Minimal Match
At least one component must match to assign the template.
Enter Credentials
Some application templates require credentials either to access restricted
resources, or to run within the context of a specific user. To scan for these
templates, add the necessary credentials to the list. If a template you are scanning
for requires credentials, the credentials in this list are tried in the order in which
they appear.
Warning: Credentials are tried several times over the course of a scan, so an
incorrect password is likely to lock out an account. To avoid potential account
lockouts that affect actual users, we recommend you create and use service
accounts. A service account is an account that is created specifically for the
purpose of providing credentials to use for SolarWinds monitoring. With service
accounts, no actual user is affected by an account lockout if a password should
be entered incorrectly.
If you have domains sharing user names with different passwords, we
recommend you run separate application discoveries for each domain.
Review & Start Scan
Review the summary for the scan. If the automatic discovery matches templates
that are already assigned to the node, by default the template is not assigned a
second time. If you want to assign duplicate templates, select Yes, Assign
Anyway from the Do you want to assign duplicates list.

394

Chapter 13: Building Component Monitors and Templates

Click Start Scan to begin the scan. The scan runs in the background. You are
notified by a message near the top of the window when scanning is completed.
Click View results to see the results of the scan.
Add UX Monitors
You cannot scan for user experience (UX) monitors, but you can assign them to
nodes manually. Adding monitors from this page does not affect your scan.

Manually Assign Application Monitors

The quickest way to assign Application Monitors to nodes is through the Add
New Application Monitors Wizard, but you can also assign them through the
Manage Templates page.
To assign a template using the wizard:
1.
2.
3.
4.
5.
6.
7.
8.

9.
10.
11.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manually Assign Application Monitors.
Select the Application Monitor template you want to apply, and then click
Next.
Select the server node or nodes to which you want to apply the Application
Monitor template, and then click Next.
If suitable credentials already exist, choose the credential from the
Choose Credential list.
If suitable credentials do not exist, choose <New Credential> from the
Choose Credential list, and then add the new credential by filling out the
credential details.
Click Test to test the credentials and component monitors against the test
node.
If the test fails, troubleshoot the problem based on the error messages,
and then retest the node.
If the test passes, click Assign Application Monitors.

To assign a template through the Manage Application Monitor Templates

page:
1.
2.
3.
4.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Templates.

395

Creating New Templates

5.
6.
7.
8.
9.
10.

11.
12.
13.
14.

Select the tag by which to filter the templates.

Check the check box next to the template you want to assign.
Click Assign to Node.
Select the server node or nodes to which you want to apply the Application
Monitor template, and then click Next.
If suitable credentials already exist, choose the credential from the
Choose Credential list.
If suitable credentials do not exist, choose <New Credential> from the
Choose Credential list, and then add the new credential by filling out the
credential details.
Click Test to test the credentials and component monitors against the test
node.
If the test fails, troubleshoot the problem based on the error messages,
and then retest the node.
If the test passes, click Assign Application Monitors.
Review the information for the assigned Application Monitor and then click
Done.

Creating New Templates

SolarWinds SAM allows you to create new templates by bundling component
monitors together. There are two ways of creating a template from scratch. The
traditional method allows you to create any kind of template. The browsing
method only creates templates monitoring services, processes, and performance
counters.
Creating New Templates Using the Traditional Method:
1.
2.
3.
4.
5.
6.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Create a new template.
Type a name for your template in the Template Name field.
Specify the values for the Polling Frequency and Polling Timeout fields.
Note: Setting a polling frequency below 30 seconds can result in erratic
monitor behavior.
7. If you want to turn on extended debug information to assist Customer
Support, expand Advanced and then turn Debug logging On and specify
the Number of log files to keep. Here you can also select either 32bit or
64bit from the dropdown list entitled, Platform to run polling job on.

396

Chapter 13: Building Component Monitors and Templates

Note: Do not turn on Debug logging unless directed by Customer
Support.
8. Click Add Component Monitor.
9. Expand the component groups and check all the component monitors you
want to add.
Note: You can select multiple component monitors of the same type to be
added by entering a number in the field next to the check box for the
component monitor and then checking the check box.
10. Click Submit.
11. Configure the component monitor settings, and then click Submit.
Creating New Templates Using the Browsing Method:
1.
2.
3.
4.
5.
6.
7.
8.

9.
10.
11.
12.
13.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Component Monitor Wizard.
Select the component monitor type that you want to browse, then click
Next.
Type the IP address of the node you want to browse, or click Browse and
select the node from the list.
If suitable credentials already exist, choose the credential from the
Choose Credential list.
If suitable credentials do not exist, choose <New Credential> from the
Choose Credential list, and then add the new credential by filling out the
credential details.
Click Next.
If you selected a performance counter monitor type, select a performance object from Performance Object to populate the list.
Check the check boxes next to one or more found items to add as a component monitor.
Click Next.
Configure the component monitor properties, and then click Next.
Note: You can specify the name of a specific process to monitor by
entering the name in the Process Name field.

14. Select New Application Monitor Template.

15. Type a name for your template in the Application Monitor Template
Name field.
16. Click Next.

397

Managing Templates
17. If you want to assign the template to nodes, select the nodes.
18. If you only want to create the template, do not select any nodes.
19. Click Next, and then click OK, Create.

Managing Templates
You can create a new template or manage existing templates by using the
commands on the SAM Settings page:
l
l
l
l
l
l
l

Creating Templates
Assign to Node
Editing Templates
Copying Views
Exporting and Importing Templates Locally or Using Thwack
Deleting Templates
Tagging Templates

Creating Templates
You can create a new template by specifying the name of the template and then
adding the desired component monitors.
To create an application template:
1.
2.
3.
4.
5.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Templates.
Click Create New Template.

See Creating New Templates Using the Traditional Method for information on
completing the new template.
Assign to Node
You can create an assigned Application Monitor by assigning template(s) to
nodes.
To create an assigned Application Monitor by assigning template(s) to
nodes:
1.
2.
3.
4.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Templates.

398

Chapter 13: Building Component Monitors and Templates

5.
6.
7.
8.
9.

10.
11.
12.

Check the check box for the template(s) you want to assign.
Click Assign to Node.
Specify the node(s) to monitor and then click Next.
If suitable credentials already exist, choose the credential from the
Choose Credential list.
If suitable credentials do not exist, choose <New Credential> from the
Choose Credential list, and then add the new credential by filling out the
credential details.
Click Test to test the credentials and component monitors against the test
node.
If the test fails, troubleshoot the problem based on the error messages,
and then retest the node.
If the test passes, click Assign Application Monitors.

Editing Templates
You can modify an existing template by adding or removing its component
monitors. You can then save it to a new template by changing the template name
if desired.
To edit an application template:
1.
2.
3.
4.
5.
6.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Templates.
Check the application template you want to edit, and then click Edit.
If you are creating a new template by modifying an existing template,
specify the name for your new template in the Template Name field.
7. Specify the values for the Polling Frequency and Polling Timeout fields.
Note: Setting a polling frequency below 30 seconds can result in erratic
monitor behavior.
8. To turn on extended debug information to assist Customer Support,
expand Advanced and then set Debug logging On and specify the Number of log files to keep. Here you can also select either 32bit or 64bit from
the dropdown list entitled, Platform to run polling job on.
Note: Do not turn on Debug logging unless directed by Customer
Support.

399

Multi-Edit Templates
9. Click Add Component Monitor.
10. Expand the component groups and check all the component monitors you
want to add.
Note: You can select multiple component monitors of the same type to be
added by entering a number in the field next to the check box for the
component monitor and then checking the check box.
11. Click Submit.
12. Remove component monitors if desired by clicking Delete.
13. Configure the component monitor settings, and then click Submit.

Multi-Edit Templates
Multiple component monitors within a template can be edited simultaneously. As
indicated by the toolbar, multiple monitors can be selected to: Assign
Credentials, Test, Set Test Node, Disable, and Delete. The monitors selected
do not to be of the same type when performing a multiple monitor edit. When
performing a multiple monitor edit, the correct buttons will become enabled and/or
disabled based on your selection.
The Multi-Edit button allows you to change the options of two or more monitors of
the same type, simultaneously. To enable the Multi-Edit button, two or more
monitors of the same type must be selected. Once multiple monitors of the same
type are selected, the Multi-Edit button becomes enabled. In the illustration
below, three monitors (Services) are checked and the Multi-Edit button is
enabled:

Once the Multi-Edit button is pressed, a pop-up window is dispalyed with editing
options specific to the type of monitor selected. For example, the Fetching Method
for the three Services selected can be changed from RPC to WMI, as shown
below:

400

Chapter 13: Building Component Monitors and Templates

Note: Different types of monitors will have different options available for editing.
Ordering Components
Beginning in SAM 5.5, you now have the ability to re-order the components within
a template. When editing a template, the green arrows to the right of each
component monitor, highlighted below, will allow you to change the order of each
monitor. This new order is respected only on the All Applications resource and
the Application Details resource.

Copying Templates
After successfully creating a complicated template, instead of having to recreate it
over for a similar application, consider copying the template. This will allow you to
only modify those properties that differ.
To copy an application template:
1. Log on to your SolarWinds Web Console with an Administrator account.
2. Click the Applications tab.

401

Exporting and Importing Templates Locally or Using Thwack

3. Click SAM Settings.
4. Click Manage Templates.
5. Check the application template you want to copy, and then click Copy.
Exporting and Importing Templates Locally or Using Thwack
You can export and import templates to and from your file system for your own
use, or to the SolarWinds community site ([Link]) where templates can be
shared with the network engineering community.
Note: [Link] import and export operations require Internet connectivity to
[Link] and [Link]. In addition, thwack export
operations require a valid [Link] user account.
To export a template:
1.
2.
3.
4.
5.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Templates.
If you want to export a template to a file, complete the following procedure:
a. Check the application template you want to export, and then click
Import/Export > Export as File.
b. Confirm that you want to save the file by clicking Save.
c. If you are prompted for a path, specify or browse to one and then click
Save.
6. If you want to export the template to [Link], complete the following procedure:
a. Click Share Now to open a browser to the Application Monitor Templates area of thwack, where you can upload your newly exported
application template.
b. Click Sign in and then type your [Link] user name and password.
c. Click Upload a File and then specify the file pathname to your newly
exported application template.
To import a template from a file:
1.
2.
3.
4.
5.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Templates.
Click Import/Export > Import.

402

Chapter 13: Building Component Monitors and Templates

6. Click Browse and select the template file, then click Open.
7. Click Submit.
Note: If you import a template with the same name as one of your existing
templates, the name of the imported template is modified by appending (n)
to the name, where n is an integer. For example, assume you save the
template named Tomcat Server Template (shipped with SAM) to a file. If you
then import the saved template Tomcat Server Template from the file, the
imported template is renamed as Tomcat Server Template (1). If you import the
same template again, the next imported template is named Tomcat Server
Template (2), and so on. This renaming protects you from accidentally
overwriting an existing template.
To import a template from thwack:
1.
2.
3.
4.
5.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Shared thwack templates.
Check the template(s) you want to import, and then click Import. Then
enter your thwack User Name and Password and click Log In.
6. A dialog is displayed informing you that the import operation was successful. Click Close to close the dialog or click View Imported Templates
to view the results.
Note: If you import a template with the same name as one of your existing
templates, the name of the imported template is modified by appending (n)
to the name, where n is an integer. For example, assume you save the
template named Tomcat Server Template (shipped with SAM) to a file. If you
then import the saved template Tomcat Server Template from the file, the
imported template is renamed as Tomcat Server Template (1). If you import the
same template again, the next imported template is named Tomcat Server
Template (2), and so on. This renaming protects you from accidentally
overwriting an existing template.
Deleting Templates
If you no longer need a template, you can delete it. Deleting a template also
deletes all the data associated with it, so ensure you no longer need either the
template or the associated data before deleting the template.
Notes:

403

To delete a template:
l

Deleting a template also deletes all of its assigned applications, both modified and unmodified.
To speed user interface interaction, data is not immediately removed from
the database, but systematically updated every few minutes in the background.

To delete a template:
1.
2.
3.
4.
5.
6.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Templates.
Check the template(s) you want to delete, and then click Delete.
Confirm you want to delete the template(s) by clicking Yes.

Tagging Templates
Tags are descriptive labels that help you classify and sort your application
templates on the Manage Application Monitor Templates page. The application
templates included in SolarWinds SAM have already been tagged with several
descriptive labels you can modify as you see fit.
To add tags:
1.
2.
3.
4.
5.
6.
7.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Manage Templates.
Select the templates you want to tag.
Click Tags.
If you want to add existing tags, follow these instructions:
d. Click Add existing tag(s).
e. Select the tags from the list.
8. If you want to add new tags, follow these instructions:
a. Click Add new tag(s).
b. Type the tags in the Add new tag(s) field, separating multiple tag
entries with commas.
9. Click Submit.
To remove tags:
1. Log on to your SolarWinds Web Console with an Administrator account.
2. Click the Applications tab.

404

Chapter 13: Building Component Monitors and Templates

3.
4.
5.
6.
7.
8.
9.

Click SAM Settings.

Click Manage Templates.
Select the templates you want to tag.
Click Tags.
Click Remove tag(s).
Select the tags from the list.
Click Submit.

Understanding Component Monitors and Application Monitor Templates

The following terms are used throughout this guide to describe the SolarWinds
SAM concepts that allow you to monitor your applications.
Component Monitors
Component monitors are the building blocks of SolarWinds SAM. Each
monitors the status and performance of a different aspect of an application.
There are several different types of component monitors, each containing
settings that define what is monitored and how to monitor it.
Some types of component monitors allow you to set threshold conditions on
the monitored parameters. You can set separate thresholds to indicate
warning and critical conditions. For example, if you are monitoring the
percentage of free space remaining on a volume, you can set a warning
threshold at 15%, and a critical condition at 5%.
As an analogy, pretend SolarWinds SAM is monitoring a car. You would
have component monitors to check tire pressure, engine RPM, water
temperature, battery voltage, and other important subsystems of that vehicle.
You can set alerts to give notification if the water gets too hot, or if the
battery voltage drops too low.
Application Monitor Templates
A template is a group of component monitors modeling the total availability
and performance level of an application. A complicated application such as
Windows Server may require dozens of component monitors to accurately
assess its current status and performance.
Instead of creating component monitors one-by-one for every application
server, you can assign a pre-made template. The template can either be
one included with SolarWinds SAM, or a custom template you make
yourself. For example, you can assign the included Microsoft Windows

405

Understanding Component Monitors and Application Monitor Templates

Server 2003-2008 template to your Windows 2003 and Windows 2008
computers and obtain vital statistics on all of them.
A template is only a blueprint and does not perform any monitoring on its
own. Only after assigning the template to a server node are active assigned
component monitors created.
To continue the car analogy, pretend you want to monitor a fleet of 50, 2010,
blue Dodge Charger automobiles. Instead of defining the component
monitors for 50 cars, you can define all the component monitors in a Dodge
Charger template.
Assigned Component Monitors
Assigned component monitors are created by assigning Application Monitor
templates to server nodes. Each actively monitors its assigned node
according to its settings. Component monitors inherit these initial settings
from the template. If you make a change to a template, that same change is
rolled out to all assigned Application Monitors based on the template.
You can override the template settings at any time, breaking the inheritance
relationship between the component monitor and its template. For example,
the user name and password usually differ for each node, and you would
select a different credential for each assigned Application Monitor, thus
overriding the template setting for the Credentials field.
To restore the inheritance relationship between a component monitor and
its template, click Inherit From Template next to the setting.
Continuing the car analogy, when you assign the Dodge Charger template
to a Dodge Charger vehicle, you now have a set of assigned component
monitors for monitoring the vehicles tire pressures, engine RPM, and so
forth.
Assigned Application Monitors
An assigned Application Monitor runs its assigned component monitors at
regular intervals, and then uses the status results from the component
monitors to determine an overall status for the application.
If some of the component monitors are up and others are down, the
Application Monitor follows the Status Rollup Mode setting in the
SolarWinds Web Console Settings to show either the worst status of the
group or a warning status.

406

Chapter 13: Building Component Monitors and Templates

The difference between an assigned Application Monitor and a template is
that the template is only a blueprint and does not perform any monitoring on
its own. Only after assigning the template to a server node does SolarWinds
SAM conduct any actual monitoring on the node.
To complete the car example, you assign the Dodge Charger template to all
the Dodge Charger vehicles to create the assigned Application Monitor for
determining the overall status for your Dodge Charger fleet. For example,
the fleet may be 95% available at a given time due to warnings for some of
the cars.

Requirements for Component Monitors and Templates that use WMI

Microsoft Windows by default uses a random port between 1024 and 65535 for
WMI communications. You must create firewall exceptions to allow TCP/UDP
traffic on ports 1024 - 65535 or the component monitors and templates that use
WMI will not work.
The following component monitors use WMI:
l
l
l
l
l
l

Performance Counter Monitor

Process Monitor WMI (if script uses WMI access)
Windows Event Log Monitor
Windows PowerShell Monitor (if script uses WMI access)
Windows Script Monitor
Windows Service Monitor (if script uses WMI access)

The following templates use WMI:

l
l
l
l
l
l
l
l
l
l
l
l
l

Active Directory
Blackberry Enterprise Server
Citrix XenApp 5.0 Core WMI Counters
Citrix XenApp 5.0 ICA Session WMI Counters
Citrix XenApp 5.0 Presentation Server WMI Counters
Citrix XenApp 5.0 Services
Errors in Application Event Log
Exchange 2007
Exchange 2007 Client Access Role Services
Exchange 2007 Client Access Role WMI Counters
Exchange 2007 Common WMI Counters
Exchange 2007 Edge Transport Role Services
Exchange 2007 Hub Transport Role Services

407

Monitoring External Nodes

l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l

Exchange 2007 Hub Transport Role WMI Counters

Exchange 2007 Mailbox Role Services
Exchange 2007 Mailbox Role WMI Counters
Exchange 2007 Unified Messaging Role Services
Exchange 2007 WMI Counters
Exchange 2010 Client Access Role Services
Exchange 2010 Common Performance Counters
Exchange 2010 Edge Transport Role Services
Exchange 2010 Hub Transport Role Services
Exchange 2010 Mailbox Role Services
Exchange 2010 Unified Messaging Role Services
Exchange Server 2000 and 2003
Internet Information Services
SolarWinds Server
SharePoint Server (MOSS) 2007
SharePoint Services (WSS) 3.0
SQL Server 2005 Database
SQL Server 2008 Database
Windows Print Services
Windows Server 2003-2008

Monitoring External Nodes

To monitor services and applications on a server you do not directly manage, add
the server to the SolarWinds database as an external node. External nodes skip
all network performance data collection and polling tasks, but allow you to assign
applications to them.
For example, you could add [Link] as an external node, and then
assign several HTTP monitors to monitor Google search results.
For more information, see " on page 187.

Custom Application Monitor Template Example:

Creating a SolarWinds SAM Template
The following procedure creates a SolarWinds SAM Application Monitor template
that monitors a locally installed SQL Server instance. The template is simplified
by using the Windows Service component monitors, a TCP port monitor for your
SQL Server, and an HTTP monitor for the local Web Console. You do not need to
know the specific names of the processes, and you are not limited to a single

408

Chapter 13: Building Component Monitors and Templates

process per application. With Server & Application Monitor you can group
multiple component monitors into a single application and monitor these
groupings as one mission critical application.
While completing this procedure, you will create an application template with the
following component monitors:
l

TCP port component monitor to monitor port 1433, the port through which
SolarWinds communicates with the SQL Server.
Service component monitors for the following windows services:
l SolarWinds Alerting Engine
l SolarWinds Network Performance Monitor
l SolarWinds Job Engine
l SolarWinds Job Scheduler
l SolarWinds Module Engine
l SolarWinds Syslog Service
l SolarWinds Trap Service

HTTP component monitor to monitor port 80, the port through which you access
the SolarWinds Web Console.
To create a SolarWinds SAM application template:
1.
2.
3.
4.
5.

Log on to your SolarWinds Web Console with an Administrator account.

Click the Applications tab.
Click SAM Settings.
Click Create a new template underneath Application Monitor Templates.
Type a name for your template in the Template Name field. For example,
type SolarWinds SAM.
6. If you want to turn on extended debug information to assist Customer
Support, expand Advanced, set Debug logging On, and specify the Number of log files to keep.
Here you can also select either 32bit or 64bit from the dropdown list
entitled, Platform to run polling job on.
Note: Do not turn on Debug logging unless directed by Customer
Support.
7. Click Add Component Monitor.
8. Expand the Network Protocol Component Monitors list, and then check
TCP Port Monitor.
9. Click Submit.

409

To create a SolarWinds SAM application template:

10. Click Rename and then type a name for the TCP port monitor. For
example, type SolarWinds SAM SQL Server Port. Then click OK.
11. Ensure the Port Number field corresponds to the port used to communicate with the SolarWinds SAM SQL Server instance. By default, this
is port 1433.
12. Click Add Component Monitor.
13. Expand the Process and Service Component Monitors, and then check
Windows Service Monitor and click Submit.
14. Click Rename and then type a name for the SolarWinds Alerting Engine
monitor. For example, type SW Alerting Engine. Then click OK.
15. Select the credential set you want to use when accessing the Windows service information. For more information about creating a credential set, see
Understanding the Credentials Library on page341.
16. Type the name of the SolarWinds Alerting Engine service in the Net
Service Name field.
Note: This field is the Service name of the service to monitor. You can find
the Service name on Windows systems by clicking Start> Administrative
Tools> Services and then locating the desired service. Right-click the
service and select Properties from the context menu. The Service name is
the value of the Service name field in the Properties dialog. For the
SolarWinds Alerting Engine, this is typically SolarWindsAlertingEngine.
17. Repeat Steps 12 through 16 for the following SolarWinds SAM Windows
services:
l SolarWinds Network Performance Monitor
l SolarWinds Job Engine v2
l SolarWinds Job Scheduler
l SolarWinds Module Engine
l SolarWinds Syslog Service
l SolarWinds Trap Service
18. Click Add Component Monitor.
19. Expand the User Experience Component Monitors list, and then check
HTTP Monitor.
20. Click Rename and then type a name for the HTTP port monitor. For
example, type SolarWinds Web Console. Then click OK.
21. Ensure the Port Number field corresponds to the port you use for the
SolarWinds Web Console port.
22. Click Submit.

410

Chapter 13: Building Component Monitors and Templates

Web Service Monitoring

For custom web services that need to be monitored, SAMoffers the ability to
utilize the following technologies:
l

JSON: JavaScript Object Notation (JSON) is an open standard format that

uses human-readable text to transmit data objects consisting of attribute
value pairs. It is used primarily to transmit data between a server and web
application, as an alternative to XML.
Note: Inserted JSONcontent cannot exceed 1MB in size.
SOAP: Simple Object Access Protocol (SOAP) is a protocol used for
exchanging information in the implementation of web services in computer
networks. It relies on XML for its message format, and usually relies on other
application layer protocols. The SOAPmonitor is useful if you have custom
web services that need to be monitored.
Note: Currently, the SOAPmonitor within SAMcan return a status of either
Up or Down, or return a status of Warning or Critical based on response
time thresholds. This monitor also has the ability to search for the presence
of a string.

For more information, see:

l
l
l
l
l
l

Component Monitor Types

SOAP Component Monitor
SOAP Monitor
HTTP Monitor
HTTPS Monitor
JSON

JMX Component Monitor Wizard

Creating a standard template for this monitor is not practical because of the
amount of variables in any one specific environment. However, adding this
monitor to your environment has been made simple with the use of a wizard
driven interface.
Note: Only values that return numerical data can be monitored. String data is not
supported at this time. Non-numerical data will be shown without a check box.

411

To add a JMX component monitor, perform the following steps:

To add a JMX component monitor, perform the following steps:
1.
2.
3.
4.
5.
6.

Log on to your SolarWinds Web Console with an Administrator account.

Click Settings in the upper right hand corner of the web page.
Click SAM Settings.
Click Component Monitor Wizard underneath Getting Started with SAM.
Select JMX Monitor from the dropdown list then click Next.
For Server IP Address, click Browse, then select the node you want to
monitor.
7. Add the Port number, Protocol type, URL path, and Credentials for the
remaining fields.
8. Click Next. The following MBean selection screen appears:

9. Expand the folders by clicking the arrows (or [+]) to expand the tree view
folder structure. From here you can drill down to select the attributes you
want by checking them.
10. Click Next.
Now you are able to edit the JMX Component Monitor properties.
l
l

For more information, see "JMX Monitor " on page 1058.

For more information, see "JMX" on page 1143.

412

Chapter 13: Building Component Monitors and Templates

Available Data Transformations

SolarWinds SAM provides a number of predefined transformation functions that
may be applied to one or more monitors to generate mathematically manipulated
results. The following table lists transformation functions that are currently
available in SolarWinds SAM:
Data
Syntax
Transformati
on

Definition

Eulers
Number

E()

Eulers number, commonly called the

number e, is defined as the base of the
natural logarithm as the limit of a certain
sequence, or as the sum of a certain series.

Pi

Pi()

Pi is the mathematical constant whose value

is the ratio of any circle's circumference to its
diameter.

Rounding

Round({value},
{number of
decimal places})

Provides a number that is rounded to the

specified number of digits.

Truncate

Truncate({value},
{number of
decimal places})

Truncates a monitored value to a designated

number of decimal places.

Square Root

Sqrt({value})

Provides the square root of a given number.

Exponentiati
on

Pow({base value},
{exponent value})

Provides the result from repeated

multiplication of the base number.

Temperature:
Celsiusto
Fahrenheit

CToF({value})

Provides the Fahrenheit result originally

presented in Celsius

Temperature: FToC({value})
Fahrenheitto
Celsius
XtoKilobyte

XToKilo({value})

Provides the Celsius result originally

presented in Fahrenheit
Provides the number of Kilobytes originally

413

Available Data Transformations

presented in Bytes
XtoMegabyt
e

XToMega({value})

Provides the number of Megabytes originally

presented in Bytes

XtoGigabyte

XToGiga({value})

Provides the number of Gigabytes, originally

presented in Bytes

XtoTerabyte

XToTera({value})

Provides the number of Terabytes, originally

presented in Bytes

Kilobyteto
Megabyte

KiloToMega
({value})

Provides the number of Megabytes,

originally presented in Kilobytes

Kilobyteto
Gigabyte

KiloToGiga
({value})

Provides the number of Gigabytes, originally

presented in Kilobytes

Kilobyteto
Terabyte

KiloToTera
({value})

Provides the number of Terabytes, originally

presented in Kilobytes

Megabyteto
Gigabyte

MegaToGiga
({value})

Provides the number of Gigabytes, originally

presented in Megabytes

Megabyteto
Terabyte

MegaToTera
({value})

Provides the number of Terabytes, originally

presented in Megabytes

Gigabyteto
Terabyte

GigaToTera
({value})

Provides the number of Terabytes, originally

presented in Gigabytes

Terabyte to
Kilobyte

TeraToKilo
({value})

Provides the number of Kilobytes, originally

presented in Terabytes

Terabyte to
Megabyte

TeraToMega
({value})

Provides the number of Megabytes,

originally presented in Terabytes

Terabyte to
Gigabyte

TeraToGiga
({value})

Provides the number of Gigabytes, originally

presented in Terabytes

414

Chapter 13: Building Component Monitors and Templates

Conversion Value
Some monitors now offer the option to mathematically convert returned values
through the use of Data Transformations.
Checking the Convert Value check box opens the Formula box that enables you
to perform various mathematical functions. You can choose common functions
from the dropdown lists to manipulate the returned value, or you can select the
Custom Conversion option.
The Custom Conversion option offers more flexibility when manipulating
returned values. This option allows you to use the basic arithmetic operators; +, -,
*, /, along with built-in functions for more advanced conversions.
For a list of these functions, see Available Data Transformations" on page 413.
Following is a real world example for converting bytes into megabytes using a
predefined formula, or data transformation. In this case, XtoMega, was used to
convert bytes to megabytes.

With the XtoMega formula applied, the data transforms from 318767104 bytes to
304 megabytes, which is much easier to read.

Note: The Retrieve Current Value button tests the application and does not
apply the data transformation. Instead, the original statistic value will be returned.

415

Chapter 14:
Asset Inventory
The Asset Inventory dashboard allows you to maintain a current and detailed
inventory of your environment's hardware and software. Automatic inventory data
collection will benefit those interested in tracking asset depreciation, gathering
information for insurance purposes, or managing and maintaining your
infrastructure.
The following resources are available for the Asset Inventory dashboard:
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l

Custom Asset Information

Drivers
Firmware
Graphics and Audio
Hard Drives
Hosted Virtual Machines
Logical Volumes
Memory
Network Interfaces
Operating System Updates Applied
Out of Band Management
Peripherals
Ports and USB Controllers
Processors
Removable Media
Software Inventory
Storage Controllers
System Information
Windows Update Information

Note: Certain information may not be available for certain nodes. This may be
due to the polling method used or a lack of data provided by the manufacturer.
For additional information on Asset Inventory, see:
l
l

Asset Inventory Requirements

Third Party Software Required for Asset Inventory Information

416

Chapter 14: Asset Inventory

l
l
l

Asset Inventory Data Collection

Enabling the Asset Inventory Dashboard
Viewingthe Asset Inventory Dashboard

Asset Inventory Requirements

Asset inventory data collection can be enabled for both physical and virtual
assets and functions independently of hardware health monitoring. This means
you do not need to have hardware health monitoring enabled to have inventory
data collected and displayed.
The following hardware supports Asset Inventory data collection:
l

l
l
l

Dell servers with OpenManage Server Administrator Managed Node

v7.2or later
HP servers with HP System Insight Manager v6.2 or later
IBM server with IBM Director (Common Agent, v6.3 or later)
Additional hardware not listed here may be supported with a limited
amount of information returned from the polling process.

The Asset Inventory feature supports the following operating systems and
protocols and does not count against your SAM component monitor license.
Additionally, these nodes must be managed by SAM to enable collection of Asset
Inventory data:
Operating System

Protocol

Windows

SNMP, WMI

Linux

SNMP

AIX (v7 and higher)

SNMP

VMware ESX/ESXi v4.x and v5.x

l
l
l

VMware API for ESX/ESXi hosts

polled via vCenter.

CIM
VMware API
SNMP for VMware nodes not
polled via CIM or the VMware API

HTTPS

417

Third Party Software Required for Asset Inventory Information

Third Party Software Required for Asset Inventory

Information
HP
l
l
l

HP ESXi Offline Bundle

HP Management Agents for VMware ESX 4.x Only (Not for ESXi 4.x)
HP ESXi Offline Bundle for VMware ESXi 5.0

HP/VMWare
l
l
l

HP Management Agents for VMware ESX 4.x Only (Not for ESXi 4.x)
HP Insight Management WBEM Providers for ESXi 5.0
HP ESXi Offline Bundle for VMware ESXi 5.0

Dell/VMWare
l

OpenManage Support for VMware ESXi 5.x

IBM
l

IBM Director v6.2x

VMWare
l
l
l
l

HP Management Agents for VMware ESX 4.x Only (Not for ESXi 4.x)
HP Insight Management WBEM Providers for ESXi 5.0
HP ESXi Offline Bundle for VMware ESXi 5.0
Dell OpenManage Support for VMware ESXi 5.x

Asset Inventory Data Collection

Asset Inventory data collection is automatically enabled during the Network
Sonar Discovery and/or the upgrade process.
Data collected for Asset Inventory purposes uses less than 100KB of database
space per node. For a larger environment consisting of roughly 1,000 servers, the
total Asset Inventory data should total just under 100MB.
Note: Required sub-views are enabled by default for nodes with Asset Inventory
enabled. For more information, see "Customized SAM Tabbed Sub-Views" on
page 180.
Inventory data does not need to be collected with the same degree of regularity as
status information, therefore, the impact on your polling engine will be minimal.

418

Chapter 14: Asset Inventory

Asset Inventory data collection occurs once daily. This data collection interval
can be configured to suit your needs.
To Change the Default Asset Inventory Collection Period:
1. From the web console, navigate to Settings > Orion Polling Settings.
2. Adjust the number of days for the Default Asset Inventory Poll Interval field.
Note: 1 is the minimum allowable value for this field.

3. Click Submit.

Enabling the Asset Inventory Dashboard

The Asset Inventory sub-view is automatically displayed for each node supported.
You can enable Asset Inventory data collection for an individual node via the Add
Node Wizard or by navigating through the Management resource.
Note: The Asset Inventory option is available only if the node supports Asset
Inventory polling.
To Enable Asset Inventory data collection via the Add Node Wizard:
1. Navigate to Settings > Add Node.
2. From the Add Node wizard, the option to display Asset Inventory is available after a node has been defined. Check the Asset Inventory box to
enable Asset Inventory data collection.
To Enable Asset Inventory data collection via the Management Resource:
1. Navigate to the Node Details view by clicking any node.
2. From the Management resource, click List Resources.
3. Check the Asset Inventory box to enable Asset Inventory data collection.

419

Viewingthe Asset Inventory Dashboard

Note: The option to display Asset Inventory information may not be available if the node does not have a supported operating system.
To Disable Asset Inventory Data Collection:
l

For existing nodes, you can disable Asset Inventory data collection by
executing the following SQL command:
UPDATE [SolarWindsOrion].[dbo].[AssetInventory_Polling] set Enabled
= 0;

To disable this for future nodes added, rename the following file:
C:\Program Files (x86)
\SolarWinds\Orion\Discovery\Plugins\[Link]
[Link]

For example: [Link]-Disabled

Viewingthe Asset Inventory Dashboard

The Asset Inventory Dashboard is comprised of various resource modules and
provides detailed insight about the selected asset. The dashboard information
can be found on a separate sub-view tab, as shown:

420

Chapter 14: Asset Inventory

Navigating to the Asset Inventory page:

1. Click any node to be taken to the Node Details page.
2. With sub-views enabled, click the Asset Inventory tab.
For more information, see "Customized SAM Tabbed Sub-Views" on page 180.
All Asset Inventory resources contain a blue icon in the upper left-hand corner of
the resource. This will allow you to better identify this as an Asset Inventory
resource should you decide to place individual resources on different views.
Both the titles and subtitles of each resource can be changed by clicking Edit in
the upper right-hand corner of any resource.
Resources for the Asset Inventory dashboard can be added and deleted by
clicking Customize Page in the upper right-hand corner of the web console.
Notes:
l

If no information can be collected for a particular resource, that resource

will become hidden for that node.
Clicking the title of any resource will open that resource in a new window.

Custom Asset Information

This resource allows you display custom properties you have created relating to
Asset Information.
Following is an example of how this can be used:

421

Drivers
l
l
l
l

InServiceDate: Displays the first day of service for the asset

PONumber: Displays the Purchase Order number for the asset.
PurchaseDate: Displays the purchase date of the asset.
PurchasePrice: Displays the purchase price of the asset.

To add custom properties and have them displayed in this resource:

1. In the Custom Asset Information resource, click Edit.
2. Click Use the Custom Property Editor.

3. Follow the steps of the Wizard.

4. If available, check Asset Inventory to have the item displayed in the Custom Asset Information resource.

Drivers
This resource displays driver software currently installed on the current node
while providing a search window. The data can be sorted by clicking the headers
of each column.

422

Chapter 14: Asset Inventory

l
l
l
l
l

Device: Displays the device that relies on the driver listed.

Name: Displays the name of the driver listed.
Publisher: Displays the publisher of the driver listed.
Version: Displays the version of the driver listed.
Driver Date: Displays the date that the listed driver was created.

Firmware
This resource displays the firmware currently installed on the current node while
providing a search window. The data can be sorted by clicking the headers of
each column.

l
l
l
l

Name: Displays the name of the firmware listed.

Publisher: Displays the publisher of the firmware listed.
Version: Displays the version number of the firmware listed.
Release Date: Displays the release date of the version of the firmware listed.

Graphics and Audio

This resource provides detailed information about the current graphics and audio
devices associated with the node.
Note: In systems that contain multiple video cards or monitors, only the first of
each will be displayed in the Graphics and Audio resource for that node.

423

Hard Drives

Name: Displays field information about the listed graphics/audio device.

o Monitor Manufacturer Displays the manufacturer of the current
monitor.
o Monitor Model Number Displays the model number of the current
monitor.
o Monitor Resolution Displays the current resolution of the current
monitor.
o Video Card Displays details about the listed video card.
o Video Chipset Displays the current video chipset information for
the listed device.
o Video Memory - Displays the amount of memory currently installed
on the listed video card.
o Sound Card Displays details about the installed sound card.
Details: Displays details about the current device.

Hard Drives
This resource provides information about the current hard drives associated with
the node.

l
l
l

Model: Displays the model of the listed hard drive

Serial Number: Displays the serial number of the listed hard drive.
Capacity: Displays the total storage space of the current hard drive in gigabytes.

424

Chapter 14: Asset Inventory

Hosted Virtual Machines

This resource details the amount of resources allocated to each virtual machine.
Both VMware and Hyper-V hosts can be displayed in this resource.
Note: Only VMware 4.0 and higher is supported.

l
l

l
l
l

VM Name: Displays the name of the virtual machine listed.

Operating System: Displays the operating system of the virtual machine
listed.
State: Displays the on/off status of the virtual machine listed.
Memory Size: Displays the memory allocated to the virtual machine listed.
CPU Count: Displays the number of CPUs associated with the virtual
machine listed.
CPU Shares: Displays the percentage of CPU resources being used by
the listed virtual machine.
IP Address: Displays the IP address of the virtual machine listed.

For more information, see "Hardware Monitoring and VMware" on page 836.

Logical Volumes
This resource provides detailed information about the current logical volumes
associated with the node. Volumes call be polled via all protocols except VMware
CIM for ESX hosts. Any logical volume that can be monitored by SolarWinds will
appear in this resource.

425

Memory

l
l
l
l
l
l
l

Name: Displays the name of the volume listed.

Type: Displays the type of volume listed.
File System: Displays the file system employed on the volume listed.
Serial Number: Displays the serial number of the volume listed.
Size: Displays the total size of the volume listed.
Space Used: Displays the amount of space used on the volume listed.
Available Space: Displays the free space on the listed volume as a number of bytes.
% Available Space: Displays the amount of free space on the volume listed as a percentage and a bar chart.

Memory
This resource provides detailed information about the memory associated with
the node.

Memory Summary
l
l
l

Total RAM: Displays the total amount of RAM on the current node.
Free RAM: Displays the total amount of free RAM on the current node.
Total Virtual Memory: Displays the total amount of virtual RAM on the current node.
Free Virtual Memory: Displays the total amount of free virtual RAM on the
current node.

Memory Modules

426

Chapter 14: Asset Inventory

Slot: Displays the slot number in the server where memory is installed.
SAM also shows empty slots that could be populated with additional
memory modules to increase the server's RAM.
Capacity: Displays the maximum available RAM installed in the current
memory slot, in megabytes.
Model: Displays the model part number which can be used for purchasing
a replacement part.
Speed: Displays the frequency on which the memory module runs, in
megahertz.

Network Interfaces
This resource provides detailed information about current network interfaces
associated with the node.

l
l
l

Name: Displays the name and model of the listed interface. For more
information about a network interface, click [+] to the left of the interface
name to expand the tree view and reveal the following information:
o NetMask: Displays the configured netmask.
o Gateway: Displays the address of the gateway.
o DHCP Server: Displays the address of the DHCP server.
o DNS Server: Displays the address of the DNS server.
Manufacturer: Displays the manufacturer of the listed interface.
MAC Address: Displays the MAC address of the listed interface.
IP Address: Displays the IP address of the listed interface.

Operating System Updates Applied

This resource displays operating system updates that have been applied on the
current node while providing a search window. The data can be sorted by clicking
the headers of each column.
Note: This resource is only visible for Windows Nodes polled via WMI

427

Out of Band Management

l
l
l

Name: Displays the name of the listed update. Clicking the name in this
field may take you to the website with information concerning the listed
update.
Type: Displays the type of update installed.
Install Date: Displays the date that the listed update was installed.
Installed By: Displays the user responsible for installing the listed update.

Out of Band Management

This resource provides details about out of band management controllers
installed on the node.

l
l
l

Management Card: Displays the current management card.

Type: Displays the type of the current management card.
Firmware Version: Displays the current firmware version for the listed
management card.
IP Address: Displays the current IP address of the listed management
card.
MAC Address: Displays the current MAC address of the listed management card.

Peripherals
This resource provides information about the current peripherals associated with
the node.

428

Chapter 14: Asset Inventory

l
l

Type: Displays the type of peripheral listed

Details: Displays details about the peripheral listed.

Ports and USB Controllers

This resource provides detailed information about the current ports and USB
controllers associated with the node.

Ports
l
l

Ports: Displays the type of port.

Number: Displays the number of ports.

USB Controllers
l

USB Controllers: Displays detailed information about the listed USB controller.

Processors
This resource provides detailed information about the processors associated with
the node.
Notes:
l

Some IBM nodes may not provide processor information which will result
in missing information from this resource.
If a monitored computer is running the Solaris operating system, processor
information will not be available in this resource.

429

Removable Media

Important: Data for the number of cores will not be available for computers
running Windows Server 2003 unless the following Microsoft hotfix is applied:
[Link]
l
l
l
l
l
l

Processor: Lists the processors associated with the selected node.

Manufacturer: Displays the manufacturer of the listed processor.
Speed: Displays the current speed of the listed processor in gigahertz.
Cores: Displays the number of cores (CPUs) within the listed processor.
Threads: Displays the number of threads (concurrent processes) per core.
Model: Displays the processor manufacturing technology and design generation for the listed processor.
Stepping: Displays the revision number of the listed processor.

Removable Media
This resource provides information about the current removable media associated
with the node.

l
l
l

Name: Displays the name of the media listed.

Type: Displays the technology of the media listed.
Manufacturer: Displays the manufacturer of the media listed.

Software Inventory
This resource displays software currently installed on the current node while
providing a search window.

430

Chapter 14: Asset Inventory

l
l
l
l

Name: Displays the name of the software listed.

Publisher: Displays the publisher of the software listed.
Version: Displays the version of the software listed.
Install Date: Displays the date that the listed software was installed.

Storage Controllers
This resource provides detailed information about the current storage controllers
associated with the node. The data can be sorted by clicking the headers of each
column.

l
l

l
l

Name: Displays the name of the listed storage controller.

Model Number: Displays the model number of the listed storage controller.
Serial Number: Displays the serial number of the listed storage controller.
Firmware Version: Displays the firmware version of the listed storage controller.
Driver Version: Displays the driver version of the listed storage controller.

System Information
This resource provides a general overview of the selected node. To update the
details of this resource, click Poll Now, which forces all Asset Inventory
information to be polled immediately. To navigate to the Node Details page of the
current node, click the name of the node in the System Name field.

431

General

Note: When the listed machine is on Microsoft Hyper-V virtual hardware,certain

fields are populated with virtual machine related information. Because SAM
collects physical enclosure information from this class when using WMI, the
following fields may read as follows:
l
l
l

Manufacturer will read, "Microsoft."

Model will read, Virtual Machine.
Serial Number will read a GUID string.

The fields for this resource are defined as follows:

General
l

l
l

l
l

Last Inventory Collection: The date when SAM last collected inventory
data on the selected node.
System Name: Name of the current node.
Host Name: Name of the current host. This only applies to Windows hosts
polled via WMI
Domain/Workgroup Name: Name of the domain or workgroup this node
belongs to.
DNS: This is the DNS name of the current node. The IP address of the
node can change while the DNS name remains the same.
Domain Role: Shows the role of the current node. This only applies to Windows hosts polled via WMI
IP Address: Shows the IP address of the current node.
Dynamic IP: Shows if the current IP address is dynamic or static.

Hardware
l
l
l
l

Asset Type: Defines the current node as a specific type of hardware.

Hardware: Shows the hardware status as being either physical or virtual.
Manufacturer: Shows the company that produced this hardware.
Model: Shows the model number of the hardware as defined by the manufacturer. This only applies to physical nodes.

432

Chapter 14: Asset Inventory

l
l

Serial Number/Service Tag: Shows the serial number of the current node.
This only applies to physical nodes.
Warranty Status: Shows the warranty information about the current node
with a link to that vendor's site. This only applies to physical servers that
are Dell, HP, or IBM.
Note: One alert is included for Warranty Status:
o Alert me when a node warranty expires in 30 days - Disabled by
default.
Location: Displays the geographical location of the current node.
Device Time Zone: Shows the time zone set in the system. This only
applies to Windows nodes polled via WMI.

Operating System
l
l
l

l
l

Operating System: Shows the operating system of the current node.

OS Version: Shows the current version of the operating system.
OS Architecture: Shows the design (32-bit or 64-bit) of the operating system.
OS Language: Shows the language the current operating system is using
on the current node.
Service Pack: Displays the current service pack installed on the operating
system. This only applies to Windows nodes polled via WMI.
Last Boot: Shows the date of the last boot for the current node.
Last Logged in User: Displays the last user to log in on the current node.
This only applies to Windows nodes polled via WMI.
Firewall Status: Displays whether or not the built-in Windows firewall is
currently enabled on the node. This only applies to Windows nodes polled
via WMI.
Hardware Agent: Displays the Hardware Monitoring Agent Software currently installed on the node.

Windows Update Information

This resource provides information about the current Windows update status
associated with the node. This only applies to Windows nodes polled via WMI.

433

Windows Update Information

Windows Update Status: Displays whether or not Windows Update is

enabled.
Most Recent Check for Updates: Displays the time and date of the last
successful check for updates.
Updates Last Installed: Displays the time and date of the last successful
installation of updates.
Update Method: Displays how updates are managed on the host. This
value can be Automatically Applied, Download And Notify, or Notify Only.

434

Chapter 15:
AppInsight Applications
AppInsight applications provide a level of detail and expert knowledge far beyond
what a simple template can provide, allowing you to monitor virtually every aspect
of the assigned application.
Like any unassigned application in SAM, AppInsight applications are considered
templates until applied. Therefore, it is a member of the Application Monitor
Templates collection.
Once applied to a node, AppInsight applications are considered applications.
Like any SAM application, AppInsight applications are comprised of multiple
component monitors, also known as performance counters.
Currently, SAMoffers two different AppInsight Applications:
l
l

AppInsight for SQL

AppInsight for Exchange

Template/Application Relationship
The following illustration explains the Template and Application relationship and
is true for all templates, including all AppInsight applications.
Here you can see that if you change something at the template level, the
applications based on that template will be affected. Conversely, if you change
something on the application level, only the individual application will be affected.
This inheritance relationship is beneficial if you need to make a great deal of
changes quickly. For example, rather than change one item on 100 applications
that are based on a single template (which requires 100 changes), you can more
easily change the one item on the template. That one change in the template will
trickle down to all 100 applications that are based on the template.

435

Chapter 15: AppInsight Applications

AppInsight for SQL

SAM offers a detailed view of your SQL databases' performance without the use
of agents or templates by using the AppInsight for SQL embedded application.
AppInsight for SQL provides a level of detail and expert knowledge far beyond
what a SQL template can provide, allowing you to monitor virtually every aspect
of your SQL instances and databases.
Like any unassigned application in SAM, AppInsight for SQL is considered a
template until it is applied. Therefore, it is a member of the Application Monitor
Templates collection.

436

AppInsight for SQL Requirements and Permissions

Once applied to a node, AppInsight for SQL is considered an application. Like
any SAM application, AppInsight for SQL is comprised of multiple component
monitors, also known as performance counters.
AppInsight for SQL general information:
l
l
l
l
l
l
l

AppInsight for SQL Requirements and Permissions

AppInsight for SQL Licensing
Template/Application Relationship
Adding AppInsight for SQL to a Node
Editing the AppInsight for SQL Template
Understanding the AppInsight for SQL Details View
Navigating the AppInsight for SQL Details View

Information about individual AppInsight for SQL resources can be found at

the following locations:
l

AppInsight for SQL Details view, which is comprised of the following subviews:
o AppInsight for SQL Details View (Summary Tab)
o AppInsight for SQL Details View (Queries Tab)
o Database Details View
Performance Counter Details View

_________________
Portions of the performance counter information used in the AppInsight for SQL application are provided courtesy of
multiple sources listed in the copyright and attribution section at the beginning of this document.

AppInsight for SQL Requirements and Permissions

AppInsight for SQL data is collected at the same default five minute polling
interval as traditional application templates. Following are the requirements and
permissions needed for AppInsight for SQL:
Important: AppInsight for SQL does not require named-pipes; however, it does
require TCP. For example, SAM uses TCP detection during discovery. You may
receive an error message pertaining to "[Link] is the result of the the
last client protocol that is tried during connection to the SQL server.
AppInsight for SQL Requirements
AppInsight for SQL supports the following versions of Microsoft SQL Server:
Microsoft SQL Server Version Versions Supported

437

Chapter 15: AppInsight Applications

Microsoft SQL Server 2008

Without SP
SP1
SP2
SP3

Microsoft SQL Server 2008 R2

Without SP
SP1
SP2

Microsoft SQL Server 2012

Without SP
SP1

AppInsight for SQL Permissions

The minimum SQL permissions required to use AppInsight for SQL are as
follows:
l

l
l
l
l
l
l
l

Must be a member of the db_datareader role on the msdb system database.

Must have VIEW SERVER STATE permissions.
View any definition.
Connect permission to Master database.
Execute permission on the Xp_readerrorlog stored procedure.
Connect permission to the Msdb database.
Must be member of db_datareader role in the Msdb database.
Connect permission to all databases.

Note: AppInsight for SQL supports both the SNMP and WMI protocols and uses
SQL to gather information about the application. Additional information is
available for nodes managed via WMI.
The following script will configure permissions:
USE master
GRANT VIEW SERVER STATE TO AppInsightUser
GRANT VIEW ANY DEFINITION TO AppInsightUser
GRANT VIEW ANY DATABASE TO AppInsightUser
EXEC sp_adduser @loginame = 'AppInsightUser' ,@name_in_db =
'AppInsightUser'
GRANT EXECUTE ON xp_readerrorlog TO AppInsightUser
USE msdb

438

AppInsight for SQL Licensing

EXEC sp_adduser @loginame = 'AppInsightUser' ,@name_in_db =
'AppInsightUser'
EXEC sp_addrolemember N'db_datareader', N'AppInsightUser'

AppInsight for SQL Licensing

When usingAppInsight for SQL, 50 component monitors will count against your
licensed number of component monitorsper SQL instance.
For example, if you have an active license for 1,500 component monitors and
useAppInsight for SQLto monitor 88 databases over ten instances of SQL, 500
component monitors will count against your total license. The number of
databases you have on these instances is irrelevant.
(50 component monitors X 10 SQL Server instances = 500 component
monitors used.)
This will leave you with 1,000 component monitors available for use elsewhere.
(1,500 component monitors 500 component monitors used for
AppInsight for SQL = 1,000 component monitors remaining).
There is no restriction on the number of databases you can have monitored. Also
note that if you choose not to use this application, you will not be penalized any
number of component monitors.
For more information, see "Licensing" on page 150.

Adding AppInsight for SQL to a Node

There are multiple ways to add AppInsight for SQL to a node, via Node
Discovery, manually adding it via the Manage Application Monitor Templates
screen, adding it via the Management resource, adding it via Network Sonar
Discovery, or adding it via a Scheduled Discovery.
To Add AppInsight for SQL to a Node via Discovery:
1. From the web console, navigate to Settings > Add a Node in the Getting
Started with Orion section.

439

Chapter 15: AppInsight Applications

2. Fill out the information on the Define Node step, and then click Next.
3. On the Choose Resources step, check the AppInsight for SQL applications you want. AppInsight applications have a unique blue and white
icon, as shown:

4. Click Next and complete the wizard as instructed.

To Add AppInsight for SQL to a Node via Manage Application Templates:
1. From the web console, navigate to Settings > SAM Settings > Manage
Templates.

440

To Add AppInsight for SQL via the Management Resource:

2. Select AppInsight for SQL by checking its box and click Assign to Node.
3. Complete the required fields in the wizard and click Assign Application
Monitor.
To Add AppInsight for SQL via the Management Resource:
1. Navigate to the Node Details view by clicking any node.
2. From the Management resource, click List Resources.
3. Check the AppInsight for SQL box to enable AppInsight for SQL data
collection.
For information on Network Sonar Discovery, see Network Sonar Discovery.
For information on Scheduled Discovery, see Managing Scheduled Discovery
Results.

Editing the AppInsight for SQL Template

The AppInsight for SQL application behaves like any other application in SAM.
And like other applications, AppInsight for SQL's template can be edited.
Editing the AppInsight for SQL Template:
1. From the web console, navigate to Settings > SAM Settings > Manage
Templates.
2. Check the AppInsight for SQL template in the list and then click Edit.
3. From here, you can edit any and all component monitors within the template; including threshold values, number of records to retrieve, component
monitor description, and so on.

441

Chapter 15: AppInsight Applications

4. When done editing, click Submit at the bottom of the screen.

Understanding the AppInsight for SQL Details View

The AppInsight for SQL Details view is the equivalent of the Application Details
view of a traditional SAM application; however, there are some notable
differences:
l

Details View - Unlike a traditional Application Details view, the AppInsight

for SQL Details view is comprised of two tabs, or sub-views, that host a variety of resources and information:
o Summary Tab This view displays an informative summary about
the current SQL instance.
o Queries Tab This view displays details about the most expensive
queries running across all databases on the current SQL instance.

442

Editing Resources

Database Details View - This view displays details about the selected database.
Performance Counter Details View - This view displays details about the
selected performance counter.
From here, you can select from the dropdown menu and choose to display
different amounts of data based on a time range, as shown below:

Editing Resources
Both the titles and subtitles of each resource can be changed by clicking Edit in
the upper right-hand corner of any resource, and then clicking Submit.
The time and date displayed at the top of each resource (where applicable)
shows the range of data currently loaded into the resource. This, along with the
Sample Interval Range, can be changed by clicking Edit from within the resource.
Additionally, certain resources will allow you to add and remove component
monitors from the resource. You can do this by clicking the Edit button, and then
checking the component monitors you want to keep.

443

Chapter 15: AppInsight Applications

Note: Pertinent data for each resource is grouped together by default.

Navigating the AppInsight for SQL Details View

AppInsight for SQL acts like any other application and can therefore be found in
the All Applications resource on the Application Summary view. By default, subviews are turned on once you navigate to the AppInsight for SQL Details page.
Below is the AppInsight for SQL application with the All Applications resource
detailed on the Summary tab of the Application Details page:

444

Navigating the AppInsight for SQL Details View

To Navigate to the AppInsight for SQL Details View:

1. From the web console, locate the All Applications resource.
2. Expand the AppInsight for SQL tree by clicking [+].

445

Chapter 15: AppInsight Applications

3. Select a SQL instance to view by clicking it.

To Navigate to the Database Details view:

1. From the AppInsight for SQL Details view, click a database in All Databases resource.

To Navigate to the Performance Counter Details view:

1. From the AppInsight for SQL Details view, click a performance counter in
any resource.

446

Monitoring Clusters with AppInsight for SQL

Monitoring Clusters with AppInsight for SQL

To start monitoring a SQL server instance which is clustered, take the
following steps:
1. Connect to the instance that you want monitor using SQL Management Studio
2. Execute the following query to make sure you have the proper target node
and instance name:
SELECT SERVERPROPERTY('ServerName')

447

Chapter 15: AppInsight Applications

3. Determine the IP address of the target node (e.g. ping P111SQLV23)

448

Monitoring Clusters with AppInsight for SQL

4. Make sure that the node with this address is being monitored by SAM. If it is
not, add it.
Note: If the IP address represents a cluster, the node name of the active
cluster member will be populated. It is recommended that you change the
node name to something more easily understood, for example: P111SQLV23

449

Chapter 15: AppInsight Applications

(cluster) during

the final step of the Add Node Wizard.

5. Enter the proper information and manually assign the Appinsight for SQL
template to the node with the appropriate IP address.
6. The application should begin polling.
For more information, see How to Handle Microsoft Server Clusters in AppInsight
for SQL

AppInsight for SQL Alerts

The following two alerts are included with AppInsight for SQL:
l
l

Alert me when my database file disk I/O latency is high.

Alert me when a node warranty expires in 30 days.

450

AppInsight for SQL Details View (Summary Tab)

AppInsight for SQL Details View (Summary Tab)

The Summary tab provides a great deal of information about the current SQL
instance. The available resources unique to this view include:
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l

All Databases
Application Availability
Application Details
Buffer Manager
Cache
Connections
Disk
Latches and Locks
Memory
Pages
Sessions
SQL Agent Job Status
SQL Errors
SQL Event Log Message Details
SQL Server
Top 10 Databases by Active User Connections
Top 10 Most Expensive Queries by CPU Time

Note: Chart resources require several values for lines on charts to be visible.
All Databases
This resource shows the status of all monitored databases on the current SQL
instance. The data can be sorted by clicking the headers of each column.

l
l

Name: Displays the name of the listed database, in addition to the current
performance status as indicated by the icon. Clicking the name of the database will take you to the Database Details page.
Status: Displays the Online or Offline status of the listed database.
Database Size: Displays the current size of the listed database.

451

Chapter 15: AppInsight Applications

Transaction Log Size: Displays the size of the transaction log associated
with the listed database.

Application Availability
This resource graphically shows the various states of an application in a
percentage format and is made up of three sections: the legend, the main chart,
and the lower chart. The colors of the main chart correspond to the labels in the
legend.

Note: This resource will not be available when using Internet Explorer 7.
Consider upgrading Internet Explorer or using FireFox or Chrome as your web
browser.
Zooming
You can have the chart show a predetermined, hourly time period of data by
clicking on any one of the three Zoom buttons; 1h, 12h, or 24h. Alternatively, you
can have the chart show a specific time range by dragging the mouse over a
small area of the chart.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom

452

Application Details
in further by fine tuning the view with the sliders. The main view of the chart will
display the selected time period between the two sliders of the lower chart.
Moving the mouse over the main chart will reveal a tooltip with more detailed
information about the specific time period the mouse is hovering over. By default,
all statistics are shown in the main chart.
Application Details
This resource provides tools and details concerning the current application.

l
l
l
l

l
l

Management: This provides tools allowing you to more easily manage

and troubleshoot the current application.
Instance Name: Displays the name of the current SQL instance.
Status: Displays the status of the current SQL instance.
SQL Server Version: Displays the version of the current SQL server.
SQL Server Product Level: Displays the maturity level of the current SQL
version.
SQL Server Edition: Displays the edition of the current SQL Server.
Clustered with: If the listed SQL Server is in a cluster, this field will show a
listing of the servers that make up the cluster. If the cluster is managed by
SAM, a status icon will become visible. If the cluster is not managed in
SAM, no status icon will be visible.

Buffer Manager
This resource contains performance counters specific to the current status of
buffers. The icons of the listed performance counters in the Statistic Name column
will change color to reflect the listed counter's current state. Clicking any
performance counter in the Statistic Name column will take you to the
Performance Counter Details page for that counter.

453

Chapter 15: AppInsight Applications

If the value of a listed performance counter crosses the Warning threshold, the
chart for the listed counter will display a yellow background. If the value of a listed
monitor crosses the Critical threshold, the chart for the listed counter will display a
red background. Hovering over any time period within the chart will display
detailed information about that time period in the tooltip. Hovering over a counter
will give you detailed information about that counter.

Total
pages

Definition:
This performance counter returns the number of pages in the
buffer pool
Information:
The returned value includes database, free, and stolen pages.
Note: This counter is not available in SQL 2012.

Buffer
Cache Hit
Ratio

Definition:
Indicates the percentage of pages found in the buffer cache
without having to read from disk. The ratio is the total number of
cache hits divided by the total number of cache lookups over the
last few thousand page accesses.
Information:
After a long period of time, the ratio moves very little. Because
reading from the cache is much less expensive than reading from
disk, you want this ratio to be high. Generally, you can increase
the buffer cache hit ratio by increasing the amount of memory

454

Buffer Manager

available to SQL Server. The higher this ratio, the less often SQL
Server has to go to the hard disk to fetch data, and performance is
boosted overall. This counter averages the Buffer Cache Hit
Ratio from the time the last instance of SQL Server was restarted.
This counter is not a real-time measurement, but an average of all
the days since SQL Server was last restarted. In OLAP
applications, the ratio could be much lower because of the nature
of how OLAP works.
Possible problems:
If the returned value is low, this could indicate that your SQL
server may not have enough memory to function at peak
performance.
Remediation:
Check your SQL server and verify its memory is being used
efficiently. Applications other than SQL may be using a great deal
of memory. Try and recover memory by closing unnecessary
applications. Installing additional memory may also help.
Lazy
Definition:
Writes/Sec The lazy writer is a system process that flushes out buffers that
contain changes that must be written back to disk before the
buffer can be reused for a different page and makes them
available to user processes.
Information:
This counter tracks how many times per second that the Lazy
Writer process is moving dirty pages from the buffer to disk in
order to free up buffer space. The Lazy Writer eliminates the need
to perform frequent checkpoints in order to create available
buffers.
Generally speaking, this should not be a high value, say more
than 20 per second. Ideally, it should be close to zero. If it is zero,
this indicates that your SQL Server's buffer cache is large and
your SQL Server does not need to free up dirty pages.
Possible problems:

455

Chapter 15: AppInsight Applications

If the returned value is high, this can indicate that your SQL
Server's buffer cache is small and that your SQL Server needs to
free up dirty pages.
Remediation:
Check your SQL server and verify its memory is being used
efficiently. Applications other than SQL may be using a great deal
of memory. Try and recover memory by closing unnecessary
applications. Installing additional memory may also help.
Free List
Stalls/Sec

Definition:
Indicates the number of requests per second that had to wait for a
free page.
Information:
This displays the frequency with which requests for available
database pages are suspended because no buffers are
available.
Possible problems:
If the returned value is high, this indicates that not enough
memory is available for the SQL Server.
Remediation:
Check your SQL server and verify its memory is being used
efficiently. Applications other than SQL may be using a great deal
of memory. Try and recover memory by closing unnecessary
applications. Installing additional memory may also help.

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.

456

Cache
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
Cache
This resource contains monitors specific to the current status of the cache. The
icons of the listed performance counters in the Statistic Name column will change
color to reflect the listed counter's current state. Clicking any performance counter
in the Statistic Name column will take you to the Performance Counter Details
page for that counter.
If the value of a listed performance counter crosses the Warning threshold, the
chart for the listed counter will display a yellow background. If the value of a listed
monitor crosses the Critical threshold, the chart for the listed counter will display a
red background. Hovering over any time period within the chart will display
detailed information about that time period in the tooltip. Hovering over a counter
will give you detailed information about that counter.

Cache
Definition:
Used/Min This displays the number of times the cache object has been
looked up.
Information:
This is not incremented when parameterized queries find a plan in
the cache. However, this can be incremented multiple times when
using Showplan. Good plan reuse is one sign of a healthy system.
Compiling a query plan can be a CPU-intensive operation,
especially with complex queries, so reuse is encouraged.

457

Chapter 15: AppInsight Applications

Possible problems:
If the returned value is low, this can indicate ineffective reusing of
plan cache which could cause a CPU spike. Conversely, if the
returned value is high for a large number of plans, this could
indicate that your cache space is being taken up with plans that
were compiled and used once to execute an ad hoc query, then
never used again.
Remediation:
A database setting that can be helpful to plan reuse is forced
parameterizaton. (You can set this using the following command:
ALTER DATABASE <databaseName> SET
PARAMETERIZATION FORCED). Normally, the query optimizer
is very conservative when deciding what queries can be
parameterized, but this setting makes the optimizer be more liberal
in choosing parameters.
Cache
Object
Counts

Definition:
This performance counter returns the number of cache objects in
the cache.
Information:
ThePlan Cache object provides counters to monitor how SQL
Server uses memory to store objects such as stored procedures,
ad hoc and prepared Transact-SQL statements, and triggers.
Multiple instances of thePlan Cacheobject can be monitored at
the same time, with each instance representing a different type of
plan to monitor.
Possible problems:
High numbers of total cached objectsuseportions of thephysical
memory available toa SQLinstanceon a per database basis.
This can result in one database cache impacting the performance
of other local databases due to memory contention.
Remediation:
Increase the memory available to SQL services, reduce the
number of databases on this instance of SQL, or examine the
volume of ad hoc queries running against the server.

458

Connections

Cache
Objects
in Use

Definition:
This performance counter returns number of cache objects in use.
Information:
ThePlan Cache object provides counters to monitor how SQL
Server uses memory to store objects such as stored procedures,
ad hoc and prepared Transact-SQL statements, and triggers.
Multiple instances of thePlan Cacheobject can be monitored at
the same time, with each instance representing a different type of
plan to monitor.
Possible problems:
High numbers ofcached objects in use consumethe memory
available to a SQL server at a higher rate than non-active objects
on a per database basis. This can result in one database cache
impacting the performance of other local databases due to
memory contention.
Remediation:
Increase the memory available to SQL server, reduce the number
of active objects, consolidate stored procedures, consolidate and
convert ad hoc queries to stored procedures where possible, or
reduce the number of databases on the server.

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
Connections
This resource contains monitors specific to the current status of the active
connections. The icons of the listed performance counters in the Statistic Name

459

Chapter 15: AppInsight Applications

column will change color to reflect the listed counter's current state. Clicking any
performance counter in the Statistic Name column will take you to the
Performance Counter Details page for that counter.
If the value of a listed performance counter crosses the Warning threshold, the
chart for the listed counter will display a yellow background. If the value of a listed
monitor crosses the Critical threshold, the chart for the listed counter will display a
red background. Hovering over any time period within the chart will display
detailed information about that time period in the tooltip. Hovering over a counter
will give you detailed information about that counter.

User
Definition:
Connections The User Connections performance counter identifies the
number of different users that are connected to your SQL
Server at the time the sample was taken.
Information:
You need to watch this counter over time to understand your
baseline user connection numbers. Since each user
connection consumes some memory space, a high number of
user connections can impact throughput and cause a
performance slow-down. Once you have an idea of your high
and low thresholds during normal usage of your system, you
can then look for times when this counter exceeds these high
and low marks.
Possible problems:

460

Connections

If the returned value of this counter goes down and the load on
the system remains stable, you might have a bottleneck that is
not allowing your server to handle the normal load. Keep in
mind that this counter value might go down just because less
people are using your SQL Server instance. If you see this
number jump by 500% from your baseline, you may be seeing
a slowdown of your server activity.
Remediation:
You may want to boost the SQL Server configuration setting,
Maximum Worker Threads to a figure higher than the default
setting of 255. The setting for Maximum Worker Threads
should be higher than the maximum number of user
connections your server ever reaches.
Logins/Sec

Definition:
This performance counter returns the total number of logins
started, per second, and does not include pooled connections.
Information:
Opening and closing connections is an expensive process. A
pooled connection is one which is kept open by an application
for other requests to re-use.
Possible problems:
If the returned value is high, this can indicate that the
application is not correctly using connection pooling.
Remediation:
Review the Connection Polling configuration.

Logout/Sec

Definition:
This performance counter returns the total number of logout
operations started, per second.
Information:
Opening and closing connections is an expensive process.
When applications do not use a connection pool, each request
needs to establish its own connection before the query can be

461

Chapter 15: AppInsight Applications

executed. It then has to close it. A pooled connection is one

which is kept open by an application for other requests to reuse.
Possible problems:
If the returned value is high, this can indicate that the
application is not correctly using connection pooling.
Remediation:
Review the Connection Polling configuration.

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
Disk
This resource contains monitors specific to the current status of the disk. The
icons of the listed performance counters in the Statistic Name column will change
color to reflect the listed counter's current state. Clicking any performance counter
in the Statistic Name column will take you to the Performance Counter Details
page for that counter.
If the value of a listed performance counter crosses the Warning threshold, the
chart for the listed counter will display a yellow background. If the value of a listed
monitor crosses the Critical threshold, the chart for the listed counter will display a
red background. Hovering over any time period within the chart will display
detailed information about that time period in the tooltip. Hovering over a counter
will give you detailed information about that counter.

462

Disk

Average Disk
Sec/Read

Definition:
This performance counter shows the average time, in
seconds, of a read of data from the disk.
Information:
The returned value indicates the average time of read data
from the disk. 4-8ms is ideal. The returned value is
considered acceptable up to 20ms. Any higher value needs
further investigation.
Possible problems:
If a value greater than 15-20ms is reported, this may indicate
disk bottlenecks.
Remediation:
Increase the number of hard disks.

Average Disk
Sec/Write

Definition:
This performance counter shows the average time, in
seconds, of a write of data to the disk.
Information:
The returned value indicates the average time of write data
from the disk. 4-8ms is ideal. The returned value is
considered acceptable up to 20ms. Any higher value needs

463

Chapter 15: AppInsight Applications

further investigation.
Possible problems:
Values greater than 15-20ms nay indicate disk bottlenecks.
Remediation:
Increase the number of hard disks.
Forwarded
Definition:
Records/Batch This performance counter identifies the use of a pointer
Requests
which has been created when variable length columns have
caused a row to move to a new page in aheap.
Possible problems:
Rows withVarcharcolumns can experience expansion
whenVarcharvalues are updated with a longer string. In the
case where the row cannot fit in the existing page, the row
migrates and access to the row will traverse a pointer. This
only happens on heaps (tables without clustered indexes).
Remediation:
Evaluate clustered indexes for heap tables. In cases where
clustered indexes cannot be used, drop non-clustered
indexes, build a clustered index toReorgpages and rows,
drop the clustered index, then recreate non-clustered
indexes.
Forwarded
Records/Sec

Definition:
This performance counter returns the number of records
fetched through forwarded record pointers.
Information:
Tables without a clustered index. If you start with a short row,
and update the row creating a wider row, the row might not fit
on the data page. A pointer is put in its location and the row
is forwarded to another page.
Possible problems:
Look at the code to determine where the short row is inserted

464

Disk

followed by an update.
Remediation:
Can be avoided by:
1. Using default values so that an update does not result
in a longer row that is the root cause of forwarded
records.
2. Use Char instead of Varchar. This fixes the length so
that an update does not result in a longer row.
Physical Disk
Time

Definition:
This performance counter returns the ratio of elapsed time
when the disk drive was busy with read or write requests.
Information:
This performance counter is deceptive because it makes no
accommodation for multiple spindles. Thus, the more
spindles (i.e. physical hard disks) you have, the higher the
percentile values can go. Conversely, if these spindles are
shared across LUNs or other services, you may have high
numbers on this counter without any correlation to SQL
Server activity. The value for this counter should be below
50%.
Possible problems:
If this performance counter sustains an average above 70%,
you may have contention with your drive or RAM.
Remediation:
You should increase number of hard drives used by SQL
server.

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows

465

Chapter 15: AppInsight Applications

the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.

Latches and Locks

This resource measures the time it takes for latches and locks to perform various
operations.
Latches perform the task of thread synchronization. For example, if a thread is
reading a page from disk and creating a memory structure to contain it, it will
create one or more Latches to prevent corruption of these structures. Once the
operation is complete, the Latches will be released and other threads will be able
to access that page and memory structure again. For the most part, latches are
transient, taking a few milliseconds to complete.
A Lock prevents different users from overwriting each other's changes. Generally
speaking, a lock will last for the duration of the transaction.
The icons of the listed performance counters in the Statistic Name column will
change color to reflect the listed counter's current state. Clicking any performance
counter in the Statistic Name column will take you to the Performance Counter
Details page for that counter.
If the value of a listed performance counter crosses the Warning threshold, the
chart for the listed counter will display a yellow background. If the value of a listed
monitor crosses the Critical threshold, the chart for the listed counter will display a
red background. Hovering over any time period within the chart will display
detailed information about that time period in the tooltip. Hovering over a counter
will give you detailed information about that counter.

466

Latches and Locks

Latch
Waits/Sec

Definition:
This performance counter displays the number of latch
requests that could not be granted immediately.

Total Latch
Wait
Time/Latch
Waits

Definition:
This performance counter returns the ratio of Total Latch Wait
Time, in milliseconds, for latch requests in the last second to
amount of latches, in a one second period that had to wait.
Latches are lightweight means of holding a very transient
server resource, such as an address in memory.
Information:
This ratio should be less than 10. Monitoring the latches to
determine user activity and resource usage can help you to
identify performance bottlenecks.
Possible problems:
If the returned value is high, it is likely there is an I/O or
memory bottleneck.
Remediation:
Check your SQL server and verify its memory is being used
efficiently. Applications other than SQL may be using a great
deal of memory. Try and recover memory by closing
unnecessary applications. Installing additional memory may
also help.

467

Chapter 15: AppInsight Applications

Lock
Definition:
Requests/Sec This performance counter returns the number of requests for a
type of lock, per second.
Possible problems:
If the returned value is high, this can indicate that the queries
are accessing large numbers of rows. If you notice a high
Average Wait time, then this could be an indication of
blocking.
Information:
Blocking is an unavoidable characteristic of any relational
database management system (RDBMS) with lock-based
concurrency. On SQL Server, blocking occurs when one
Server Process ID (SPID) holds a lock on a specific resource
and a second SPID attempts to acquire a conflicting lock type
on the same resource. Typically, the time frame for which the
first SPID locks the resource is very small. When it releases
the lock, the second connection is free to acquire its own lock
on the resource and continue processing. This is normal
behavior and may happen many times throughout the course
of a day with no noticeable effect on system performance.
Remediation:
High Read queries should be reviewed. The simple way to fix
locking is just kill the connection that is causing the lock.
Fixing locking, blocking, and deadlocking issues is often a
matter of redesign. You should examine either the schema of
your database and/or the way the application is designed.
One of the most efficient ways to deal with locking is to ensure
that the design of your system does not have to deal with
excessive locks. The best way to do this is to normalize your
tables, using more atomic structures that allow the query to
get in and get out faster. Another method is to code with the
locks in mind. If the design requires less normalization, you
will have to evaluate the programs to ensure that they have
the right isolation levels.

468

Latches and Locks

Lock
Waits/Sec

Definition:
This performance counter reports the number of times users
waited to acquire a lock over the past second.
Information:
Note that this counter only gets incremented only when you
wake up after waiting on the lock.
Possible problems:
Non-zero values indicate that there is at least some level of
blocking occurring. If you combine this with the Lock Wait
Time counter, you can get some idea of how long the blocking
lasted. A zero value for this counter can definitively rule out
blocking as a potential cause.
Remediation:
High Read queries should be reviewed.

Lock
Timeouts/Sec

Definition:
This performance counter returns the number of lock requests
per second that have timed out, including internal requests for
NoWait locks.
Information (timeout_period):
This is the number of milliseconds that will pass before
Microsoft SQL Server returns a locking error. A value of -1
(default) indicates no time-out period (that is, wait forever).
When a wait for a lock exceeds the time-out value, an error is
returned. A value of 0 means to not wait at all and return a
message as soon as a lock is encountered.
Possible problems:
If you see a value above 0 for this counter, your users will
experience problems as their queries are not completing.
Remediation:
You should review your queries to determine which queries
are causing this situation.

469

Chapter 15: AppInsight Applications

Lock Wait
Time

Definition:
This performance counter displays the total time spent waiting
across all transactions, in milliseconds, to acquire a lock in
the last second.
Information:
Though this counts how many milliseconds SQL Server is
waiting on locks during the last second, this counter actually
starts recording at the end of locking event. Peaks most likely
represent one large locking event.
Possible problems:
If the returned value is greater than 60 seconds (60,000ms)
then there may be extended blocking which could be an
issue.
Remediation:
Thoroughly analyze the blocking script output. Some
applications are written for timing out after 60 seconds.
Because SQL Server records a lock at the end of a locking
event, remember that an application with large transactions
may have inflated lock wait times while still performing as
expected. For example, an application that issues multimillion record updates might have very long lock wait times
while performing exactly as it was designed.

Average
Latch
Wait Time

Definition:
This performance counter reports the average latch wait time,
in milliseconds, for latch requests that had to wait.
Information:
SQL Server two lightweight mutual exclusion solutions
Latches and Spinlockswhich are less robust than locks but
are less resource intensive. The value of this counter should
generally correlate to Latch Waits/sec and move up or down
with it accordingly.
Possible problems:
If you see this number jump above 300, you may have

470

Latches and Locks

contention for your server's resources. High values for this

counter could potentially block other users.
Remediation:
You should examine tasks currently waiting using the
following command: sys.dm_os_waiting_tasks DMV.
Average Lock Definition:
Wait Time
This performance counter reports the average amount of Wait
time, in milliseconds, for each lock request that resulted in a
wait.
Information:
Generally speaking, the lower the value, the better. This value
should correlate to theLock Waits/seccounter and move up
or down with it accordingly.
Possible problems:
An average wait time longer than 500ms may indicate
excessiveblocking.
Remediation:
You should determine which queries are generating locks to
identify where the blocking is originating.
Total Latch
Wait Time

Definition:
Total latch wait time (in milliseconds) for latch requests in the
last second.
Information:
Short term light weight synchronization object. Latches are
not held for the duration of a transaction. Typical latching
operations during row transfers to memory, controlling
modifications to row offset table, and so on.
Possible problems:
If high, check Perfmon Disk and Memory objects for:
l
l

I/O bottlenecks
Memory pressure

471

Chapter 15: AppInsight Applications

Remediation:
This can be mitigated by adding more memory or I/O capacity.

Zooming:
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
Memory
This resource displays the current status of SQL Server memory. The icons of the
listed performance counters in the Statistic Name column will change color to
reflect the listed counter's current state. Clicking any performance counter in the
Statistic Name column will take you to the Performance Counter Details page for
that counter.
If the value of a listed performance counter crosses the Warning threshold, the
chart for the listed counter will display a yellow background. If the value of a listed
monitor crosses the Critical threshold, the chart for the listed counter will display a
red background. Hovering over any time period within the chart will display
detailed information about that time period in the tooltip. Hovering over a counter
will give you detailed information about that counter.

472

Memory

Total Server
Memory

Definition:
This performance counter measures the current amount of
memory that SQL Server is using.
Information:
If the value of this counter continues to grow larger, the server
has not yet reached its steady state and is still trying to populate
the cache and get pages loaded into memory. Performance will
likely be somewhat slower if this value continually grows larger
since more disk I/O is required. This behavior is normal.
Eventually Total Server Memory should approximate Target
Server Memory.
Possible problems:
If the Total Server Memory counter is greater than or equal to
the Target Server Memory counter, this can indicate that your
SQL Server may be under memory pressure.
Remediation:
Installing additional memory into your SQL server should
resolve the problem.

Target
Server
Memory

Definition:
This monitor measures the total amount of dynamic memory the
server can consume.

473

Chapter 15: AppInsight Applications

Information:
This performance counter tells you how much memory SQL
Server would like to use to operate efficiently. Compare with
Total Server Memory.
Possible problems:
If the Total Server Memory counter is greater than or equal to
the Target Server Memory counter, this could indicate that your
SQL Server may be under memory pressure.
Remediation:
Installing additional memory into your SQL server should
resolve the problem.
Target Total Server
Memory

Definition:
This performance counter shows the difference between the
total amount of dynamic memory the server can consume and
the current amount of memory that SQL Server is using.
Possible problems:
If this performance counter is greater than or equal to the Target
Server Memory performance counter, this indicates that SQL
Server may be under memory pressure.
Remediation:
Installing additional memory into SQL server should resolve the
problem.

SQL Cache
Memory
(KB)

Definition:
This performance counter measures the total amount of
dynamic memory the server is using for the Dynamic SQL
cache.
Information:
Most memory used by SQL Server is allocated to the Buffer
Pool, which is used to store data pages. SQL Server steals a
proportion of this memory for use in caching query plans. The
overall amount of memory available to SQL Server depends

474

Memory

upon the amount of memory installed on the server, the

architecture of the server, the version and edition of SQL Server
and the amount of memory pressure being experienced by SQL
Server. This pressure can be internal (SQL Server resources
need memory) or external (operating system needs memory).
SQL Server is designed to respond to memory pressure when
necessary.
Possible problems:
Memory contention with the buffer pool.
Remediation:
Increase memory available to SQL server.
Lock
Memory

Definition:
This performance counter returns the total amount of dynamic
memory the server is using for locks.
Information:
Lock pages in memoryis used to prevent older versions of
Windows and SQL from allowing Windows operating
systempage out of the buffer pool.
Possible problems:
Lock pages in memorydetermines which accounts can use a
process to keep data in physical memory, which prevents the
system from paging the data to virtual memory on disk.
Exercising this privilege could significantly affect system
performance by decreasing the amount of available random
access memory (RAM).
Remediation:
Upgrade to Windows 2008 R2 or greater and SQL 2008 or
greater.

Granted
Workspace
Memory

Definition:
This performance counter returns the total amount of memory
currently granted to executing processes, such as Hash, Sort,
Bulk Copy, and Index creation operations.

475

Chapter 15: AppInsight Applications

Information:
This performance counter tells you how much memory has
currently been granted to running queries. If there is memory
pressure because of workspace memory, this value should be
at least 25% of the virtual memory available to SQLServer.
Possible problems:
If the memory pressure is severe, the server might return errors
such as 701 or 8645.
Remediation:
If this is the case, this might be a good reason to consider using
SQL Server 64-bit.
Optimizer
Memory

Definition:
This performance counter returns the total amount of dynamic
memory the server is using for query optimization.
Information:
There are no thresholds associated with this performance
counter.

Connection
Memory

Definition:
This monitor returns the total amount of dynamic memory the
server is using for maintaining connections.
Information:
SQL Server sets aside three packet buffers for every connection
made from a client. Each buffer is sized according to the default
network packet size specified by the sp_configure stored
procedure. If the default network packet size is less than 8KB,
the memory for these packets comes from SQL Server's buffer
pool. If it is 8KB or larger, the memory is allocated from SQL
Server's MemToLeave region. It is worth noting that the default
network packet size for the .NET Framework Data Provider for
SQL Server is 8KB, so the buffers associated with managed
code client connections typically come from SQL Server's

476

Memory

MemToLeave region. This contrasts with classic ADO

applications, where the default packet size is 4KB, and the
buffers are allocated form the SQL Server buffer pool.
Memory
Grants
Pending

Definition:
This monitor returns the total number of processes waiting for a
workspace memory grant.
Information:
Memory resources are required for each user request. If
sufficient memory is not available, the user waits until there is
adequate memory for the query to run.
Possible problems:
Returned values greater than zero for a sustained period of time
is a very strong indicator of memory pressure.
Remediation:
You should first examine the database design, queries, and
indexes to ensure the system is properly tuned before installing
additional RAM. There may be query inefficiencies in the
instance that is causing excessive memory grant requirements.
For example, large Sorts or Hashes that can be resolved by
tuning the indexing or queries being executed.
Compare with Memory Grants Outstanding. If the number of
pending grants increases, try the following:
l
l
l

Add more memory to SQLServer

Add more physical memory to the server.
Check for memory pressure. See and correct indexing if
you experience Out of memory conditions.

Memory
Definition:
Grants
This performance counter returns the total number of processes
Outstanding that have successfully acquired a workspace memory grant.
Information:
Look at Memory Grants Outstanding and Memory Grants
Pending. If you see a long queue of pending grants as

477

Chapter 15: AppInsight Applications

compared to outstanding grants, there is likely memory

pressure because of query workspace memory. You can
confirm this by checking the Granted Workspace Memory (KB)
performance counter that tells you how much memory has
currently been granted to running queries.
Possible problems:
A returned value that is high can indicate peak user activity. If
there is memory pressure because of workspace memory, this
value should be at least 25% of the virtual memory available to
SQLServer. If the memory pressure is severe, the server might
even return errors such as 701 or 8645.
Remediation:
If severe, and using 32-bit, consider using SQL Server 64-bit.
See Memory Grants Pending.
Pages/Sec

Definition:
This performance counter displays the rate at which pages are
read from or written to disk to resolve hard page faults.
Information:
This is a primary indicator of the kinds of faults that cause
system-wide delays. This should be close to zero on a
dedicated SQL Server. You will see spikes during backups and
restores, but this is normal.
Possible problems:
High values causes hard page faults, which can cause SQL
Server to use the page, as opposed to RAM.
Remediation:
You may want to add additional RAM to stop the paging.

Cache Hit
Ratio

Definition:
This metric is the ratio between Cache Hits and Lookups.
Cache Hit Ratio measures how much theplan cacheis being
used.

478

Memory

Information:
A high percentage here means that your SQL Server is not
building a new plan for every query it is executing and is
working effectively and efficiently. A low percentage here
means that, for some reason, the SQL Server is doing more
work than it needs to. This metric needs to be considered
alongside theplan cachereuse metric which looks at the
spread of plan reuse through your cache.
Plan cacheis memory used to store objects such as stored
procedures, ad hoc and preparedTransact-SQLstatements,
and triggers. Theplan cacheis the component of SQL memory
that stores query plans for re-use. When a query is issued
against SQL, the optimizer will attempt to re-use a cached plan
if the traits of the query permit - but can only do so if that plan
resides in cache, otherwise it needs to compile a new plan.
This is not to say that every plan that is cached is re-used.
Changes in schema, a query running parallel that may have run
serially before, or changes in parameters may require a new
plan to be compiled even if a similar plan exists in cache. Plan
compilations are expensive though. Ideally this counter should
be near 100%.
Possible problems:
The value of this counter should never fall below 90%. Low
cache hit ratio (<20%) along with a sustained query execution
rate (Batch Requests/sec) indicates that compiled plans are not
being re-used. It should be noted that the hit ratio counter may
be skewed by internal lookups performed.
Remediation:
The amount of caching should be reduced by examining the
workload to see if queries have beenparameterized, or can be
rewritten with stored procedures.
Available
MBytes

Definition:
This is the amount of available physical memory on the server.
Information:

479

Chapter 15: AppInsight Applications

An acceptable output for this may vary widely based on how

much physical memory is in the machine. If you have 2GB of
RAM installed on the machine, it is common to see SQL Server
use 1.7GB of RAM. If no other processes are running on your
SQL Server, ensure you have at least 80MB available for
Windows at any given time.
Possible problems:
Low values show that SQL server has lack of memory.
Remediation:
Install additional memory.
Page Usage

Definition:
This shows the percentage of the page file that is being utilized.
Information:
A Page File is simply a file on the hard drive that handles
situations where the system wants to move or page out
sections of memory. There are several situations that cause
this, but the one you should be most concerned about is when
the system is out of physical memory.
Possible problems:
Values greater than 70 percent indicate paging and lack of
memory. If the system runs out of memory it can borrow some
storage from the hard drive to release some memory until it
needs that data again. The reason that this is bad is because
hard drives are amazingly slow in comparison with solid-state
memory access. Using the page file slows SQL Server a great
deal.
Remediation:
Install additional memory.

Workfiles
Created/Sec

Definition:
This is the number of work files created per second.
Information:

480

Memory

For example, work files could be used to store temporary

results for hash joins and hash aggregates. The returned value
should be less than 20. Tempdb work files are used in
processing hash operations when the amount of data being
processed is too large to fit into the available memory.
Possible problems:
High values can indicate thrash in the tempdb file as well as
poorly coded queries.
Remediation:
It is possible to reduce the value this monitor returns by making
queries more efficient by adding/changing indexes. Adding
additional memory will also help.
Worktables
Created/sec

Definition:
This performance counter displays the number of work tables
created per second.
Information:
For example, work tables could be used to store temporary
results for query spool, lob variables, XML variables, and
cursors. The returned value should be less than 20. Worktables
are used for queries that use various spools (table spool, index
spool, and so on).
Possible problems:
High values could cause general slowdown.
Remediation:
Remediation requires rewriting your procedures.

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows

481

Chapter 15: AppInsight Applications

the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
Pages
This resource shows page status of the SQL server.
In SQL Server, the page size is 8 KB. Therefore, SQL Server databases have 128
pages per MB. Each page starts with a 96 byte header that stores information
about the page. This information includes the page number, page type, the
amount of free space on the page, and the allocation unit ID of the object that
owns the page.
The icons of the listed performance counters in the Statistic Name column will
change color to reflect the listed counter's current state. Clicking any performance
counter in the Statistic Name column will take you to the Performance Counter
Details page for that counter.
If the value of a listed performance counter crosses the Warning threshold, the
chart for the listed counter will display a yellow background. If the value of a listed
monitor crosses the Critical threshold, the chart for the listed counter will display a
red background. Hovering over any time period within the chart will display
detailed information about that time period in the tooltip. Hovering over a counter
will give you detailed information about that counter.

Page
Definition:
Lookups/Sec: This performance counter returns the number of requests to
find a page in the buffer pool.

482

Pages

Information:
(Page lookups/sec) / (Batch Requests/sec) > 100.
Possible problems:
When the ratio of page lookups to batch requests is much
greater than 100, this is an indication that while query plans
are looking up data in the buffer pool, these plans are
inefficient.
Remediation:
Identify queries with the highest amount of logical I/O's and
tune them.
Page
Reads/Sec

Definition:
This performance counter returns the number of physical
database page reads issued.
Information:
80 90 physical database page reads per second is normal.
Possible problems:
Returned values that are high could indicate indexing or
memory constraint.
Remediation:
Attempt to tune the application so that fewer I/O operations
are required. For example, perhaps I/O operations would be
reduced if there were the appropriate indexes, or if the
database design were de-normalized. If the applications
cannot be tuned, you will need to acquire disk devices with
more capacity. Because physical I/O operations are
expensive, you may be able to minimize the cost either by
using a larger data cache, intelligent indexes, more efficient
queries, or by changing the database design.

Page
Lookups/
Batch
Request

Definition:
This performance counter displays the number of page splits
per second that occur as the result of overflowing index
pages.

483

Chapter 15: AppInsight Applications

Information:
(Page lookups/sec) / (Batch Requests/sec) > 100.
Possible problems:
When the ratio of page lookups to batch requests is much
greater than 100, this is an indication that while query plans
are looking up data in the buffer pool, these plans are
inefficient.
Remediation:
Identify queries with the highest amount of logical I/O's and
tune them.
Page
Writes/Sec

Definition:
This performance counter returns the number of physical
database page writes issued.
Information:
80 90 physical database page writes per second is normal.
Possible problems:
If the returned values are high, you should check the Lazy
Writer/sec monitor.

Page
Faults/Sec

Definition:
This performance counter returns the average number
ofpages faultedper second.
Information:
This performance counter gives an idea of how many times
information being requested is not where the application
expects it to be. The information must either be retrieved from
another location in memory or from the pagefile. While a
sustained value may indicate trouble, you should be more
concerned with hard page faults that represent actual reads or
writes to the disk. Disk access is much slower than RAM.
Possible problems:
Any measurement higher than zero delays response time and
probably indicates that more RAM is needed.

484

Pages

Remediation:
Add additional memory to your SQL server.
Page
Splits/Batch
Request

Definition:
This performance counter displays the number of page splits
per second that occur as the result of overflowing index
pages.
Information:
The returned value needs to be low as possible.
Possible problems:
High values could mean poor table or index design.
Remediation:
If the number of page splits is high, consider increasing the
Fill Factor of your indexes. An increased Fill Factor helps to
reduce page splits because there is more room in data pages
before it fills up and a page split has to occur. Note that this
counter also includes the new page allocations as well and
does not necessarily pose a problem. The other place we can
confirm the page splits that involve data or index rows moves
are the fragmented indexes on page splits.

Page
Splits/Sec

Definition:
This performance counter returns the number of page splits
per second.
Information:
The returned value for this monitor should be as low as
possible.
Possible problems:
Returned values that are high can indicate the overflowing of
index pages. A high value for this counter is not bad in
situations where many new pages are being created, since it
includes new page allocations.

485

Chapter 15: AppInsight Applications

Remediation:
To avoid Page Splits, review the table and index design so as
to reduce non-sequential inserts. You can also implement
Fillfactor and Pad_Index to leave more empty space per
page.
Page Life
Expectancy

Definition:
This performance counter returns the number of seconds a
page will stay in the buffer pool without references.
Information:
This performance monitor reports, on average, how long data
pages are staying in the buffer.
Possible problems:
If this value gets below 300 seconds, this is a potential
indication that your SQL Server could use more memory in
order to boost performance. Consistently having pages that
stay in memory for less than that amount of time may indicate
the need for more memory.
Remediation:
Add additional memory to your SQL server.

Database
Pages

Definition:This metric tells you the number of database

pages that are currently being occupied in the data cache.
Information:
The higher the buffer managerDatabase Pagesis, the less
room there is for SQL Server to cache more data pages. This
means that SQL Server may have to free up data cache
pages order to make room for pages being moved in from disk
to the data cache, which can increase disk IO and hurt
performance. There are no specific thresholds for this counter
as each server is different. Instead, watch baseline values
and look for sudden changes in the baseline value.
Possible problems:
If the value for this performance counter increases above its
typical baseline value, this may indicate memory pressure for

486

Pages

the SQL Server instance.

Remediation:
Investigate buffer management and disk I/O.
Free Memory
Note: This
performance
counter is only
available in
SQL Server
2012.

Definition:
The amount of memory available for SQL Server to use.
Information:
When SQL Server is using memory dynamically, it queries the
system periodically to determine the amount of free memory.
Maintaining this free memory prevents the operating system
(OS) from paging. If less memory is free, SQL Server releases
memory to the OS. If more memory is free, SQL Server may
allocate more memory. SQL Server adds memory only when
its workload requires more memory; a server at rest does not
increase the size of its virtual address space. The returned
value should be as high as possible.
Possible problems:
If Resource Semaphore does not find enough free memory,
then it puts the current query into the waiting queue.
Remediation:
l
l
l

Free Pages

Increase RAM
Increase SQL Servers Max Server Memory
Consider OS requirements and other instances

Definition:
This performance counter displays the total number of pages
on all free lists.
Information:
This is not main indicator of memory problems and could only
used as signal of possible memory pressure.
Possible problems:
If this performance counter is critical and other memory
counters are good, it is possible that there are no problems

487

Chapter 15: AppInsight Applications

with memory.
Remediation:
Check other memory counters. If they have critical values, you
may try to install additional memory into SQL server.

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
Sessions
This resource displays the current number of sessions.
Sessions include both connections and internal background processes like ghost
cleanup , checkpoint, and so on. There is a close correlation between
connections and sessions, but they are not necessarily the same.
The icons of the listed performance counters in the Statistic Name column will
change color to reflect the listed counter's current state. Clicking any performance
counter in the Statistic Name column will take you to the Performance Counter
Details page for that counter.
If the value of a listed performance counter crosses the Warning threshold, the
chart for the listed counter will display a yellow background. If the value of a listed
monitor crosses the Critical threshold, the chart for the listed counter will display a
red background. Hovering over any time period within the chart will display
detailed information about that time period in the tooltip. Hovering over a counter
will give you detailed information about that counter.

488

Sessions

Active
Definition:
Sessions A current connection that is actively processing.
Information:
To find information about an active session, Use Sp_Who2 Active
or Sys.Dm_Exec_Sessions (Available in SQL 2005 or greater).
Possible problems:
Blocking session.
Remediation:
Wait until blocking clears or kill the session. If killed, the process
would roll back changes. If there are many changes, it could take a
while to roll-back.
Inactive
Definition:
Sessions A current connection that is not currently processing.
Information:
To find information about an inactive sessions, use Sp_Who2.
Possible problems:
Blocking session.
Remediation:
Kill the session if blocking a process needs to finish. If killed, the

489

Chapter 15: AppInsight Applications

process would roll back changes. If there are many changes, it

could take a while to roll-back.
System
Definition:
Sessions A System initiated connection.
Information:
Normally these numbers are less than 50.
Possible problems:
Blocking session.
Remediation:
Do not kill system sessions.
User
Definition:
Sessions A user initiated connection.
Information:
Normally these numbers are greater than 50.
Possible problems:
Blocking session.
Remediation:
Kill the session if blocking a process needs to finish. If killed, the
process will roll back changes. If there are many changes, it could
take a while to roll-back.

Zooming:
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.

490

SQL Agent Job Status

SQL Agent Job Status
The SQL Agent is a Microsoft Windows service that executes scheduled
administrative tasks known as "jobs" in SQL Server. This resource shows the
status and details of these jobs.
The data can be sorted by clicking the headers of each column.

l
l
l
l

Job Name: Displays the name of the listed job.

Last Run: Displays the date and time the listed job was last run.
Duration: Displays the amount of time the listed job took to complete.
Outcome: Displays the result from having run the listed job.

SQL Agent Job information is used to provide metrics for this resource and cannot
be edited.
SQL Errors
This resource displays SQL events that have occurred on the current SQL
instance. The data can be sorted by clicking the headers of each column.

l
l

Date/Time: Displays the date and time that the error occurred.
Error Message: Displays the error message that occurred at the listed
date and time.

491

Chapter 15: AppInsight Applications

SQL Event Log Message Details
This resource displays the SQL event log messages while providing a search
window and a filter. The filter allows you to choose which types of log messages
you want to display. The data can be sorted by clicking the headers of each
column. This resource shows only Error and Warning events specific to the
monitored SQL instance.
Note: The filter, Information, will not list any events. This is by design and is an
accidental by-product of an earlier resource that was implemented.

Clicking any event message in the list will open a new window, displaying the
entire message, as shown below:

SQL Server
This resource shows the status of SQL server counters that warrant a view
independent of grouped resources.
The icons of the listed performance counters in the Statistic Name column will
change color to reflect the listed counter's current state. Clicking any performance
counter in the Statistic Name column will take you to the Performance Counter
Details page for that counter.

492

SQL Server
If the value of a listed performance counter crosses the Warning threshold, the
chart for the listed counter will display a yellow background. If the value of a listed
monitor crosses the Critical threshold, the chart for the listed counter will display a
red background. Hovering over any time period within the chart will display
detailed information about that time period in the tooltip. Hovering over a counter
will give you detailed information about that counter.

Batch
Requests/Sec

Definition:
This performance counter returns the number of Batch
Requests that SQL Server receives per second.
Information:
The values this monitor returns generally follows in
step as to how busy your server's CPUs are. From a
network bottleneck approach, a typical 100Mbs
network card is only able to handle about 3,000 batch
requests per second.
Possible problems:
Generally speaking, over 1,000 batch requests per
second indicates a very busy SQL Server. If this is the
case, you may soon experience a CPU bottleneck, if
you are not already. Of course, this is a relative
number, and the more powerful your hardware, the
more batch requests per second your SQL Server can
handle.

493

Chapter 15: AppInsight Applications

Sometimes low Batch Requests/Sec can be

misleading. If there were a SQL Statements/sec
counter, this would be a more accurate measure of the
amount of SQL Server activity. For example, an
application may call only a few stored procedures, yet
each stored procedure does a great deal of work. In this
case, we will see a low number for Batch
Requests/sec, but each stored procedure (one batch)
will execute many SQL statements that drive up CPU
and other resources. As a result, many counter
thresholds based on the number of Batch Requests/sec
will seem to identify issues because the batch requests
on such a server are unusually low for the level of
activity on the server.
Remediation:
Check your SQL server and verify system resources
are being used efficiently. Applications other than SQL
may be using unnecessary system resources. Try and
recover memory by closing unnecessary applications.
Installing additional memory and upgrading your
hardware should solve this problem.
SQL
Compilations/Sec

Definition:
This performance counter returns the number of times
per second that SQL Server compilations have
occurred.
Information:
This value should be as low as possible.
Possible problems:
If you see a high value, say above 100, then this can be
an indication that there are a great deal of ad hoc
queries that are running which may cause increased
CPU usage.
Remediation:

494

SQL Server

Re-write the running ad hoc queries as stored

procedures or use the following command: sp_
executeSQL.
SQL
Definition:
Recompilations/Sec This performance counter returns the number of SQL
statement recompiles that are triggered per second.
Information:
When an execution plan is invalidated due to some
significant event, SQL Server will re-compile it. Recompiles, like compiles, are expensive operations so
you want to minimize the number of re-compiles.
Ideally you want to keep this counter less than 10% of
the number of Compilations/Sec. In other words, keep
this value as low a possible.
In SQL Server 2000, when SQL Server recompiles a
stored procedure, the entire stored procedure is
recompiled, not just the statement that triggered the
recompilation. In SQL Server 2008 and SQL Server
2005, the behavior is changed to statement-level
recompilation of stored procedures. When SQL Server
2008 or SQL Server 2005 recompiles stored
procedures, only the statement that caused the
recompilation is compiled, not the entire procedure.
This uses less CPU bandwidth and results in less
contention on lock resources such asCompilelocks.
Possible problems:
Returned values that are high can indicate deadlocks
and compile locks that are not compatible with any
locking type.
Remediation:
Recompilation can happen for various reasons, such
as:Schema changed; Statistics changed; Deferred
compile; Set option changed; Temporary table
changed;Stored procedurecreated with the
Recompilequery hintor using theOption(Recompile).

495

Chapter 15: AppInsight Applications

If the recompile occurred because aSetoption

changed, use SQL Server Profiler to determine
whichSetoption changed. Avoid
changingSetoptions within stored procedures. It
is better to set them at the connection level.
Ensure thatSetoptions are not changed during
the lifetime of the connection.
Recompilation thresholds for temporary tables
are lower than for normal tables. If the recompiles
on a temporary table are due to statistics
changes, you can change the temporary tables to
table variables. A change in thecardinalityof a
table variable does not cause a recompilation.
The drawback of this approach is that the query
optimizer does not keep track of a table variables
cardinality because statistics are not created or
maintained on table variables. This can result in
non-optimal query plans. Test the different
options and choose the best one.
Another option is to use theKeep Planquery hint.
This sets the threshold of temporary tables to be
the same as that of permanent tables.
TheEventSubclasscolumn indicates that Statistics Changed for an operation on a temporary
table.
To avoid recompilations that are due to changes
in statistics (for example, when the plan becomes
suboptimal due to change in the data statistics),
specify theKeepFixed Planquery hint. With this
option in effect, recompilations can only happen
because of correctness-related reasons (for
example, when the underlying table structure has
changed and the plan no longer applies) and not
due to statistics. An example might be when a
recompilation occurs if the schema of a table that
is referenced by a statement changes, or if a table
is marked with the sp_recompile stored pro-

496

SQL Server

Auto-Param
Attempts/Sec:

cedure.
Turning off the automatic updates of statistics for
indexes and statistics that are defined on a table
or indexed view prevents recompiles that are due
to statistics changes on that object. Note, however, that turning off theAuto-Statsfeature by
using this method is usually not a good idea. This
is because the query optimizer is no longer sensitive to data changes in those objects and suboptimal query plans might result. Use this method
only as a last resort after exhausting all other
alternatives.
Batches should have qualified object names (for
example,dbo.Table1) to avoid recompilation and
to avoid ambiguity between objects.
To avoid recompiles that are due to deferred compiles, do not interleaveDMLandDDLor create
theDDLfrom conditional constructs such
asIfstatements.
Run Database Engine Tuning Advisor (DTA) to
see if any indexing changes improve the compile
time and the execution time of the query.
Check to see if the stored procedure was created
with theWith Recompileoption or if
theRecompilequery hint was used. If a procedure was created with theWith
Recompileoption, in SQL Server 2005, you may
be able to take advantage of the statement
levelRecompilehint if a particular statement
within that procedure needs to be recompiled.
This would avoid the necessity of recompiling the
whole procedure each time it executes, while at
the same time allowing the individual statement
to be compiled.

Definition:
This monitor returns the number of autoparameterization attempts per second.

497

Chapter 15: AppInsight Applications

Information:
The total for this monitor should be the sum of the
failed, safe, and unsafe auto-parameterizations. Autoparameterization occurs when an instance of SQL
Server tries to parameterize a Transact-SQL request by
replacing some literals with parameters so that reuse of
the resulting cached execution plan across multiple
similar-looking requests is possible. Note that autoparameterizations are also known as simple
parameterizations in newer versions of SQL Server.
This counter does not include forced
parameterizations.
Possible problems:
Bad T-SQL coding practices can increase
recompilation frequency and adversely affect SQL
Server's performance. Such situations can be
debugged and corrected in many cases.
Longest
Transaction
Running Time

Definition:
The performance counter displays the length of time, in
seconds, the transaction that has been running the
longest, has been active.
Information:
Transactions that run longer than others use more
resources. They can be used to track down procedures
and calls that are taking longer than expected by
identifying the specific transaction(s).
Possible problems:
Long running transactions can prevent truncation of
transaction logs. This can cause the transaction log
files to grow until they consume all available physical
disk space shutting down access to the database.
Remediation:
Check the functionality of the query and/or redesign the
long running transaction.

498

SQL Server

Failed AutoParams/Sec

Definition:
This monitor returns the number of failed autoparameterization attempts per second.
Information:
The value returned by this monitor should be low. Note
that auto-parameterizations are also known as simple
parameterizations in later versions of SQL Server.
Preferred values should be near zero.
Possible problems:
Bad T-SQL coding practices can increase
recompilation frequency and adversely affect SQL
Server's performance. Such situations can be
debugged and corrected in many cases.

Full Scans/Sec

Definition:
This performance counter returns the number of Full
Scans on base tables or indexes.
Information:
This is the number of unrestricted full scans per
second. These can be either base-table or full-index
scans.
Possible problems:
Values greater than 1 or 2 indicate table/Index page
scans are occurring. If the CPU is running high, you
should investigate the cause as related to this counter
measurement. You can rule this out as a problem if the
full scans are on small tables.
Remediation:
Following are a few of the main causes of high Full
Scans/sec:
l
l

Missing indexes
Too many rows requested; Queries with missing
indexes or too many rows requested will have a
large number of logical reads and an increased

499

Chapter 15: AppInsight Applications

Range Scans/Sec

CPU time.
Scans are IO-intensive and should run within
your databases minimally. Identify the tables that
have a large number of scans against them.
Review the fill factor you have set up on your
indexes and minimize it where appropriate.

Definition:
This performance counter returns the number of
Qualified Range Scans through indexes per second.
Information:
This monitor returns the number of qualified range
scans through indexes per second.

Plan Re-Use

Definition:
A query plan is used to execute a query.
Information:
Plan re-use is desirable forOLTPworkloads because
re-creating the same plan (for similar or identical
transactions) is a waste of CPU resources.
Possible problems:
Zero cost plans will not be cached (not re-used) in SQL
2005 SP2. Applications that use zero cost plans will
have a lower plan re-use but this is not a performance
issue.
Remediation:
Review your plan re-use design. Tune your plan re-use
design as it is described in the following
article:[Link]

Probe Scans/Sec

Definition:
This performance counter returns the number of Probe
Scans, per second, that are used to find at most, one
single qualified row in an index or base table directly.
Information:

500

SQL Server

There are no thresholds associated with this

performance counter.
Recompilations/
Compilations

Definition:
This performance counter shows the ratio of SQL
Recompilations to SQL Compilations.
Information:
SQL Recompilations should be less than 10% of SQL
Compilations.
Possible problems:
Returned values that are high can indicate more
temporary tables in use.
Remediation:
Change stored procedures to not change schemas,
Use table variables instead of temporary tables

Compilations/
Definition:
Recompilations/Sec Monitoring the number of query compilations and
recompilations and the number of batches received by
an instance of SQL Server gives you an indication of
how quickly SQL Server is processing user queries
and how effectively the query optimizer is processing
the queries.
Information:
Compilation is a significant part of a query's turnaround
time. In order to save the compilation cost, the
Database Engine saves the compiled query plan in a
query cache. The objective of the cache is to reduce
compilation by storing compiled queries for later reuse,
therefore ending the requirement to recompile queries
when later executed. However, each unique query
must be compiled at least one time.
Compilations/sec divided by 10 minus
recompilations/sec.
Possible problems:

501

Chapter 15: AppInsight Applications

Query recompilations can be caused by the following

factors:
l

Schema changes, including base schema

changes such as adding columns or indexes to
a table, or statistics schema changes such as
inserting or deleting a significant number of rows
from a table.
Environment (Set statement) changes. Changes
in session settings such as Ansi_Padding or
Ansi_Nulls can cause a query to be recompiled.

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
Top 10 Databases by Active User Connections
This resource graphically shows the number of users per database for the top 10
most active databases. The colors of the chart correspond to the labels in the
legend, which indicate the most active databases.

502

Top 10 Most Expensive Queries by CPU Time

The performance counter, Top Active Sessions with Statistics, is used to

provide metrics for this resource and cannot be edited.
Expanding the tree by clicking [+] will provide details about the users, host, length
of connection and idle time, as well as the number of bytes transferred during that
time.
Top 10 Most Expensive Queries by CPU Time
This resource displays the top 10 most expensive queries sorted by the length of
time the CPU spent processing the listed query.
When viewing this resource from the Summary tab on the Application Details
page, queries are listed for the entire SQL Server instance. Conversely, when this
same resource appears on the Database Details view, queries are only listed for
that specific database.

503

Chapter 15: AppInsight Applications

The data can be sorted by clicking the headers of each column. Additionally, this
resource can optionally show Top Queries by I/O by clicking Edit in this resource
and making the necessary adjustments.
Note: The resource is filtered based on the settings found on the Queries tab in
Details view in the Most Expensive Queries resource.

Query Text: The text shown is a preview of the full query. To view an
entire query in the list, click [+] next to the query listed to expand and view
the query.
Note: Clicking any listed query will take you to the Most Expensive Queries resource on the Queries tab, providing greater detail about the query.
CPU Time: Display the time, in milliseconds, the listed query took to complete.
Database: Displays the database with which the listed query is associated. The icon in this column shows the current state of the listed database.

The performance counter, Top Expensive Queries, is used to provide metrics for
this resource and cannot be edited.

504

AppInsight for SQL Details View (Queries Tab)

AppInsight for SQL Details View (Queries Tab)

The Queries tab provides detailed insight into the most expensive queries
running on your SQL instance.
The performance counter, Top Expensive Queries, is used to provide metrics for
this resource and cannot be edited.
Most Expensive Queries
This resource provides detailed insight into the most expensive queries running
on your SQL database. Queries for this view can be filtered by Time, Host,
Database, and Login using the filter dropdown menus at the top of the window.
Note: The filters used here will also be applied to the Top 10 Most Expensive
Queries by CPU Time resource found on the Summary tab in the Details view.
To view an entire query in the list, hover the mouse over a query, or click [+] next
to the query listed to expand and view the query.
The data can be sorted by clicking the headers of each column.
Note: This resource will be empty when polling of queries is disabled.

l
l

Query Text: The text shown is a preview of the full query. To view an
entire query in the list, click [+] next to the query listed to expand and view
the query.
SPID: Server Process ID of the listed query.
Plan Count: Displays the number of cached query plans for the listed
query. A large number might indicate a need for explicit query parameterization.
Executions: Displays the number of times the listed query was executed.

505

Chapter 15: AppInsight Applications

l
l
l
l

CPU Time: Displays the amount of time, in milliseconds, that the listed
query took to complete.
Phys. Read: This field returns the number of physical reads. Physical
reads are reads that require reading directly from disk. Physical reads are
substantially slower than reading from the cache or from RAM.
Logical Reads: Displays the number of times data was read from the
cache.
Logical Writes: Displays the number of times data was written to the
cache.
Average Duration: This displays the length of time it took, in milliseconds,
to execute the listed query averaged by the number of executions.
Bytes Transferred: Number of bytes transferred during the query.
Login: Displays the current login information for the listed database.
Host: Displays the host for the listed database.
Database: Displays the current name for the listed database. Clicking any
database in the list will take you to the Database Details page.

Database Details View

The Database Details view provides a great deal of information about the current
database and can be accessed by clicking any listed database.
Important: A high number of databases monitored on a single SQL instance
using AppInsight for SQL can cause job timeout issues. To alleviate this problem,
try increasing the timeout value. If this does not resolve the issue, reduce the
number of visible databases by granting view permissions to the user account
used for polling only for the databases you want to see.
To navigate to the Database Details view:
1. From the web console, navigate to the AppInsight for SQL Details view.
2. From the All Databases resource, click any database in the list.
The available resources unique to this view include:
l
l
l
l
l
l
l
l
l

Active User Connections

Connections
Database Availability
Database Details
Database Disk I/O
Database Size by File
Log Flushes
Processes and Services
Storage

506

Active User Connections

l
l
l
l
l
l

Top 10 Clustered Indexes by Fragmentation

Top 10 Most Expensive Queries by CPU Time
Top 10 Nonclustered Indexes by Fragmentation
Top 10 Tables by Size
Transaction Log Disk I/O
Transaction Log Size by File

Active User Connections

This resource provides detailed information about the active user connections
associated with the database selected. Data can be sorted by clicking the
headers of each column.

l
l

Login: This displays the login information for the listed user connection.
Host: This displays the type of host associated with the listed user connection.
Connection Duration: This displays the length of time the listed user connection has been connected.
Idle Time: This displays the length of time the listed user connection has
been idle.
Bytes Transferred: This displays the number of bytes transferred for the
listed user connection.

The performance counter, Top Active Sessions with Statistics, is used to

provide metrics for this resource and cannot be edited.
Connections
This resource shows the status of your current database connections. The icons
of the listed performance counters in the Statistic Name column will change color
to reflect the listed counter's current state. Clicking any performance counter in the
Statistic Name column will take you to the Performance Counter Details page for
that counter.
If the value of a listed performance counter crosses the Warning threshold, the
chart for the listed counter will display a yellow background. If the value of a listed
monitor crosses the Critical threshold, the chart for the listed counter will display a

507

Chapter 15: AppInsight Applications

red background. Hovering over any time period within the chart will display
detailed information about that time period in the tooltip. Hovering over a counter
will give you detailed information about that counter.

User
Definition:
Connections The User Connections performance counter identifies the
number of different users that are connected to your SQL
Server at the time the sample was taken.
Information:
You need to watch this performance counter over time to
understand your baseline user connection numbers. Since
each user connection consumes some memory space, a high
number of user connections can impact throughput and cause
a performance slow-down. Once you have an idea of your high
and low thresholds during normal usage of your system, you
can then look for times when this counter exceeds these high
and low marks.
Possible problems:
If the returned value of this performance counter goes down
and the load on the system remains stable, you might have a
bottleneck that is not allowing your server to handle the normal
load. Keep in mind that this counter value might go down just
because less people are using your SQL Server instance. If
you see this number jump by 500% from your baseline, you
may be seeing a slowdown of your server activity.

508

Connections

Remediation:
You may want to boost the SQL Server configuration setting,
Maximum Worker Threads to a figure higher than the default
setting of 255. The setting for Maximum Worker Threads
should be higher than the maximum number of user
connections your server ever reaches.
Logins/Sec

Definition:
This performance counter returns the total number of logins
started, per second, and does not include pooled connections.
Information:
Opening and closing connections is an expensive process. A
pooled connection is one which is kept open by an application
for other requests to re-use.
Possible problems:
If the returned value is high, this can indicate that the
application is not correctly using connection pooling.
Remediation:
Review the Connection Polling configuration.

Logout/Sec

Definition:
This performance counter returns the total number of logout
operations started, per second.
Information:
Opening and closing connections is an expensive process.
When applications do not use a connection pool, each request
needs to establish its own connection before the query can be
executed. It then has to close it. A pooled connection is one
which is kept open by an application for other requests to reuse.
Possible problems:
If the returned value is high, this can indicate that the
application is not correctly using connection pooling.

509

Chapter 15: AppInsight Applications

Remediation:
Review the Connection Polling configuration.

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
Database Availability
This resource graphically shows the various states of availability for the current
database in a percentage format. This chart is made up of three sections: the
legend, the main chart, and the lower chart. The colors of the main chart
correspond to the labels in the legend.

510

Zooming

Clicking the Edit button will allow you to change the default zoom range, the
amount of historical data loaded, and set the sample interval time period, as well
as reveal the Advanced section. Expanding the Advanced section will allow you
to change the defaults of the titles from macros to anything you want.
Zooming
You can have the chart show a predetermined, hourly time period of data by
clicking on any one of the three Zoom buttons; 1h, 12h, or 24h. Alternatively, you
can have the chart show a specific time range by dragging the mouse over a
small area of the chart.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders. The main view of the chart will
display the selected time period between the two sliders of the lower chart.
Moving the mouse over the main chart will reveal a tooltip with more detailed
information about the specific time period the mouse is hovering over.

511

Chapter 15: AppInsight Applications

Database Details
This resource provides tools and details concerning the current database.

l
l
l

Management: This provides tools allowing you to more easily manage

and troubleshoot the current application.
Database Name: Displays the name of the current database.
Performance Status: Displays the status of the current database.
Operational State: Displays whether or not the database is currently
online.
Recovery Model: Will display the type of recovery model employed on the
listed database. This can be either, Simple, Full, or Bulk-Logged. For more
information, refer to the following MSDN article: [Link]
Collation: Displays the method of sorting used by the database. (In the
above image, Latin1 means the server treats strings using Charset Latin 1,
i.e. ASCII. CI means Case Insensitive. AS means Accent Sensitive (''
does not equal 'u')).
Compatibility Level: Displays the compatibility level of the current database. The value displayed in this field correlates to the bulleted table
below:
o 60 = SQL Server 6.0
o 65 = SQL Server 6.5
o 70 = SQL Server 7.0
o 80 = SQL Server 2000
o 90 = SQL Server 2005
o 100 = SQL Server 2008
o 110= SQL Server 2012
Last Backup: Displays the date and time of the last successful backup for
the current database.

512

Database Disk I/O

l

High Availability Group: Displays the database mirroring status and

details of the mirrored database, if available.

Database Disk I/O

This resource displays the status, as well as I/O metrics, for your current database
file. The icons of the listed performance counters in the Statistic Name column will
change to reflect the listed counter's current state. Clicking any volume in the
Volume column will take you to the Volume Details page for that counter.
The data can be sorted by clicking the headers of each column.

l
l

File Path: Displays the full path of the listed database.

Volume: Displays the name of the volume of the current database. Clicking a listed volume will take you to the Volume Details page.
Disk Queue Length: This is the number of both read and write requests
that were queued for the selected disk during the sample interval.
Total IOPS: Displays the current total read and write I/O operations occurring for the database logical volume. High I/O may be normal for some databases, but excessively high I/O will lead to higher queue lengths, meaning
there are more requests for disk reads or writes than the storage subsystem can handle simultaneously.
Latency: Displays a measurement of disk latency occurring on the disk
where the database resides. High latency values indicate sluggish database performance

The performance counter, Database Files, is used to provide metrics for this
resource. It is used in combination with volume polling. This counter is not listed
in the resource; however, the thresholds can be changed.
To change the thresholds for the Database Files performance counter:
1. From the Database Details view, locate the Database Files resource and
click Edit in the Management field.

513

Chapter 15: AppInsight Applications

2. Locate the Database Files performance counter and click [+] to expand
the counter and reveal the counter details.

3. Click Override Template and adjust the thresholds to suit your needs.
4. When done, click Submit.
Database Size by File
This resource lists the current databases sorted by file size. Moving the mouse
over the Database Usage percent value will reveal a tooltip with more detailed
information about that database. Clicking the value will take you to the Custom
Chart resource page. If the Warning or Critical thresholds is breached, the color of
the bar chart will change from green to yellow or red, respectively.

l
l

File Path: Displays the full path of the listed database.

Auto-Growth: Displays the Auto-growth status of the listed database.

514

Log Flushes
l
l

File Size: Displays the size of the listed database in megabytes.

Database Usage: Depending on how your database is configured, this
value is showing you how close you are to running out of space. If your
database is configured as a fixed size, auto-grow, or a restricted auto-grow,
the percentages relate to what is going to cause your database to run out
of space.
Volume Usage: The value returned is the database file usage in relation
to the space remaining on the volume.

Database Files, is used to provide metrics for this resource. This counter is not
listed in the resource; however, the thresholds can be changed.
To change the thresholds for the Database Files performance counter:
1. From the Database Details view, locate the Database Files resource and
click Edit in the Management field.

2. Locate the Database Files performance counter and click [+] to expand
the counter and reveal the counter details.

3. Click Override Template and adjust the thresholds to suit your needs.
4. When done, click Submit.
Log Flushes
This resource contains monitors specific to the current status of log flushes for the
current database. The icons of the listed performance counters in the Statistic
Name column will change color to reflect the listed counter's current state.

515

Chapter 15: AppInsight Applications

Clicking any performance counter in the Statistic Name column will take you to
the Performance Counter Details page for that counter.
If the value of a listed performance counter crosses the Warning threshold, the
chart for the listed counter will display a yellow background. If the value of a listed
monitor crosses the Critical threshold, the chart for the listed counter will display a
red background. Hovering over any time period within the chart will display
detailed information about that time period in the tooltip. Hovering over a counter
will give you detailed information about that counter.

Log Bytes
Definition:
Flushed/Sec This performance counter shows the average log bytes flushed
per second for the current database since the last data point.
Information:
The value returned helps identify trends of the transaction log.
A log flush happens when data is written from the log cache to
the transaction log on disk, each time a transaction happens.
Note: This is not available in SQL 2012.
Possible problems:
The rate at which log records are written to the disk. This is the
log generation rate of the application. It plays a very important
role in determining database mirroring performance. This
counter is in the Databases performance object.
Log Bytes Flushed/sec can indicate many small transactions
leading to high mechanical disk activity.

516

Log Flushes

Remediation:
Look at the statements associated with the log flush and
determine if the number of log flushes can be reduced. When a
single transaction is used, the log records for the transaction
can be bundled and a single, larger write can be used to flush
the gathered log records. The mechanical intervention is
significantly reduced. It is not recommended that you increase
your transaction scope. Long-running transactions can lead to
excessive and unwanted blocking as well as increased
overhead.
Log
Flushes/Sec

Definition:
This performance counter returns the number of log flushes per
second, averaged since the last collection time.
Information:
A log flush happens when a transaction is committed and data
is written from the log cache to the transaction log file. The log
cache is a location in memory where SQL Server stores data to
be written to the log file. This is used to roll back a transaction
before it is committed. Once complete, the log cache is flushed
to the physical log file on the disk. Generally speaking, log
flushes per second should parallel the number of transactions
per second.
Possible problems:
If the returned value is higher than expected, check your use of
explicit transactions in your queries.
Remediation:
Explicitly define the start and end of your transactions. This
should reduce the number of log flushes, and reduce the impact
on I/O. Also check the Log Bytes Flushed/Sec monitor.

Log Flush
Waits/Sec

Definition:
This performance counter returns the number of commits, per
second, waiting for the log flush.
Information:

517

Chapter 15: AppInsight Applications

This value should be as low as possible.

Possible problems:
A high number of Log Flush Waits can indicate that it is taking
longer than normal to flush the transaction log cache. This will
slow the performance of your SQL Server.
Remediation:
Check the value of the Disk avg. Write time monitor. If the
returned value is greater than 5ms, then this can indicate that
there is an I/O bottleneck. Move your transaction log file to a
disk drive separate from your data files. This should increase
performance since there is no access competition on the same
disk. Consider upgrading to RAID 10 for transaction log
storage. Also, adding spindles to your RAID array should
increase performance.
Log Flush
Wait Time

Definition:
This performance counter returns the total wait time (in
milliseconds) to flush the log to the transaction log file.
Information:
On an AlwaysOn secondary database, this value indicates the
wait time for log records to be hardened to disk.

Percent Log
Used

Definition:
This performance counter returns the percentage of space in
the log that is in use.
Information:
This is thesize of thetransaction log thatactively contains data
in relation to the total physical size on disk of thelog file.
Possible problems:
If the log file is 100% used, it will attempt to increase its size. If
there is not sufficient disk space to accommodate the growth,
the database will stop functioning.
Remediation:
Perform a transaction log backup to truncate the log.

518

Processes and Services

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
Processes and Services
This resource provides detailed information about the active processes and
services associated with the database selected. Hovering over a component will
give you detailed information about that component.

l
l
l

Component Name: Name of the listed component.

Process Name: Name of the listed process.
CPU Load: Percentage of the CPU that the listed process/service is currently using.
Memory Used: Memory currently being used by the listed process/service.
o Physical: RAM currently being used by the listed process/service.
o Virtual: Virtual memory currently being used by the listed process/service.
IOPS: Current amount of Input/Output data being processed per second.

Storage
This resource contains monitors specific to the current storage status of the
current database. The icons of the listed performance counters in the Statistic

519

Chapter 15: AppInsight Applications

Name column will change color to reflect the listed counter's current state.
Clicking any performance counter in the Statistic Name column will take you to
the Performance Counter Details page for that counter.
If the value of a listed performance counter crosses the Warning threshold, the
chart for the listed counter will display a yellow background. If the value of a listed
monitor crosses the Critical threshold, the chart for the listed counter will display a
red background. Hovering over any time period within the chart will display
detailed information about that time period in the tooltip. Hovering over a counter
will give you detailed information about that counter.

Backup/Restore Definition:
Throughput/Sec This performance counter shows the Read/Write
throughput for backup and restore operations of a database
per second.
Information:
You can measure how the performance of the database
backup operation changes when more backup devices are
used in parallel, or when faster devices are used.
Throughput of a database backup or restore operation
allows you to determine the progress and performance of
your backup and restore operations. There are no
thresholds associated with this performance counter.
Log Cache
Reads/Sec

Definition:
This performance counter returns the amount of Reads

520

Storage

performed per second through the Log Manager cache.

Total Size

Definition:
This performance counter returns the total size of the
database including white space.
Possible problems:
Running out of storage space.
Remediation:
Shrink the database if free space is running low.

Log File(s) Size

Definition:
This performance counter shows the cumulative size (in
kilobytes) of all the transaction log files in the database.
Information:
Every transaction in the database is logged to the
Transaction log. This is useful during recovery in the event
of data loss. Information about the log file is shown under
theFilessection of the Database Overview page in SQL
Server Management Studio.
The size of this file is based on the logging level set for the
database. By default, a new database uses Full Recovery
Mode or the recovery mode that the model database is set
up as. Transactions in the log file are only removed when a
complete backup or transaction log backup is initiated. This
enables pinpoint recovery for critical applications. Be
aware that if the transaction log is not backed up on a
regular basis, the log will grow until your disk is completely
full. The transaction log should be adjusted to a reasonable
size. This will depend on the number of transactions you
expect, and how often you perform backups.
Set the correct Autogrowth properties: The default of 10%
Autogrowth for data and log files should be enough for low
use databases. Conversely, a 500 MB Autogrowth rate may
be better suited for a busy database, preventing a large I/O
impact caused by normal Autogrowth operations.
Possible problems:

521

Chapter 15: AppInsight Applications

If the returned value occasionally drops to zero, this can

indicate a problem with the following file: sys.master_files.
This file is what the SQL Monitor uses to collect data.
Note: With Simple Recovery Model, fast writing to the
transaction log will trigger Autogrowth.
Remediation:
If you are performing a insert operation, you should
consider switching the recovery model to Bulk Logged for
the insert.
l

If you do not need pinpoint recovery, it is recommended you switch to Simple Recovery model.
If your database is configured with the Full or Bulk
Logged recovery model, back up the log on a regular basis so it can be truncated to free up log space.

Note: This action removes inactive virtual log files, but

does not reduce the file size.
Data File(s) Size

Definition:
This performance counter shows the cumulative size (in
kilobytes) of all the data files in the database including any
automatic growth.
Information:
Monitoring this counter is useful for determining the correct
size of tempdb. The value returned from this monitor reports
the size of your database (not including the Transaction
log). Information about distinct primary data files and
secondary data files is shown under theFiles section of the
Database Overview page in SQL Server Management
Studio.
Having a file size increase on demand is expensive and
will degrade performance significantly. Autogrowth should
only be used to let a database increase in size if you are
running out of disk space. Autogrowth should not be used
to manage your MDF size increases. Data files should be
sized properly when they are initially created to meet the

522

Storage

expected growth. This also helps avoid fragmentation,

which leads to better database performance.
Possible problems:
Be wary of large and unusual increases to the size of your
data files. Generally speaking, your database should be
sized to minimize Autogrowth. An increase in size is
expensive concerning I/O. Additionally, this will fragment
your data and log files. If the returned value occasionally
drops to zero, this can indicate a problem with the following
file: sys.master_files. This file is what the SQL Monitor uses
to collect data.
Remediation:
l

Shrink Space

Ensure that Full Recovery Mode is used for your

databases and that you regularly backup everything,
including the transaction log.
Manually add space as data increases in size. It is
recommended that you have approximately one year
of space available for data growth. If this is not possible, move the database to a higher capacity drive
or simply upgrade the drive.
Note:Compressing files causes fragmentation and
is therefore not recommended.

Definition:
This is essentially the white space in the database that can
be reclaimed by compacting/shrinking the database.
Information:
Shrinking data files recovers space by moving pages of
data from the end of the file to unoccupied space closer to
the front of the file. When enough free space is created at
the end of the file, data pages at end of the file can deallocated and returned to the file system.
Possible problems:
Data that is moved to shrink a file can be scattered to any
available location in the file. This causes index
fragmentation and can slow the performance of queries that

523

Chapter 15: AppInsight Applications

search a range of the index.

Remediation:
To eliminate the fragmentation, consider rebuilding the
indexes on the file after shrinking.
Average
Bytes/Read

Definition:
Perfmon captures the total number of bytes sent to the disk
(write) and retrieved from the disk (read) over a period of
one second.
Information:
The Disk Read Bytes/sec and the Disk Write Bytes/sec
performance counters break down the results displaying
only read bytes or only write bytes, respectively.

Average
Bytes/Write

Definition:
Perfmon captures the total number of bytes sent to the disk
(write) and retrieved from the disk (read) over a period of
one second.
Information:
The Disk Read Bytes/sec and the Disk Write Bytes/sec
performance counters break down the results displaying
only read bytes or only write bytes, respectively.

Average Read
Latency

Definition:
This performance counter indicates the response time of
the disk how long it takes for a read request to get
acknowledged by the disk.
Information:
The average read latency should be less than 20ms for
database files.

Average Write
Latency

Definition:
Avg. Disk sec/Write is the average time, in seconds, to
write data to the disk.
Information:
This analysis determines if any of the physical disks are
responding slowly.

524

Storage

Possible problems:
If the response times are greater than .015 (15
milliseconds), then the disk subsystem is keeping up with
demand, but does not have much overhead left.
If the response times are greater than .025 (25
milliseconds), then noticeable slow-downs and
performance issues affecting users may be occurring.
Forwarded
Records/Sec

Definition:
This performance counter returns the number of records per
second fetched through forwarded record pointers.
Information:
Heaps have one interesting feature - forwarded records. If a
record needs to be updated and the updated record size is
greater than the current record size, and there is no space
on the page to fit the new record in, then we have two
options:
1. Move the record to a new page and change all the
non-clustered index records that point to it to point to
the new location of the record.
2. Move the record to a new page and leave a forwarding record in the original location to point to the
new location.
Possible problems:
This is one drawback of using heaps - all the extra space
that is wasted with the Forwarding/Forwarded Records.
Another drawback is that when scanning through the heap,
forwarding records have to be followed immediately (as
opposed to ignoring them and just reading the forwarded
records when they are encountered). This is to vastly
reduce the possibility of read anomalies such as nonrepeatable reads or missed rows if a row moves before the
scan point during a scan.
Remediation:
Once a data table (heap) includes forward pointers, there is

525

Chapter 15: AppInsight Applications

only one way to get rid of them : Table Reorg. There are a
few options to do this:
l

Log Cache
Reads/Sec

The simplest one would be to create a clustered

index on the data table and drop it again.
To avoid forward pointers entirely, create a clustered
index from the beginning. A clustered index keeps
the data rows in its leaf node level. Therefore the
data is always sorted according to the index keys
and forward pointers will not be used. This is like a
continuous online Reorg in this regard.

Definition:
This performance counter displays the number of Reads
performed per second through the Log Manager cache.
Information:
There are no thresholds associated with this performance
counter.

Log Cache Hit

Ratio

Definition:
This performance counter returns the percentage of Log
cache reads satisfied from the Log cache.
Information:
The log cache is used to hold information that will be
written to the transaction log. There are no thresholds
associated with this performance counter.

Number of
Reads/Sec

Definition:
This performance counter returns the number of physical
database page reads issued per second.
Information:
This statistic displays the total number of physical page
reads across all databases. 80 to 90 per second is normal.
Anything that is above 90 indicates indexing or memory
constraint.
Possible problems:
Because physical I/O is expensive, you may be able to

526

Storage

minimize the cost, either by using a larger data cache,

intelligent indexes, and more efficient queries, or by
changing the database design.
Remediation:
Attempt to tune the application so that fewer I/O operations
are required. For example, perhaps I/O would be reduced if
there were appropriate indexes or if the database design
were de-normalized. If the applications cannot be tuned,
you will need to acquire disk devices with more capacity.
Compare to the Memory: Pages/sec performance counter
to see if there is paging while the SQL Server:Buffer
Manager\Page reads/sec is high. Note: Before adjusting
the fill factor, at a database level, compare the SQL
Server:Buffer Manager\Page reads/sec performance
counter to the SQL Server:Buffer Manager\Page writes/sec
counter, and use the fill factor option only if writes are a
substantial fraction of reads (greater than 30 percent).
Number of
Writes/Sec

Definition:
This performance counter returns the number of data pages
written per second.
Information:
Page writes per second are the total number of physical
writes, including checkpoint writes, lazy writer writes, and
large block writes done during index creation or bulk copy
operations.
Possible problems:
If Page Writes/sec is high, this might indicate a SQL Server
performance issue.
Remediation:
If these values are high, you can try to reduce the values by
tuning your application or database to reduce I/O
operations such as index coverage, better indexes,
normalization, increasing the I/O capacity of the hardware,
or by adding memory.

527

Chapter 15: AppInsight Applications

Total Size:
Percent
Change 24 Hrs

Definition:
This value is the same as the value returned by the
performance counter, Total Size but calculated as a
percentage of change over the last 24 hours.
Information:
This metric allows users to be alerted when the database
experiences sudden growth.
Possible problems:
A database that suddenly changes in size by a high
percentage could be indicative of a problem that should be
investigated.

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
Top 10 Clustered Indexes by Fragmentation
A clustered index determines the physical order of data in a table. This resource
displays the clustered indexes with the highest level of fragmentation. If the
Warning or Critical threshold is breached, the color of the bar chart will change
from green to yellow or red, respectively.

528

To change the thresholds for the Top Indexes for Database performance counter:
l
l
l

Table Name: Displays the name of the listed table.

Index Name: Displays the name listed index.
Fragmentation: Numerically and graphically displays the percentage of
fragmentation of the listed index.

The performance counter, Top Indexes for Database, is used to provide metrics
for this resource. This counter is not listed in the resource; however, the
thresholds can be changed.
To change the thresholds for the Top Indexes for Database performance
counter:
1. From the Database Details view, locate the Database Details resource
and click Edit in the Management field.

2. Locate the Top Indexes for Database performance counter and click [+]
to expand the counter and reveal the counter details.

3. Click Override Template and adjust the thresholds to suit your needs.
4. When done, click Submit.
To change the number of tables displayed in this resource, values must be
changed in two locations:

529

Chapter 15: AppInsight Applications

1. In the resource, click Edit.
2. Change the value for the field: Maximum Number of Records to Display,
and then click Submit.
3. Edit the application or the template that the application is based on. To edit
the template which will affect applications based on it:
a. From the web console, navigate to Settings > SAM Settings > Manage Templates.
b. Check the AppInsight for SQL application and click
in the toolbar.
c. Expand the Top Indexes for Database component monitor by clicking [+].
d. Change the value for the field, Number of Records to Retrieve
and then click Submit.

4. To edit the individual application:

a. From the web console, click the Applications tab.
b. From the All Applications resource, click an AppInsight for SQL
application to select it.
c. From the Application Details resource, click
.
d. Expand the Top Indexes for Database component monitor by clicking [+].
e. Click Override Template corresponding to the row, Number of
Records to Retrieve.

530

Top 10 Most Expensive Queries by CPU Time

f. Change the value for the field, Number of Records to Retrieve
and then click Submit.

Top 10 Most Expensive Queries by CPU Time

This resource displays the top 10 most expensive queries sorted by the length of
time the CPU spent processing the listed query.
When viewing this resource from the Summary tab on the Application Details
page, queries are listed for the entire SQL Server instance. Conversely, when this
same resource appears on the Database Details view, queries are only listed for
that specific database.
The data can be sorted by clicking the headers of each column. Additionally, this
resource can optionally show Top Queries by I/O by clicking Edit in this resource
and making the necessary adjustments.
Note: The resource is filtered based on the settings found on the Queries tab in
Details view in the Most Expensive Queries resource.

531

Chapter 15: AppInsight Applications

Query Text: The text shown is a preview of the full query. To view an
entire query in the list, click [+] next to the query listed to expand and view
the query.
Note: Clicking any listed query will take you to the Most Expensive Queries resource on the Queries tab, providing greater detail about the query.
CPU Time: Display the time, in milliseconds, the listed query took to complete.
Database: Displays the database with which the listed query is associated. The icon in this column shows the current state of the listed database.

The performance counter, Top Expensive Queries, is used to provide metrics for
this resource and cannot be edited.
Top 10 Nonclustered Indexes by Fragmentation
A non-clustered index is one in which the data rows are not sorted and stored in
order based on their non-clustered keys. This resource displays the non-clustered
indexes with the highest level of fragmentation. If the Warning or Critical
thresholds is breached, the color of the bar chart will change from green to yellow
or red, respectively.

532

Top 10 Nonclustered Indexes by Fragmentation

l
l
l

Table Name: Displays the name of the listed table.

Index Name: Displays the name listed index.
Fragmentation: Numerically and graphically displays the percentage of
fragmentation of the listed index.

The performance counter, Top Indexes for Database, is used to provide metrics
for this resource. This counter is not listed in the resource; however, the
thresholds can be changed.
To change the thresholds for the Top Indexes for Database performance
counter:
1. From the Database Details view, locate the Database Details resource
and click Edit in the Management field.

533

Chapter 15: AppInsight Applications

2. Locate the Top Indexes for Database performance counter and click [+]
to expand the counter and reveal the counter details.

3. Click Override Template and adjust the thresholds to suit your needs.
4. When done, click Submit.
To change the number of tables displayed in this resource, values must be
changed in two locations:
1. In the resource, click Edit.
2. Change the value for the field: Maximum Number of Records to Display,
and then click Submit.
3. Edit the application or the template that the application is based on. To edit
the template which will affect applications based on it:
a. From the web console, navigate to Settings > SAM Settings > Manage Templates.
b. Check the AppInsight for SQL application and click
in the toolbar.
c. Expand the Top Indexes for Database component monitor by clicking [+].
d. Change the value for the field, Number of Records to Retrieve
and then click Submit.

534

Top 10 Tables by Size

4. To edit the individual application:
a. From the web console, click the Applications tab.
b. From the All Applications resource, click an AppInsight for SQL
application to select it.
c. From the Application Details resource, click
.
d. Expand the Top Indexes for Database component monitor by clicking [+].
e. Click Override Template corresponding to the row, Number of
Records to Retrieve.
f. Change the value for the field, Number of Records to Retrieve
and then click Submit.

Top 10 Tables by Size

This resource displays the current database tables in order based on size. If the
Warning or Critical thresholds is breached, the color of the bar chart will change
from green to yellow or red, respectively.

l
l

Name: Displays the name of the listed table of the current database.
Size: Displays the size of the listed table of the current database.

535

Chapter 15: AppInsight Applications

% Used by Index: Displays the percentage of the table space used by the
index.
Total Row Count: Displays the total number of rows in the listed table of
the current database.

The performance counter, Top Tables for Database, is used to provide metrics
for this resource. This counter is not listed in the resource; however, the
thresholds can be changed.
To change the thresholds for the Top Tables for Database performance
counter:
1. From the Database Details view, locate the Database Details resource
and click Edit in the Management field.

2. Locate the Top Tables for Database performance counter and click [+] to
expand the counter and reveal the counter details.

3. Click Override Template and adjust the thresholds to suit your needs.
4. When done, click Submit.

536

Transaction Log Disk I/O

Transaction Log Disk I/O
This resource lists the current status of the transaction log file. The icons of the
Volume column will change to reflect the listed volume's current state. Clicking
the volume will take you to the Volume Details page.

l
l

File Path: Displays the full path where the transaction log file resides.
Volume: Displays the volume where the transaction log file resides. Clicking on the volume name will take you to the Volume Details View.
Disk Queue Length: Displays the current disk queue length for the listed
volume as seen on the Volume Details view. Queue lengths that are high
for a sustained period of time are indicative of disk I/O performance issues
that can negatively impact the database.
Total IOPS: Displays the current total read and write IO operations occurring on the drive where the database or transaction log file resides. High
I/O may be normal for some databases, but excessively high I/O will lead to
higher queue lengths, meaning there are more requests for disk reads or
writes than the storage subsystem can handle.
Latency: Displays a measurement of disk latency occurring on the disk
where the database or transaction log file resides. High volume latency values indicate sluggish database performance.

The performance counter, Database Files, is used to provide metrics for this
resource. It is used in combination with volume polling. This counter is not listed
in the resource; however, the thresholds can be changed.
To change the thresholds for the Database Files performance counter:
1. From the Database Details view, locate the Database Files resource and
click Edit in the Management field.

537

Chapter 15: AppInsight Applications

2. Locate the Database Files performance counter and click [+] to expand
the counter and reveal the counter details.
3. Click Override Template and adjust the thresholds to suit your needs.
4. When done, click Submit.
Transaction Log Size by File
This resource lists the current status of transaction log files as sorted by size.
Hovering the mouse over a listed percentage will reveal a tooltip with detailed
information about the item listed. Clicking the percentage will take you to the
Database Details page. If the Warning or Critical thresholds is breached, the color
of the bar chart will change from green to yellow or red, respectively.

l
l
l
l

File Path: Displays the complete file path of the listed transaction log.
Auto-Growth: Displays the current Auto-growth setting.
File Size: Displays the current size of the listed transaction log.
Database Usage: This resource displays the amount of space consumed
as a percentage of whatever restrictions are in place for the file. For
example:
o If the transaction log is allowed to grow unrestricted, then it is limited
only by the amount of free space on the volume.
o If the transaction log is allowed to grow to a maximum size, the percentage is calculated based on this restricted size limit.
o If the transaction log has a fixed size, the percentage used is calculated based on the total size of the transaction log file and the
amount of remaining white space.
Volume Usage: Displays the amount of space the listed file is consuming
on the volume where it is located.

538

Transactions
The performance counter, Database Files, is used to provide metrics for this
resource. This counter is not listed in the resource; however, the thresholds can
be changed.
To change the thresholds for the Database Files performance counter:
1. From the Database Details view, locate the Database Files resource and
click Edit in the Management field.

2. Locate the Database Files performance counter and click [+] to expand
the counter and reveal the counter details.

3. Click Override Template and adjust the thresholds to suit your needs.
4. When done, click Submit.
Transactions
A transaction is a unit of work that is performed against a database. In other
words, if you are creating a record, for example, then you are performing
transaction on the table. It is important to control transactions to ensure data
integrity and to handle database errors.
This resource contains monitors specific to the current status of transactions. The
icons of the listed performance counters in the Statistic Name column will change
color to reflect the listed counter's current state. Clicking any performance counter
in the Statistic Name column will take you to the Performance Counter Details
page for that counter.

539

Chapter 15: AppInsight Applications

If the value of a listed performance counter crosses the Warning threshold, the
chart for the listed counter will display a yellow background. If the value of a listed
monitor crosses the Critical threshold, the chart for the listed counter will display a
red background. Hovering over any time period within the chart will display
detailed information about that time period in the tooltip. Hovering over a counter
will give you detailed information about that counter.

Longest
Transaction
Running
Time

Definition:
This performance counter displays the length of time, in
seconds, the transaction that has been running the longest,
has been active.
Information:
Transactions that run longer than others use more resources.
They can be used to track down procedures and calls that are
taking longer than expected by identifying the specific
transaction(s).
Possible problems:
Long running transactions can prevent truncation of
transaction logs. This can cause the transaction log files to
grow until they consume all available physical disk space
shutting down access to the database.

540

Transactions

Remediation:
Check the functionality of the query and/or redesign the long
running transaction.
Transactions/ Definition:
Sec
This performance counter returns the number of transactions
started for the database, per second.
Information:
Transaction rate is affected by general system performance
and resource constraints, such as I/O, number of users, cache
size, and the complexity of requests.
Possible problems:
A high rate of transactions can indicate that some transactions
are not completing.
Remediation:
Using stored procedures in transactions speeds transaction
processing because SQL code in stored procedures runs
locally on the server. The transactions can finish much faster
without the network traffic required by the transactions.
Active
Transactions

Definition:
This performance counter returns the number of active
transactions for the database.
Information:
During an active transaction, no other transaction can modify
the data held by the active transaction. While you are
modifying data, an exclusive lock is held on that data.
Conversely, you cannot read data held by another transaction
because another transaction holds an exclusive lock on the
data that prevents it from being read. The returned value for
this monitor should be less than 200.
Possible problems:
A high number of active transactions can indicate that certain

541

Chapter 15: AppInsight Applications

transactions are never completing.

Remediation:
Keeping a low level of active transactions assists in keeping
requested data accessible.
Repl. Trans.
Rate
(Replication
Transactions
Rate)

Definition:
This performance counter returns the number of transactions
read out of the transaction log and sent to the distribution
database
Information:
SQL Server Overall Replication Performance Analysis
provides a graph of several SQL Server overall replication
performance counters for the specified server during the
specified time period. Performance counter data is averaged
by the hour. The graph displays the following replication
performance counters:
l

Bulk Copy
Rows/sec

SQLServer:Databases / Replication Pending Xacts

(SQL Server; Scale=1\100)
SQLServer:Databases / Replication Transaction Rate
(SQL Server; Scale=1\100)
SQLServer Replication Published DB / Replicated
Transactions Per Second

Definition:
This monitor returns the number of rows bulk copied per
second.
Information:
Measure the number of rows coming into the database.
Optimization yields a higher number. See The Data Loading
Performance Guide [Link]
Possible problems:
BCP to bulk load data over the network, having the correct
throughput configured is crucial.

542

AppInsight for Exchange

Bulk Copy
Throughput/
Sec

Definition:
This monitor returns the amount of data bulk copied (in
kilobytes) per second.
Possible problems:
Overall throughput will mostly be limited by your I/O
subsystem.

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.

AppInsight for Exchange

AppInsight for Exchange was designed exclusively for the mailbox role which
offers a detailed view of your Exchange environment. This application provides
detailed metrics on mailboxes, databases, and a host of performance counters
without the use of agents or templates. AppInsight for Exchange's level of detail
and expert knowledge goes far beyond what an Exchange template can provide,
allowing you to monitor virtually every aspect of your Exchange environment.
Like any unassigned application in SAM, AppInsight for Exchange is considered
a template until it is applied. Therefore, it is a member of the Application Monitor
Templates collection.
Once applied to a node, AppInsight for Exchange is considered an application.
Like any SAM application, AppInsight for Exchange is comprised of multiple
component monitors.
Note: To optimize your Exchange server performance, see 5 Tips to Optimize
Exchange Server for Improved Performance.
AppInsight for Exchange General Information:

543

Chapter 15: AppInsight Applications

l
l
l
l
l
l
l

AppInsight for Exchange Requirements and Permissions

AppInsight For Exchange Licensing
Template/Application Relationship
Adding AppInsight for Exchange to a Node
Editing the AppInsight for Exchange Template
Understanding the AppInsight for Exchange Details Views
Navigating the AppInsight for Exchange Details Views

_________________
Portions of the performance counter information used in the AppInsight for Exchange application are provided courtesy of
multiple sources listed in the copyright and attribution section at the beginning of this document.

AppInsight For Exchange Licensing

When using AppInsight for Exchange, 50 component monitors will count against
your licensed number of component monitors, per Exchange Server.
For example, if you have an active license for 1,500 component monitors and use
AppInsight for Exchange to monitor 88 mailboxes over ten Exchange servers, 500
component monitors will count against your total license. The number of
mailboxes you have on these servers is irrelevant.
(50 component monitors X 10 Exchange Servers = 500 component
monitors used.)
This will leave you with 1,000 component monitors available for use elsewhere.
(1,500 component monitors 500 component monitors used for
AppInsight for Exchange = 1,000 component monitors remaining).
There is no restriction on the number of mailboxes you can have monitored. Also
note that if you choose not to use this application, you will not be penalized any
number of component monitors.
For more information, see "Licensing."

Quick Configuration and Navigation

Configuration of SAM's AppInsight for Exchange is most easily achieved via
Discovery, as shown below.
l

To add AppInsight for Exchange, see Adding AppInsight for Exchange to a

Node

544

Adding AppInsight for Exchange to a Node

AppInsight for Exchange Requirements and Permissions

l

Local administrator permissions are needed for automatic configuration, but

they are not needed for monitoring once configuration is complete.
To provide organization-wide capability, the service account (Domain
User) needs to be a member of the View-Only Organization Management
group. Membership to this group gives the user object read-only access to
the entire Exchange environment, without providing any domain or local
access on the Exchange server. It also prevents possible abuse by an unauthorized user accessing the account (e.g. modifying Exchange environment
configuration, creating/deleting users, and so on.)
In order to gather information, the user object must be assigned the Mailbox
Search management role within Exchange. In order for the account to be
configured correctly, the account must be a member of the Local Administrators group.

For more information, see Troubleshooting Permissions.

Adding AppInsight for Exchange to a Node

There are multiple ways to add AppInsight for Exchange to a node. This can be
done via Node Discovery, adding it via the Management resource, adding it via

545

Chapter 15: AppInsight Applications

Network Sonar Discovery, or adding it via a Scheduled Discovery.
It is recommended that you add this application on WMI managed nodes. If you
convert an SNMP managed node to SNMP, interface statistics will be lost. To
convert SNMP managed nodes to WMI, see Promoting a Node to WMI Monitoring
Notes:
l
l

Multiple instances of Exchange on the same server is not supported.

Nodes that are not added via WMIwill not appear in the List Resources dialog.
Monitoring an Exchange Database Access Group (DAG) via a Virtual
IPaddress (VIP) is not supported. AppInsight for Exchange should only be
applied to the physical IP address of each mailbox server in the DAG individually.

AppInsight for Exchange Requirements and Permissions

l

Local administrator permissions are needed for automatic configuration, but

they are not needed for monitoring once configuration is complete.
To provide organization-wide capability, the service account (Domain
User) needs to be a member of the View-Only Organization Management
group. Membership to this group gives the user object read-only access to
the entire Exchange environment, without providing any domain or local
access on the Exchange server. It also prevents possible abuse by an unauthorized user accessing the account (e.g. modifying Exchange environment
configuration, creating/deleting users, and so on.)
In order to gather information, the user object must be assigned the Mailbox
Search management role within Exchange. In order for the account to be
configured correctly, the account must be a member of the Local Administrators group.
Note: For Exchange access this is not required, but in order to modify
Exchange and WinRM settings on the server, as well as to poll performance
counters, this additional level of permission is required.

To Add AppInsight for Exchange via the Management Resource:

1. Navigate to the Node Details view by clicking any Windows node.

546

Adding AppInsight for Exchange to a Node

2. From the Management resource, click List Resources.

3. Check the Microsoft for Exchange Server box to enable AppInsight Applications data collection.

4. Navigate to the All Applications resource to verify the addition.

5. Enter your Exchange credentials when prompted, and then click Configure
Server.

547

Chapter 15: AppInsight Applications

To Add AppInsight for Exchange to a Node via Discovery:

1. From the web console, navigate to Settings > Add a Node in the Getting
Started with Orion section.

2. Complete the information on the Define Node step, and then click Next.
3. On the Choose Resources step, check the AppInsight for Exchange
applications you want. AppInsight applications have a unique blue and
white icon, as shown:

548

Adding AppInsight for Exchange to a Node

4. Click Next and complete the wizard as instructed.

5. Navigate to the All Applications resource and click your application.

6. Enter your Exchange credentials when prompted, and then click Configure
Server.

549

Chapter 15: AppInsight Applications

For information on Network Sonar Discovery, see:

l
l

Network Sonar Discovery.

Managing Scheduled Discovery Results.

Understanding the AppInsight for Exchange Details Views

AppInsight for Exchange has multiple Details views. These views are the
equivalent of the Application Details view of a traditional SAM application. There
are four main views:
l

The AppInsight for Exchange Details view: This view displays a broad overview of the application.
The Performance Counter Details View: This view displays details about
the selected performance counter.
The Database Details View: This view displays details about the selected
database.
The Mailbox Details View . This view displays details about the selected
mailbox.
From the AppInsight for Exchange Details view, you can select from
the dropdown menu and choose to display different amounts of data

550

Navigating the AppInsight for Exchange Details Views

based on a time range, as shown below:

Editing Resources
Both the titles and subtitles of each resource can be changed by clicking Edit in
the upper right-hand corner of any resource, and then clicking Submit.

Note: As illustrated above, other options may appear depending upon the
resource being edited.
For more information, see:
l
l
l
l

AppInsight for Exchange Details View

Performance Counter Details View
AppInsight for Exchange Database Details View
AppInsight for Exchange Mailbox Details View

Navigating the AppInsight for Exchange Details Views

AppInsight for Exchange acts like any other application and can therefore be
found in the All Applications resource on the Application Summary view.

551

Chapter 15: AppInsight Applications

Below is the AppInsight for Exchange application within the All Applications
resource on the Application Details page:

To Navigate to the AppInsight for Exchange Details View:

1. From the web console, locate the All Applications resource.
2. Expand the AppInsight for Exchange tree by clicking [+].
3. Expand the node tree by clicking [+].

552

Navigating the AppInsight for Exchange Details Views

4. Click the application, as highlighted:

To Navigate to the Performance Counter Details view:

1. From the AppInsight for Exchange Details view, click any performance
counter within a resource, as highlighted:

To Navigate to the Database Details view:

1. From the AppInsight for Exchange Details view, click any database within a
Database resource, as highlighted:

553

Chapter 15: AppInsight Applications

To Navigate to the Mailbox Details view:

1. From the AppInsight for Exchange Details view, click any user name within
a Mailbox resource, as highlighted:

Advanced Manual Configuration

AppInsight for Exchange's automated configuration tool makes adding this
application to a node simple. However, there may be times when you want to
manually configure available settings, permissions, and so on. Manual
configuration is only recommended for experienced Exchange administrators.
To Manually Configure Available Settings, refer to the following sections:
l
l
l
l

Changes that will be made to enable AppInsight for Exchange

Finding Exchange Credentials
Manually Configuring Exchange Server
AppInsight for Exchange Requirements and Permissions

554

Changes that will be made to enable AppInsight for Exchange

l
l

Finding Exchange URL Settings

PowerShell Permissions

Changes that will be made to enable AppInsight for Exchange

The target machine must have the following:
l
l
l

WinRM 2.0
PowerShell v2.0
IIS

SAMuses a specially designed configuration tool to make the necessary

changes for enabling AppInsight for Exchange. Once this tool completes remote
configuration, it will automatically remove and unregister itself.
1. The configuration tool first transfers to the Exchange Server by using the
Windows administrative share.
2. Once on the Exchange Server, the tool uses a custom PowerShell script to
make configuration changes.
3. SAM will add the Mailbox Search Role to the Exchange server with the credentials provided.
4. The tool then reports back to SAM with the results.
5. If errors are reported, you will be asked to configure Exchange.
SAMwill make the following configuration changes:
l
l
l

Enable WinRM
Enable Windows Authentication for PowerShell's web site.
WinRM and Windows Authentication configurations are performed remotely
from SAM.

For more information, see:

l

l
l

l
l

To add local administrative privileges to an Active Directory account, see

Manually Configuring Exchange Server.
To find Exchange URLsettings, see Finding Exchange URL Settings.
To install PowerShell on the Exchange server, see Manually Configuring
Exchange Server
To set the appropriate permissions for PowerShell, see PowerShell Permissions
To create a self-signed certificate, see Manually Configuring Exchange
Server.
To configure WinRM, see Manually Configuring Exchange Server.
To create a firewall rule for WinRM, see Manually Configuring Exchange
Server

555

Chapter 15: AppInsight Applications

l
l

To configure IIS, see Manually Configuring Exchange Server

To correct a Non-Domain account configuration error, see Manually Configuring Exchange Server.
To correct a Exchange access configuration error, see Manually Configuring Exchange Server.
To correct a Mailbox Search Access configuration error, see Manually Configuring Exchange Server.

Finding Exchange Credentials

For an account to access Exchange:
l
l

The account must be a domain account.

In order to modify IIS and PowerShell settings on the Exchange server, the
account must be a Local Administrator.
The account is recommended to not be a member of the Domain Administrators group. (Typically, this is handled by adding a custom domain
security group which is used to define a specific type of administrator with
specific permissions to the Local Administrators group. In larger, more
mature environments, this is handled using GPOs, whereas smaller organizations may perform this task manually).

The verify you have valid Exchange credentials, run the following cmdlet in the
Exchange Management Shell (EMS):
Get-ManagementRoleAssignment -RoleAssignee USER_IDENTITY

556

Finding Exchange Credentials

For more information, see:

l

l
l

l
l

l
l

To add local administrative privileges to an Active Directory account, see

Manually Configuring Exchange Server.
To find Exchange URLsettings, see Finding Exchange URL Settings.
To install PowerShell on the Exchange server, see Manually Configuring
Exchange Server
To set the appropriate permissions for PowerShell, see PowerShell Permissions
To create a self-signed certificate, see Manually Configuring Exchange
Server.
To configure WinRM, see Manually Configuring Exchange Server.
To create a firewall rule for WinRM, see Manually Configuring Exchange
Server
To configure IIS, see Manually Configuring Exchange Server
To correct a Non-Domain account configuration error, see Manually Configuring Exchange Server.
To correct a Exchange access configuration error, see Manually Configuring Exchange Server.

557

Chapter 15: AppInsight Applications

To correct a Mailbox Search Access configuration error, see Manually Configuring Exchange Server.

Manually Configuring Exchange Server

To manually prepare an Exchange server for AppInsight for Exchange, the
following items must be installed and/or configured on the server. Instructions for
each item are listed on this page below.
l
l
l
l
l
l
l

Defining Exchange Credentials

Installing PowerShell 2.0 on Server 2008:
Installing PowerShell 2.0 on Server 2012:
Create a Self-Signed Certificate:
WinRM 2.0
Create a Firewall Rule
Configuring IIS

For a list of possible configuration errors with solutions, see Troubleshooting

Error Codes in AppInsight for Exchange.
Defining Exchange Credentials
Non-Domain Account
Local accounts (Non-Domain) cannot access Exchange Management interfaces
and therefore are not supported by AppInsight for Exchange. Please select an
Active Directory account or create a new one to use with AppInsight for
Exchange.
Add Local Administrative privileges to an Active Directory Account
1. On the server where you wish to grant local administrative privileges, open
a Computer Management console.
Note: On Windows 2012, add this privilege using the Active Directory console.
2. Navigate to System Tools > Local Users and Groups > Groups and
double click the Administrators group.
3. Click Add and type in the Active Directory username of the account you
want to grant administrative privileges and then press Enter. (Ensure the location is set to either the domain where the account is located or Entire Directory.)
4. Click Apply and then click OK button.
Note: Alternatively, you can add an Active Directory group to the local
administrators group and add the Active Directory user accounts to that
group.
558

Installing PowerShell 2.0 on Server 2008:

Exchange Access
Granting Least Privilege access to the Exchange Organization can be
accomplished using Active Directory Users and Computers (ADUC). To
accomplish this, take the following steps:
1. From the Start Menu, open ADUC and navigate to the Microsoft Exchange
Security Groups OU.
2. Double click on the View-Only Organization Management group.
3. After the window opens, click the Members tab, then click the Add.
4. Type the username of the account you want to grant access to the
Exchange organization and then click OK.
5. Click Apply and then click OK.
6. Close the ADUC window.
Mailbox Search Access
Mailbox Search access is required to determine attachment counts and sizes.
This can be granted using the Exchange Management Shell (EMS).
1. From the Start Menu, open the EMS.
2. Type: New-ManagementRoleAssignment -Role "Mailbox Search" -User
<Username of account being granted access> and then press Enter.
3. To verify the management role has been properly assigned, enter the following command:
Get-ManagementRoleAssignment -RoleAssignee <Username of account>

Installing PowerShell 2.0 on Server 2008:

Note: PowerShell 2.0 is automatically installed on Server 2008 R2 and therefore
no additional installation is required.
1. Navigate to Windows Management Framework
([Link]
2. Review the information on the web page, and then click the link for the
download of the Windows Management Framework Core for your platform
in the Download Information section.
3. On the Update page, click Download.
4. When the download is complete, click Finish.

559

Chapter 15: AppInsight Applications

Installing PowerShell 2.0 on Server 2012:
1. Open Server Manager
2. Click on the Manage menu, and the select Add Roles and Features.

3. After the wizard opens, click Next until you get to the Installation Type page.
4. Select Role-based or feature-based installation.

5. Click Next until you reach the Features page.

6. Scroll down to Windows PowerShell. It will likely show itself as partially
installed (square inside box).
7. Check the box next to Windows PowerShell 2.0 Engine.
8. Click Next and then Install.

560

Create a Self-Signed Certificate:

9. When the installation finishes, click Close.

Create a Self-Signed Certificate:

SolarWinds has created a PowerShell script to create a self-signed certificate
suitable for AppInsight for Exchange. This can be found at: Self-signed Certificate
PowerShell script for AppInsight for Exchange. If you choose not to download this
script, you can create your own self-signed certificate with the following
instructions and code:
1. To create a self-signed certificate using PowerShell and CertEnroll, open
PowerShell in the Run as Administrator context.
2. Enter the following code:
Note: The CN (Subject) should be in the following format: <IP Address of
Server>_Solarwinds_Exchange_Zero_Configuration.
$name = new-object -com
"X509Enrollment.CX500DistinguishedName.1"
$[Link]("CN=TestServer", 0)
$key = new-object -com
"X509Enrollment.CX509PrivateKey.1"
$[Link] = "Microsoft RSA SChannel

561

Chapter 15: AppInsight Applications

Cryptographic Provider"
$[Link] = 1
$[Link] = 1024
$[Link] = "D:PAI(A;;0xd01f01ff;;;SY)
(A;;0xd01f01ff;;;BA)(A;;0x80120089;;;NS)"
$[Link] = 1
$[Link]()
$serverauthoid = new-object -com
"[Link].1"
$[Link]
("[Link].[Link].1")
$ekuoids = new-object -com
"[Link].1"
$[Link]($serverauthoid)
$ekuext = new-object -com
"X509Enrollment.CX509ExtensionEnhancedKeyUsage.1"
$[Link]($ekuoids)
$cert = new-object -com
"X509Enrollment.CX509CertificateRequestCertificate.
1"
$[Link](2, $key, "")
$[Link] = $name
$[Link] = $[Link]
$[Link] = get-date
$[Link] = $[Link](3650)
$[Link]($ekuext)
$[Link]()
$enrollment = new-object -com
"X509Enrollment.CX509Enrollment.1"
$[Link]($cert)
$certdata = $[Link](0)
$[Link](2, $certdata, 0, "")

For more information, see Generating a Certificate.

WinRM 2.0
1. To configure WinRM on an Exchange server, open a command prompt in
the Run as Administrator context.

562

Create a Firewall Rule

2. Type: winrm create winrm/config/listener?Address=*+Transport=HTTPS
@{Port="5986";CertificateThumbprint="<Thumbprint value of certificate>";Hostname="<IP Address of Server>_Solarwinds_Exchange_
Zero_Configuration"}

and then press Enter.

3. Verify the configuration by typing the following: winrm get

winrm/config/listener?Address=*+Transport=HTTPS.

Create a Firewall Rule

To create a firewall rule for WinRM, follow the directions outlined below:
1. Open PowerShell in the Run as Administrator context.
2. Create a function for adding firewall rules using the following code:
function Add-FirewallRule {
param(
$name,
$tcpPorts,
$appName = $null,
$serviceName = $null
)
$fw = New-Object -ComObject hnetcfg.fwpolicy2
$rule = New-Object -ComObject [Link]
$[Link] = $name
if ($appName -ne $null) { $[Link] = $appName
}
if ($serviceName -ne $null) { $[Link] =
$serviceName }
$[Link] = 6 #NET_FW_IP_PROTOCOL_TCP

563

Chapter 15: AppInsight Applications

$[Link] = $tcpPorts
$[Link] = $true
$[Link] = "@[Link],-23255"
$[Link] = 7 # all
$[Link] = 1 # NET_FW_ACTION_ALLOW
$[Link] = $false
$[Link]($rule)
}

3. Run the function to create the firewall exception for WSMAN using the
following command:
Add-FirewallRule "Windows Remote Management" "5986" $null
$null

4. Verify the rule was created by navigating to Control Panel >Windows

Firewall >Advanced Settings.

564

Configuring IIS

Configuring IIS
1. Open a command prompt in the Run as Administrator context.
2. Change the directory to C:\Windows\System32\Inetsrv.
3. Type: [Link] unlock config -section:[Link]/security/authentication/windowsAuthentication

and then press Enter.

4. Open PowerShell in the Run As Administrator context.
5. Type: Import-Module WebAdministration and then press Enter.
6. Type: (Get-WebConfiguration [Link]/security/authentication/windowsAuthentication 'IIS:\s-

and then press Enter to

determine if Windows Authentication has been configured.
a. If the value returned is True, you do not need to do anything.
b. If the value returned is False, then take the following steps:
i. Type: Set-WebConfiguration sysites\Default Web Site\PowerShell').enabled

[Link]/security/authentication/windowsAuthentication
'IIS:\sites\Default Web Site\PowerShell' -value True

and

then press Enter.

ii. Type: (Get-WebConfiguration [Link]/security/authentication/windowsAuthentication
'IIS:\sites\Default Web Site\PowerShell').enabled

to verify

the setting has changed.

iii. Close PowerShell.

iv. In the open command prompt, type: [Link] lock config -

565

Chapter 15: AppInsight Applications

section:[Link]/security/authentication/windows
Authentication

and then press Enter.

v. Close the command prompt.

Testing the Application:
1. When you are finished with configuration, navigate to the Application Edit
page and click Test.

566

For correcting common configuration issues, see:

2. If successful, your screen should look like the illustration below:

For correcting common configuration issues, see:

l
l
l
l

To add local administrative privileges to an Active Directory account, see

To find Exchange URLsettings, see Finding Exchange URL Settings.
To correct a Non-Domain account configuration error, see
To correct a Mailbox Search Access configuration error, see

For more information, see:

l
l
l

To add local administrative privileges to an Active Directory account, see

To find Exchange URLsettings, see Finding Exchange URL Settings.
To install PowerShell on the Exchange server, see Manually Configuring
Exchange Server

567

Chapter 15: AppInsight Applications

l
l

l
l
l

To set the appropriate permissions for PowerShell, see PowerShell Permissions

To create a self-signed certificate, see Manually Configuring Exchange
Server.
To configure WinRM, see Manually Configuring Exchange Server.
To create a firewall rule for WinRM, see Manually Configuring Exchange
Server
To configure IIS, see Manually Configuring Exchange Server
To correct a Non-Domain account configuration error, see
To correct a Exchange access configuration error, see Manually Configuring Exchange Server.
To correct a Mailbox Search Access configuration error, see

AppInsight for Exchange Requirements and Permissions

AppInsight for Exchange works only with the Mailbox Role, which is used for
data storage. All other Exchange servers running different roles should use the
Exchange application templates included with SAM if you intend to monitor them.
Data is collected at the same default five minute polling interval as traditional
application templates.
Following are the requirements and permissions needed for AppInsight for
Exchange:
Microsoft Exchange Versions Supported:
l
l

Microsoft Exchange Server 2010

Microsoft Exchange Server 2013

AppInsight for Exchange Requirements and Permissions

l

Local administrator permissions are needed for automatic configuration, but

they are not needed for monitoring once configuration is complete.
To provide organization-wide capability, the service account (Domain
User) needs to be a member of the View-Only Organization Management
group. Membership to this group gives the user object read-only access to
the entire Exchange environment, without providing any domain or local
access on the Exchange server. It also prevents possible abuse by an unauthorized user accessing the account (e.g. modifying Exchange environment
configuration, creating/deleting users, and so on.)
In order to gather information, the user object must be assigned the Mailbox
Search management role within Exchange. In order for the account to be
configured correctly, the account must be a member of the Local Administrators group.
Note: For Exchange access this is not required, but in order to modify
568

Finding Exchange URL Settings

Exchange and WinRM settings on the server, as well as to poll performance
counters, this additional level of permission is required.
PowerShell Requirements
l
l
l
l

Exchange 2010 must have PowerShell 2.0 installed

Exchange 2013 must have PowerShell 3.0 installed
Permissions must be granted for PowerShell to be accessed
PowerShell 2.0 is required for Windows 2012 (regardless of Exchange version)

For information on configuring PowerShell permissions, see PowerShell

Permissions.
Common Configuration Issues
l

l
l

l
l

l
l

To add local administrative privileges to an Active Directory account, see

Manually Configuring Exchange Server.
To find Exchange URLsettings, see Finding Exchange URL Settings.
To install PowerShell on the Exchange server, see Manually Configuring
Exchange Server
To set the appropriate permissions for PowerShell, see PowerShell Permissions
To create a self-signed certificate, see Manually Configuring Exchange
Server.
To configure WinRM, see Manually Configuring Exchange Server.
To create a firewall rule for WinRM, see Manually Configuring Exchange
Server
To configure IIS, see Manually Configuring Exchange Server
To correct a Non-Domain account configuration error, see Manually Configuring Exchange Server.
To correct a Exchange access configuration error, see Manually Configuring Exchange Server.
To correct a Mailbox Search Access configuration error, see Manually Configuring Exchange Server.

Finding Exchange URL Settings

By default, AppInsight for Exchange uses the following URLs for the Exchange
and WinRM sessions, where ${IP} is the IP address of the server node being
added.
Exchange: [Link]
WinRM: [Link]

569

Chapter 15: AppInsight Applications

To verify the PowerShell instance used by Exchange on a server, follow the
steps listed below:
1. Open IIS Manager.
2. Navigate to the default website, and then navigate to the PowerShell virtual
directory.
3. Click on Advanced Settings, and verify the Virtual Path value.

To verify a server's WinRM PowerShell instance, follow the steps listed

below:
1. Open a command prompt in the Run as Administrator context.
2. Type: winrm get winrm/config/listener?Address=*+Transport=HTTPS to
get the current configuration for the HTTPS protocol.

Note: The two items of interest for the URL are Port and URLPrefix. If either of
these have been modified and do not match the default values, edit the
AppInsight for Exchange application with the correct values.

570

To verify the PowerShell instance used by Exchange on a server, follow the steps

Additionally, the value of Hostname must match the CN of the certificate listed in
the Certificate Thumbprint property.

571

Chapter 15: AppInsight Applications

For more information, see:

l

l
l

To add local administrative privileges to an Active Directory account, see

Manually Configuring Exchange Server.
To find Exchange URLsettings, see Finding Exchange URL Settings.
To install PowerShell on the Exchange server, see Manually Configuring
Exchange Server
To set the appropriate permissions for PowerShell, see PowerShell Permissions
To create a self-signed certificate, see Manually Configuring Exchange
Server.
To configure WinRM, see Manually Configuring Exchange Server.

572

PowerShell Permissions
l

l
l

To create a firewall rule for WinRM, see Manually Configuring Exchange

Server
To configure IIS, see Manually Configuring Exchange Server
To correct a Non-Domain account configuration error, see Manually Configuring Exchange Server.
To correct a Exchange access configuration error, see Manually Configuring Exchange Server.
To correct a Mailbox Search Access configuration error, see Manually Configuring Exchange Server.

PowerShell Permissions
To set the appropriate permissions for PowerShell, follow these steps:
1. On the remote computer, open the PowerShell console.
2. Execute Set-PSSessionConfiguration [Link] -ShowSecurityDescriptorUI -Force The permissions dialog should appear.)
3. Uncheck the Deny check box to enable the Full Control option under the
Permissions for Everyone group, then check Allow.

573

Chapter 15: AppInsight Applications

4. Ensure that the group to which the polling user belongs has access to
Microsoft PowerShell.

5. Click OK.
Note: If PowerShell 2.0 was installed on Windows Server 2012 with Exchange
2013 and subsequently uninstalled, a Microsoft error removes the required
registry key for remote PowerShell to work properly. Security patches or updates
may also cause this issue. You can create the required registry key by following
these instructions:
1. Open Notepad.
2. Copy and paste the following text into Notepad:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_
MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine]
"ApplicationBase"="C:\\Windows\\System32\\WindowsPowerShell
\\v1.0"
"PSCompatibleVersion"="1.0, 2.0"

574

Editing the AppInsight for Exchange Template

"RuntimeVersion"="v2.0.50727"
"ConsoleHostAssemblyName"="[Link]
t, Version=[Link], Culture=neutral,
PublicKeyToken=31bf3856ad364e35,
ProcessorArchitecture=msil"
"ConsoleHostModuleName"="C:\\Windows\\System32\\WindowsPowe
rShell\\v1.0\\[Link]"
"PowerShellVersion"="2.0"
3. Save the file as [Link] then double-click it to add it to the

registry. (A reboot may be required.)

For more information, see: PowerShell.
Editing the AppInsight for Exchange Template
The AppInsight for Exchange application behaves like any other application in
SAM. And like other applications, AppInsight for Exchange's template can be
edited.
Editing the AppInsight for Exchange Template:
1. From the web console, navigate to Settings > SAM Settings > Manage
Templates.
2. Check the AppInsight for Exchange template in the list and then click Edit.
3. From here, you can edit any and all component monitors within the template.

575

Chapter 15: AppInsight Applications

4. When done editing, click Submit at the bottom of the screen.

Attachment Extensions
The following table lists the default attachment extensions that are acknowledged
by AppInsight for Exchange:
.accdb

.doc

.inf

.mmp

.ppt

.swf

.xml

.arj

.dot

.ini

.mobi

.ps1

.tar

.xps

.avi

.eml

.iso

.mov

.pst

.tmp

.zip

.bak

.epub

.jar

.mp3

.pub

.txt

.bat

.flv

.jpg

.mpeg

.psd

.vbs

576

AppInsight for Exchange Alerts

.bin

.gif

.jpeg

.msg

.rar

.wav

.bmp

.gzip

.lnk

.pdf

.reg

.wks

.cab

.hta

.log

.png

.rtf

.wma

.cmd

.htm

.mdb

.pot

.sql

.wmv

.csv

.img

.mid

.pps

.svg

.xls

AppInsight for Exchange Alerts

The following alerts are included with AppInsight for Exchange:
l
l

AppInsight for Exchange: Alert me when a replication status check fails.

AppInsight for Exchange: Alert me when mailbox database file is low on
space.
AppInsight for Exchange: Alert me when mailbox database is in warning or
critical state.
AppInsight for Exchange: Alert me when mailbox database is not on preferred server.
AppInsight for Exchange: Alert me when mailbox database transaction log
is low on space.
AppInsight for Exchange: Notify users that their mailbox is exceeding size
or quota.
AppInsight for Exchange: Warn me when database failover occurs.

To View Alerts:
1. From the web console, navigate to Home >Alerts.

577

Chapter 15: AppInsight Applications

2. Select the alerts you want to view from the dropdown menu:

For more information, see:

l
l

Creating Alerts
Predefined SAM Web Console Based Reports

AppInsight for Exchange Details View

The Exchange Details view provides a great deal of information about the current
Exchange Application. The available resources offered in this view include:
l
l
l
l
l
l
l

Active Alerts
Application Availability
Application Details
Calendar and Resource Booking
Critical Processes and Services
Exchange Event Log Message Details
Exchange Server

578

Active Alerts
l
l
l
l
l
l
l
l
l
l
l
l

Information Store
Mailbox Database Copies
Mailbox Database Size and Space Used
Mailbox Database Status
Mail Database
Management
Replication
Replication Status Checks
Storage
Users By Mailbox Size
Users By % Mailbox Quota Used
Users By Messages Sent

Note: Chart resources require several values for lines on charts to be visible.
Active Alerts
This resource lists details about all unacknowledged active alerts.

The following defines the three columns of this resource:

l
l

Time of Alert: Displays the time and date the listed alert was triggered.
Object Name: Displays the object that triggered the alert. Clicking the
object will take you to the details page for that object.
Message: Displays the message of the listed alert.

Application Availability
This resource graphically shows the various states of an application in a
percentage format and is made up of three sections: the legend, the main chart,
and the lower chart. The colors of the main chart correspond to the labels in the
legend.

579

Chapter 15: AppInsight Applications

Note: This resource may not be available when using Internet Explorer 7/8.
Consider upgrading Internet Explorer or using FireFox or Chrome as your web
browser.
Zooming
You can have the chart show a predetermined, hourly time period of data by
clicking on any one of the three Zoom buttons; 1h, 12h, or 24h. Alternatively, you
can have the chart show a specific time range by dragging the mouse over a
small area of the chart.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders. The main view of the chart will
display the selected time period between the two sliders of the lower chart.
Moving the mouse over the main chart will reveal a tooltip with more detailed
information about the specific time period the mouse is hovering over. By default,
all statistics are shown in the main chart.

580

Application Details
Application Details
This resource provides details concerning the current Exchange application.

The following list defines each field of this resource:

l

l
l

l
l

Application Name: This provides the name of the current application as

well as the name of the node on which it is active. Hovering over the node
name will reveal a detailed tooltip concerning the health of that node.
Status: Displays the current status of the application.
Exchange Server Version: Displays the current version of Exchange that
is being monitored.
Exchange Server Build Number: This is Microsoft's internal versioning
number system that indicates the version of Exchange installed. For more
information, refer to this article: [Link]
Exchange Domain: The domain of the listed Exchange server.
Database Availability Group (DAG): This contains information pertaining
to the DAG of which the local node belongs.
l DAG Name: Name of the listed Database Availability Group.
l Other Exchange Servers in DAG: Lists additional Exchange servers
in the current DAG.
l File Share Witness: The File Share Witness (FSW) is the quorum directory for the DAG Cluster. It is used to provide a majority node set in
a DAG with an even number of members. In a DAG with an odd number of members, the FSW still exists, but is not used to determine a
majority node set. For additional information, see: [Link]

581

Chapter 15: AppInsight Applications

Witness Share in use: This is the current witness share in use.

Note: This field may be replaced with the Alternate File Share Witness field.
(Alternate File Share Witness): The Alternate FSW is used when the
primary site with the FSW has failed. To use the Alternate FSW
requires manual intervention from the Exchange administrator.
Note: This field may be replaced with the Witness Share in use field.

Calendar and Resource Booking

This resource contains performance counters specific to the status of calendar
and resource booking. The icons of the listed performance counters in the
Statistic Name column will change color to reflect the listed counter's current
state. Clicking any performance counter in the Statistic Name column will take
you to the Performance Counter Details page for that counter.
If the value of a listed counter crosses the Warning threshold, the chart for the
listed monitor will display a yellow background. If the value of a listed
performance counter crosses the Critical threshold, the chart will display a red
background. Hovering over any time period within the chart will display detailed
information about that time period in the tooltip.
Calendaring is method of creating, changing, deleting, accepting, or declining a
meeting via an email message. Resource booking is an automated process of
creating, changing, and deleting calendar requests for resource mailboxes. The
Calendar and Resource Booking Attendant are the processes used by Exchange
to fulfill requests for each. Once a request has been accepted, the free/busy data
for the mailbox is updated.

582

Calendar and Resource Booking

The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:
Counter

Expert Knowledge

Warning Critical

Average
Resource
Booking
Processing
Time

Definition:
Shows the average time to process an event in
the Resource Booking Attendant.

> 100
> 100
ms for 5 ms for
polls
15
polls

Information:
Should be a low value at all times.
Possible problems:
High values may indicate a performance
bottleneck.
Remediation:
Check Memory andCPU status for any
[Link] event logs for related events
examining log entries for each Assistants
Infrastructure and its corresponding assistant.
Use the Exchange Troubleshooting Assistant
(ExTRA) to obtain Event Tracing for Windows
traces.

Resource
Booking
Requests
Failed

Definition:
Shows the total number of failures that occurred
while the Resource Booking Attendant was
processing events.
Information:
Should be 0 at all times.
Possible problems:
Meeting Room bookings or updates may not be
processed for some users.
Remediation:
Review event logs for related events examining
log entries for each Assistants Infrastructure and
its corresponding assistant. Use the Exchange
Troubleshooting Assistant (ExTRA) to obtain

583

>0

> 0 for
15
polls

Chapter 15: AppInsight Applications

Event Tracing for Windows traces. Verify your

resource mailboxes are properly configured.
Average
Calendar
Attendant
Processing
Time

Definition:
Shows the average time to process an event in
the Calendar Attendant.
Information:
Should be a low value at all times.

> 100
> 100
ms for 5 ms for
polls
15
polls

Possible problems:
High values may indicate a performance
bottleneck.
Remediation:
Check Memory andCPU for any bottlenecks.
Review event logs for related events examining
log entries for each Assistants Infrastructure and
its corresponding assistant. Use the Exchange
Troubleshooting Assistant (ExTRA) to obtain
Event Tracing for Windows traces.
Calendar
Attendant
Requests
Failed

Definition:
Shows the total number of failures that occurred
while the Calendar Attendant was processing
events.
Information:
Should be 0 at all times.
Possible problems:
Automated calendaring activities may not
function for some users.
Remediation:
Review event logs for related events examining
log entries for each Assistants Infrastructure and
its corresponding assistant. Use the Exchange
Troubleshooting Assistant (ExTRA) to obtain
Event Tracing for Windows traces. Verify your
resource mailboxes are properly configured.

Zooming

584

>0

> 0 for
15
polls

Critical Processes and Services

You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Notes:
l

Additional components on certain resources may be available for addition

and/or deletion on the Edit page.
The Value from Last Poll column shows the most recent data available for
the listed statistic.

Critical Processes and Services

This resource numerically and graphically shows metrics concerning the
Exchange's critical processes and services. The icons of the listed component in
the Component Name column will change color to reflect the listed counter's
current state. Clicking any component in the Component Name column will take
you to the Component Details page for that component.
If the value of the listed component crosses the Warning threshold, the icon for the
listed component will become yellow. If the value of the listed component crosses
the Critical threshold, the icon for the listed component will become red.

The following list defines each column of this resource:

l
l

Component Name: Display name of the listed component.

Process Name (ID): Service name of the listed process or service with its
identification number.

585

Chapter 15: AppInsight Applications

CPU Load: This graphically and numerically represents the percentage of

CPU resources currently being used by the listed process.
Memory Used:
l Physical: This graphically and numerically represents the percentage
of physical memory (RAM) currently being used by the listed process.
l Virtual: This graphically and numerically represents the percentage of
virtual memory currently being used by the listed process.
IOPS: Displays the current total read and write I/O (Input/Output) operations
occurring for the current process per second.

The following tables list all possible processes and services:

Exchange 2010 Services/Processes
DisplayName Description
Microsoft
Exchange
Active
Directory
Topology

Provides Active Directory topology information to Exchange

services. If this service is stopped, most Exchange services are
unable to start. This service has no dependencies.

Microsoft
Exchange
Information
Store

Manages the Exchange Information Store. This includes

mailbox databases and public folder databases. If this service is
stopped, mailbox databases and public folder databases on this
computer are unavailable. If this service is disabled, any
services that explicitly depend on it will fail to start. This service
is dependent on the RPC, Server, Windows Event Log, and
Workstation services.

Microsoft
Exchange
Mail
Submission

Submits messages from the Mailbox server to Exchange 2010

Hub Transport servers. This service is dependent upon the
Microsoft ExchangeActive Directory Topology service.

Microsoft
Exchange
Mailbox
Assistant

Performs background processing of mailboxes in the Exchange

store. This service is dependent upon the Microsoft
ExchangeActive Directory Topology service.

Microsoft
Exchange
Monitoring

Allows applications to call the Exchange diagnostic cmdlets.

This service has no dependencies.

586

Critical Processes and Services

Microsoft
Exchange
Replication

Provides replication functionality for mailbox databases on

Mailbox servers in a database availability group (DAG) and
database mount functionality for all Mailbox servers. This
service is dependent upon the Microsoft ExchangeActive
Directory Topology service.

Microsoft
Exchange
RPC Client
Access

Manages client RPC connections for Exchange. This service is

dependent upon the Microsoft ExchangeActive Directory
Topology service.

Microsoft
Exchange
Search
Indexer

Drives indexing of mailbox content, which improves the

performance of content search. This service is dependent upon
the Microsoft ExchangeActive Directory Topology and Microsoft
Search (Exchange Server) services.

Microsoft
Enables Windows Server Backup users to back up and recover
Exchange
application data for Microsoft Exchange. This service has no
Server
dependencies.
Extension for
Windows
Server Backup
Microsoft
Exchange
Service Host

Provides a host for several Microsoft Exchange services. On

internal server roles, this service is dependent upon the
Microsoft ExchangeActive Directory Topology service.

Microsoft
Exchange
System
Attendant

Forwards directory lookups to a global catalog server for legacy

Outlook clients, generates e-mail addresses and OABs, updates
free/busy information for legacy clients, and maintains
permissions and group memberships for the server. If this
service is disabled, any services that explicitly depend on it will
fail to start. This service is dependent on the RPC, Server,
Windows Event Log, and Workstation services.

Microsoft
Exchange
Throttling

Limits the rate of user operations. This service is dependent

upon the Microsoft ExchangeActive Directory Topology service.

Microsoft
Exchange

Provides remote search capability for Microsoft Exchange

Transport log files. This service is dependent upon the Microsoft

587

Chapter 15: AppInsight Applications

Transport Log ExchangeActive Directory Topology service.

Search
Microsoft
Search
(Exchange)

This is a Microsoft Exchange-customized version of Microsoft

Search. Quickly creates full-text indexes on content and
properties of structured and semi-structured data to allow fast
linguistic searches on this data. This service is dependent on
the RPC service.

Exchange 2013 Services/Processes

DisplayName Description
Microsoft
Exchange
Active
Directory
Topology

Provides Active Directory topology information to Exchange

services. If this service is stopped, most Exchange services
are unable to start. This service is dependent on the [Link]
Port Sharing Service.

Microsoft
Exchange
Anti-spam
Update

The Microsoft Forefront Protection 2010 for Exchange Server

anti-spam update service. This service is dependent upon the
Microsoft ExchangeActive Directory Topology service.

Microsoft
Exchange
Mailbox
Transport
Delivery

This service, running on the Mailbox servers, receives mail

items fromthe ExchangeTransport service, submits them to
extension modules for processing and commits them into
mailbox [Link] service is dependent upon the
Microsoft ExchangeActive Directory Topology service.

Microsoft
Exchange
Diagnostics

Agent that monitors server [Link] service has no

dependencies.

Microsoft
Exchange
EdgeSync

Replicates configuration and recipient data from the Hub

Transport servers to the Edge Transport servers. This service
is dependent upon the Microsoft ExchangeActive Directory
Topology service.

Exchange
Search

Drives indexing and querying of data for Exchange. This

588

Critical Processes and Services

service is dependent upon the Microsoft ExchangeActive

Directory Topology service.
Microsoft
Exchange
Health
Manager

Manages Exchange server health. This service is dependent

on the Windows Event Log service.

Microsoft
Exchange
IMAP4
Backend

Provides Internet Message Access Protocol service to

mailboxes. If this service is stopped, mailboxes on this server
cannot be accessed using the IMAP4 protocol. This service is
dependent upon the Microsoft ExchangeActive Directory
Topology service.

Microsoft
Exchange
Information
Store

This process controls all of the Store Worker processes. If a

DB is dismounted, it is responsible for terminating the
associated Store Worker process and if a DB is mounted, it
starts a new Store Worker process. If this service is disabled,
any services that explicitly depend on it will fail to start. This
service is dependent on the Microsoft ExchangeActive
Directory Topology,RPC, Server, Windows Event Log, and
Workstation services.

N/A

Each database hosted on a server will create a separate

process for each one. This process performs the same work
as the '[Link] process did in previous versions, just on an
individual DB basis. This process is dependent on the
Microsoft Exchange Information Store service.

Microsoft
Exchange
Mailbox
Assistant

Performs background processing of mailboxes in the

Exchange store. This service is dependent upon the Microsoft
ExchangeActive Directory Topology service.

Microsoft
Exchange
Mailbox
Replication

Processes mailbox move requests. This service is dependent

on the Microsoft ExchangeActive Directory Topology and
[Link] Port Sharing services. This service is dependent
upon the Microsoft ExchangeActive Directory Topology
service.

589

Chapter 15: AppInsight Applications

Microsoft
Exchange
Monitoring

Allows applications to call the Exchange diagnostic cmdlets.

This service has no dependencies.

Microsoft
Exchange
POP3
Backend

Provides Post Office Protocol version 3 service to mailboxes.

If this service is stopped, mailboxes on this server cannot be
accessed using the POP3 protocol.

Microsoft
Exchange
Replication

Provides replication functionality for mailbox databases on

Mailbox servers in a database availability group (DAG) and
database mount functionality for all Mailbox servers. This
service is dependent upon the Microsoft ExchangeActive
Directory Topology service.

Microsoft
Exchange
RPC Client
Access

Manages client RPC connections for Exchange. This service

is dependent upon the Microsoft ExchangeActive Directory
Topology service.

Microsoft
Enables Windows Server Backup users to back up and
Exchange
recover application data for Microsoft Exchange. This service
Server
has no dependencies.
Extension for
Windows
Server Backup
Microsoft
Exchange
Search Host
Controller

This service provides host level deployment and management

services for applications. This service is dependent upon the
HTTP service.

Microsoft
Exchange
Service Host

Provides a host for several Exchange services. On internal

server roles, this service is dependent upon the Microsoft
ExchangeActive Directory Topology service.

Microsoft
Exchange
Mailbox

This service, running on the Mailbox servers, receives the

Submit events, processes the messages by converting them
from MAPI to MIME and hands them over to theExchange

590

Exchange Event Log Message Details

Transport
Submission

Transport service. This service is dependent upon the

Microsoft ExchangeActive Directory Topology service.

Microsoft
Exchange
Throttling

Limits the rate of user operations. This service is dependent

upon the Microsoft ExchangeActive Directory Topology
service.

Microsoft
Exchange
Transport

Acts as a middle man and routes messages between Mailbox

Transport Submission service and the Front End Transport
service. It is identical to the Hub Transport Server role in
Exchange 2010. Never contacts the mailbox databases
directly. This service is dependent upon the Microsoft
ExchangeActive Directory Topology and Microsoft Filtering
Management services.

Microsoft
Exchange
Transport Log
Search

Provides remote search capability for Microsoft Exchange

Transport log files. This service is dependent upon the
Microsoft ExchangeActive Directory Topology service.

Microsoft
Exchange
Unified
Messaging

Enables Microsoft Exchange Unified Messaging features.

This allows voice and fax messages to be stored in Microsoft
Exchange and gives users telephone access to e-mail, voice
mail, calendar, contacts, or an auto attendant. If this service is
stopped, Unified Messaging is not available. This service is
dependent upon the Microsoft ExchangeActive Directory
Topology service.

Exchange Event Log Message Details

This resource displays the Exchange event log messages while providing a
search window and a filter. The filter allows you to choose which types of log
messages you want to display. The data can be sorted by clicking the headers of
each column. This resource shows Error, Warning, Information, Security Audit
Success, and Security Audit Failure events specific to the monitored Exchange
server.

591

Chapter 15: AppInsight Applications

Clicking any event message in the list will open a new window, displaying the
entire message, as shown below:

Exchange Server
This resource contains performance counters specific to the current status of the
Exchange Server. The icons of the listed performance counters in the Statistic
Name column will change color to reflect the listed counter's current state.
Clicking any performance counter in the Statistic Name column will take you to
the Performance Counter Details page for that counter.
If the value of a listed performance counters crosses the Warning threshold, the
chart for the listed counter will display a yellow background. If the value of a listed
counter crosses the Critical threshold, the chart will display a red background.

592

Exchange Server
Hovering over any time period within the chart will display detailed information
about that time period in the tooltip.

The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:
Counter

Expert Knowledge

Warning Critical

RPC
Requests
failed (%)

Definition:
>1
Shows the percentage of failed requests in the
total number of RPC requests. Failed means
the sum of failed with error code plus failed with
exception.
Information:
Should be less than 1 at all times
Possible problems:
Users may report slow performance,
disconnects, or failures within their client
performing certain activities.
Remediation:
Review the Windows Event logs for any related
events. Use ExBPA to perform a Health scan of
your server and review any issues [Link]
Exchange 2010, verify SP1 or higher has been

593

> 1 for
15
polls

Chapter 15: AppInsight Applications

installed on your system.

RPC
Definition:
Requests
Shows thecurrent number of outstanding RPC
Outstanding requests.

>0

> 0 for
15
polls

> 100
ms

> 100
ms for
15
polls

N/A

N/A

Information:
Should be 0 at all times.
Possible problems:
Server may stop accepting RPC requests.
Remediation:
Review the Windows Event logs for any related
events. Use ExBPA to perform a Health scan of
your server and review any issues reported.
Use Exchange Server User Monitor application
to review user [Link] Exchange 2010,
verify SP1 or higher has been installed on your
system.
RPC
Latency
Average
(msec)

Definition:
Shows the average latency, in ms, of RPC
requests. The average is calculated over all
RPCs since exrpc32 was loaded.
Information:
The average is calculated over all RPCs since
exrpc32 was loaded. Should be less than 100
ms at all times.
Possible problems:
Users may report slow performance issues.
Remediation:
If the disk subsystem is not meeting demand,
correcting the problem may require additional
disks, faster disks, or modifying the disk
configuration.

RPC
Requests
sent/sec

Definition:
RPC Requests sent/sec is the current rate of
initiated RPC requests per second.

594

Exchange Server
Information:
Used for determining current load.
RPC Slow
requests
latency
average
(msec)

Definition:
Shows the average latency, in ms, of slow
requests.

N/A

N/A

>1

>1 for
15
polls

N/A

N/A

Information:
Used for determining the average latencies of
RPC slow requests.
Possible problems:
Client disconnects or slow performance issues.
Remediation:
Review the Windows Event logs for any related
events. Use ExBPA to perform a Health scan of
your server and review any issues [Link]
Exchange 2010, verify SP1 or higher has been
installed on your system.

RPC Slow Definition:

requests (%) RPC Slow requests (%) is the percent of slow
RPC requests among all RPC requests.
Information:
A slow RPC request is one that has taken more
than 500 [Link] be less than 1 at all times.
Possible problems:
Client disconnects or slow performance issues.
Remediation:
Review the Windows Event logs for any related
events. Use ExBPA to perform a Health scan of
your server and review any issues [Link]
Exchange 2010, verify SP 1 or higher has been
installed on your system.
ROP
Definition:
Requests
ROP Requests outstanding shows the total
Outstanding number of outstanding remote operations
requests.

595

Chapter 15: AppInsight Applications

Information:
Used for determining current load.
Hub Servers Definition:
In Retry
Shows the number of Hub Transport servers in
retry mode.
(Only

> 0.99

>1

> 30

> 30 for
15
polls

available in Information:
Exchange
Should be 0 at all times.
2010)
Possible problems:
Domain where you send large amount of email
is unavailable, infected machine on network
sending messages, DNS resolution issues, or
network connectivity to destination servers or
the internet.
Remediation:
Determine the root cause and verify there aren't
any network connectivity issues.
Average
Document
Processing
Time In
Milliseconds

Definition:
Shows the average, in ms, of how long it takes
to index documents.
Information:
Should be less than 30 seconds at all times.
Possible problems:
Verify content index state of all database
copies.
Remediation:
For any database indexes not "healthy," update
the content Index on the server using the
following command: UpdateMailboxDatabaseCopy <DBName> -CatalogOnly

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows

596

Information Store
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Notes:
l

Additional components on certain resources may be available for addition

and/or deletion on the Edit page.
The Value from Last Poll column shows the most recent data available for
the listed statistic.

Information Store
This resource contains performance counters specific to the status of the current
Information Store. The icons of the listed performance counters in the Statistic
Name column will change color to reflect the listed counter's current state.
Clicking any performance counter in the Statistic Name column will take you to
the Performance Counter Details page for that counter.
If the value of a listed counter crosses the Warning threshold, the chart for the
listed monitor will display a yellow background. If the value of a listed
performance counter crosses the Critical threshold, the chart will display a red
background. Hovering over any time period within the chart will display detailed
information about that time period in the tooltip.
The Exchange Information Store is a storage platform that is used to manage
numerous types of information within an Exchange server deployment.

The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:

597

Chapter 15: AppInsight Applications

Counter

Expert Knowledge

Warning Critical

Connection Definition:
Count
Is the total number of client connections
maintained.
(Only

N/A

N/A

N/A

N/A

> 100
ms

> 100
ms for

available in Information:
Exchange This is used to determine current load of the
2013)
server's Information Store.
Possible problems:
May cause memory bottlenecks on the server if
the number is excessively high.
Remediation:
Reduce the number of user mailboxes hosted on
the server or increase available resources.
Active User Definition:
Count
Number of user connections that have shown
some activity in the last2 minutes.
Information:
Used to determine current user load on the
server. Each active user will typically start up to
5 active sessions (connections)on a server,in
order to sync variousservices.
Possible problems:
May cause memory bottlenecks on the server if
the number is excessively high.
Remediation:
Determine if users are running applications not
required for business use, and request they do
not run these applications which is causing an
increase in server logons. If this does not help,
or is not possible, reduce the number ofusers
hosted on the server and move any Public
Folders on the server to a different server.
RPC
Averaged

Definition:
Indicates the RPC latency, in ms, averaged for

598

Information Store
Latency

all operations in the last 1,024 packets.

15
polls

Information:
For information about how clients are affected
when overall server RPC averaged latencies
increase, see Understanding Client Throttling
Policies at [Link] Should not be higher
than 100 ms on average.
Possible problems:
To determine if certain protocols are causing
overall RPC latencies, monitor MSExchangeIS
Client (*)\RPC Average Latency to separate
latencies based on client protocol.
Remediation:
Faster disks, more disks, or redesigning existing
disk arrays.
RPC
Requests

Definition:
Indicates the overall RPC requests currently
executing within the information store process.

> 70

> 70 for
15
polls

N/A

N/A

Information:
Should be below 70 at all times.
Possible problems:
When I/O counters fall outside of normal range,
client performance is directly impacted. For
example, Outlook and Outlook Web App (OWA)
users will report Outlook is slow when opening
mail or moving between folders.
Remediation:
Faster disks, more disks, or redesigning existing
disk arrays.
Active
Definition:
Connection Number of connections that have shown some
Count
activity in the last 10 minutes.
(Only

Information:

599

Chapter 15: AppInsight Applications

available in This is used to determine current load of the

Exchange server's Information Store.
2010)
Possible problems:
May cause memory bottlenecks on the server if
the number is excessively high.
Remediation:
Reduce the number of user mailboxes hosted on
the server or increase available resources.
Client:
RPCs
Failed:
Server too
busy/sec

Definition:
Shows the client-reported rate of failed RPCs
(since the store was started) due to the Server
Too Busy ROC error.

> 0 for 5 > 0 for

polls
15
polls

Information:
Should be 0 at all times.

(Only
available in Possible problems:
Exchange Higher values may indicate RPC threads are
2010)
exhausted or client throttling is occurring for
clients running versions of Outlook earlier than
Microsoft Office Outlook 2007. This can cause
user mail clients experiencing slowness.
Remediation:
Check if RPC latencies are high and determine
the cause of the performance issue (e.g. poorly
performing disk I/O, excessive load, insufficient
memory, high number of users).
RPC Client Definition:
Backoff/sec The rate at which the server notifies a client to
withdraw (backoff).
(Only
available in Information:
Exchange Indicates the rate at which client backoffs are
2010)
occurring.
Possible problems:
Higher values may indicate that the server may
be incurring a higher load resulting in an

600

N/A

N/A

Information Store
increase in overall averaged RPC latencies,
causing client throttling to occur. This can also
occur when certain client user actions are being
performed. Depending on what the client is
doing and the rate at which RPC operations are
occurring, it may be normal to see backoffs
occurring.
Remediation:
Check if RPC latencies are high and determine
the cause of the performance issue (e.g. poorly
performing disk I/O, excessive load, insufficient
memory, high number of users).
Active
Client
Logons

Definition:
N/A
Number of logons that have been active (issued
any MAPI requests) within the last10 minute
time interval.

N/A

(Only
available in Information:
Exchange Active client logons can be high if users are
2010)
logging on and logging off frequently.

Possible problems:
May cause memory bottlenecks on the server if
the number is excessively high.
Remediation:
Determine if users are running applications not
required for business use, and request they do
not run these applications which is causing an
increase in server logons. If this does not help,
or is not possible, reduce the number of server
hosted on the server and move any Public
Folders on the server to a different server.
Messages Definition:
Queued for Shows the current number of submitted
Submission messages not yet processed by the transport
layer.
(Only
available in Information:

601

>50

> 50 for
15
polls

Chapter 15: AppInsight Applications

Exchange
2010)

The queues should remain below 50 at any

given time. Anything above this amount should
be cleared within 15 minutes.
Possible problems:
Mailbox server is not communicating properly
with the transport server.
Remediation:
Verify network connectivity and transport server
functionality.

Slow
FindRow
Rate

Definition:
Shows the rate at which the slower FindRow
needs to be used in the mailbox store.

(Only
available in
Exchange
2010)

Information:
Should be no more than 10 for any specific
mailbox store.
Possible problems:
Higher values indicate applications are crawling
or searching mailboxes, which is affecting server
performance. These include desktop search
engines, customer relationship management
(CRM), or other third-party applications.
Remediation:
Run the ResetSearchIndex.ps1 script which is
located in the scripts directory at the root of the
Exchange installation. Alternatively, you can
perform the process manually:
1. Rebuild the index catalog using: UpdateMailboxDatabaseCopy <DBName> -CatalogOnly

command.
2. Stop the Microsoft Exchange Search Service.
3. Delete old catalog files.
4. Restart Microsoft Exchange Search Service.
Zooming

602

N/A

N/A

Mailbox Database Copies

You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Notes:
l

Additional components on certain resources may be available for addition

and/or deletion on the Edit page.
The Value from Last Poll column shows the most recent data available for
the listed statistic.

Mailbox Database Copies

This resource shows the status of the Exchange mailbox database copies. The
data can be sorted by clicking the headers of each column.
Hovering over any Database Name in the list will display detailed information
about that database in the tooltip. Hovering over the node will provide a tooltip
with information about that node.

The following list defines each column of this resource:

l
l

Database Name: Name of the listed database copy.

Copy Status: Displays the status of the listed database copy. (See Table 1
below for possible statuses.)
Content Index State: See the following table for returned status descriptions. (See Table 2 below for possible statuses.)
Exchange Server: Name of the Exchange application and the node it is on.

Table 1.
Mounted

The active copy is online and accepting client connections. Only

the active copy of the mailbox database copy can have a copy
status of Mounted.

603

Chapter 15: AppInsight Applications

Mounting

The active copy is coming online and not yet accepting client
connections. Only the active copy of the mailbox database copy
can have a copy status of Mounting.

Dismounting

The active copy is going offline and terminating client

connections. Only the active copy of the mailbox database copy
can have a copy status of Dismounting.

Dismounted

The active copy is offline and not accepting client connections.

Only the active copy of the mailbox database copy can have a
copy status of Dismounted.

Seeding

The mailbox database copy is being seeded, the content index

for the mailbox database copy is being seeded, or both are being
seeded. Upon successful completion of seeding, the copy status
should change to Initializing.

Seeding
Source

The mailbox database copy is being used as a source for a

database copy seeding operation.

Initializing

The mailbox database copy is in an Initializing state when a

database copy has been created, when the Microsoft Exchange
Replication service is starting or has just been started, and
during transitions from Suspended, Service Down, Failed,
Seeding, or Single Page Restore to another state. While in this
state, the system is verifying that the database and log stream are
in a consistent state. In most cases, the copy status will remain in
the Initializing state for about 15 seconds, but in all cases, it
should generally not be in this state for longer than 30 seconds.

ReThe mailbox database copy and its log files are being compared
synchronizing with the active copy of the database to check for any divergence
between the two copies. The copy status will remain in this state
until any divergence is detected and resolved.
Single Page
Restore

This state indicates that a single page restore operation is

occurring on the mailbox database copy.

Failed

The mailbox database copy is in a Failed state because it is not

suspended, and it is not able to copy or replay log files. While in
a Failed state and not suspended, the system will periodically

604

Mailbox Database Copies

check whether the problem that caused the copy status to
change to Failed has been resolved. After the system has
detected that the problem is resolved, and barring no other
issues, the copy status will automatically change to Healthy.
Service
Down

The Microsoft Exchange Replication service is not available or

running on the server that hosts the mailbox database copy.

Suspended

The mailbox database copy is in a Suspended state as a result of

an administrator manually suspending the database copy by
running the Suspend-MailboxDatabaseCopy cmdlet.

Healthy

The mailbox database copy is successfully copying and

replaying log files, or it has successfully copied and replayed all
available log files.

Disconnected The mailbox database copy is no longer connected to the active

and Healthy database copy, and it was in the Healthy state when the loss of
connection occurred. This state represents the database copy
with respect to connectivity to its source database copy. It may be
reported during DAG network failures between the source copy
and the target database copy.
Disconnected The mailbox database copy is no longer connected to the active
and Redatabase copy, and it was in the Re-synchronizing state when
synchronizing the loss of connection occurred. This state represents the
database copy with respect to connectivity to its source database
copy. It may be reported during DAG network failures between
the source copy and the target database copy.
Failed and
Suspended

The Failed and Suspended states have been set simultaneously

by the system because a failure was detected, and because
resolution of the failure explicitly requires administrator
intervention. An example is if the system detects unrecoverable
divergence between the active mailbox database and a database
copy. Unlike the Failed state, the system will not periodically
check whether the problem has been resolved, and automatically
recover. Instead, an administrator must intervene to resolve the
underlying cause of the failure before the database copy can be
transitioned to a healthy state.

605

Chapter 15: AppInsight Applications

Table 2.
State

Description

Status
on
Active &
Passive
Copies

Crawling

Database is in the process of indexing database content. Warning

Depending on the size of the database, this process
could take some time to complete.

Disabled

Indexingforthe database has been disable by an

administrator.

Offline
(Active)
N/A
(Passive)

Failed

An error has occurred causing the content index to fail.

Critical

Failed and The Failed and Suspended states have been set
Suspended simultaneously by the system because a failure was
detected, and because resolution of the failure explicitly
requires administrator intervention.

Critical

Healthy

This indicates the Content Index is up to date and has

Up
not detected any issues. This is the only state in which a
failover (automatic process)to a specific database copy
can occur.

Seeding

A database copy is in the process of updating its Content Up

Index from another database copy.

Suspended The Suspended status occurs if an administrator manually pauses or suspends it from receiving updates from
the active copy. This might be done to update a failed
Content Index or to perform troubleshooting for other
issues.

Warning

Mailbox Database Size and Space Used

This resource numerically and graphically shows metrics concerning the
Exchange mailbox database size. The data can be sorted by clicking the headers
of each column.

606

Mailbox Database Status

Hovering over any Database Name in the list will display detailed information
about that database in the tooltip. Clicking any database in the Database column
will take you to the Database Details page for that database.

The following list defines each column of this resource:

l
l
l

l
l

Database Name: Name of the listed database.

Database Size: Size of the listed database.
White Space: The amount of space available at the root of a database for
new mailboxes before the file size increases.
Space Usage: This graphically represents used data of the database, white
space of the database, and free space on the volume, respectively.
Total Mailboxes: The total number of mailboxes on the listed database.
Average Mailbox Size: The average size of an individual mailbox.

Mailbox Database Status

This resource provides details concerning the status of the current mailbox
database being monitored by the application.

607

Chapter 15: AppInsight Applications

l
l

Database Name: Name of the listed database.

Copy Status: Displays the status of the active database. The table below
provides the possible status with its definition:
Mounted

The active copy is online and accepting client connections.

Only the active copy of the mailbox database copy can
have a copy status of Mounted.

Mounting

The active copy is coming online and not yet accepting

client connections. Only the active copy of the mailbox

608

Mailbox Database Status

database copy can have a copy status of Mounting.
Dismounting

The active copy is going offline and terminating client

connections. Only the active copy of the mailbox database
copy can have a copy status of Dismounting.

Dismounted

The active copy is offline and not accepting client

connections. Only the active copy of the mailbox database
copy can have a copy status of Dismounted.

Seeding

The mailbox database copy is being seeded, the content

index for the mailbox database copy is being seeded, or
both are being seeded. Upon successful completion of
seeding, the copy status should change to Initializing.

Seeding
Source

The mailbox database copy is being used as a source for a

database copy seeding operation.

Initializing

The mailbox database copy is in an Initializing state when

a database copy has been created, when the Microsoft
Exchange Replication service is starting or has just been
started, and during transitions from Suspended,
ServiceDown, Failed, Seeding, or SinglePageRestore to
another state. While in this state, the system is verifying that
the database and log stream are in a consistent state. In
most cases, the copy status will remain in the Initializing
state for about 15 seconds, but in all cases, it should
generally not be in this state for longer than 30 seconds.

ReThe mailbox database copy and its log files are being
synchronizing compared with the active copy of the database to check for
any divergence between the two copies. The copy status
will remain in this state until any divergence is detected and
resolved.
Single Page
Restore

This state indicates that a single page restore operation is

occurring on the mailbox database copy.

Failed

The mailbox database copy is in a Failed state because it

isnot suspended, and it isnot able to copy or replay log
files. While in a Failed state and not suspended, the system
will periodically check whether the problem that caused the

609

Chapter 15: AppInsight Applications

copy status to change to Failed has been resolved. After

the system has detected that the problem is resolved, and
barring no other issues, the copy status will automatically
change to Healthy.
Service
Down

The Microsoft Exchange Replication service isnot available

or running on the server that hosts the mailbox database
copy.

Suspended

The mailbox database copy is in a Suspended state as a

result of an administrator manually suspending the
database copy by running the SuspendMailboxDatabaseCopy cmdlet.

Healthy

The mailbox database copy is successfully copying and

replaying log files, or it has successfully copied and
replayed all available log files.

Disconnected The mailbox database copy is no longer connected to the

and Healthy active database copy, and it was in the Healthy state when
the loss of connection occurred. This state represents the
database copy with respect to connectivity to its source
database copy. It may be reported during DAG network
failures between the source copy and the target database
copy.
Disconnected The mailbox database copy is no longer connected to the
and Reactive database copy, and it was in the Re-synchronizing
synchronizing state when the loss of connection occurred. This state
represents the database copy with respect to connectivity to
its source database copy. It may be reported during DAG
network failures between the source copy and the target
database copy.
Failed and
Suspended

The Failed and Suspended states have been set

simultaneously by the system because a failure was
detected, and because resolution of the failure explicitly
requires administrator intervention. An example is if the
system detects unrecoverable divergence between the
active mailbox database and a database copy. Unlike the
Failed state, the system will not periodically check whether

610

Mailbox Database Status

the problem has been resolved, and automatically recover.
Instead, an administrator must intervene to resolve the
underlying cause of the failure before the database copy
can be transitioned to a healthy state.
l

Copy Queue Length: The copy queue length is an integer indicating number of files. The Copy Queue Length shows the number of transaction log
files waiting to be copied to the passive copy log file folder. A copy is not
considered complete until it has been checked for corruption.
Replay Queue Length: The Replay Queue Length shows the number of
transaction log files waiting to be replayed into the passive copy.
Last Inspected Log Time: This is the date and time when the last log file
was verified (inspected) by the LogInspector for a particular database after
being copied from the active copy. This field is only relevant for passive copies of a database.
Content Index State: See the following table for returned status descriptions.
State

Description

Status
on
Active &
Passive
Copies

Crawling

Database is in the process of indexing database

content. Depending on the size of the database,
this process could take some time to complete.

Warning

Disabled

Indexingforthe database has been disable by an

administrator.

Offline
(Active)
N/A
(Passive)

Failed

An error has occurred causing the content index to Critical

fail.

Failed and The Failed and Suspended states have been set
Critical
Suspended simultaneously by the system because a failure
was detected, and because resolution of the failure
explicitly requires administrator intervention.

611

Chapter 15: AppInsight Applications

Healthy

This indicates the Content Index is up to date and Up

has not detected any issues. This is the only state
in which a failover (automatic process)to a specific
database copy can occur.

Seeding

A database copy is in the process of updating its

Content Index from another database copy.

Up

Suspended The Suspended status occurs if an administrator

Warning
manually pauses or suspends it from receiving
updates from the active copy. This might be done to
update a failed Content Index or to perform
troubleshooting for other issues.
l

Activation Preference: Indicates which database copy has preference over

another copy. It is used as part of the formula to determine which database
copy will become active during a failover. The value can range from 1 to 16
depending on the number of servers in the DAG. The lower the number, the
higher the preference.

Mail Database
This resource contains performance counters specific to the status of the current
Mail Database. The icons of the listed performance counters in the Statistic Name
column will change color to reflect the listed counter's current state. Clicking any
performance counter in the Statistic Name column will take you to the
Performance Counter Details page for that counter.
If the value of a listed counter crosses the Warning threshold, the chart for the
listed monitor will display a yellow background. If the value of a listed
performance counter crosses the Critical threshold, the chart will display a red
background. Hovering over any time period within the chart will display detailed
information about that time period in the tooltip.

612

Mail Database

The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:
Counter Expert Knowledge
Database
Cache
Size
(MB)

Warning Critical

Definition:
N/A
Shows the amount of system memory, used by the
database cache manager to hold commonly used
information from the database files to prevent file
operations.
Information:
This and Database Cache Hit % are useful
counters for gauging whether a server's
performance problems might be resolved by
adding more physical memory. Use this counter
along with store private bytes to determine if there
are store memory leaks.
Possible problems:
Situation when the database cache size seems too
small for optimal performance and there is little
available memory on the system (check the value
of Memory/Available Bytes) could negatively
impact on performance. If there is ample memory

613

N/A

Chapter 15: AppInsight Applications

on the system and the database cache size is not

growing beyond a certain point, the database
cache size may be capped at an artificially low
limit. Increasing this limit may increase
performance.
Remediation:
Adding more memory to the system and/or
increasing database cache size may increase
performance.
Database
Page
Fault
Stalls/sec

Definition:
> 0
Shows the rate that database file page requests
require of the database cache manager to allocate
a new page from the database cache.

> 0 for
15
polls

Information:
Should be 0 at all times.
Possible problems:
If this value is nonzero, this indicates that the
database is not able to flush dirty pages to the
database file fast enough to make pages free for
new page allocations.
Remediation:
If the disk subsystem is not meeting demand,
correcting the problem may require additional
disks, faster disks, or modifying the disk
configuration.
Version Definition:
Buckets Shows the total number of version buckets
Allocated allocated.
Information:
Should be less than 12,000 at all times. The
maximum default version is 16,384. If version
buckets reach 70% of maximum, the server is at
risk of running out of the version store.
Possible problems:

614

> 11500 >

12000

Mail Database
Typically indicates a database transaction which is
taking a long time to save to disk. During Online
DB defrags, the version buckets may increase.
Remediation:
Verify if the server has any applications running
that have a long running transaction which has not
been saved to disk, causing the version store
memory resource to be exhausted.
Log
Definition:
Record
Shows the number of log records that can't be
Stalls/sec added to the log buffers per second because the
log buffers are full. If this counter is nonzero for a
long period of time, the log buffer size may be a
bottleneck.

> 10for > 10 for

15polls 60
polls

Information:
The average value should be below 10 per
second. Spikes (maximum values) should not be
higher than 100 per second.
Possible problems:
If I/O log write latencies are high, check for RAID5
or synchronize replication on log devices.
Remediation:
You can also use the MSExchange Database
Instances (Information store/<Database Name>)
\log record stalls/sec counter to determine which
database(s) may be having issues. This will assist
you in determining which drive(s) to focus on. This
counter is an extended Exchange counter in
Performance Monitor. The solution can include
additional disks, reconfigured RAID configuration,
adding new database(s), or re-balancing
mailboxes across databases or servers.
Log
Threads
Waiting

Definition:
> 10 for > 10 for
Shows the number of threads waiting for their data 15 polls 60
to be written to the log to complete an update of the
polls

615

Chapter 15: AppInsight Applications

database. If this number is too high, the log may be

a bottleneck.
Information:
Should be less than 10 on average.
Possible problems:
If this number is too high, the log may be a
bottleneck. Regular spikes concurrent with log
record stall spikes indicate that the transaction log
disks are a bottleneck. If the value for log threads
waiting is more than the spindles available for the
logs, there is a bottleneck on the log disks.
Remediation:
If the disk subsystem is not meeting demand,
correcting the problem may require additional
disks, faster disks, or modifying the disk
configuration.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Notes:
l

Additional components on certain resources may be available for addition

and/or deletion on the Edit page.
The Value from Last Poll column shows the most recent data available for
the listed statistic.

Management
This resource contains controls that are actionable for both the application and
the node. The controls in the following illustration are SAM-specific.

616

Management

Application:
l

Edit Application Monitor: This allows you to edit the current application by
changing the settings specifically related to this application. This includes,
but is not limited to: changing the polling frequency, changing the Windows
and PowerShell URLs, changing the Exchange Server credentials, and
adjusting threshold settings for component monitors that have thresholds.
Changing some settings may require you to override the template that this
application is based upon. To do this, simply click Override Template.

617

Chapter 15: AppInsight Applications

Unmanage: Allows you to stop the polling and collecting of statistics of the
current application for a user-defined period of time.

Poll Now: Allows the application to retrieve the most current statistics when
clicked.
Note: By default, mailbox statistics are not polled when Poll Now is clicked.

Node:
l

Real-Time Process Explorer: Opens the RTPE in a new window. For

more information, see Real Time Process Explorer.
Service Control Manager: Opens the SCM in a new window. For more
information, see Service Control Manager.
Real-Time Event Viewer: Opens the RTEV in a new window. For more
information, see Real Time Event Viewer.

Replication
This resource contains performance counters specific to the status of the current
replication process. The icons of the listed performance counters in the Statistic
Name column will change color to reflect the listed counter's current state.
Clicking any performance counter in the Statistic Name column will take you to
the Performance Counter Details page for that counter.
If the value of a listed counter crosses the Warning threshold, the chart for the
listed monitor will display a yellow background. If the value of a listed
performance counter crosses the Critical threshold, the chart will display a red
background. Hovering over any time period within the chart will display detailed
information about that time period in the tooltip.
The purpose of using data replication is to maintain current replicas of the data.
Exchange servers can use the replicas to provide continuity of email service in
the event of a storage or site outage in the primary location.

618

Replication

The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:
Counter

Expert Knowledge

CopyQueueLength

Definition:
>1
Shows the number of transaction log
files waiting to be copied to the passive
copy log file folder. A copy isn't
considered complete until it has been
checked for corruption.
Information:
Allnodes in a Database Availability
Group (DAG) should be monitored for
this counter depending on the passive
node. Should be less than 1 at all times
for continuous replication.
Possible problems:
Server recently rebooted or services
restarted, network connectivity issues,
or multiple mailbox moves are in

619

Warning Critical
> 1 for
5 polls

Chapter 15: AppInsight Applications

process.
Remediation:
Verify network connectivity between the
various nodesin the DAG. Verify
Replication Service is running on all
DAG members.
ReplayQueueLength Definition:
Shows the number of transaction log
files waiting to be replayed into the
passive copy.

> 50 for
5 polls

> 100
for 5
polls

N/A

N/A

(Only available in
Exchange 2010)

Definition:
Average number of milliseconds
observed by the log copier when
sending messages over the network.

Log Copy KB/sec

Definition:

N/A

N/A

Information:
With DAG replication, transaction logs
are shipped to the other DAG members.
They then replay the log file.
(Thresholds should be manually
removed for DAG members configured
to be 'lagged copies.')
Possible problems:
The replay queue length should be as
low as possible, otherwise this could
indicate a (performance) issue with the
DAG member containing the Copy
database. A high number could also
negatively affect failover with some loss
of data as a possibility.
Remediation:
Check Memory, CPU, and Disk I/O for
any bottlenecks. Review the Windows
Event logs for any related events.
Avg Log Copy
Latency (msec)

620

Replication
The size of the log files (in KB) that are
copied per second.
Information:
Shows the size in KB/secof the
transaction logs being copied to
passive copies.
Log Replay Rate
(generations/sec)

Definition:
The number of log files that have been
replayed per second.

N/A

N/A

Information:
Shows you the number of Transaction
Logs being replayed on the passive
copies of a database.
Log Replay is Not
Keeping Up

Definition:
>= 1
LogReplayNotKeepingUp is 1 when
log replay is falling behind and not able
to keep up with log copying and
inspection.
Information:
Exchange 2010/2013 uses continuous
replication to create and maintain
database copies. To maintain a
synchronized copy of a mailbox
database, transaction log files from the
active mailbox server are replayed into
the passive database of another server
in the DAG. This provides high
availability and resiliency in the
Exchange environment.
Possible problems:
Indicates a replication issue may exist
with the mailbox database copies in the
DAG. If Transaction Log replay is not
able to keep up with the active copy,
passive copies willnot be upof date.

621

>= 1
for 60
polls

Chapter 15: AppInsight Applications

Remediation:
Review the Windows Event logs for
any related events. Examine network
topology between DAG members and
verify connectivity and network latency
is below 250 ms. Examine CPU
utilization by the Information Store
service on passive copies. Examine the
replication status for each replica
database using the GetMailboxDatabaseCopyStatus cmdlet.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Notes:
l

Additional components on certain resources may be available for addition

and/or deletion on the Edit page.
The Value from Last Poll column shows the most recent data available for
the listed statistic.

Replication Status Checks

This resource will perform up to 16 checks in Exchange 2010 and up to 18
checks in Exchange 2013 (divided into two columns. This resource will only show
test results which apply to the server it is being run against, whether the server
contains only active databases, passive databases, or a combination of the two.
The fewestchecks are performed when run against a server with only active
databases (Seven checks for 2010, 12 checks for 2013). This is because check
for databases replication status is not necessary because they are all on the local
server.
The status for each Health Check Test can be one of the following: Passed,
Failed, or Warning.

622

Replication Status Checks

The table below provides a list of all possible tests for this resource along with
their definitions.
Health Check Test
Name

Description

TcpListener

Verifies that the TCP log copy listener is running and

reachable on the specified DAG member, or if no
DAG member is specified, on the local server.

TasksRpcListener

Verifies that the tasks remote procedure call (RPC)

server is running and reachable on the specified
DAG member, or if no DAG member is specified, on
the local server.

ServerLocatorService

Verifies the Active Manager client/server processes

on DAG members and on the Client Access Server
that perform lookups in Active Directory and Active
Manager to determine where a users mailbox
database is active.

ReplayService

Verifies that the Microsoft Exchange Replication

service is running and reachable on the specified
DAG member, or if no DAG member is specified, on

623

Chapter 15: AppInsight Applications

the local server.

QuorumGroup

Verifies that the default cluster group (quorum group)

is in a healthy and online state.

FileShareQuorum

Verifies that the witness server and witness directory

and share configured for the DAG are reachable.

DBLogReplayKeepingUp Verifies that replay activity for the passive copies of

databases on the specified DAG member, or if no
DAG member is specified, on the local server, is able
to keep up with log copying and inspection activity.
DBLogCopyKeepingUp

Verifies that log copying and inspection by the

passive copies of databases on the specified DAG
member, or if no DAG member is specified, on the
local server, are able to keep up with log generation
activity on the active copy.

DBInitializing

Checks whether any mailbox database copies are in

a state of Initializing on the specified DAG member,
or if no DAG member is specified, on the local server.

DBDisconnected

Checks whether any mailbox database copies are in

a state of Disconnected on the specified DAG
member, or if no DAG member is specified, on the
local server.

DBCopySuspended

Checks whether any mailbox database copies are in

a state of Suspended on the specified DAG member,
or if no DAG member is specified, on the local server.

DBCopyFailed

Checks whether any mailbox database copies are in

a state of Failed on the specified DAG member, or if
no DAG member is specified, on the local server.

DatabaseRedundancy
(Only 2013)

Verifies that there is at least one healthy copy

available of the databases on the specified DAG
member, or if no DAG member is specified, on the
local server.

DatabaseAvailability
(Only 2013)

Verifies that the databases have sufficient availability

624

Storage
on the specified DAG member, or if no DAG member
is specified, on the local server.
DagMembersUp

Verifies that all DAG members are available, running,

and reachable.

ClusterService

Verifies that the Cluster service is running and

reachable on the specified DAG member, or if no
DAG member is specified, on the local server.

ClusterNetwork

Verifies that all cluster-managed networks on the

specified DAG member, or if no DAG member is
specified, the local server, are available.

ActiveManager

Verifies that the instance of Active Manager running

on the specified DAG member, or if no DAG member
is specified, the local server, is in a valid role
(primary, secondary, or stand-alone).

Storage
This resource contains performance counters specific to the status of storage. The
icons of the listed performance counters in the Statistic Name column will change
color to reflect the listed counter's current state. Clicking any performance counter
in the Statistic Name column will take you to the Performance Counter Details
page for that counter.
If the value of a listed counter crosses the Warning threshold, the chart for the
listed monitor will display a yellow background. If the value of a listed
performance counter crosses the Critical threshold, the chart will display a red
background. Hovering over any time period within the chart will display detailed
information about that time period in the tooltip.

625

Chapter 15: AppInsight Applications

The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:
Counter

Expert Knowledge

Warning Critical

I/O
Database
Reads
Average
Latency

Definition:
Shows the average length of time, in ms, per
database read operation.

>50 ms >50
msfor
15
polls

Information:
Should be 20 ms on [Link] should
not exceed 50 ms.
Possible problems:
Users may report sluggish responsiveness
within their email client.
Remediation:
If the disk subsystem is not meeting demand,
correcting the problem may require additional
disks, faster disks, or modifying the disk
configuration.

I/O
Database

Definition:
Shows the average length of time, in ms, per

626

> 100
ms

> 100
ms for

Storage
Writes
Average
Latency

database write operation.

15
polls

Information:
Should be 50 ms on average. Spikes of up to
100 ms are acceptable if not accompanied by
database page fault stalls.
Possible problems:
Users may report sluggish responsiveness
within their email client.
Remediation:
If the disk subsystem is not meeting demand,
correcting the problem may require additional
disks, faster disks, or modifying the disk
configuration.

I/O Log
Reads
Average
Latency

Definition:
Indicates the average time, in ms, to read data
from a log file. Specific to log replay and
database recovery operations.

> 200
ms

> 200
ms
for15
polls

Information:
Average should be less than 200 ms with
spikes up to 1000 ms
Possible problems:
Users may report sluggish responsiveness
within their email client.
Remediation:
If the disk subsystem is not meeting demand,
correcting the problem may require additional
disks, faster disks, or modifying the disk
configuration.
I/O Log
Writes
Average
Latency

Definition:
> 10 ms > 10
Indicates the average time, in ms, to write a log
ms for
buffer to the active log file.
15
polls
Information:
This count should be 10 ms or less on
production servers.

627

Chapter 15: AppInsight Applications

Possible problems:
Indication that the MS Exchange Database\I/O
Database Writes Average Latency is too high
Remediation:
If the disk subsystem is not meeting demand,
correcting the problem may require additional
disks, faster disks, or modifying the disk
configuration.

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Notes:
l

Additional components on certain resources may be available for addition

and/or deletion on the Edit page.
The Value from Last Poll column shows the most recent data available for
the listed statistic.

Users By Mailbox Size

This resource numerically and graphically shows metrics concerning mailbox
size per user. The data can be sorted by clicking the headers of each column.
Hovering over any user in the User Name list will display detailed information
about that user's mailbox in the tooltip. Clicking any database in the Database
column will take you to the Database Details page for that database.
Notes:
l

If there are no user mailboxes on a given database, this resources will disappear from the Mailbox Database Details page.
If there are no user mailboxes in any of the active databases on an
Exchange server, this resource will disappear from the Application Details
page.

628

Users By % Mailbox Quota Used

l

User mailbox information is collected only once a day after midnight, local
time.

The following list defines each column of this resource:

l
l

User Name: Name of the listed user.

Mailbox Size: Total size of the listed mailbox that is currently being used by
the user.
% Quote Used: Graphically and numerically shows the percentage used of
the listed mailbox.
Attachment Size: This is the total size of all emails that have an attachment. This includes the body of the email as well as any attachments.
Attachment Count: Shows the number of email messages that contain
attachments, as opposed to the actual number of attachments contained in
each email.
Last Accessed: Displays the time and date the listed mailbox was last
accessed by the user.
Database: This is the database that contains the listed user's mailbox.

For more information, see Attachment Extensions.

Users By % Mailbox Quota Used
This resource shows metrics based on the percentage of a user's mailbox quota
used. The data can be sorted by clicking the headers of each column.

629

Chapter 15: AppInsight Applications

Hovering over any user in the User Name list will display detailed information
about that user's mailbox in the tooltip. Clicking any database in the Database
column will take you to the Database Details page for that database.
Notes:
l

If there are no user mailboxes or mailbox quotas are not in use on a given
database, this resources will disappear from the Mailbox Database Details
page.
If there are no user mailboxes or mailbox quotas are not in use in any of the
active databases on an Exchange server, this resource will disappear from
the Application Details page.
User mailbox information is collected only once a day after midnight, local
time.

The following list defines each column of this resource:

630

Users By Messages Sent

l
l

User Name: Name of the listed user.

% Quota Used: Graphically and numerically shows the percentage used of
the listed mailbox.
Mailbox Size: Total size of the listed mailbox that is currently being used by
the user.
Attachment Size: This is the total size of all emails that have an attachment. This includes the body of the email as well as any attachments.
Attachment Count: This is the number of emails that have at least one
attachment.
Last Accessed: Displays the time and date the listed mailbox was last
accessed by the user.
Database: This is the database that contains the listed user's mailbox.

For more information, see Attachment Extensions .

Users By Messages Sent
This resource shows metrics based on messages sent. The data can be sorted by
clicking the headers of each column.
Hovering over any user in the User Name list will display detailed information
about that user's mailbox in the tooltip. Clicking any database in the Database
column will take you to the Database Details page for that database.
Notes:
l

If there are no user mailboxes on a given database, this resources will disappear from the Mailbox Database Details page.
If there are no user mailboxes in any of the active databases on an
Exchange server, this resource will disappear from the Application Details
page.
User mailbox information is collected only once a day after midnight, local
time.
If Server Mailbox Accounts Statistics is disabled, this resource, as well as
the Messages Sent and Messages Received charts on the Mailbox Details
view, will disappear.

631

Chapter 15: AppInsight Applications

The following list defines each column of this resource:

l
l

User Name: Name of the listed user.

Sent Yesterday: Current number of messages sent yesterday for the listed
user.
Sent Last 7 Days: This is the total number of emails that have been sent in
the last seven days.
Sent Last 30 Days: This is the total number of emails that have been sent
in the last 30 days.
Last Accessed: Displays the date the listed mailbox was last accessed by
the user
Database: This is the database that contains the listed user's mailbox.

632

AppInsight for Exchange Database Details View

AppInsight for Exchange Database Details View

The Database Details view provides a great deal of information about the current
database and can be accessed by clicking any listed database.
To navigate to the Database Details view:
1. From the web console, navigate to the AppInsight for Exchange Details
view.
2. From a Database resource, click any database in the list.
The available resources unique to this view include:
l
l
l
l
l
l
l
l
l
l
l

Active/Mounted Database Availability

Database Copies
Database Details
Database Disk I/O
Database File Size
Database I/O
Database Metrics
Events
Messages
Transaction Log File Size
Transaction Log Disk I/O

Notes:
l

If the name of a database is extremely long, certain performance counters

may not be visible on the Database Details page.
If databases are grouped by a status of Unknown in Network Atlas,
AppInsight for Exchange databases will be displayed.

Active/Mounted Database Availability

This resource graphically shows the various states of database availability in a
percentage format and is made up of three sections: the legend, the main chart,
and the lower chart. The colors of the main chart correspond to the labels in the
legend.

633

Chapter 15: AppInsight Applications

Note: This resource may not be available when using Internet Explorer 7/8.
Consider upgrading Internet Explorer or using FireFox or Chrome as your web
browser.
Zooming
You can have the chart show a predetermined, hourly time period of data by
clicking on any one of the three Zoom buttons; 1h, 12h, or 24h. Alternatively, you
can have the chart show a specific time range by dragging the mouse over a
small area of the chart.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders. The main view of the chart will
display the selected time period between the two sliders of the lower chart.

634

Database Copies
Moving the mouse over the main chart will reveal a tooltip with more detailed
information about the specific time period the mouse is hovering over. By default,
all statistics are shown in the main chart.
Database Copies
This resource provides details concerning the status of the current Exchange
server being monitored by the application.

l
l

Exchange Server: Name of the listed Exchange Server.

Copy Status: Displays the status of the active database. The table below
provides the possible status with its definition:
Mounted

The active copy is online and accepting client connections.

Only the active copy of the mailbox database copy can
have a copy status of Mounted.

Mounting

The active copy is coming online and not yet accepting

client connections. Only the active copy of the mailbox
database copy can have a copy status of Mounting.

Dismounting

The active copy is going offline and terminating client

connections. Only the active copy of the mailbox database
copy can have a copy status of Dismounting.

Dismounted

The active copy is offline and not accepting client

connections. Only the active copy of the mailbox database
copy can have a copy status of Dismounted.

Seeding

The mailbox database copy is being seeded, the content

index for the mailbox database copy is being seeded, or
both are being seeded. Upon successful completion of
seeding, the copy status should change to Initializing.

Seeding
Source

The mailbox database copy is being used as a source for a

database copy seeding operation.

635

Chapter 15: AppInsight Applications

Initializing

The mailbox database copy is in an Initializing state when

a database copy has been created, when the Microsoft
Exchange Replication service is starting or has just been
started, and during transitions from Suspended,
ServiceDown, Failed, Seeding, or SinglePageRestore to
another state. While in this state, the system is verifying that
the database and log stream are in a consistent state. In
most cases, the copy status will remain in the Initializing
state for about 15 seconds, but in all cases, it should
generally not be in this state for longer than 30 seconds.

ReThe mailbox database copy and its log files are being
synchronizing compared with the active copy of the database to check for
any divergence between the two copies. The copy status
will remain in this state until any divergence is detected and
resolved.
Single Page
Restore

This state indicates that a single page restore operation is

occurring on the mailbox database copy.

Failed

The mailbox database copy is in a Failed state because it

isnot suspended, and it isnot able to copy or replay log
files. While in a Failed state and not suspended, the system
will periodically check whether the problem that caused the
copy status to change to Failed has been resolved. After
the system has detected that the problem is resolved, and
barring no other issues, the copy status will automatically
change to Healthy.

Service
Down

The Microsoft Exchange Replication service isnot available

or running on the server that hosts the mailbox database
copy.

Suspended

The mailbox database copy is in a Suspended state as a

result of an administrator manually suspending the
database copy by running the SuspendMailboxDatabaseCopy cmdlet.

Healthy

The mailbox database copy is successfully copying and

replaying log files, or it has successfully copied and
replayed all available log files.

636

Database Copies
Disconnected The mailbox database copy is no longer connected to the
and Healthy active database copy, and it was in the Healthy state when
the loss of connection occurred. This state represents the
database copy with respect to connectivity to its source
database copy. It may be reported during DAG network
failures between the source copy and the target database
copy.
Disconnected The mailbox database copy is no longer connected to the
and Reactive database copy, and it was in the Re-synchronizing
synchronizing state when the loss of connection occurred. This state
represents the database copy with respect to connectivity to
its source database copy. It may be reported during DAG
network failures between the source copy and the target
database copy.
Failed and
Suspended

The Failed and Suspended states have been set

simultaneously by the system because a failure was
detected, and because resolution of the failure explicitly
requires administrator intervention. An example is if the
system detects unrecoverable divergence between the
active mailbox database and a database copy. Unlike the
Failed state, the system will not periodically check whether
the problem has been resolved, and automatically recover.
Instead, an administrator must intervene to resolve the
underlying cause of the failure before the database copy
can be transitioned to a healthy state.

Copy Queue: The Copy Queue length is an integer indicating number of

files. The Copy Queue Length shows the number of transaction log files
waiting to be copied to the passive copy log file folder. A copy is not considered complete until it has been checked for corruption.
Replay Queue: The Replay Queue Length shows the number of transaction log files waiting to be replayed into the passive copy.
Inspected Log Time: This is the date and time when the last log file was
verified (inspected) by the LogInspector for a particular database after being
copied from the active copy. This field is only relevant for passive copies of
a database.
Content Index: See the following table for returned status descriptions.

637

Chapter 15: AppInsight Applications

State

Description

Status
on
Active &
Passive
Copies

Crawling

Database is in the process of indexing database

content. Depending on the size of the database,
this process could take some time to complete.

Warning

Disabled

Indexingforthe database has been disable by an

administrator.

Offline
(Active)
N/A
(Passive)

Failed

An error has occurred causing the content index to Critical

fail.

Failed and The Failed and Suspended states have been set
Critical
Suspended simultaneously by the system because a failure
was detected, and because resolution of the failure
explicitly requires administrator intervention.
Healthy

This indicates the Content Index is up to date and Up

has not detected any issues. This is the only state
in which a failover (automatic process)to a specific
database copy can occur.

Seeding

A database copy is in the process of updating its

Content Index from another database copy.

Up

Suspended The Suspended status occurs if an administrator

Warning
manually pauses or suspends it from receiving
updates from the active copy. This might be done to
update a failed Content Index or to perform
troubleshooting for other issues.
l

Activation Preference: Indicates which database copy has preference over

another copy. It is used as part of the formula to determine which database
copy will become active during a failover. The value can range from 1 to 16
depending on the number of servers in the DAG. The lower the number, the
higher the preference.

638

Database Details
Database Details
This resource provides details concerning the current database.

The following list defines each field of this resource:

l
l

l
l

Database Name: This provides the name of the current database.

Summary Status: Displays the current status of the database. (See Table 1
for possible statuses.)
Active Copy Status: Displays the current status of the database of the
Exchange application that is being monitored. (See Table 2 for possible
statuses.)
Preferred Server: The database copy with an activation preference of 1 is
the preferred server.
Master: This refers to the name of the DAG or the name of the Server which
maintains the copy status information.
Total Number of Mailboxes: Displays the total number of mailboxes on the
listed database.
Average Mailbox Size: Displays the average size of user mailboxes.
Last Full Backup: Displays the time and date of the last full backup of the
database.
Last Incremented Backup: Displays the time and date of only those files
that have been altered since the last full backup of the database.
Circular Logging: Circular logging is a method of conserving disk space by
deleting transaction log files after they have been committed to the

639

Chapter 15: AppInsight Applications

database. Circular Logging should only be enabled if the mailbox server is

part of a DAG with a minimum of three database copies and one of those
should be set as a "lagged copy."
Storage Quota Defaults:
l Issue Warning: Displays the minimum size the mailbox must be
before a Warning is issued to the user's mailbox.
l Prohibit Send: Displays the minimum size the mailbox must be
before sending email is prohibited from the user's mailbox.
l Prohibit Send and Receive: Displays the minimum size the mailbox
must be before sending and receiving email is prohibited from the
user's mailbox.

Table 1.
This table shows how the value for the Summary Status field is calculated. If the
conditions in the first four columns are met, the status in the Final SAMStatus
column is displayed in the Summary Status field.
DB Copy
DB Copy Status (Passive) DB Content DB Content Final
Status (Active)
Index State Index State SAM
Statu
(Active)
(Passive)
s
Dismounted

Any

Any

Any

Offline

Dismounting

Any

Any

Any

Warni
ng

Failed

Any

Any

Any

Down

Initializing

Any

Any

Any

Warni
ng

Mounted,
DisconnectedAndHealthy
Seeding, or
SeedingSource

Healthy,
Any
Seeding, or
SeedingSou
rce

Warni
ng

Mounted,
DisconnectedAndHealthy
Seeding, or
SeedingSource

Any other

Any

Critica
l

Any

Warni
ng

Mounted,

DisconnectedAndResynchr Healthy,
onizing

640

Database Details
Seeding, or
SeedingSource

Seeding, or
SeedingSou
rce

Mounted,
DisconnectedAndResynchr Any other
Seeding, or
onizing
SeedingSource

Any

Critica
l

Mounted,
Failed
Seeding, or
SeedingSource

Healthy,
Any
Seeding, or
SeedingSou
rce

Warni
ng

Mounted,
Failed
Seeding, or
SeedingSource

Any other

Any

Critica
l

Mounted,
FailedAndSuspended
Seeding, or
SeedingSource

Healthy,
Any
Seeding, or
SeedingSou
rce

Warni
ng

Mounted,
FailedAndSuspended
Seeding, or
SeedingSource

Any other

Any

Critica
l

Mounted,
Healthy
Seeding, or
SeedingSource

Healthy,
Seeding, or
SeedingSou
rce

Healthy,
Up
Seeding, or
SeedingSou
rce

Mounted,
Healthy
Seeding, or
SeedingSource

Healthy,
Any other
Seeding, or
SeedingSou
rce

Warni
ng

Mounted,
Healthy
Seeding, or
SeedingSource

Crawling

Any

Warni
ng

Mounted,
Seeding, or

Any other

Healthy,
Warni
Seeding, or ng

Healthy

641

Chapter 15: AppInsight Applications

SeedingSource

SeedingSou
rce

Mounted,
Healthy
Seeding, or
SeedingSource

Any other

Mounted,
Initializing
Seeding, or
SeedingSource

Healthy,
Any
Seeding, or
SeedingSou
rce

Up

Mounted,
Initializing
Seeding, or
SeedingSource

Any other

Any

Warni
ng

Mounted,
Resynchronizing
Seeding, or
SeedingSource

Healthy,
Seeding, or
SeedingSou
rce

Healthy,
Up
Seeding, or
SeedingSou
rce

Mounted,
Resynchronizing
Seeding, or
SeedingSource

Healthy,
Any other
Seeding, or
SeedingSou
rce

Mounted,
Resynchronizing
Seeding, or
SeedingSource

Any other

Healthy,
Warni
Seeding, or ng
SeedingSou
rce

Mounted,
Resynchronizing
Seeding, or
SeedingSource

Any other

Any other

Mounted,
Seeding
Seeding, or
SeedingSource

Healthy,
Any
Seeding, or
SeedingSou
rce

Up

Mounted,
Seeding, or

Any other

Warni
ng

Seeding

642

Any other

Any

Critica
l

Warni
ng

Critica
l

Database Details
SeedingSource
Mounted,
SeedingSource
Seeding, or
SeedingSource

Healthy,
Any
Seeding, or
SeedingSou
rce

Up

Mounted,
SeedingSource
Seeding, or
SeedingSource

Any other

Any

Warni
ng

Mounted,
Service Down
Seeding, or
SeedingSource

Healthy,
Any
Seeding, or
SeedingSou
rce

Warni
ng

Mounted,
Service Down
Seeding, or
SeedingSource

Any other

Any

Critica
l

Mounted,
SinglePageRestore
Seeding, or
SeedingSource

Healthy,
Any
Seeding, or
SeedingSou
rce

Warni
ng

Mounted,
SinglePageRestore
Seeding, or
SeedingSource

Any other

Any

Critica
l

Mounted,
Suspended
Seeding, or
SeedingSource

Healthy,
Any
Seeding, or
SeedingSou
rce

Warni
ng

Mounted,
Suspended
Seeding, or
SeedingSource

Any other

Any

Critica
l

Mounting

Any

Any

Any

Warni
ng

Service Down

Any

Any

Any

Down

643

Chapter 15: AppInsight Applications

SinglePageRe DisconnectedAndHealthy
store

Healthy,
Any
Seeding, or
SeedingSou
rce

Warni
ng

SinglePageRe DisconnectedAndHealthy
store

Any other

Any

Critica
l

SinglePageRe DisconnectedAndResynchr Healthy,

Any
store
onizing
Seeding, or
SeedingSou
rce

Warni
ng

SinglePageRe DisconnectedAndResynchr Any other

store
onizing

Any

Critica
l

SinglePageRe Failed
store

Any

Any

Critica
l

SinglePageRe FailedAndSuspended
store

Any

Any

Critica
l

SinglePageRe Healthy
store

Healthy,
Any
Seeding, or
SeedingSou
rce

Warni
ng

SinglePageRe Healthy
store

Crawling

Any

Critica
l

SinglePageRe Healthy
store

Any other

Any

Critica
l

SinglePageRe Initializing
store

Any

Any

Critica
l

SinglePageRe Resynchronizing
store

Healthy,
Any
Seeding, or
SeedingSou
rce

Warni
ng

SinglePageRe Resynchronizing
store

Any other

Critica
l

644

Any

Database Details
SinglePageRe Seeding
store

Healthy,
Any
Seeding, or
SeedingSou
rce

Warni
ng

SinglePageRe Seeding
store

Any other

Any

Critica
l

SinglePageRe SeedingSource
store

Healthy,
Any
Seeding, or
SeedingSou
rce

Warni
ng

SinglePageRe SeedingSource
store

Any other

Any

Critica
l

SinglePageRe Service Down

store

Any

Any

Critica
l

SinglePageRe SinglePageRestore
store

Any

Any

Critica
l

SinglePageRe Suspended
store

Healthy,
Any
Seeding, or
SeedingSou
rce

Warni
ng

SinglePageRe Suspended
store

Any other

Critica
l

Any

Table 2.
Mounted

The active copy is online and accepting client connections. Only

the active copy of the mailbox database copy can have a copy
status of Mounted.

Mounting

The active copy is coming online and not yet accepting client
connections. Only the active copy of the mailbox database copy
can have a copy status of Mounting.

Dismounting

The active copy is going offline and terminating client

connections. Only the active copy of the mailbox database copy

645

Chapter 15: AppInsight Applications

can have a copy status of Dismounting.

Dismounted

The active copy is offline and not accepting client connections.

Only the active copy of the mailbox database copy can have a
copy status of Dismounted.

Seeding

The mailbox database copy is being seeded, the content index

for the mailbox database copy is being seeded, or both are being
seeded. Upon successful completion of seeding, the copy status
should change to Initializing.

Seeding
Source

The mailbox database copy is being used as a source for a

database copy seeding operation.

Initializing

The mailbox database copy is in an Initializing state when a

database copy has been created, when the Microsoft Exchange
Replication service is starting or has just been started, and
during transitions from Suspended, Service Down, Failed,
Seeding, or Single Page Restore to another state. While in this
state, the system is verifying that the database and log stream are
in a consistent state. In most cases, the copy status will remain in
the Initializing state for about 15 seconds, but in all cases, it
should generally not be in this state for longer than 30 seconds.

ReThe mailbox database copy and its log files are being compared
synchronizing with the active copy of the database to check for any divergence
between the two copies. The copy status will remain in this state
until any divergence is detected and resolved.
Single Page
Restore

This state indicates that a single page restore operation is

occurring on the mailbox database copy.

Failed

The mailbox database copy is in a Failed state because it is not

suspended, and it is not able to copy or replay log files. While in
a Failed state and not suspended, the system will periodically
check whether the problem that caused the copy status to
change to Failed has been resolved. After the system has
detected that the problem is resolved, and barring no other
issues, the copy status will automatically change to Healthy.

Service
Down

The Microsoft Exchange Replication service is not available or

running on the server that hosts the mailbox database copy.

646

Database Disk I/O

Suspended

The mailbox database copy is in a Suspended state as a result of

an administrator manually suspending the database copy by
running the Suspend-MailboxDatabaseCopy cmdlet.

Healthy

The mailbox database copy is successfully copying and

replaying log files, or it has successfully copied and replayed all
available log files.

Disconnected The mailbox database copy is no longer connected to the active

and Healthy database copy, and it was in the Healthy state when the loss of
connection occurred. This state represents the database copy
with respect to connectivity to its source database copy. It may be
reported during DAG network failures between the source copy
and the target database copy.
Disconnected The mailbox database copy is no longer connected to the active
and Redatabase copy, and it was in the Re-synchronizing state when
synchronizing the loss of connection occurred. This state represents the
database copy with respect to connectivity to its source database
copy. It may be reported during DAG network failures between
the source copy and the target database copy.
Failed and
Suspended

The Failed and Suspended states have been set simultaneously

by the system because a failure was detected, and because
resolution of the failure explicitly requires administrator
intervention. An example is if the system detects unrecoverable
divergence between the active mailbox database and a database
copy. Unlike the Failed state, the system will not periodically
check whether the problem has been resolved, and automatically
recover. Instead, an administrator must intervene to resolve the
underlying cause of the failure before the database copy can be
transitioned to a healthy state.

Database Disk I/O

This resource provides details concerning the database disk I/O being monitored
by the application.

647

Chapter 15: AppInsight Applications

l
l
l

File Path: Path of the listed database.

Volume: Displays the name of the listed volume.
Disk Queue Length: Displays the length of the disk queue of the listed
volume.
Total IOPS: Displays the total number of Input/Output operations per
second of the listed volume.
Latency: Numerically displays the average time the disk transfers took to
complete, in seconds.
Exchange Server: Displays the name of the listed Exchange Server.

Database File Size

This resource provides details concerning the size of the listed database copies
being monitored by the application.

l
l
l

File Path: Path of the listed database.

Total File Size: Displays the size of the listed database file.
Database Usage: Depending on how your database is configured, this
value is showing you how close you are to running out of space. If your database is configured as a fixed size, auto-grow, or a restricted auto-grow, the
percentages relate to what is going to cause your database to run out of
space.
Volume Usage: Numerically and graphically displays the volume usage as
a percentage.
Exchange Server: Displays the name of the listed Exchange server.

648

Database I/O
Database I/O
This resource contains performance counters specific to the status of database
I/O. The icons of the listed performance counters in the Statistic Name column will
change color to reflect the listed counter's current state. Clicking any performance
counter in the Statistic Name column will take you to the Performance Counter
Details page for that counter.
If the value of a listed counter crosses the Warning threshold, the chart for the
listed monitor will display a yellow background. If the value of a listed
performance counter crosses the Critical threshold, the chart will display a red
background. Hovering over any time period within the chart will display detailed
information about that time period in the tooltip.

The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:
Counter Expert Knowledge

Warning Critical

I/O
Definition:
Database Shows the average length of time, in ms, per
Reads
database read operation.
Average

> 50 ms >50
msfor
5 polls

649

Chapter 15: AppInsight Applications

Latency

Information:
Should be 20 ms on [Link] should not
exceed 50 ms.
Possible problems:
Users may experience decreased performance,
including delayed message deliveries.
Remediation:
If the disk subsystem is not meeting demand,
correcting the problem may require additional
disks, faster disks, or modifying the disk
configuration. Review the event logs for related
events. Verify network topology between mailbox
servers and storage resources. Examine CPU &
Memory usage to determine possible bottlenecks.
Examine replication status forreplica database.

I/O
Database
Writes
Average
Latency

Definition:
Shows the average length of time, in ms, per
database write operation.

>100
ms

> 100
ms for
5 polls

> 200

> 200

Information:
Should be 50 ms on average. Spikes of up to 100
ms are acceptable if not accompanied by database
page fault stalls.
Possible problems:
Users may experience decreased performance,
including delayed message deliveries.
Remediation:
If the disk subsystem is not meeting demand,
correcting the problem may require additional
disks, faster disks, or modifying the disk
[Link] the event logs for related
events. Verify network topology between mailbox
servers & storage resources. Examine CPU and
Memory usage to determine possible bottlenecks.
Examine replication status forreplica database.

I/O Log

Definition:

650

Database I/O
Reads
Average
Latency

Indicates the average time, in ms, to read data from ms

a log file. Specific to log replay and database
recovery operations.

ms
for5
polls

Information:
Average should be less than 200 ms with spikes
up to 1,000 ms
Possible problems:
Users may experience decreased performance,
including delayed message deliveries.
Remediation: If the disk subsystem is not meeting
demand, correcting the problem may require
additional disks, faster disks, or modifying the disk
[Link] the event logs for related
events. Verify network topology between mailbox
servers & storage resources. Examine CPU and
Memory usage to determine possible bottlenecks.
Examine replication status forreplica database.
I/O Log
Writes
Average
Latency

Definition:
Indicates the average time, in ms, to write a log
buffer to the active log file.
Information:
This count should be 10 ms or less on production
servers.
Possible problems:
Indication that the Exchange Database\I/O
Database Writes Average Latency is too high
Remediation: If the disk subsystem is not meeting
demand, correcting the problem may require
additional disks, faster disks, or modifying the disk
[Link] the event logs for related
events. Verify network topology between mailbox
servers & storage resources. Examine CPU and
Memory usage to determine possible bottlenecks.
Examine replication status forreplica database.

651

> 10 ms > 10
ms for
5 polls

Chapter 15: AppInsight Applications

Log
Threads
Waiting

Definition:
> 10 for
Shows the number of threads waiting for their data 5 polls
to be written to the log to complete an update of the
database. If this number is too high, the log may be
in a bottleneck situation.

> 10
for15
polls

Information:
Should be less than 10 on average.
Possible problems:
If this number is too high, the log may be a
bottleneck. Regular spikes concurrent with log
record stall spikes indicate that the transaction log
disks are in a bottleneck situation. If the value for
log threads waiting is more than the spindles
available for the logs, there is a bottleneck on the
log disks.
Remediation:
If the disk subsystem is not meeting demand,
correcting the problem may require additional
disks, faster disks, or modifying the disk
[Link] the event logs for related
events. Verify network topology between mailbox
servers and storage resources. Examine CPU and
Memory usage to determine possible bottlenecks.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Notes:
l

Additional components on certain resources may be available for addition

and/or deletion on the Edit page.
The Value from Last Poll column shows the most recent data available for
the listed statistic.

652

Database Metrics
Database Metrics
This resource contains performance counters specific to the status of database
metrics. The icons of the listed performance counters in the Statistic Name
column will change color to reflect the listed counter's current state. Clicking any
performance counter in the Statistic Name column will take you to the
Performance Counter Details page for that counter.
If the value of a listed counter crosses the Warning threshold, the chart for the
listed monitor will display a yellow background. If the value of a listed
performance counter crosses the Critical threshold, the chart will display a red
background. Hovering over any time period within the chart will display detailed
information about that time period in the tooltip.

The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:
Counter

Expert Knowledge

Warning Critical

Active Client
Logons

Definition:
The number of clients that performed any
action within the last 10 minute interval.

N/A

(Only
available in

Information:
Active client logons can be high if users are

653

N/A

Chapter 15: AppInsight Applications

Exchange
2010)

logging on and logging off frequently.

Possible problems:
May cause memory bottlenecks on the server
if the number is excessively high.
Remediation:
Determine if users are running applications
not required for business use and request
they do not run these applications which is
causing an increase in server logons. If this
does not help, or is not possible, reduce the
number of server hosted on the server and
move any public folders on the server to a
different server.

Slow Findrow Definition:

Rate
Shows the rate at which the slower FindRow
needs to be used in the mailbox store.
(Only
available in
Exchange
2010)

Information:
Should be no more than 10 for any specific
mailbox store.
Possible problems:
Higher values indicate applications are
crawling or searching mailboxes, which is
affecting server performance. These include
desktop search engines, customer
relationship management (CRM), or other
third-party applications.
Remediation:
Run the ResetSearchIndex.ps1 script which
is located in the scripts directory at the root of
the Exchange installation. Alternatively, you
can perform the process manually:
1. Rebuild index catalog using UpdateMailboxDatabaseCopy <DBName> CatalogOnly

command.

654

>10

> 10 for
15
polls

Database Metrics
2. Stop the Microsoft Exchange Search
Service.
3. Delete old catalog files.
4. Restart the Microsoft Exchange Search
Service.
Average
Definition: Shows the average, in ms, of how > 30
Document
long it takes to index documents.
Indexing Time Information:Should be less than 30 seconds
at all times.
(Only
available in
Exchange
2010)

Possible problems: Verify content index

state of all database copies.
Remediation: For any database indexes not
"healthy," update the content index on the
server using the Update-MailboxDatabaseCopy
<DBName> -CatalogOnly command.

Mailboxes
Definition:Shows the rate of mailboxes
processed/sec processed by time-based assistants per
second.
(Only
available in
Exchange
2013)

> 30for
15
polls

N/A

N/A

Information: Determines current load

statistics for this counter.

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Notes:
l

Additional components on certain resources may be available for addition

and/or deletion on the Edit page.
The Value from Last Poll column shows the most recent data available for
the listed statistic.

655

Chapter 15: AppInsight Applications

Events
This resource contains performance counters specific to the status of database
events. The icons of the listed performance counters in the Statistic Name column
will change color to reflect the listed counter's current state. Clicking any
performance counter in the Statistic Name column will take you to the
Performance Counter Details page for that counter.
If the value of a listed counter crosses the Warning threshold, the chart for the
listed monitor will display a yellow background. If the value of a listed
performance counter crosses the Critical threshold, the chart will display a red
background. Hovering over any time period within the chart will display detailed
information about that time period in the tooltip.

The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:
Counter

Expert Knowledge

Warning Critical

Average
Event
Processing
Time In
Seconds

Definition:
>2
Shows the average processing time of the events
chosen.
Information:
Should be less than 2 at all times.
Possible problems:
Indicates the Mail Submission Assistant is not

656

> 2 for
15
polls

Events
able to handle the number of submission
requests being made to the database. May
occurwhen serveris experiencing a heavy load
which can cause messages to queue on the
server.
Remediation:
Review event logs for related events examining
log entries for each Assistant's infrastructure and
its corresponding assistant.
Events in
Queue

Definition:
> 20
Shows the number of events in the in-memory
queue waiting to be processed by the assistants.

> 50

Information:
Should be a low value at all times.
Possible problems:
High values may indicate a performance
bottleneck.
Remediation:
Review event logs for related events. Monitor
CPU and memory for bottlenecks.
Events
Definition:
Polled/sec Shows the number of events polled per second.

N/A

N/A

Information:
Determines current load statistics for this counter.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Notes:
l

Additional components on certain resources may be available for addition

and/or deletion on the Edit page.

657

Chapter 15: AppInsight Applications

The Value from Last Poll column shows the most recent data available for
the listed statistic.

Messages
This resource contains performance counters specific to the status of messages.
The icons of the listed performance counters in the Statistic Name column will
change color to reflect the listed counter's current state. Clicking any performance
counter in the Statistic Name column will take you to the Performance Counter
Details page for that counter.
If the value of a listed counter crosses the Warning threshold, the chart for the
listed monitor will display a yellow background. If the value of a listed
performance counter crosses the Critical threshold, the chart will display a red
background. Hovering over any time period within the chart will display detailed
information about that time period in the tooltip.

The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:
Counter

Expert Knowledge

Warning Critical

Messages
Queued For
Submission

Definition:
Shows the current number of submitted
messages not yet processed by the transport
layer.

> 30

658

> 50

Messages
(Only
available in
Exchange
2010)

Information:
The queues should remain below 50 at any
given time. Anything above this amount should
be cleared within 15 minutes.
Possible problems:
Mailbox server is not communicating properly
with the transport server.
Remediation:
Verify network connectivity and transport
server functionality. Additional bottlenecks
may include disk reads or writes, processor
time, available memory, and network
configuration.

Messages
Sent/sec

Definition:
Shows the rate that messages are sent to
transport.

N/A

N/A

(Only
available in
Exchange
2010)

Information:
Used to determine current messages sent to
transport.

Messages
Definition:
N/A
Delivered/sec Shows the rate that messages are delivered to
all recipients.

N/A

(Only
available in
Exchange
2010)

Information:
Indicates current message delivery rate to the
store.

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Notes:

659

Chapter 15: AppInsight Applications

Additional components on certain resources may be available for addition

and/or deletion on the Edit page.
The Value from Last Poll column shows the most recent data available for
the listed statistic.

Transaction Log Disk I/O

This resource provides details concerning the status of the current transaction log
disk I/O of database copies being monitored by the application.

l
l
l

File Path: Path to the transaction log directory.

Volume: Displays the name of the listed volume.
Disk Queue Length: Displays the length of the disk queue of the listed
volume.
Total IOPS: Displays the total number of Input/Output operations per
second of the listed volume.
Latency: Numerically displays the average time the disk transfers took to
complete, in seconds.
Exchange Server: Displays the name of the listed Exchange Server.

Transaction Log File Size

This resource provides details concerning the status of the current transaction log
file size of database copies being monitored by the application.

l
l

File Path: Path to the transaction log directory.

Number of Files: Lists the total number of log files associated with the database.
Total File Size: Displays the total file size of all the transaction log files.

660

AppInsight for Exchange Mailbox Details View

l

Volume Usage: Numerically and graphically displays the current volume

usage as a percent of the total size of the transaction log files.
Exchange Server: Displays the name of the listed Exchange Server.

AppInsight for Exchange Mailbox Details View

The Mailbox Details view provides information about the selected Exchange
mailbox. The available resources offered in this view include:
l
l
l
l
l

Mailbox Details
Mailbox Synced Devices
Received Mail
Sent Mail
Total Mailbox and Attachments Sizes

Note: Chart resources require several values for lines on charts to be visible.
Mailbox Details
This resource provides details about the current user's mailbox.

The following list defines each field of this resource:

l
l
l

User Logon Name: User's domain account name.

Display Name: Name of the listed user as it is displayed as a mailbox.
Mailbox Database: Displays the database that contains the listed mailbox
as well as the server that contains the database. The colors of the displayed
icons display the status of the object the icon represents.

661

Chapter 15: AppInsight Applications

l
l

l
l

Type: Lists the role of the listed mailbox.

Organizational Unit: This is the location of the Users Active Directory
account within the Active Directory tree.
Primary SMTP Address: This is the primary email address for a user. A
user can have secondary email addresses which will route mail to the same
mailbox.
Mailbox Size:
l Total Size: Current size of all mailbox items shown numerically and
as a percentage with a bar graph.
l Total Items: Total number of mailbox items in the listed mailbox.
l Attachment Size: Shows the total size of those email messages that
include attachments, including the email message body.
l Attachment Count: Shows the number of email messages that contain attachments, as opposed to the actual number of attachments contained in each email.
Last Polled: The time and date the listed mailbox was polled for information.
Last Logged On: The time and date the listed user logged in to the mailbox.
Mailbox Last Modified: The time and date the listed mailbox was last modified.
Alias: The legible name for the listed user's email address.
Mailbox Limits:
l Issue Warning: Displays the size limit of the mailbox before it issues
a usage warning.
l Prohibit Send: Displays the size limit of the mailbox when it is no
longer able to send emails.
l Prohibit Send and Receive: Displays the size limit of the mailbox
when it is no longer able to send or receive emails.

For more information, see Attachment Extensions .

Mailbox Synced Devices
This resource provides details about the current user's synced mailbox status.

662

Received Mail
The following list defines each field of this resource:
l
l

Device Type: Lists the device the mailbox is being synced with.
Device User Agent: Displays the operating system and build of the listed
device.
Last Successful Sync: Displays the last time the listed device was successfully synced with the current mailbox.

Received Mail
This resource graphically details the value history of the current performance
counter, in this case, the total amount of received mail for the selected mailbox.
Hovering over any time period within the chart will display detailed information
about that time period in the tooltip.
The colors of the main chart correspond to the labels in the legend. You can
choose which data to display by using the check boxes in the legend.

663

Chapter 15: AppInsight Applications

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart or manipulating the sliders of the lower chart.
Sent Mail
This resource graphically details the value history of the current performance
counter, in this case, the number of messages sent for the selected mailbox.
Hovering over any time period within the chart will display detailed information
about that time period in the tooltip.

664

Total Mailbox and Attachments Sizes

The colors of the main chart correspond to the labels in the legend. You can
choose which data to display by using the check boxes in the legend.

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart or manipulating the sliders of the lower chart.
Total Mailbox and Attachments Sizes
This resource graphically details the value history of the current performance
counter, in this case, the total size of the selected mailbox and its attachments.

665

Chapter 15: AppInsight Applications

Hovering over any time period within the chart will display detailed information
about that time period in the tooltip.
The colors of the main chart correspond to the labels in the legend. You can
choose which data to display by using the check boxes in the legend.

Note: Attachment Size shows the total size of those email messages that
include attachments, including the email message body.
For more information, see Mailbox Details.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart or manipulating the sliders of the lower chart.

666

Troubleshooting AppInsight for Exchagne

Troubleshooting AppInsight for Exchagne

The following sections will help you identify and correct AppInsight for Exchange
errors concerning configuration and performance counters:
l
l
l

Troubleshooting Error Codes in AppInsight for Exchange

Troubleshooting Exchange Performance Counters
Troubleshooting Permissions

Troubleshooting Permissions
The following information will help you troubleshoot issues with the following:
l
l
l
l

Non-Domain Accounts
Adding Local Administrative privileges to Active Directory Account
Exchange Access
Mailbox Exchange Access

Non-Domain Account
Local accounts (Non-Domain) cannot access Exchange Management interfaces
and therefore are not supported by AppInsight for Exchange. Please select an
Active Directory account or create a new one to use with AppInsight for
Exchange.
Add Local Administrative privileges to Active Directory Account
1. On the server where you want to grant local administrative privileges, open
a Computer Management console.
2. Navigate to System Tools >Local Users and Groups > Groups and then
double click the Administrators group.
3. Click Add and type in the Active Directory username of the account you
want to grant administrative privileges to, and then press Enter. (Ensure the
location is set to either the domain where the account is located or Entire
Directory.)
4. Click Apply and then click OK.
5. Alternatively, you can add an Active Directory group to the Local Administrators group and then add the AD user accounts to that group.
6. To verify the account and local group membership has been configured
properly, run the following in a PowerShell session:
$Recurse = $true
$GroupName = 'Administrators'
Add-Type -AssemblyName [Link]
$ct =

667

Chapter 15: AppInsight Applications

[[Link]]::Machine
$group = [[Link]]::FindByIdentity
($ct,$GroupName)
$LocalAdmin = $[Link]($Recurse) | select @{N='Domain'; E=
{$_.[Link]}}, samaccountName, @{N='ObjectType'; E={$_.StructuralObjectClass}} -Unique
$LocalAdmin = $LocalAdmin | Where-Object {$_.ObjectType -eq "user"}

Exchange Access
Granting Least Privilege access to the Exchange Organization can be
accomplished using Active Directory Users and Computers (ADUC)
1. From the Start Menu open ADUC and navigate to the Microsoft Exchange
Security Groups OU.
2. Double click on the View-Only Organization Management group.
3. After the window opens, click the Members tab and then click Add.

668

Troubleshooting Permissions
4. Type the username of the account you want to grant access to the
Exchange organization, and then click OK.
5. Click Apply and then click OK .
6. Close the ADUC window.
Access can also be granted using the Exchange Management
Shell with the following command:
${USER} = Username of service account
Add-RoleGroupMember -Identity "View-Only Organization
Management" -Member "$USER"

To verify the management role is properly assigned, use the

following commands:
Get-RoleGroupMember -Identity "View-Only Organization
Management" | Where-Object {$_.SamAccountName -eq
"$USER"}
Get-RoleGroupMember -Identity "Organization Management"
| Where-Object {$_.SamAccountName -eq "$USER"}

or
Get-ManagementRoleAssignment -RoleAssignee ${USER} |
Where-Object {$_.RoleAssigneeName -eq "View-Only
Organization Management" -or $_.RoleAssigneeName -eq
"Organization Management"}

Mailbox Search Access

Mailbox Search access is required to determine attachment counts and sizes. It
can be granted using the Exchange Management Shell (EMS).
1. From the Start Menu, open the EMS.
2. Type: New-ManagementRoleAssignment -Role "Mailbox Search" -User
"${USER}" and press Enter.
To verify the management role has been properly assigned, use
the following command:
Get-ManagementRoleAssignment -RoleAssignee ${USER} Role "Mailbox Search" | Where-Object {$_.RoleAssignmentDelegationType -eq "Regular"}

Note: Exchange Management Roles can be assigned to role

assignees using either regular or delegating role assignments.

669

Chapter 15: AppInsight Applications

Regular role assignments enable the role assignee to access

the permissions provided by the management role entries on this
role.
Delegating role assignments give the role assignee the ability to
assign this role to Role Groups, Users, or Universal Security
Groups.

For more information, see:

l
l

[Link]
[Link]

Troubleshooting Exchange Performance Counters

Occasionally, you may encounter an Exchange server which is missing some of
the expected performance counters. If this happens, you need to verify whether
the counters are simply disabled or if they are completely missing. The simplest
way to do this is through the registry.
1. Navigate to the service with the missing performance counters.
Note: Individual services are listed under HKLM\SYSTEM\CurrentControlSet\Services.
2. Expand the service and click on the Performance key. The important values we want to ensure exist are listed below and displayed in Figure 1.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<ServiceName>\Performance]

Example: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ESE\Performance]
"Close"="ClosePerformanceData"
"Collect"="CollectPerformanceData"
"Library"="<Path to performance counter DLL file>"

Example: "Library"="C:\\Program Files\\Microsoft\\Exchange

Server\\V15\bin\\perf\\%PROCESSOR_ARCHITECTURE%\\[Link]"

"Open"="OpenPerformanceData"
"PerfIniFile"="<Name of performance counter INI file>"

Example: "PerfIniFile"="[Link]"

670

Troubleshooting Exchange Performance Counters

The "Library" file path is typically "C:\Program
Files\Microsoft\Exchange
Server\%ExchangeVersion%\Bin\perf\%Processor_
Architecture%\%DLLFileName%"

Figure 1.

3. Verify the counters have not been disabled by expand the service and then
clicking on the "Performance" key.
4. Check for the value Disable Performance Counters (See Figure 2.) If this
value exists, ensure the data value is 0. Any other value will disable the
counters.
5. Once the value is confirmed to be set to 0, close all PerfMon windows and
then reopen them.
Note: The performance counters should be visible at this time. If the performance counters are not visible, proceed to the next step.
Figure 2.

671

Chapter 15: AppInsight Applications

6. If the values First Counter, First Help, Last Counter, and Last Help are listed (See Figure 3), it is highly recommended to unload the performance
counters prior to reloading them.
Figure 3.

To Unload Performance Counters: (See Figure 4)

1. Close all PerfMon windows and stop any services which may be using
these counters.
2. Open the Exchange Management Shell (EMS) in the Run as Administrator
context.
3. Type: Add-PSSnapin [Link]
and then press Enter.
4. Type: Remove-PerfCounters -DefinitionFileName "<Path to counter
definition XML file> and then press Enter.

672

Troubleshooting Error Codes in AppInsight for Exchange

a. The default location for Exchange counter definition files is: C:\Program Files\Microsoft\Exchange Server\%ExchangeVersion%\Setup\perf\%XMLFileName%

To Reload Performance Counters: (See Figure 4)

1. Close all PerfMon windows and stop any services which may be using
these counters.
2. Open the Exchange Management Shell (EMS) in the Run As Administrator
context.
3. Type: Add-PSSnapin [Link]
and then press Enter.
4. Type: New-PerfCounters -DefinitionFileName "<Path to counter definition XML file> and then press Enter.
a. The default location for Exchange counter definition files is: C:\Program Files\Microsoft\Exchange Server\%ExchangeVersion%\Setup\perf\%XMLFileName%

5. Check the application log to verify the counters were properly loaded and
no PerfLib errors exist. Reopen PerfMon to ensure the counters are available.
Figure 4.

Troubleshooting Error Codes in AppInsight for Exchange

Following are the possible error messages associated with AppInsight for
Exchange. Included are possible causes and solutions.
Configuration Errors
Error Message, Information, and Remediation
Error message: Remote configuration was unsuccessful due to the following:
"The deployment service executable was not found on the Orion server." For
details, see the log on the Orion server: ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\[Link]).
Description: Internal error. The Remote Installation [Link] file was not
found. (Default file location: C:\Program Files (x86)\SolarWinds\Orion\APM).

673

Chapter 15: AppInsight Applications

This can be caused by an incorrect SAM installation or Remote Installation

[Link] was deleted or modified.
Remediation: Add the Remote Installation [Link] file to the following
folder: C:\Program Files (x86)\SolarWinds\Orion\APM.

Error message: Remote configuration was unsuccessful due to the following:

"The configurator executable was not found on the Orion server." For details,
see the log on the Orion server: ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\[Link]).
Description: Internal error. [Link]
file was not found (Default file location: C:\Program Files (x86)
\SolarWinds\Orion\APM).This can be caused by an incorrect SAM installation or
[Link] was deleted or modified..
Remediation: Add [Link] to the
following folder: C:\Program Files (x86)\SolarWinds\Orion\APM.

674

Troubleshooting Error Codes in AppInsight for Exchange

Error message: Remote configuration was unsuccessful due to the following:

"Access denied." For details, see the log on the Orion server:
([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\[Link]).
Description: The provided user account does not have access to the
Administrator share on the remote Exchange server.
Remediation: Connect to the Administrator share with
\\ExchangeComputerName\<drive letter>$\ from the Orion server.

675

Chapter 15: AppInsight Applications

Error message: Remote configuration was unsuccessful due to the following:

"The configurator executable has an invalid signature." For details, see the log
on the Orion server: ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\[Link]).
Description: The configuration executable cannot be started on the remote
Exchange server due to any of the following:
n
n

The high level of User Account Control settings

The provided user account does not have privileges high
enough to run *.exe files
[Link] is not
signed with a Solarwinds certificate.

Remediation:
n

Reduce User Account Control settings on the remote

Exchange server;

676

Troubleshooting Error Codes in AppInsight for Exchange

Ensure the user's account has privileges to run *.exe files

Error message: Remote configuration was unsuccessful due to the following:

"The network path was not found." For details, see the log on the Orion server:
([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\[Link]).
Description: This is a Windows error indicating that a networking component is
malfunctioning.
Remediation:
l

Ensure you have access to the Shared Storage drive.

1. In Windows Explorer, navigate to My Network Places > Entire
Network > Microsoft Windows Network > (workgroup name) >
(Shared Storage drive name).
Firewalls can block traffic to the network which could generate this message. Try temporarily disabling any software or hardware firewalls to isolate the problem.

677

Chapter 15: AppInsight Applications

Anti-spyware tools can block network traffic. Try temporarily disabling any
anti-spyware programs and restart the computer to isolate the problem.

Error message: Remote configuration was unsuccessful due to the following:

"Executable configuration file was not found on the Orion server." For details,
see the log on the Orion server: ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\[Link]).
Description: Internal error.
was not found
(Default file location: C:\Program Files (x86)\SolarWinds\Orion\APM.) This
can be caused by an incorrect SAM installation or
[Link] was deleted or
modified.
[Link]

Remediation:Add [Link]
to the following location: C:\Program Files (x86)\SolarWinds\Orion\APM.

678

Troubleshooting Error Codes in AppInsight for Exchange

For information about Microsoft error codes, see: [Link]

679

Chapter 15: AppInsight Applications

Error message: Remote configuration was unsuccessful due to the following:

"PowerShell 2.0 was not detected on the Exchange server." Learn how to
correct this. For details, see the log on the remote computer. ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\[Link]).
Description: PowerShell 2.0 is not installed on the remote Exchange server.
Remediation: PowerShell 2.0 should be installed on Exchange server.
Installing PowerShell 2.0 on Server 2008:
For Server 2008, download the installation file for PowerShell 2.0 at
[Link] and install it on the
server.
Note: PowerShell 2.0 is automatically installed on Server 2008 R2
and therefore no additional installation is required.
Installing PowerShell 2.0 on Server 2012:
1. Open Server Manager.

680

Troubleshooting Error Codes in AppInsight for Exchange

2. Click on the Manage menu, and the select Add Roles and
Features.
3. After the wizard opens, click Next until you get to the Installation Type page.
4. Select Role-based or feature-based installation.
5. Click Next until you reach the Features page.
6. Scroll down to Windows PowerShell. It will likely show itself
as partially installed (square inside box).
7. Check the box next to Windows PowerShell 2.0 Engine.
8. Click Next and then Install.
9. When the installation finishes, click Close.

Error message: Remote configuration was unsuccessful due to the following:

"This account must be an Active Directory account with local administrative

681

Chapter 15: AppInsight Applications

privileges." Learn how to correct this. For details, see the log on the remote
computer. ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\[Link]).
Description: The provided user account does not have Local Administrative
privileges.
Remediation:
Add Local Administrative privileges to Active Directory Account:
1. On the server where you wish to grant local administrative privileges,
open a Computer Management console.
Note: On Windows 2012, add this privilege using the Active Directory
console.
2. Navigate to System Tools >Local Users and Groups > Groups and
double click the Administrators group.
3. Click Add and type in the Active Directory username of the account you
want to grant administrative privileges, and then press Enter. (Ensure the
location is set to either the domain where the account is located or Entire
Directory.)
4. Click Apply and then click OK.
Note: Alternatively, you can add an Active Directory group to the local
administrators group and add the Active Directory user accounts to that
group.
Error message: Remote configuration was unsuccessful due to the following:
"This account must be an Active Directory account with organization wide
Exchange access (View-Only-Organization Management and Mailbox Search
Management Role)." Learn how to correct this. For details, see the log on the
remote computer. ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\[Link]).
Description: The provided user account does not have View-Only-Organization
Management or Mailbox Search Management privileges.
Remediation:
Grant View-Only-Organization Management privileges:
Granting Least Privilege access to the Exchange Organization can be
accomplished using Active Directory Users and Computers (ADUC). To
accomplish this, take the following steps:

682

Troubleshooting Error Codes in AppInsight for Exchange

1. From the Start Menu, open ADUC and navigate to the Microsoft
Exchange Security Groups OU.
2. Double click on the View-Only Organization Management group.
3. After the window opens, click the Members tab and then click Add.
4. Type the username of the account you want to grant access to the
Exchange organization, and then click OK.
5. Click Apply, and then click OK.
6. Close the ADUC window.
Grant Mailbox Search Access:
Mailbox Search access is required to determine attachment counts and sizes.
This can be granted using the Exchange Management Shell (EMS).
1. From the Start Menu, open the EMS.
2. Type: New-ManagementRoleAssignment -Role "Mailbox Search" User <Username of account being granted access> and then press
Enter.
3. To verify the management role has been properly assigned, enter the
following command:
Get-ManagementRoleAssignment -RoleAssignee <Username of
account>

683

Chapter 15: AppInsight Applications

Performance Counter Details View

This view is equivalent to the Component Details view in a typical SAM
application. This view is common to all AppInsight applications and can be
accessed by clicking any performance counter found in any resource. The default
resources for this view include:
l
l
l

Performance Counters
Performance Counter Details
History Chart

684

Performance Counters
Additionally, this view contains the Management resource and Expert
Knowledge resource.
For more information, see Management.

Performance Counters
This resource displays all the available performance counters associated with the
current application or database.
The list of performance counters displayed will change depending on how you
enter this view. For example, if you enter this view by drilling down from the
database level, just the counters associated with that database will be displayed.
If you enter this view by drilling down from the application view, then only the
performance counters associated with the application will be shown.
Clicking any performance counter in the list will display detailed information about
that performance counter in the Performance Counter Details resource.

Performance Counter Details

This resource provides tools and detailed information about the current
performance counter (Component Monitor).

685

Chapter 15: AppInsight Applications

l
l
l
l
l

l
l

Management: This section lists the tools that are available.

Name: Name of the current performance counter.
Status: Status of the current performance counter.
Current Value: The value of the current performance counter.
Group: Displays the group, or resource, this performance counter belongs
to as it would be viewed on the Application Details view. For example:

Component Type: The type of the current performance counter.

Expert Knowledge: This section provides information about the performance counter, including possible problems that may occur as a result
of the returned value being abnormal. Remediation information is also
provided, where applicable, to help you resolve typical issues that may be
occurring if abnormal values are returned.

686

History Chart

History Chart
This resource graphically details the value history of the current performance
counter. Hovering over any time period within the chart will display detailed
information about that time period in the tooltip.
The colors of the main chart correspond to the labels in the legend. You can
choose which data to display by using the check boxes in the legend.

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart or manipulating the sliders of the lower chart.

687

Chapter 16:
Viewing Performance and Status
The following sections provide a short list and overview of the views and
resources provided with Server & Application Monitor that reveal performance
and status information:
l
l
l
l
l
l

Understanding the SAM Application Summary

Understanding SAM Application Details
Understanding SolarWinds SAM Component Details
Showing SolarWinds SAM Data in Node Details
Customizing SAM Application Summary Views
Customizing Application Details Views

Understanding the SAM Application Summary

The SAM Application Summary view provides the following resources. You can
customize which of these resources appear on the page by clicking Customize
Page.
All Applications Tree
Provides an expandable list of applications that allows custom grouping.
Additionally provides the number of problem applications and the duration
of the problem state for each application.
Applications with Problems
Provides a list of applications with the status of down, unknown, warning, or
critical.
Active Application Alerts
Provides a list of the active alerts associated with applications.
Application Health Overview
Provides an overview of the status of all assigned Application Monitors.
Last 25 Application Events

688

Chapter 16: Viewing Performance and Status

Provides a list of the last twenty-five events associated with applications.
For more information about creating alerts for these events, see Creating
Alerts on page722.
thwack Community Latest Application Monitor Templates
Provides a list of the newest Application Monitor templates that have been
added to the thwack community web site. Click a template to open its
download web page.
Top XX Components by Statistic Data
Provides a list of the monitors with the highest reported statistic data values.
Because comparing disparate statistic measurements is of limited use, we
suggest you create Statistic Data resource containing filters to limit the
statistic sources. For example, you can show the statistic values only of the
mail queue size of your Exchange servers.
Top XX Components by Response Time
Provides a list of the monitors with the slowest response time on the
selected node.
Top XX Processes by CPU Load
Provides a list of the monitors consuming the most CPU on the selected
node.
Top XX Processes by Physical Memory
Provides a list of the monitors consuming the most physical memory on the
selected node.
Top XX Processes by Virtual Memory
Provides a list of the monitors consuming the most virtual memory on the
selected node.
SAM Sample Map
Provides a sample map for SolarWinds SAM.
All Groups
Displays information for the selected SAM Groups.
Custom Object Resource
Provides information for an object you select. Allows you to monitor a
specific node, volume, application and component resources in a summary

689

Understanding SAM Application Details

view. For example, you can now create a custom object resource to monitor
Application Availability in a Network Summary view.
For more information about a resource, click Help in the resource.

Understanding SAM Application Details

The SAM Application Details view provides the following resources. You can
customize which of these resources appear on the page by clicking Customize
Page. You may see different resources depending on the item you are viewing.
Note: You can also add SolarWinds SAM node resources to the application
details view. For example, you can add the CPU Load & Memory Utilization
charts or Packet Loss gauges. For more information about adding resources to
views, see Editing Views" on page 205.
Application Details
Provides a list of application properties, including the application name,
application status, application server status, component names, component
types, and component status.
Buttons are provided to Edit Application Monitor, Unmanage the
application, or Poll Now.
Last XX Application Events
Provides a customizable list of the most current XX events specific to the
application.
Active Application Alerts
Provides a list of the active alerts specific to the application.
Components
Provides a list of the components included in the application and their
response times.
Processes and Services
Provides a list of the process and service monitors included in the
application and the response time for the application you are viewing.
Application Availability
Provides a bar chart of the application availability percentage. To modify the
chart, click the title of the chart. Ensure you adjust your polling to less than

690

Chapter 16: Viewing Performance and Status

the interval you want displayed in charts. Not adjusting your polling will
result in gaps in your charts.
For more information about a resource, click Help in the resource.

Understanding SolarWinds SAM Component

Details
The Component Details view provides the following resources. You can
customize which of these resources appear on the page by clicking Customize
Page.

Component Statistics
Provides a number of gauges that pertain to the selected component.
Response time is provided for port components. CPU load, physical
memory, and virtual memory gauges are provided for process and service
components.
Note: SNMP process components do not include the virtual memory
gauge.
Component Details
Provides a number of details about the component, including application
status, component status, component type, component-specific properties,
last up time, next poll time, and any warning or critical thresholds.

691

Understanding SolarWinds SAM Component Details

Component Availability
Provides a chart of component availability. To modify the chart, click the
chart title. Ensure you adjust your polling to less than the interval you want
displayed in charts. Not adjusting your polling will result in gaps in your
charts.
Last 25 Component Events
Provides the last 25 events specific to the component.
Min/Max Average Response Time
Provides a chart of the minimum, maximum, and average response times of
the component. To modify the chart, click the chart title. This chart is
available for port components only. Ensure you adjust your polling to less
than the interval you want displayed in charts. Not adjusting your polling will
result in gaps in your charts.
Min/Max Average CPU Load
Provides a chart of the minimum, maximum, and average CPU loads of the
component. To modify the chart, click the chart title. This chart is available
for access and process components only. Ensure you adjust your polling to
less than the interval you want displayed in charts. Not adjusting your
polling will result in gaps in your charts.
Min/Max Average Physical Memory
Provides a chart of the minimum, maximum, and average physical memory
of the component. To modify the chart, click the chart title. This chart is
available for access and process components only. Ensure you adjust your
polling to less than the interval you want displayed in charts. Not adjusting
your polling will result in gaps in your charts.
Min/Max Average Virtual Memory
Provides a chart of the minimum, maximum, and average virtual memory of
the component. To modify the chart, click the chart title. This chart is
available for access and process components only. Ensure you adjust your
polling to less than the interval you want displayed in charts. Not adjusting
your polling will result in gaps in your charts.
Min/Max Average Statistic Data
Provides a chart of the minimum, maximum, and average statistic data of the
component. To modify the chart, click the chart title. This chart is available

692

Chapter 16: Viewing Performance and Status

for access and process components only. Ensure you adjust your polling to
less than the interval you want displayed in charts. Not adjusting your
polling will result in gaps in your charts.
For more information about a resource, click Help in the resource.

Understanding SolarWinds SAM Component Settings

This resource provides a view of the current settings for a particular component.
When editing a component, any changes made will appear in this resource for
quick reference.

Showing SolarWinds SAM Data in Node Details

You have the option of adding the SolarWinds SAM application resources to the
Node Details pages.
To enable SolarWinds SAM-specific resources:
Click Yes when SAM asks on first log on whether you want to include SAM
resources on the Node Details page.
- or 1. Log on to your SolarWinds Web Console with an Administrator account.
2. Click Settings near the top right corner of the window, and then click Manage Views.
3. Select Node Details on the Manage Views page, and then click Edit.
4. Click [+] next to the column in which you want to display SAM resources.

693

Customizing SAM Application Summary Views

5. Click [+] to expand the Node Detail Reports category, and then check the
resources you want to add, for example:
l Applications
l Top XX Processes by CPU Load
l Top XX Components by Response Time
6. Click Submit.
7. Click Done on the Customize Node Details page.
8. Navigate to a node with which you have associated an application and
review the new resources.
Additionally, the Management resource is located on the Node Details page and
provides a variety of self-explanatory options for that particular node, as shown
below:

Customizing SAM Application Summary Views

Filtering SAM Application Summary Views lets you create custom summary
views that limit the displayed information to applications or nodes that match
certain criteria. For example, you can create a filtered application summary view
that shows only information from applications containing Linux in the application
name. After creating filter limited views, you can add them as menu items under
the Applications tab.
Pre-configured Summary Views
SolarWinds SAM ships with seven pre-configured summary view menu items. To
access these views, move your pointer to the menu bar at the top of the
Applications tab in your SolarWinds Web Console and then click one of the
following items:
SAM Summary
This is an unfiltered summary view.
Active Directory

694

Chapter 16: Viewing Performance and Status

Summary information for applications with Active Directory in the
application name.
Exchange
Summary information for applications with Exchange in the application
name.
SQL Server
Summary information for applications with SQL Server in the application
name.
IIS
Summary information for applications with Internet Information in the
application name.
Windows
Summary information for applications with Windows in the application
name.
Linux
Summary information for applications with Linux in the application name.
Summary View Filtering Criteria
Each summary view may be filtered by only one view limitation entry, but some
view limitation entries allow you to select more than one criteria. For example, the
Group of Application Names limitation allows you to select multiple application
names.
In addition to the standard view limitations of SolarWinds common components,
the following view limitations are also available in SolarWinds SAM:
Application Name Pattern
Limit the view to an assigned application or applications fitting a certain
naming pattern. Enter the naming pattern and then click Submit. The
asterisk (*) is a valid wildcard for this view limitation type.
Group of Application Names
Limit the view to a group of assigned applications that share the same
application names. You may select multiple application names for this
group. Select the applications from the list and then click Submit.
Specific Applications

695

To create a Filtered Applications Summary view based on the default SAM

Limit the view to individual applications assigned to specific nodes. Select
the assigned applications, and then click Submit.
To create a Filtered Applications Summary view based on the default SAM
Application Summary view:
1. Log on to your SolarWinds Web Console with an Administrator account.
2. Click Settings near the top right corner of the window, and then click Manage Views.
3. Select SAM Application Summary and then click Copy.
4. Select Copy of SAM Application Summary and then click Edit.
5. Click Edit in the View Limitation section.
6. Select a view limitation and click Continue. For example, Application
Name Pattern.
7. Enter the view limitation criteria and then click Submit. For example:
*Oracle*

8. Enter a new name for this summary view and then click Update. For
example: SAM Oracle Application Summary
9. Click Done.
To add a summary view menu item to the menu bar in the Applications tab:
1. Log on to your SolarWinds Web Console with an Administrator account.
2. Click Settings near the top right corner of the window, and then click Manage Views.
3. Select the summary view you want to add and then click Edit. For
example: SAM Oracle Application Summary.
4. Click Preview.
5. On the preview page, make note of the URL field of the browser. For
example, [Link]
6. Click Settings near the top right corner of the window, and then click Customize Menu Bars.
7. Click Edit in the Admin Menu Bar section.
8. Scroll to the bottom of the Available Items list and then click Add.
9. Enter a name for the menu item. For example: Oracle
10. Enter the URL of the summary view.
11. Click OK.
12. Drag the new menu item from the Available Items list to the Selected
Items list and then click Submit.

696

Chapter 16: Viewing Performance and Status

Customizing Application Details Views

Applications initially share a generic, default application details view. You can
add, remove, or rearrange resources in this default view, or you can create
completely new views that you can apply to groups of applications according to
their templates.
Default Application Details View
Application Details

Processes and Services

Last 25 Application Events Components

Active Application Alerts

Application Availability

Node Details

CPU Load & Memory Statistics

Availability Statistics
To customize the default SAM application details view:
1. Find an Application Monitor that is using the default view by following
these steps:
a. Click Settings and then click SAM Settings.
b. Click Manage Application Monitors.
c. Find an assigned Application Monitor without a Custom View.
d. Return to Applications > SAM Summary.
2. Click the Application Monitor to view its application details page.
3. Click Customize Page.
4. Proceed with your customizations.
Custom Application Details View
You can select and create a custom application details view. This custom view is
applied at the template level. Applications inherit the custom view setting from
their templates in the same way as other template settings.
To customize an application details view for an assigned Application Monitor:
1. Click Settings and then click SAM Settings.
2. Click Manage Application Monitors.
3. Check the check box next to an Application Monitor and then click Edit
Properties.

697

Managing Custom Application Details Views

4. Click Modify Template Settings in the field Custom Application Details
View.
5. Select Yes, use <TemplateName> Details View in the field Custom
Application Details View, where TemplateName is the name of the selected Application Monitor template.
6. Click Submit.
7. Click the name of the assigned Application Monitor to view its application
details page.
8. Click Customize Page.
9. Proceed with your customizations.
After creating a customized application details view for a template, you can
change the Custom Application Details View setting in the template properties
to switch between the default view and the custom view.
Managing Custom Application Details Views
For each template or application based upon a template, you can select either the
default application details view or the template's custom details view.
To select a view for a template:
1.
2.
3.
4.

Click Settings and then click SAM Settings.

Click Manage Templates.
Check the check box next to a template and then click Edit.
If you want applications based on this template to use the default
view, set Custom Application Details View to No, use Default Application Details View.
5. If you want applications based on this template to use the custom view, set
Custom Application Details View to Yes, use <TemplateName> Details
View, where TemplateName is the name of the selected template.
6. Click Submit.
To select a view for an application:
1. Click Settings and then click SAM Settings.
2. Click Manage Application Monitors.
3. Check the check box next to an Application Monitor and then click Edit
Properties.
4. Click Modify Template Settings in the field Custom Application Details
View.
5. If you want this application to use the default view, set Custom Application Details View to No, use Default Application Details View.

698

Chapter 16: Viewing Performance and Status

6. If you want this application to use the custom view, set Custom Application Details View to Yes, use <TemplateName> Details View, where
TemplateName is the name of the selected template.
7. Click Submit.

Viewing Node and Application Data in Tooltips

Node and application tooltips in SolarWinds SAM provide immediate status
overviews of monitored nodes and applications. To view a quick overview of any
monitored node or application in the web console, hover over the name of the
item. Depending on the selected device, the information in the following tables is
displayed immediately.
Node Tooltips
Hover
over

To see

Node
Status

Current status of the node (up, down, warning, unplugged, or

unmanaged)
Note: SolarWinds SAM now supports the ability to include
applications in calculation of node child status. So if node is up,
but application on that device is down, you will see a child status
icon indicating there is a problem.

IP
Address

The IP address currently assigned to the selected node

Machine
Type

The vendor icon and vendor description of the selected node

Average
The measured average response time of the selected node as of
Response the last node poll
Time
Packet
Loss

The percent of all transmitted packets that are lost by the selected
node as of the last node poll

CPU
Load

The percent of available processing capacity on the selected node

that is currently used as of the last node poll

699

Application Tooltips

Memory
Used

The percent of available memory on the selected node that is

currently used as of the last node poll

# of
Running
VMS

Number of running VMS and total VMS

ESX Host
Status

Status of the ESX Host

Application Tooltips
Hover over

To see

App Name

The name of the application.

App Status

The status of the application (up, down, unknown,

warning, or critical).

Server Status

Operational status of the server (up, down, warning,

unplugged, or unmanaged).

Components with
Problems

List of the components with problems and their statuses.

Monitoring Network Events in the Web Console

SolarWinds SAM automatically logs all events that occur to any monitored
devices on your network. These events are then displayed in the SolarWinds
Web Console, so you can view and acknowledge them as your network
management policies require.

Viewing Event Details in the Web Console

SolarWinds logs network events and lists them in the readily customizable Events
view of the Web Console. Events are shown in order of occurrence, and they may
be viewed by device, date and time, and event or device type.

700

Chapter 16: Viewing Performance and Status

Note: The Network Event Log is maintained as part of the Nightly Database
Maintenance plan defined within the Database Settings area of the SolarWinds
Polling Setting page in the SolarWinds Web Console. Records are kept for the
number of days specified Events Retention field (the default is 30 days). For more
information, see SolarWinds Polling Settings on page312.
To view event details in the Web Console:
1. Click Start> All Programs> SolarWinds > SolarWinds Web Console.
2. Log in to the SolarWinds Web Console, and then click Events in the
Views toolbar.
3. If you want to filter your events view by object, select the Network
Object or Type of Device to which you want to limit your view in the Filter
Devices area.
4. If you want to limit your events view to show only events of a specific
type, select the appropriate Event Type in the Filter Events area.
5. If you only want to see events from a specific period of time, complete
either of the following options:
l Select a predefined period from the Time Period menu.
l Select Custom from the Time Period menu, and then click the
appropriate fields to provide Begin and End dates and times.
6. In the Show X Events field, provide the maximum number of events you
want to view.
7. If you want to show all events, including events that have already
been cleared, check Show Cleared Events.
8. Click Refresh to complete your events view configuration.

Acknowledging Events in the Web Console

Acknowledging network events is straightforward in the Web Console, as shown
in the following procedure.
To acknowledge events in the Web Console:
1. Click Start> All Programs> SolarWinds> SolarWinds Web Console.
2. Log in to the SolarWinds Web Console, and then click Events in the
Views toolbar.
3. Provide appropriate filter criteria for the displayed events. For more information, see Viewing Event Details in the Web Console on page700.
4. Click Refresh to ensure that all selected view criteria take effect.
5. Check individual events to acknowledge or click Select All.
6. Click Clear Selected Events.

701

Understanding Volume Details

Understanding Volume Details

SAM has the ability to monitor Disk Volume with great detail. Windows mount
points are treated as regular volumes.
Note: Monitoring mount points can only be done on nodes that are monitored via
WMI
To navigate to the Volume Details page:
1. From the web console click the Home tab.
2. In the All Nodes resource, click any node.
3. From the Node Details page, click any volume in the Disk Volumes
resource.
The Volume Details page comes with a variety of resources and charts that
provide details about the volume being monitored.
If this resource is not shown, you can add it to the current view by taking the
following steps:
1.
2.
3.
4.

Click Customize Page.

Click [+] in either column.
Search for Disk Volumes, and then click Add Selected Resources.
Click Done.

Volume Details Resource

This resource provides detailed memory information about the current volume
being monitored.

702

Chapter 16: Viewing Performance and Status

Volume Polling Details

This resource provides detailed polling information about the current volume
being monitored.

Total Disk IOPS

This resource provides detailed read/write information about the current volume
being monitored and is located on the Volume Details page. This chart lets you
see the number of disk reads and writes
This chart is interactive. Hovering over any part of the chart will provide detailed
information. You can check or uncheck any box in the legend to add or remove
that element from the chart, as shown below:

703

Avg. Disk sec/Transfer

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders, highlighted above. The main
view of the chart will display the selected time period between the two sliders of
the lower chart.
Note: The Export button will allow you to export this data to both MS Excel and
HTML.

Avg. Disk sec/Transfer

This resource provides average data transfer rate information about the current
volume being monitored and is located on the Volume Details page.

704

Chapter 16: Viewing Performance and Status

This chart is interactive. Hovering over any part of the chart will provide detailed
information. You can check or uncheck any box in the legend to add or remove
that element from the chart, as shown below:

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
you can have the chart show a specific time range by dragging the mouse over a
small area of the chart, or by adjusting the sliders, also highlighted.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders, highlighted above. The main
view of the chart will display the selected time period between the two sliders of
the lower chart.
Note: The Export button will allow you to export this data to both MS Excel and
HTML.

705

Disk queue length

Disk queue length

This resource provides information about the length of the disk queue for the
current volume being monitored and is located on the Volume Details page.
This chart is interactive. Hovering over any part of the chart will provide detailed
information. You can check or uncheck any box in the legend to add or remove
that element from the chart, as shown below:

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
you can have the chart show a specific time range by dragging the mouse over a
small area of the chart, or by adjusting the sliders, also highlighted.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders, highlighted above. The main
view of the chart will display the selected time period between the two sliders of
the lower chart.

706

Chapter 16: Viewing Performance and Status

Note: The Export button will allow you to export this data to both MS Excel and
HTML.

Avg. Disk Space Used - Today

This resource shows the average amount of disk space used on the current
volume being monitored and is located on the Volume Details page.
This chart is interactive. Hovering over any part of the chart will provide detailed
information. You can check or uncheck any box in the legend to add or remove
that element from the chart, as shown below:

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
you can have the chart show a specific time range by dragging the mouse over a
small area of the chart, or by adjusting the sliders, also highlighted.

707

Percent Disk Space Used - Today

Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders, highlighted above. The main
view of the chart will display the selected time period between the two sliders of
the lower chart.
Note: The Export button will allow you to export this data to both MS Excel and
HTML.

Percent Disk Space Used - Today

This resource shows the percentage of disk space used on the current volume
being monitored and is located on the Volume Details page.
This chart is interactive. Hovering over any part of the chart will provide detailed
information. You can check or uncheck any box in the legend to add or remove
that element from the chart, as shown below:

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,

708

Chapter 16: Viewing Performance and Status

you can have the chart show a specific time range by dragging the mouse over a
small area of the chart, or by adjusting the sliders, also highlighted.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders, highlighted above. The main
view of the chart will display the selected time period between the two sliders of
the lower chart.
Note: The Export button will allow you to export this data to both MS Excel and
HTML.

Volume Size
This resource shows the size of the current volume being monitored and is
located on the Volume Details page.
This chart is interactive. Hovering over any part of the chart will provide detailed
information. You can check or uncheck any box in the legend to add or remove
that element from the chart, as shown below:

Zooming

709

Understanding Interface Details

You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
you can have the chart show a specific time range by dragging the mouse over a
small area of the chart, or by adjusting the sliders, also highlighted.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders, highlighted above. The main
view of the chart will display the selected time period between the two sliders of
the lower chart.
Note: The Export button will allow you to export this data to both MS Excel and
HTML.

Understanding Interface Details

SAM offers the added ability to monitor Windows based interfaces using WMI.
To navigate to the Interface Details page:
1.
2.
3.
4.

From the web console click the Home tab.

In the All Nodes resource, click Manage Nodes.
From the Show dropdown list, select Interfaces.
Click on an interface in the list.

The Interface Details page comes with a variety of resources and charts that
provide details about the interface being monitored. Most are self-explanatory.
Those that are not are listed below:
Note: Using the Enterprise Operations Console (EOC) with a standalone version
of SAM 5.5 will not allow interfaces to be monitored via WMI. For more
information, refer to the following KB article:
[Link]

Interface Details Resource

This resource provides detailed information about the current interface being
monitored. You also have the ability to manage this interface with the four buttons,
Edit Interface, Unmanage, Poll Now, and Rediscovery, located at the top in the
Management section, as shown below:

710

Chapter 16: Viewing Performance and Status

Percent Utilization
These gauges provide a visual representation showing the percentage of utilized
bandwidth when transmitting and receiving data. The Thresholds button allows
you to configure these thresholds to suit your needs.

Min/Max Average bps In/Out Chart

The Min/Max Average bps In/Out Chart is located on the Interface Details page.
This chart lets you see the average amount of bits per second being transmitted
and received. It also shows the values for the lowest number and highest number
where this data is concerned.
This chart is interactive. Hovering over any part of the chart will provide detailed
information. You can check or uncheck any box in the legend to add or remove
that element from the chart, as shown below:

711

Percent Utilization - Line Chart

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
you can have the chart show a specific time range by dragging the mouse over a
small area of the chart, or by adjusting the sliders, also highlighted.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders, highlighted above. The main
view of the chart will display the selected time period between the two sliders of
the lower chart.
Note: The Export button will allow you to export this data to both MS Excel and
HTML.

Percent Utilization - Line Chart

The Percent Utilization Line Chart is located the Interface Details page. This
chart lets you see the percent of bandwidth being utilized when transmitting and
receiving data.
This chart is interactive. Hovering over any part of the chart will provide detailed
information. You can check or uncheck any box in the legend to add or remove
that element from the chart, as shown below:

712

Chapter 16: Viewing Performance and Status

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
you can have the chart show a specific time range by dragging the mouse over a
small area of the chart, or by adjusting the sliders, also highlighted.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders, highlighted above. The main
view of the chart will display the selected time period between the two sliders of
the lower chart.

713

In/Out Errors and Discards

Note: The Export button will allow you to export this data to both MS Excel and
HTML.

In/Out Errors and Discards

The In/Out Errors and Discards chart is located the Interface Details page. This
chart lets you see the number of errors/discards the occurred when data was
transmitted and received.
This chart is interactive. Hovering over any part of the chart will provide detailed
information. You can check or uncheck any box in the legend to add or remove
that element from the chart, as shown below:

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
you can have the chart show a specific time range by dragging the mouse over a
small area of the chart, or by adjusting the sliders, also highlighted.

714

Chapter 16: Viewing Performance and Status

Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders, highlighted above. The main
view of the chart will display the selected time period between the two sliders of
the lower chart.
Note: The Export button will allow you to export this data to both MS Excel and
HTML.

Total Bytes Transferred

The Total Bytes Transferred chart is located the Interface Details page. This chart
lets you see the total amount of data transmitted, measured in bytes
This chart is interactive. Hovering over any part of the chart will provide detailed
information. You can check or uncheck any box in the legend to add or remove
that element from the chart, as shown below:

Zooming

715

Min/Max/Average Packets In/Out

You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
you can have the chart show a specific time range by dragging the mouse over a
small area of the chart, or by adjusting the sliders, also highlighted.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders, highlighted above. The main
view of the chart will display the selected time period between the two sliders of
the lower chart.
Note: The Export button will allow you to export this data to both MS Excel and
HTML.

Min/Max/Average Packets In/Out

The Min/Max/Average Packets In/Out chart is located the Interface Details page.
This chart lets you see the total number of packets per second that was both
transmitted and received. It also shows the values for the lowest number, highest
number, and average number where this data is concerned.
This chart is interactive. Hovering over any part of the chart will provide detailed
information. You can check or uncheck any box in the legend to add or remove
that element from the chart, as shown below:

716

Chapter 16: Viewing Performance and Status

Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
you can have the chart show a specific time range by dragging the mouse over a
small area of the chart, or by adjusting the sliders, also highlighted.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders, highlighted above. The main
view of the chart will display the selected time period between the two sliders of
the lower chart.

717

Min/Max/Average Packets In/Out

Note: The Export button will allow you to export this data to both MS Excel and
HTML.

718

Chapter 17:
Creating Account Limitations
The Account Limitation Builder application allows you to create and customize
account limitations for the SolarWinds Web Console. These limitations ensure
that users of the web console can only view the network objects that are pertinent
to their job duties. The following are but a few examples of the uses of account
limitation in the SolarWinds Web Console:
l
l
l
l

Limit customer views to specific network nodes

Limit views by department or functional area
Limit views by device type or device role
Limit views based on the geographic location of devices

SolarWinds SAM provides predefined account limitations that use built-in

SolarWinds SAM property to limit user access. For greater flexibility, however,
you can use the Account Limitation Builder to create your own account limitations
based on predefined or custom properties. For more information about enabling
account limitations in the SolarWinds Web Console, see Setting Account
Limitations on page303. For more information about custom properties, see
Creating Custom Properties on page924.

Using the Account Limitation Builder

Before you can use the Account Limitation Builder, you must have first created the
custom property that you want to use to limit the Server & Application Monitor
Web Console view. For more information, see Creating Custom Properties on
page924. After you have defined custom properties and populated them with
data, you may use the Account Limitations Builder as directed in the following
procedure.

Creating an Account Limitation

The following steps create an account limitation.

719

Chapter 17: Creating Account Limitations

To create an account limitation:
1. Click Start> All Programs> SolarWinds> Grouping and Access
Control> Account Limitation Builder.
2. Click Start on the splash screen.
3. Click Edit> Add Limitation.
4. Select a Custom Property.
Notes:
l If Custom Property is empty, you need to define a custom property.
For more information, see Creating Custom Properties on
page924.
l The remaining boxes are populated automatically, based upon your
selection.
5. Choose a Selection Method.
Note: This is the selection format that will appear when you are choosing
values for the account limitation through the web Account Manager. For
more information, see Setting Account Limitations on page303.
6. If you want to include your own description of your account limitation, type
your description over the default text provided in the Description field.
7. Click OK.
Your newly defined account limitation is added to the top of the table view. You
may now use the new limitation in the SolarWinds Web Console Account
Manager. For more information, see Setting Account Limitations on page303.

Deleting an Account Limitation

The following steps delete an account limitation using the Account Limitation
Builder utility.
To delete an account limitation:
1. Click Start> All Programs> SolarWinds> Grouping and Access
Control> Account Limitation Builder.
2. Click Start on the splash screen.
3. Click the row of the limitation that you want to delete.
Note: Use Shift+click to highlight multiple consecutive rows or Ctrl+Click to
highlight multiple non-consecutive rows.
4. Click Edit> Delete Selected Limitations.
Note: Although SolarWinds deletes the selected limitations from the table,
ensuring that they will no longer be available through the web Account Manager,
if you delete a limitation using the Account Limitation Builder, all accounts that

720

To delete an account limitation:

have been assigned that limitation will remain limited. Deleting a limitation makes
it unavailable for future use in the SolarWinds Web Console.

721

Chapter 18:
Alerting and Reporting
The following sections provide an in-depth look into the alerting and reporting
capabilities built into SolarWinds SAM.
Refer to the following sections for more information:
l
l
l
l
l
l
l
l
l
l

Creating Alerts
Adding Alert Actions
Testing Alert Actions
Viewing Alerts in the SolarWinds Web Console
Restarting Windows Services with an Alert Action
Acknowledging Advanced Alerts in the Web Console
Escalated Advanced Alerts
Viewing Alerts from Mobile Devices
Restarting Windows Services with an Alert Action
Creating SolarWinds SAM-Specific Reports

Creating Alerts
SolarWinds SAM provides application and component alerts you can use with
SolarWinds Advanced Alert Manager to actively monitor and respond to detected
issues.
Note: Only advanced alerts may be used for SolarWinds SAM-specific purposes.
Basic alerts cannot be configured to trigger on SolarWinds SAM conditions or
events.
Refer to the following sections for more information:
l

Configuring SolarWinds SAM Alerts

722

Chapter 18: Alerting and Reporting

SolarWinds SAM Alerts

Configuring SolarWinds SAM Alerts

To configure a new alert:
1. Log on to the Windows server hosting SolarWinds SAM.
2. Click Start> All Programs> SolarWinds > Alerting, Reporting, and
Mapping> Advanced Alert Manager.
3. Click Configure Alerts. This opens the Manage Alerts window.
Example 1: SolarWinds SAM Alert
This example sets up an alert triggered when a components status is Critical,
and logs the alert to the NetPerfMon event log.
To set up this alert trigger condition:
1.
2.
3.
4.
5.
6.
7.

Click New in the Manage Alerts window.

Type Alert me when a component goes critical in the Name of Alert field.
Click the Trigger Condition tab.
Select APM: Component from the Type of Property to Monitor list.
Click Add, and then click Simple Condition from the shortcut menu.
Click the first asterisk (*) in the statement * is equal to *.
Point to APM Component Monitors and then click Component Status in
the shortcut menu.

723

To set up the alert trigger action:

8. Click the remaining asterisk (*) in the statement Component Status is equal to *.
9. Type Critical in the list box.
To set up the alert trigger action:
1.
2.
3.
4.
5.

6.
7.
8.
9.

10.
11.
12.

Click the Trigger Actions tab.

Click Add New Action.
Select Log the Alert to the NetPerfMon Event Log, and then click OK.
Type "The component" in the message field, and then click Insert Variable.
Select APM:Component from the Variable Category list, select ComponentName from the Select A Variable list, and then click Build Selected
Variable.
Type "of node" in the message field, and then click Insert Variable.
Select General from the Variable Category list, select NodeName from the
Select A Variable list, and then click Build Selected Variable.
Type "is" in the message field, and then click Insert Variable.
Select APM:Component from the Variable Category list, select ComponentStatus from the Select A Variable list, and then click Build Selected Variable.
Note: The full message should read "The component ${ComponentName} of
node ${NodeName} is ${ComponentStatus}.
Click OK to close the Log Alert window.
Click OK to close the Edit Alert window.
Click Done to close the Manage Alerts window.

If any of your components go into a critical state, you will now see a line item for
each in the SolarWinds SAM Event Log.
Example 2: Displaying Root Cause of Group Status in SolarWinds SAM
Alert
This example sets up an alert that is triggered when the group is Down, displays
the root cause for the groups status in the alert, and logs the alert to the
NetPerfMon event log.
To set up this alert trigger condition:
1. Click New in the Manage Alerts window.
2. Type Alert me and show the root cause for the groups status in the
Name of Alert field.
3. Click the Trigger Condition tab.
4. Select Group from the Type of Property to Monitor list.
5. Click Add, and then click Simple Condition from the shortcut menu.

724

Chapter 18: Alerting and Reporting

6.
7.
8.
9.

Click the first asterisk (*) in the statement * is equal to *.

Point to Group and then click Group Status in the shortcut menu.
Click the remaining asterisk (*) in the statement Group Status is equal to *.
Type Down in the list box.

To set up the alert trigger action:

1.
2.
3.
4.
5.
6.
7.

8.
9.

10.
11.
12.

Click the Trigger Actions tab.

Click Add New Action.
Select Log the Alert to the NetPerfMon Event Log, and then click OK.
Type "Group" in the message field, and then click Insert Variable.
Select Group from the Variable Category list, select ContainerName from
the Select A Variable list, and then click Build Selected Variable.
Type "is" in the message field, and then click Insert Variable.
Select Group from the Variable Category list, select ContainerStatusName from the Select A Variable list, and then click Build
Selected Variable.
Type " because " in the message field, and then click Insert Variable.
Select Group from the Variable Category list, select StatusRootCause
from the Select A Variable list, and then click Build Selected Variable.
Note: The full message should read "Group ${GroupName} is
${GroupStatusName} because ${StatusRootCause}.
Click OK to close the Log Alert window.
Click OK to close the Edit Alert window.
Click Done to close the Manage Alerts window.

If any of your groups go into a Down state, you will now see a line item for each
that displays the first-level root cause of the group status for the alert in the
SolarWinds SAM Event Log. For example, Group g3 is Down because Internet
Information Services on TESTBED is Down.
Note: SolarWinds SAM does not recurse into a sub-group with problems to locate
the root cause for the problem status ${StatusRootCause}. For example, if an object
2 levels deep inside a sub-group is actually responsible for the problem status,
SolarWinds SAM will not recurse all the way down inside the sub-group to name
the actual object that is responsible for the problem. It simply reports the subgroups name and its status.

SolarWinds SAM Alerts

Your installation of SolarWinds SAM supplements the alerting abilities of
SolarWinds common components with a number of SolarWinds SAM-specific

725

Component Monitor Alerting Properties

configurable alerts.
The following list provides the SolarWinds SAM properties on which you can
trigger alerts:
Component Monitor Alerting Properties
Provides the following alert possibilities:
Component Name
This allows you to base your alert criteria on component names.
Component Type
This allows you to base your alert criteria on component types. Specify the
component monitor type by value using the following table.
Component Monitor Type

Value

None

DHCP User Experience Monitor

35

Directory Size Monitor

38

DNS Monitor - TCP

DNS Monitor - UDP

DNS User Experience Monitor

15

Download Speed Monitor

25

File Age Monitor

36

File Change Monitor

23

File Count Monitor

39

File Existence Monitor

28

File Size Monitor

22

FTP Monitor

726

Chapter 18: Alerting and Reporting

FTP User Experience Monitor

24

HTTP Form Login Monitor

27

HTTP Monitor

HTTPS Monitor

14

IMAP4 Monitor

13

IMAP4 User Experience Monitor

30

JMX Monitor

49

LDAP User Experience Monitor

34

Linux/Unix Script Monitor

21

MAPI User Experience Monitor

31

Nagios Script Monitor

50

NNTP Monitor

11

ODBC User Experience Monitor

16

Oracle User Experience Monitor

18

Performance Counter Monitor

37

POP3 Monitor

12

POP3 User Experience Monitor

29

Process Monitor SNMP

Process Monitor - WMI

RADIUS User Experience Monitor

40

SMTP Monitor

10

SNMP Monitor

32

727

Component Monitor Alerting Properties

SQL User Experience Monitor

17

TACACS+ User Experience Monitor 41

TCP Port Monitor

Tomcat Server Monitor

33

Web Link Monitor

26

Windows Event Monitor

42

Windows PowerShell Monitor

45

Windows Script Monitor

20

Windows Service Monitor

WMI Monitor

19

Component Status
This allows you to alert on Critical, Down, Unknown, Up, and Warning
status.
Response Time
This allows you to alert on response time.
Statistic Data
This allows you to alert on statistic data.
Process (Service) Name
This allows you to alert on the process or service name. For example:
[Link], or AlertingEngine.
Process Instance Count
This allows you to alert on the instance count of a process.
Percent CPU
This allows you to alert on the percentage of CPU in use.
Percent Physical Memory
This allows you to alert on the percentage of physical memory in use.

728

Chapter 18: Alerting and Reporting

Percent Memory Used
This allows you to alert on the percentage of total memory in use.
Percent Virtual Memory
This allows you to alert on the percentage of virtual memory in use.
Virtual Memory Used
This allows you to alert on the amount of virtual memory in use, in bytes.
Application Monitor Alerting properties
Below are alert possibilities:
Application Name
This allows you to select the names of currently configured application
templates as values.
Application Status
This allows you to select whether the application is in a Critical, Down,
Unknown, Up, or Warning status.
Application Monitor Variables for Alerts
SolarWinds SAM adds the following variables to the core SolarWinds Orion
variables when selecting APM-Application as the property type. For a complete
list of Core variables, see "SolarWinds Variables and Examples" on page 939.
Application Variable

Definition

${APM:ApplicationDetailsURL}

Hyperlink to
application details
page that is either the
current alert triggered
on or the details page
of the application that
the component that
triggered the alert
belongs to.

${Availability}

Provides the status of

the application.

729

Application Monitor Variables for Alerts

${ComponentsWithProblems}

Provides a commadelimited list of

components in a
down, unknown,
warning, or critical
state.

${ComponentsWithProblemsFormatted}

List of components that

are not up along with
component status
included formatted
with html tags. Html
formatting is used for
send e-mail action to
provide improved
appearance of listed
components.

${ComponentsWithProblemsFormattedHtml} List of components that

are not up along with
component status
included. Formatted
with html tags for
events that appear on
the web console.
${ComponentsWithStatus}

Provides a commadelimited list of all

components and their
current status.

${ComponentsWithStatusFormatted}

List of components
with component status
included formatted
with html tags. Html
formatting is used for
send e-mail action to
provide improved

730

Chapter 18: Alerting and Reporting

appearance of listed
components.
${ComponentsWithStatusFormattedHtml}

List of components
with component status
Formatted with html
tags for events that
appear on the web
console.

${ID}

Provides the numeric

application ID of the
specific application.

${LastTimeUp}

Provides the date and

time the application
was last seen in an Up
state.

${Name}

Provides the name of

the Application that is
triggering the Alert.

${NodeID}

Provides the numeric

node ID of the server
on which the
application is
monitored.

${SystemSummaryFormatted}

System summary. Html

formatting is used for
send e-mail action to
provide improved
appearance of listed
components.

${SystemSummaryFormattedHtml}

System summary.
Formatted with html
tags for events that

731

Component Monitor Variables for Alerts

appear on the web

console.
Provides the last
polling date and time
of an application.

${TimeStamp}

Component Monitor Variables for Alerts

SolarWinds SAM adds the following variables to the core SolarWinds Orion
variables when selecting APM-Component as the property type.
Component Monitor Variable

Definition

${APM:ComponentDetailsURL}

Hyperlink to component
details page that is the current
alert triggered on.

${ApplicationId}

Provides the unique numeric

identifier of the application.
This value is analogous to the
node ID.

${ApplicationName}

Provides the name of the

monitored application.

${ApplicationStatus}

Provides the status of the

application.

${ComponentId}

Provides the numeric

component ID of the specific
application.

${ComponentMessage}

Message sent when alerting

on component status.

${ComponentName}

Provides the name of the

component, for example, SW
Module Engine.

732

Chapter 18: Alerting and Reporting

${ComponentStatus}

Provides the status of the

specific component.

${ComponentType}

Provides the numeric

component type. For more
information, see SolarWinds
SAM Alerts on page725.

${DisplayType}

Provides the display type, for

example, Windows Service,
for the specific monitor.

${LastTimeUp}

Provides the date and time a

component was last seen in
the Up state.

${MemoryUsed}

Provides the memory used by

a component, in bytes.

${MultiValueMessages}

Message sent when alerting

on Multiple Value Chart.

${MultiValueStatistics}

Statistics sent when alerting

on Multiple Value Chart.

${NodeID}

Provides the numeric node ID

of the server on which the
application is monitored.

${PercentApplicationAvailability} Provides the availability of an

application as a percentage.
${PercentComponentAvailability}

Provides the availability of a

component as a percentage.

${PercentCPU}

Provides the CPU used by a

component as a percentage.

${PercentMemory}

Provides the memory used by

a component as a

733

Component Monitor Variables for Alerts

percentage.
${PercentVirtualMemory}

Provides the virtual memory

used by a component as a
percentage.

${ProcessInstanceCount}

Provides the instance count of

a process.

${ProcessName}

Provides the process name.

${ResponseTime}

Provides the response time of

a component.

${StatisticData}

Provides the statistics data

value of a component.

${StatusOrErrorDescription]

Provides the status of the

component, including the full
text of any error messages.

${Threshold-CPU-Critical}

Provides the critical threshold

for CPU.

${Threshold-CPU-Warning}

Provides the warning

threshold for CPU.

${Threshold-PhysicalMemoryCritical}

Provides the critical threshold

for physical memory.

${Threshold-PhysicalMemoryWarning}

Provides the warning

threshold for physical
memory.

${Threshold-ResponseTimeCritical}

Provides the critical threshold

for response time.

${Threshold-ResponseTime-Warning} Provides the warning

threshold for response time.
${Threshold-Statistic-Critical}

734

Provides the critical threshold

Chapter 18: Alerting and Reporting

for statistics.
${Threshold-Statistic-Warning}

Provides the warning

threshold for statistics.

${Threshold-VirtualMemoryCritical}

Provides the critical threshold

for virtual memory.

${Threshold-VirtualMemoryWarning}

Provides the warning

threshold for virtual memory.

${TimeStamp}

Provides the last polling date

and time of a component.

${UserDescription}

Provides a description of the

component. Note: A default
description is given by
SolarWinds. Any changes
you make will override the
default description and be
automatically saved.

${UserNotes}

Provides notes from the user

about a component. Changes
you make will automatically
be saved.

${WindowsEventMessages}

Full details of the

corresponding event.

${VirtualMemoryUsed}

Provides the virtual memory

used by a component, in
bytes.

Testing Alert Actions

The Advanced Alert Manager provides an alert action test feature so you can
confirm the desired function for actions you have configured to fire when
SolarWinds detects an alert condition on your network. Complete the following
procedure to test an alert action:

735

To test an alert action:

To test an alert action:
1. Click Start> All Programs> SolarWinds> Alerting, Reporting, and
Mapping> Advanced Alert Manager.
2. Click Configure Alerts.
3. Click the alert for which the action you want to test is configured.
4. Click Test.
5. If the alert is configured to fire on a node condition, select Alert on Network Node, and then select the node against which you want to test the
action.
6. If the alert is configured to fire on an interface condition, complete the
following steps:
Note: Testing alert actions against interfaces is only available if
SolarWinds Network Performance Monitor is installed and monitoring interfaces on your network. For more information, see the SolarWinds Network
Performance Monitor Administrator Guide.
a. Select Alert on Network Node, and then select the parent node
of the interface against which you want to test the action.
b. Select Select Interface on ParentNode, and then select the
interface against which you want to test the action.
7. If the alert is configured to fire on a volume condition, complete the following steps:
a. Select Alert on Network Node, and then select the parent node
of the volume against which you want to test the action.
b. Select Select Volume on ParentNode, and then select the
volume against which you want to test the action.
8. To test an alert trigger action, click Test Alert Trigger.
9. To test an alert reset action, click Test Alert Reset.
10. When the test completes, as indicated by the test log, click Done.
Confirm that the expected action occurred as a result of the selected alert trigger
or reset.

Viewing Alerts in the SolarWinds Web Console

The Triggered Alerts for All Network Devices page provides a table view of your
alerts log. You can customize the list view by using the following procedure to
select your preferred alert grouping criteria.
To view alerts in the Web Console:
1. Click Start> All Programs> SolarWinds> SolarWinds Web Console.
2. Click Alerts in the Views toolbar.

736

Chapter 18: Alerting and Reporting

3. To filter your alerts table view by device, select the device to which you
want to limit your alerts view in the Network Object field.
4. To filter your alerts table by type of device, select the device type to
which you want to limit your alerts view in the Type of Device field.
5. To limit your alerts table to show a specific type of alert, select the alert
type in the Alert Name field.
6. In the Show Alerts field, provide the number of alerts you want to view.
7. To show all alerts, even if they have already been cleared or acknowledged, check Show Acknowledged Alerts.
8. Click Refresh to complete your Alerts view configuration.

Acknowledging Advanced Alerts in the Web Console

SolarWinds SAM allows you to acknowledge advanced alerts in the SolarWinds
Web Console, allowing you to eliminate time lost either when multiple users
attempt to resolve the same issue or when a user tries to address an issue that
has already been resolved.
To acknowledge advanced alerts using the SolarWinds Web Console:
1. Log in to the SolarWinds Web Console using an account that has been
granted alert acknowledgement privileges.
Note: For more information about access privileges for SolarWinds Web
Console users, see User Account Access Settings on page 300.
2. Click Alerts on the Views toolbar.
3. To limit the list of alerts to only those dealing with a single device,
select the specific device from the Network Object list.
Note: This option is only available if alerts fire on multiple network
devices.
4. To limit the list of alerts to only those dealing with a single type of
device, select the device type from the Type of Device list.
Note: This option is only available if SolarWinds is monitoring multiple
types of network devices.
5. To limit the list of alerts to only those of a single type, select the specific alert type from the Alert Name list.
Note: This option is only available when multiple types of SolarWinds
SAM alerts have been triggered.
6. Confirm the number of alerts displayed in the Show Alerts field.
7. If you want acknowledged alerts to remain in the Alerts view, even
after they have been acknowledged, check Show Acknowledged
Alerts.

737

Viewing Alerts from Mobile Devices

8. Click Refresh to update the alerts list with your new settings.
9. Check Acknowledged next to the alerts you want to acknowledge.
10. Click Acknowledge Alerts.

Viewing Alerts from Mobile Devices

SolarWinds SAM is capable of detecting when you are accessing the SolarWinds
Web Console from a mobile device. This mobile alerts view allows you to view
and acknowledge existing active alerts.
To view and acknowledge alerts from a mobile device:
1. Using a browser on your mobile device, log in to your SolarWinds Web
Console as a user with alert management rights.
2. Click Alerts in the Views toolbar.
Note: If you want to view the mobile alerts view from a desktop or server
browser, add ?IsMobileView=true to the URL of the Alerts view in your
SolarWinds Web Console.
3. Check alerts you want to acknowledge, and then click Acknowledge.
Clickable links in alert messages provide more information about triggered alerts.

Restarting Windows Services with an Alert Action

You can use the alert trigger action "Execute program" to restart a Windows
service that is down. SolarWinds SAM restarts the service by running an included
program named [Link]. When given the Component ID number of
a Windows Service monitor, this program restarts the service using the service
name and credential defined in the monitor.
The Component ID number of a monitor is an internal designation. If the alert is
an SAM Component-based alert, use the ${ComponentId} variable to pass the
Component ID to the program.
Usage:
APMServiceControl ComponentId [-h] [-c=COMMAND-NAME] [-t=TIMEOUT]

Options:
ComponentId:The ID of the Windows Service Component Monitor to [Link]
theAdvanced Alert Engine,you can use the alert variable${{ComponentId}}to
determine this value.
-c = COMMAND

NAME:The command to sent to the service. This must

beSTART,STOP, orRESTART. The default is {0}.
-t = TIMEOUT:Timeout for the

command in seconds. Default is {1} second.

738

Chapter 18: Alerting and Reporting

-h =This

is help text.

Example:
From a Component Alert Trigger:APMServiceControl ${{ComponentId}} -c=RESTART
would look like the following: [Link] 156849 -c=RESTART

To manually determine the Component ID number, go to the Component Details

View in the Web Console. The number after AM: in the URL of the page is the
Component ID. For example:
[Link]

Example Alert Manager Trigger Action to Restart a Windows Service

Execute program: [Link] ${ComponentId}

Using the Preconfigured Restart a Service Alert

The SolarWinds Alert Manager includes a pre-configured alert called Restart a
Service that has a recovery action to restart a service if a Windows service
component monitor is down. You must enable this alert manually because it is
disabled by default.
To enable the Restart a Service alert:
1. Click Start> All Programs > SolarWinds> Alerting, Reporting, and
Mapping > Advanced Alert Manager.
2. Click Configure Alerts.
3. Check Restart a Service.
4. Click Done.

Creating a New Advanced Alert

The following procedure creates a new advanced alert.
To create a new advanced alert:
1. Click Start> SolarWinds> Alerting, Reporting, and Mapping>
Advanced Alert Manager.

739

To create a new advanced alert:

2. Click View> Configure Alerts.

3. Click New.

740

Chapter 18: Alerting and Reporting

The Edit Alert window displays, providing an array of configurable alerting
options, including trigger and reset conditions, suppressions, and date and time
limitations. The following sections provide more information about configuring
alert options.

Naming, Describing, and Enabling an Advanced Alert

Use the following steps, after clicking New, Copy, or Edit from the Manage Alerts
window, to name and describe an advanced alert.
To name and describe an advanced alert:
1. Click Start> SolarWinds> Alerting, Reporting, and Mapping>
Advanced Alert Manager.
2. Click View> Configure Alerts.
3. To create a new alert, click New.
4. To copy or edit an existing alert, select an alert from the list, and then
click Copy or Edit, as appropriate.

5. Click General, type the name of your alert in the Name of Alert field, and
then type a description of your alert in the description field.

741

To name and describe an advanced alert:

6. Check Enable this Alert.

7. Type the Alert Evaluation Frequency and select Seconds, Minutes, or

Hours from the list to set the checking interval for your alert.

8. Click Trigger Condition to set the trigger condition for your alert. For more
information, see Setting a Trigger Condition for an Advanced Alert on

742

Chapter 18: Alerting and Reporting

page743.

Setting a Trigger Condition for an Advanced Alert

You can set the specific conditions for triggering an advanced alert with the
following procedure.
Note: Properly defining alert trigger conditions to address specific network
conditions on selected network objects can eliminate the need for alert
suppression conditions. SolarWinds recommends the use of appropriately
specific trigger conditions to define alerts instead of suppression conditions, if
possible. For more information about defining conditions, see Understanding
Condition Groups on page750.
To set the trigger conditions for an advanced alert:
1. Click Start> SolarWinds> Alerting, Reporting, and Mapping>
Advanced Alert Manager.
2. Click View> Configure Alerts.
3. To create a new alert, click New.
4. To copy or edit an existing alert, select an alert from the list, and then
click Copy or Edit, as appropriate.
5. Click Trigger Condition.
6. Select the Type of Property to Monitor from the list.
Note: The following image is a screen capture from a SolarWinds Network
Performance Monitor installation. Other modules will look similar, but different objects may be present.

7. If you select Custom SQL Alert, complete the following steps:

743

To set the trigger conditions for an advanced alert:

a. Select the object on which you want to alert in the Set up your Trigger
Query field.
b. Provide your custom SQL in the field below the object selection query.
c. To delay the trigger of this alert, provide the value and unit of your
desired alert trigger delay.
d. To confirm your provided SQL, click Validate SQL.
8. If you select a type of monitored object, complete the following
steps:
a. Generate trigger conditions in the text field by selecting appropriate
descriptors from the linked context menus and by clicking Browse ()
on the left of the text field.
b. Click the linked text to select the number of conditions that you want to
apply (all, any, none, not all). For more information about linked text
conditions, see Understanding Condition Groups on page750.

c. Click Browse () to view the following condition options:

Note: The has changed condition is only valid for the Last Boot, IOS
Version, and IOS Image Family device characteristics.

To generate a condition based on a comparison of device states,

click Add a Simple Condition.

744

Chapter 18: Alerting and Reporting

l
l

To generate a condition based on a comparison of device fields

and values, click Add a Complex Condition.
To define more conditions, click Add a Condition Group.
To remove a selected condition, click Delete Current
Condition.
To change the order of your conditions, click Move Down or
Move Up, as appropriate.
d. To add a condition, click Browse (), and then click Add
ConditionType, as appropriate for the condition you want to
add.
e. To delete a condition, click Browse (), next to the condition you want to delete, and then click Delete Current
Condition.
Notes:
l

Conditions may be exported for use with other alerts by

clicking Export Conditions and saving as appropriate.
Click Import Conditions to import existing conditions
from other alerts. Imported trigger conditions automatically overwrite any existing trigger conditions.

f. To specify a time duration for the condition to be valid, type the

interval and select Seconds, Minutes, or Hours from the list.
Note: You may need to delay alert trigger actions until a condition has
been sustained for a certain amount of time. For example, an alert
based on CPU load would not trigger unless the CPU Load of a node
has been over 80% for more than 10 minutes. To set up a sustainedstate trigger condition, at the bottom of the Trigger Condition tab,
provide an appropriate amount of time the alert engine should wait
before any actions are performed. By default, the alert triggers immediately, if the trigger condition exists. The maximum alert action delay is
eight hours after the trigger condition is met.

745

Setting a Reset Condition for an Advanced Alert

g. When done, click OK.

Setting a Reset Condition for an Advanced Alert

Set specific conditions for resetting an advanced alert using the following steps.
To set the conditions for resetting an advanced alert:
1. Click Start> SolarWinds> Alerting, Reporting, and Mapping>
Advanced Alert Manager.
2. Click View> Configure Alerts, and then click New or select an alert from
the list and click Copy or Edit.
3. Click Reset Condition.
4. If you want a simple alert reset when trigger conditions no longer
exist, select Reset when trigger conditions are no longer true.
5. If you want a conditional alert reset, select Reset this alert when the following conditions are met.
Note: Generate reset conditions in the text field by selecting appropriate
descriptors from the linked context menus and by clicking Browse ().
6. To copy the condition used on the Trigger Condition tab, click Copy
From Trigger.
7. Click the linked text to select the number of conditions to apply. For more
information, see Understanding Condition Groups on page750.
8. Click Browse () to view the following condition options:
l To generate a condition based on a comparison of device states,
click Add a Simple Condition.
l To generate a condition based on a comparison of device fields and
values, click Add a Complex Condition.
l To further define condition application, click Add a Condition
Group.
l To remove a selected condition, click Delete Current Condition.
l To change the order of your conditions, click Move Down or Move
Up.
9. To add a condition, click Add, and then select the type of condition you
want to add.
10. To delete a condition, select the condition from the condition list, and then
click Delete.
Notes:
l Conditions may be exported for use with other alerts by clicking
Export Conditions and saving as appropriate.
l Conditions from other alerts may be imported to the current alert by
clicking Import Conditions.

746

Chapter 18: Alerting and Reporting

Warning: Imported trigger conditions automatically overwrite any
existing trigger conditions.
l Because there are many situations where the reset conditions are
the opposite of, or are very similar to, the trigger conditions,
SolarWinds has provided a function that copies the trigger conditions to the reset conditions. Click Copy From Trigger to add the
trigger condition.
11. To specify a time duration for the condition to be valid, type the time
interval and select Seconds, Minutes, or Hours from the list.
Note: It is often appropriate to delay alert reset actions until a condition has
been sustained for a certain amount of time. For example, an alert based
on node status would not reset until the node has been up for more than
five minutes. To establish a sustained-state reset condition, provide an
appropriate interval at the bottom of the Reset Condition tab for the amount
of time that the alert engine should wait before any actions are performed.
The default setting is to reset the alert immediately, once the reset condition exists. The maximum interval between when the trigger condition
first exists and when the corresponding alert action is performed is eight
hours.
12. When done, click OK.
l

Setting a Suppression for an Advanced Alert

You can set the specific conditions for suppressing an advanced alert using the
following procedure.
Notes:
l Alert Suppression is only available if you have checked Show Advanced
Features in the lower left of the Edit Advanced Alert window.
l In many cases, because suppression conditions are checked against all
monitored objects on your network, properly defining alert trigger conditions may eliminate the need for alert suppression. For more information
about defining alert trigger conditions, see Setting a Trigger Condition for
an Advanced Alert on page743 and Understanding Condition Groups
on page750.
To set conditions for advanced alert suppression:
1. Click Start> All Programs> SolarWinds> Alerting, Reporting, and
Mapping> Advanced Alert Manager.
2. Click View> Configure Alerts.

747

Setting the Monitoring Period for an Advanced Alert

3. Click New or select an alert from the list.
4. Click Copy or Edit, as appropriate.
5. Click Alert Suppression.
Note: Generate suppression conditions in the text field by selecting appropriate descriptors from the linked context menus and by clicking Browse
() on the left of the text field.
6. To copy the condition used on the Trigger Condition tab, click Copy
From Trigger.
7. Click the linked text to select the number of conditions that you want to
apply (all, any, none, not all). For more information about linked text conditions, see Understanding Condition Groups on page750.
8. Click Browse () to view the following condition options:
l To generate a condition based on a comparison of device states,
click Add a Simple Condition.
l To generate a condition based on a comparison of device fields and
values, click Add a Complex Condition.
l To further define the application of your conditions, click Add a
Condition Group.
l To remove a selected condition, click Delete Current Condition.
l To change the order of your conditions, click Move Down or Move
Up.
9. To add a condition, click Add and then select the type of condition you
want to add.
10. To delete a condition, select the condition from the condition list, and then
click Delete.
Note: Conditions may be exported for use with other alerts by clicking
Export Conditions and saving as appropriate. Conditions from other
alerts may be imported to the current alert by clicking Import Conditions.
Warning: Imported conditions automatically overwrite existing conditions.
11. If you are finished configuring your advanced alert, click OK.

Setting the Monitoring Period for an Advanced Alert

You can select the specific time periods and days that your advanced alert will
monitor your network objects with the following procedure.
To set the monitoring time period and days for an advanced alert:
1. Click Start> All Programs> SolarWinds> Alerting, Reporting, and
Mapping> Advanced Alert Manager.
2. Click View> Configure Alerts.
3. Click New or select an alert from the list.

748

Chapter 18: Alerting and Reporting

4. Click Copy or Edit.
5. Click Time of Day.
6. Enter the time period over which you want to monitor your network.
Note: Alerts only trigger if the trigger condition is met within this time
period.
7. Select the days on which you want to monitor your network.
Note: Alerts will only trigger if your trigger condition is met on the days
selected.
8. When done, click OK.

Setting a Trigger Action for an Advanced Alert

Select actions that will occur when your advanced alert is triggered as follows.
To set a trigger action for an advanced alert:
1. Click Start> SolarWinds> Alerting, Reporting, and Mapping>
Advanced Alert Manager.
2. Click View> Configure Alerts.
3. Click New or select an alert from the list, and then click Copy or Edit, as
appropriate.
4. Click Trigger Actions.
5. To add a new advanced alert action, click Add New Action, and then
select the actions you want to occur when the alert triggers.
6. To edit an existing advanced alert action, select the existing alert action,
and then click Edit Selected Action.
7. Follow the instructions to configure each action.
Note: Depending on the type of action selected, different options will be
displayed to configure the alert action. For more information about individual alert actions, see Alerting and Reporting" on page 722.
8. To delete an action, select the action and then click Delete Selected
Action.
9. When done, click OK.

Setting a Reset Action for an Advanced Alert

Select actions that will occur when your advanced alert is reset with the following
procedure.
To set a reset action for an advanced alert:
1. Click Start> SolarWinds> Alerting, Reporting, and Mapping>
Advanced Alert Manager.

749

Alert Escalation
2.
3.
4.
5.
6.
7.

8.
9.

Click View> Configure Alerts.

Click New Alert, Copy Alert, or Edit Alert, as appropriate.
Click Reset Actions.
To add an advanced alert action, click Add New Action, and then select
the actions you want to occur when the alert triggers.
To edit an advanced alert action, select the existing alert action, and
then click Edit Selected Action.
Follow the instructions to configure each action.
Note: Depending on the type of action selected, different options display
configuring the alert action. For more information about individual alert
actions, see Escalated Advanced Alerts" on page 768.
To delete a selected action, click Delete Selected Action.
When done, click OK.

Alert Escalation
When editing any trigger or reset action, use the Alert Escalation tab, if it is
available, to define additional alert action options. Depending on the alert action
being configured, any or all of the following options may be available on the Alert
Escalation tab:
l

To disable the action when the alert has been acknowledged, check Do
not execute this Action if the Alert has been Acknowledged.
To execute the action repeatedly as long as the trigger condition exists,
check Execute this Action repeatedly while the Alert is Triggered and
then provide an appropriate action execution interval.
To delay the execution of the alert action, check Delay the execution of
this Action and then provide an appropriate interval that the alert engine
should wait after the alert condition is met before the alert action is
executed.

For more information, see Escalated Advanced Alerts on page768.

Understanding Condition Groups

A condition group is a set of user-defined rules governing alert triggers and
resets. By default, the condition group Trigger Alert when all of the following apply is
added when new alert triggers or reset conditions are created. Four different
logical descriptors are used to create conditions: all, any, none, and not all, and
clicking the word all and enables you to select different values. The following
sections describe these logical descriptors.

750

Chapter 18: Alerting and Reporting

All Condition Group
Trigger Alert when all of the following apply means

that every condition in the group

must be true before the alert is triggered.

In the following example, there are three conditions within the condition group:
l
l
l

Node Status is equal to Up

Percent Loss is greater than or equal to 75
CPU Load is greater than or equal to 85

This alert will not trigger unless the Node is Up, packet loss is greater than or
equal to 75%, and CPU load is greater than or equal to 85%.
When setting the condition group to all, picture every condition as being
separated by an and statement. So, in this example, the alert trigger would read:
Alert when: (Node Status=Up) and (Percent Loss>=75) and (CPU Load>=85)

Any Condition Group

Changing the condition group to Trigger Alert when any of the following apply
changes the logic to or statements. In this example, changing the condition group
to any would change the alert trigger to:
Alert when: (Node Status=Up) or (Percent Loss>=75) or (CPU Load>=85)

In this situation, if any of the three conditions become true, the alert will trigger.
None Condition Group
Changing the condition group to Trigger Alert when none of the following apply
means that all conditions in the group must be false before the alert is triggered.
In this example the alert trigger would read:
Alert when: (Node Status=Down) and (Percent Loss<=75) and (CPULoad<=85)

Each condition is separated by an and statement just like the all condition group;
however, the conditions have been inverted (Node Status = Down instead of Node
Status = Up).
Not All Condition Group
Changing the condition group to Trigger Alert when not all of the following apply
means that any condition in the group must be false before the alert is triggered.
So, in this example the alert trigger would read:
Alert when: (Node Status=Down) or (Percent Loss<=75) or (CPU Load<=85)

751

Using the Advanced Alert Manager

Each condition is separated by an or statement just like the any condition group;
however, the conditions have been inverted (Node Status=Down instead of Node
Status=Up).
Note: The states of Down and Unreachable are not equivalent. They are two
distinct states. For example: If the trigger condition, Status is not equal to Up, is met,
an alert will be triggered for Unreachable applications.

Using the Advanced Alert Manager

The Advanced Alert Manager is an interface used to view network events and
alerts. You can also use Advanced Alert Manager to create and manage
advanced alerts. The following procedures introduce the main features of the
Advanced Alert Manager showing how to configure and view advanced alerts.
Current Events Window
The Current Events window of the Advanced Alert Manager shows the most
recent network events with their descriptions and other information from the
events log.
To use the Current Events window to view network events:
1. Click Start> All Programs> SolarWinds> Alerting, Reporting, and
Mapping> Advanced Alert Manager.
2. Click View> Current Events.
3. Select one of the following Group By criteria for grouping events: Event
Type, Object Type, Network Node, Acknowledged, or No Grouping.
4. To change the viewable category columns in the Current Events window, click Include, and then complete the following procedure:
a. Click the Event View Columns tab, and then select column IDs from the
All Columns field.
b. Click the right arrow to move your column IDs into the Selected
Columns field.
c. If there are any column IDs in the Selected Columns field that you
do not want to view, select them, and then click the left arrow to move
your selected column IDs to the All Columns field.
d. Click the up or down arrows to change the order of your selected
columns accordingly.
e. Position the slider to set the Event View refresh rate.
f. Type the number of events that you want to be able to review in the Display a maximum of XXXX events in the Event View field.
g. When done, click OK.

752

Chapter 18: Alerting and Reporting

5. Click Refresh to update the Current Events window with the latest events
and column IDs.
6. To acknowledge a network event, click X next to the event.
Active Alerts Window
The Active Alerts window of the Advanced Alert Manager shows network alerts
with their descriptions and other information from the alerts log.
To use the Active Alerts window to view active network alerts:
1. Click Start> All Programs> SolarWinds> Alerting, Reporting, and
Mapping> Advanced Alert Manager.
2. Click View> Active Alerts.
3. Select one of the Group By criteria for grouping alerts: Alert Name,
Object Type, Object Name, Alert State, Acknowledged, Acknowledged
By, or No Grouping.
4. Click Include, and then check the types of alerts that you want to view:
Acknowledged, Trigger Pending, Triggered, or Reset Pending.
5. To change the viewable category columns in the Current Events window, click Include> Select Alert Columns, and then complete the following procedure:
a. Select column IDs from the All Columns field.
b. Click the right arrow to move your column IDs into the Selected
Columns field.
c. If there are any column IDs in the Selected Columns field that you
do not want to view, select them, and then click the left arrow to move
your selected column IDs to the All Columns field.
d. Click the up or down arrows to change the order of your selected
columns accordingly.
e. Position the slider to set the Alert View refresh rate.
f. When done, click OK.
6. Click Refresh to update the Active Alerts window with the latest alerts and
column IDs.
7. Click Configure Alerts to change the settings for individual alerts. For
more information, see Creating and Viewing Reports" on page 772.
8. To acknowledge an active alert, check the alert in the Acknowledged
column.
Note: As soon as the alert is acknowledged, the user information and date/time is
recorded in the database.

753

Alert Viewer Settings

Alert Viewer Settings
Alert views in the SolarWinds Advanced Alert Manager are configured in the Alert
Viewer Settings window, as presented in the following procedure.
To configure alert views in the Advanced Alert Manager:
1. Click Start> All Programs> SolarWinds> Alerting, Reporting, and
Mapping> Advanced Alert Manager.
2. Click File> Settings.
Note: The Configure Alerts tab of the Alert Viewer Settings window displays all available network alerts, and from this window you can create,
copy, edit, and delete alerts.
3. Click Alert View Columns.
4. Select the information titles that you want to see about your alerts from the
All Columns list.
5. Click the right arrow to transfer them to the Selected Columns list.
Note: The Selected Columns list provides a list of all the information that
the Alert Viewer will show for each active [Link]: The Selected
Columns list provides a list of all the information that the Alert Viewer will
show for each active alert.
6. To remove titles from the Selected Columns list, select titles that you
want to remove from the active view in the Selected Columns list, and
then click the left arrow.
7. To rearrange the order in which the different pieces of alert information are presented in the Alert Viewer, select titles from the Selected
Columns list and use the up and down arrows to arrange the titles accordingly.
8. Position the slider at the bottom of the tab to set the Alert View refresh rate.
9. Click Event View Columns.
10. Select the information titles that you want to see about events from the All
Columns list.
11. Click the right arrow to transfer them to the Selected Columns list.
Note: The Selected Columns list provides a list of all the information that
the Alert Viewer will show for each recorded event.
12. To remove titles from the Selected Columns list, select titles that you
want to remove from the active view in the Selected Columns list, and
then click the left arrow.
13. To rearrange the order in which the different pieces of event information are presented in the Alert Viewer, select titles from the Selected

754

Chapter 18: Alerting and Reporting

Columns list and use the up and down arrows to arrange the titles accordingly.
14. Position the slider at the bottom of the tab to set the Event view refresh
rate.
15. Enter the number of events that you want to see in the Event view.

Adding Alert Actions

SolarWinds SAM provides a variety of actions to signal an alert condition on your
network. These alert actions are available for both basic and advanced alerts,
and the following procedure assigns actions to the alert conditions that you have
defined for your network.
To add an alert action:
1. Click Start> All Programs> SolarWinds Orion > Alerting, Reporting,
and mapping > Advanced Alert Manager
2. Click Configure Alerts.
3. Check the alert to which you want to add the action, and then click Edit.
4. Click the Trigger Actions tab, and then select the action you want to edit.
5. Click Add New Action, and then click the action to add to your chosen
alert.
Refer to the following sections for more information:
l
l
l
l
l
l
l
l
l
l
l
l
l
l

Sending an E-mail / Page

Playing a Sound
Logging an Advanced Alert to a File
Logging an Advanced Alert to the Windows Event Log
Logging an Advanced Alert to the NetPerfMon Event Log
Sending a Syslog Message
Executing an External Program
Executing a Visual Basic Script
Emailing a Web Page
Using Text to Speech Output
Sending a Windows Net Message
Sending an SNMP Trap
Using Get or Post URL Functions
Dial Paging or SMS Service

Sending an E-mail / Page

The following procedure configures an e-mail/page action for an advanced alert.

755

To configure an email/page action for an advanced alert:

Note: Emails and pages are sent in plain text.
To configure an email/page action for an advanced alert:
1. Click E-mail/Pager Addresses, and then
2. Complete the To, CC, BCC, Name, and Reply Address fields.
Note: You must provide at least one email address in the To field, and multiple addresses must be separated with commas. Some pager systems
require a valid reply address to complete the page.
3. Click Message.
4. Select the format (Plain text or HTML) for your alert email.
5. Type the Subject and Message of your alert trigger email/page.
Note: Messaging is disabled if both Subject and Message fields are
empty.
6. To insert a variable into the Subject or Message field, click the location
of the new variable, and then complete the following procedure:
a. Click Insert Variable.
b. Select a Variable Category, and then select the variable to add.
c. To change the parser, check Change Parser, and then select the
parser you want to use.
d. To define the SQL variable to copy to the clipboard, check Define
SQL Variable, and then click Insert Variable From Above List.
e. Click Build Selected Variable.
Note: For more information about messages that use variables, see
SolarWinds Variables and Examples" on page 939.
7. Click SMTP Server.
8. Type the Hostname or IP Address of your SMTP Server and the designated SMTP Port Number.
Note: The SMTP server hostname or IP address field is required. You cannot send an email/page alert without identifying the SMTP server.
9. To use SSL/TLS encryption for your alert email, check Enable SSL.
10. If your SMTP server requires authentication, check This SMTP Server
requires Authentication.
11. Click Time of Day.
12. Enter the time period over which you want to activate your alert action, and
then select the days on which you want to activate your alert action.
13. To enable alert escalation, click the Alert Escalation tab, and then check
any of the following options, as appropriate for your alert:
l To disable the action when the alert has been acknowledged, check
Do not execute this Action if the Alert has been Acknowledged.

756

Chapter 18: Alerting and Reporting

To execute the action repeatedly as long as the trigger condition
exists, check Execute this Action repeatedly while the Alert is
Triggered and then provide an appropriate action execution interval.
l To delay alert action execution, check Delay the execution of this
Action, and then provide an appropriate interval the alert engine
should wait after the alert condition is met before the alert action is
executed.
14. When done, click OK.
l

Playing a Sound
SolarWinds can be configured to play a sound upon alert trigger or reset. The
following procedure configures a sound to play for an advanced alert.
Note: Due to restrictions on Windows service applications, the Play a Sound
action is not available to SolarWinds installations on either Windows 7 or
Windows Server 2008 and higher.
To configure a play sound action for an advanced alert:
1. Click Play Sound.
2. Specify a sound file for the alert trigger by doing either of the following in
the Sound file to play field:
l Type the complete directory path and file name.
l Click Browse () to navigate your file system and select the target
file.
3. Click the musical note button to the right of either text field to test the sound
file you have specified.
4. Click Time of Day.
5. Enter the time period over which you want to activate your alert action, and
then select the days on which you want to activate your alert action.
6. To enable alert escalation, click Alert Escalation, and then check any of
the following options, as appropriate for your alert:
l To disable the action when the alert has been acknowledged, check
Do not execute this Action if the Alert has been Acknowledged.
l To execute the action repeatedly as long as the trigger condition
exists, check Execute this Action repeatedly while the Alert is
Triggered and then provide an appropriate action execution interval.
l To delay alert action execution, check Delay the execution of this
Action, and then provide an appropriate interval the alert engine

757

Logging an Advanced Alert to a File

should wait after the alert condition is met before the alert action is
executed.
7. When done, click OK.

Logging an Advanced Alert to a File

SolarWinds can be configured to log alerts to a designated file. The following
procedure logs an advanced alert to a designated file
To configure an alert log file for an advanced alert:
1. Click Event Log, and then specify an alert log file by doing either of the following in the Alert Log Filename field:
Note: If the file specified does not exist, it will be created with the first alert
occurrence.
l Type the complete path and name of the target file.
l Click Browse () to navigate your file system and select the target
file.
2. Type the message you want to log to your alert log file in the Message
field.
3. To insert a variable into the Message field, complete the following procedure:
a. Click Insert Variable, and then select a Variable Category.
b. Select the variable you want to add.
c. To change the parser, check Change Parser, and then select the
parser you want to use.
d. To define the SQL variable to copy to the clipboard, check
Define SQL Variable, and then click Insert Variable From Above
List.
e. Click Build Selected Variable.
Note: For more information about messages that use variables, see
SolarWinds Variables and Examples" on page 939.
4. Click Time of Day.
5. Enter the time period over which you want to activate your alert action.
6. Select the days on which you want to activate your alert action.
7. To enable alert escalation, click the Alert Escalation tab, and then check
any of the following options, as appropriate for your alert:
l To disable the action when the alert has been acknowledged, check
Do not execute this Action if the Alert has been Acknowledged.
l To execute the action repeatedly as long as the trigger condition
exists, check Execute this Action repeatedly while the Alert is

758

Chapter 18: Alerting and Reporting

Triggered and then provide an appropriate action execution interval.
l To delay alert action execution, check Delay the execution of this
Action, and then provide an appropriate interval the alert engine
should wait after the alert condition is met before the alert action is
executed.
8. When done, click OK.

Logging an Advanced Alert to the Windows Event Log

You may specify that an alert be logged to the Windows Event Log either on the
SolarWinds server or on a remote server. The following procedure logs an
advanced alert to the Windows Event Log on a designated server.
To configure advanced alert logging to the Windows Event Log:
1. Click Windows Event Log.
2. If you want your alert to write to the Windows Event Log on your
SolarWinds server, select Use Event Log Message on Network Performance Monitor Server.
3. If you want your alert to write to the Windows Event Log on a remote
server, select Use Event Log Message on a Remote Server, and then
provide the Remote Server Name or IP Address.
4. Type the message you want to log to the Windows Event Log in the Message to send to Windows Event Log field.
5. To insert a variable into the Message field, complete the following procedure:
a. Click Insert Variable.
b. Select a Variable Category.
c. Select the variable you want to add.
d. To change the parser, check Change Parser, and then select the
parser you want to use.
e. To define the SQL variable to copy to the clipboard, check Define
SQL Variable, and then click Insert Variable From Above List.
f. Click Build Selected Variable.
Note: For more information about messages that use variables, see
SolarWinds Variables and Examples" on page 939.
6. Click Time of Day.
7. Enter the time period and select the days over which you want to activate
your alert action.
8. To enable alert escalation, click Alert Escalation, and then check any of
the following options, as appropriate for your alert:

759

Logging an Advanced Alert to the NetPerfMon Event Log

To disable the action when the alert has been acknowledged, check
Do not execute this Action if the Alert has been Acknowledged.
l To execute the action repeatedly as long as the trigger condition
exists, check Execute this Action repeatedly while the Alert is
Triggered and then provide an appropriate action execution interval.
l To delay alert action execution, check Delay the execution of this
Action, and then provide an appropriate interval the alert engine
should wait after the alert condition is met before the alert action is
executed.
9. When done, click OK.
l

Logging an Advanced Alert to the NetPerfMon Event Log

You may specify that an alert be logged to the NetPerfMon Event Log either on
the SolarWinds server or on a remote server. The following procedure logs an
advanced alert to the NetPerfMon Event Log on a designated server.
To configure advanced alert logging to the NetPerfMon Event Log:
1. Click SAM Event Log.
2. Type the message you want to log to the NetPerfMon Event Log in the Message to send to Network Performance Monitor Event Log field.
3. To insert a variable into the Message field, complete the following procedure:
a. Click Insert Variable.
b. Select a Variable Category.
c. Select the variable you want to add.
d. To change the parser, check Change Parser, and then select
the parser you want to use.
e. To define the SQL variable to copy to the clipboard, check
Define SQL Variable, and then click Insert Variable From
Above List.
f. Click Build Selected Variable.
Note: For more information about messages that use variables,
see SolarWinds Variables and Examples" on page 939.
4. Click Time of Day.
5. Enter the time period and select the days over which you want to activate your alert action.
6. To enable alert escalation, click Alert Escalation, and then check any
of the following options, as appropriate for your alert:

760

Chapter 18: Alerting and Reporting

To disable the action when the alert has been acknowledged,
check Do not execute this Action if the Alert has been
Acknowledged.
l To execute the action repeatedly as long as the trigger condition
exists, check Execute this Action repeatedly while the Alert is
Triggered and then provide an appropriate action execution
interval.
l To delay alert action execution, check Delay the execution of
this Action, and then provide an appropriate interval the alert
engine should wait after the alert condition is met before the alert
action is executed.
7. When done, click OK.
l

Sending a Syslog Message

SolarWinds can log received alerts to the Syslog of a designated machine. The
following procedure configures an advanced alert to send a message to a
designated Syslog server.
To configure an advanced alert to send a Syslog message:
1. Click Syslog Message.
2. Type the Hostname or IP Address of the Syslog Server to which you
want to send Syslog messages.
3. Select the Severity of your alert Syslog message.
Note: For more information, see Using the SolarWinds Web Console Message Center" on page 231.
4. Select Facility of your alert Syslog message.
Note: For more information, see Using the SolarWinds Web Console Message Center" on page 231.
5. Type the Syslog Message you want to send.
6. To insert a variable into the Message field, complete the following procedure:
a. Click Insert Variable.
b. Select a Variable Category.
c. Select the variable you want to add.
d. To change the parser, check Change Parser, and then select the
parser you want to use.
e. To define the SQL variable to copy to the clipboard, check Define
SQL Variable, and then click Insert Variable From Above List.

761

Executing an External Program

7.
8.
9.
10.

11.

f. Click Build Selected Variable.

Note: For more information on the use of variables, see Syslog Alert
Variables."
Click Time of Day.
Enter the time period over which you want to activate your alert action.
Select the days on which you want to activate your alert action.
To enable alert escalation, click Alert Escalation, and then check any of
the following options, as appropriate for your alert:
l To disable the action when the alert has been acknowledged, check
Do not execute this Action if the Alert has been Acknowledged.
l To execute the action repeatedly as long as the trigger condition
exists, check Execute this Action repeatedly while the Alert is
Triggered and then provide an appropriate action execution interval.
l To delay alert action execution, check Delay the execution of this
Action, and then provide an appropriate interval the alert engine
should wait after the alert condition is met before the alert action is
executed.
When done, click OK.

Executing an External Program

There are several circumstances where you may want to execute a program
when a specific network event occurs. Use the Edit Execute Program Action
window to specify the executable that should be started when the specified alert
is triggered or reset, as shown in the following procedure.
Note: External programs selected for this action must be executable using a
batch file called from the command line.
To configure an advanced alert to execute an external program:
1. Click Execute Program.
2. Specify the batch file to execute, either by typing the complete path and
name of the target file into the Program to execute field or by clicking
Browse (), to browse your folder structure and select the target executable.
3. Click Time of Day, and then enter the time period when you want to
execute the external program.
4. Select the days on which you want to execute the external program.
5. Click Alert Escalation, and then check any of the following options, as
appropriate for your alert:

762

Chapter 18: Alerting and Reporting

To disable the action when the alert has been acknowledged, check
Do not execute this Action if the Alert has been Acknowledged.
l To execute the action repeatedly, while the trigger condition exists,
check Execute this Action repeatedly while the Alert is
Triggered, and then provide an action execution interval.
l To delay alert action execution, check Delay the execution of this
Action, and then provide the interval the alert engine should wait.
6. When done, click OK.
l

Executing a Visual Basic Script

In some situations you may want to execute a Visual Basic (VB) script when a
network event occurs. The Edit Execute VB Script Action window is used to
specify the name and complete path of the file that shall be executed when the
specified alert is triggered or reset.
To configure alerts to execute a Visual Basic (VB) script:
1. Click VB Script.
2. Select an available VB Script Interpreter.
3. Specify a VB script to execute either by typing the complete path and name
of the VB script into the VB Script to execute field or by clicking Browse
() to browse your folder structure and select the script.
4. Click Time of Day, and then enter the time period and select the days on
which you want to execute the selected VB script.
5. Click Alert Escalation, and then check any of the following options, as
appropriate for your alert:
l To disable the script when the alert has been acknowledged, check
Do not execute this Action if the Alert has been Acknowledged.
l To execute the script repeatedly as long as the trigger condition
exists, check Execute this Action repeatedly while the Alert is
Triggered and then provide an appropriate action execution interval.
l To delay script execution, check Delay the execution of this
Action, and then provide an appropriate interval the alert engine
should wait after the alert condition is met before the script
executes.
6. When done, click OK.

763

Emailing a Web Page

Emailing a Web Page

The Edit E-mail Web Page Action window includes several tabs for configuration.
The following procedure configures an e-mail URL action for an advanced alert.
Note: Emails are sent in plain text.
To configure an email web page action for an advanced alert:
1. Click E-mail a Web Page, and then click OK.
2. Complete the To, CC, BCC, Name, and Reply Address fields.
Note: You must provide at least one address in the To field. When entering multiple addresses, you may only separate addresses with a comma.
Some pager systems require a valid reply address to complete the page.
3. Click SMTP Server.
4. Type the Hostname or IP Address of your SMTP Server and the designated SMTP Port Number.
Note: The SMTP server hostname or IP address field is required. You cannot email a web page without identifying the SMTP server.
5. Click URL, and then type the Subject of your alert email.
Note: Messaging is disabled if both Subject and URL fields are empty.
6. To insert a variable into the Subject field, click the location of the new
variable, and then complete the following procedure:
a. Click Insert Variable, select a Variable Category, and then select the
variable to add.
b. To change the parser, check Change Parser, and then select the
parser you want to use.
c. To define the SQL variable to copy to the clipboard, check Define
SQL Variable, and then click Insert Variable From Above List.
d. Click Build Selected Variable.
Note: For more information on the use of variables, see Syslog Alert
Variables," on page 888.
7. Provide the URL of your alert email.
Note: Messaging is disabled if both Subject and URL fields are empty.
8. If the web server of the URL you want to email requires user access
authentication, provide both the Web Server UserID and the Web Server
Password in the Optional Web Server Authentication area.
9. Click Time of Day, and then enter the time period and select the days
when you want to activate your alert action.
10. To enable alert escalation, click Alert Escalation, and then check any of
the following options, as appropriate for your alert:

764

Chapter 18: Alerting and Reporting

To disable the action when the alert has been acknowledged, check
Do not execute this Action if the Alert has been Acknowledged.
l To execute the action repeatedly, as long as the trigger condition
exists, check Execute this Action repeatedly while the Alert is
Triggered and then provide an appropriate action execution interval.
l To delay alert action execution, check Delay the execution of this
Action, and then provide an appropriate interval for the alert engine
to wait after the alert condition is met before executing the alert
action.
11. When done, click OK.
l

Using Text to Speech Output

You may specify a phrase that will be spoken upon alert trigger and a separate
phrase for the alert reset. SolarWinds uses Microsoft Speech Synthesis Engine
version 5.0, as included with Windows 2003 and XP Professional. If you have
SolarWinds maintenance, you may also install and use other text-to-speech
engines by visiting the SolarWinds website. The following procedure configures
text-to-speech output for an advanced alert trigger or reset.
Note: Due to restrictions on Windows service applications, the Text to Speech
action is not available to SolarWinds installations on either Windows 7 or
Windows Server 2008 and higher.
To configure a text-to-speech output action for an advanced alert:
1. Click Text to Speech output, and then click OK.
2. On the General tab, Select a Speech Engine, and then use the sliders to
set the required Speed, Pitch and Volume.
3. On the Phrase tab, type the text you want to output as speech in the
Phrase to speak field.
Note: Click Speak to hear the text, as provided, with the options configured as set on the General tab.
4. On the Time of Day tab enter the time period and select the days on which
you want to activate your alert action.
5. To enable alert escalation, open the Alert Escalation tab, and then check
any of the following options, as appropriate for your alert:
l To disable the action when the alert has been acknowledged, check
Do not execute this Action if the Alert has been Acknowledged.
l To execute the action repeatedly, as long as the trigger condition
exists, check Execute this Action repeatedly while the Alert is

765

Sending a Windows Net Message

Triggered and then provide an appropriate action execution interval.
l To delay alert action execution, check Delay the execution of this
Action, and then provide an appropriate interval for the alert engine
to wait after the alert condition is met before executing the alert
action.
6. When done, click OK.

Sending a Windows Net Message

Alerts can be configured to display a pop-up Windows Net Message either on a
specific computer or on all computers in a selected domain or workgroup. The
following steps configure Windows Net messaging for triggered or reset alerts.
Note: The only operating systems supporting Windows Net Messaging on which
SolarWinds supports SolarWinds installations are Windows Server 2003 and
Windows XP. SolarWinds only supports evaluation installations of SolarWinds on
Windows XP.
To configure SolarWinds to send a Windows Net message upon alert:
1. Click Send a Windows Net Message, and then click OK.
2. On the Net Message tab, enter the Computer Name or IP Address of the
machine where you want to send a Windows Net message upon an alert
trigger or reset.
3. To send the message to all computers in the domain or workgroup of
your target computer, check Send to all Computers in the Domain or
Workgroup.
4. Enter the Windows Net message you want to send in the Message to
send field.
5. On the Time of Day tab enter the time period and select the days on which
you want to activate your alert action.
6. To enable alert escalation, open the Alert Escalation tab, and then check
any of the following options, as appropriate for your alert:
l To disable the action when the alert has been acknowledged, check
Do not execute this Action if the Alert has been Acknowledged.
l To execute the action repeatedly, as long as the trigger condition
exists, check Execute this Action repeatedly while the Alert is
Triggered and then provide an appropriate action execution interval.
l To delay alert action execution, check Delay the execution of this
Action, and then provide an appropriate interval for the alert engine

766

Chapter 18: Alerting and Reporting

to wait after the alert condition is met before executing the alert
action.
7. When done, click OK.

Sending an SNMP Trap

The following steps configure an alert to send an SNMP trap on trigger or reset.
To configure SolarWinds to send an SNMP trap upon alert:
1. Click Send an SNMP Trap, and then click OK.
2. On the SNMP Trap tab, in the SNMP Trap Destinations field, enter the IP
addresses of the servers to which you want to send your generated SNMP
traps.
Note: Use commas to separate multiple destination IP addresses.
3. Select the type of trap to send on alert trigger from the Trap Template list.
Note: Some trap templates may use an alert message. You may change
any provided text, if you want, but it is important that you understand the
use of variables beforehand. For more information on the use of variables,
see Syslog Alert Variables," on page 888.
4. Enter the SNMP Community String for your network in the designated
field.
5. On the Time of Day tab enter the time period and select the days on which
you want to activate your alert action.
6. To enable alert escalation, open the Alert Escalation tab, and then check
any of the following options, as appropriate for your alert:
l To disable the action when the alert has been acknowledged, check
Do not execute this Action if the Alert has been Acknowledged.
l To execute the action repeatedly, as long as the trigger condition
exists, check Execute this Action repeatedly while the Alert is
Triggered and then provide an appropriate action execution interval.
l To delay alert action execution, check Delay the execution of this
Action, and then provide an appropriate interval for the alert engine
to wait after the alert condition is met before executing the alert
action.
7. When done, click OK.

Using Get or Post URL Functions

SolarWinds can be configured to communicate alerts using HTTP GET or POST
functions. As an example, a URL may be used as an interface into a trouble ticket

767

To configure SolarWinds to use GET or POST URL functions with alerts:

system, and, by correctly formatting the GET function, new trouble tickets may be
created automatically. The following procedure configures SolarWinds to use
GET or POST HTTP functions to communicate alert information.
To configure SolarWinds to use GET or POST URL functions with alerts:
1. Click Get or Post a URL to a Web Server, and then click OK.
2. Select either Use HTTP GET or Use HTTP POST to set the function that
you want to use to communicate alert information.
3. If you selected Use HTTP GET, enter the URL you want to GET.
4. If you selected Use HTTP POST, enter the URL you want to POST, and
then enter the Body to POST.
5. On the Time of Day tab enter the time period and select the days on which
you want to activate your alert action.
6. To enable alert escalation, open the Alert Escalation tab, and then check
any of the following options, as appropriate for your alert:
l To disable the action when the alert has been acknowledged, check
Do not execute this Action if the Alert has been Acknowledged.
l To execute the action repeatedly, as long as the trigger condition
exists, check Execute this Action repeatedly while the Alert is
Triggered and then provide an appropriate action execution interval.
l To delay alert action execution, check Delay the execution of this
Action, and then provide an appropriate interval for the alert engine
to wait after the alert condition is met before executing the alert
action.
7. When done, click OK.

Dial Paging or SMS Service

If NotePager Pro is installed SolarWinds can be configured to communicate alerts
using paging and SMS services. For more information about installation and
configuration, see SolarWinds Network Performance Monitor Integration at
[Link].

Escalated Advanced Alerts

By creating an escalated alert, SolarWinds SAM enables you to customize a
series of alerts to trigger successive actions as an alert condition persists. The
following sections provide both a scenario where an escalated alert may be

768

Chapter 18: Alerting and Reporting

useful and the steps required to create one using the SolarWinds Advanced Alert
Manager.
Refer to the following sections for more information:
l
l

Escalated Alert Example

Creating a Series of Escalated Alerts

Escalated Alert Example

WidgetCo is a business with a small IT staff, consisting of two technicians and an
IT manager. To ensure that issues are addressed appropriately, the IT manager
has created multiple escalated alerts for a range of potential network events,
including device failures and excessive disk space or bandwidth usage.
Typically, the escalated alerts configured by the WidgetCo IT manager proceed
as follows:
1. Immediately, as soon as SolarWinds SAM recognizes an alert condition,
SolarWinds SAM generates both an email and a page that are sent to one
of the two technicians. An entry is also recorded in the SolarWinds events
log.
2. If the alert is not acknowledged in the SolarWinds Web Console within 20
minutes, a second alert is fired, generating another email and another
page, both sent to both technicians. An entry is also recorded in the
SolarWinds events log.
3. If the second alert is not acknowledged within 20 minutes, SolarWinds
SAM fires a third alert that sends both an email and a page to both technicians and to the IT manager. An entry is also recorded in the SolarWinds
events log.
Escalated alerts ensure that everyone on the WidgetCo IT staff is notified of any
significant network alert conditions within 45 minutes without burdening the IT
manager with excessive alert notifications. The following section provides a
procedure to create a similar escalated alert scheme.

Creating a Series of Escalated Alerts

The following procedure creates a series of escalated alerts similar to the scheme
described in the preceding example.
Note: Repeat these steps to create a separate alert for each notification level.
The example provided in the previous section uses a three-level escalated alert,
The following procedure should be completed three times, once for each alert, to
replicate the escalated alert of the previous section.

769

To create an escalated alert:

To create an escalated alert:
1. Click Start> All Programs> SolarWinds> Alerting, Reporting, and
Mapping> Advanced Alert Manager.
2. Click Configure Alerts.
3. Click New, and then click General.
4. Type Level X , where X is the level corresponding to the currently
configured alert, as the name of your escalated alert in the Name of Alert
field.
Note: The example provided in the previous section uses a three-level
escalated alert.
5. Type a description of your first level escalated alert in the description field,
and then check Enable this Alert.
6. Type the Alert Evaluation Frequency and select Seconds, Minutes, or
Hours from the list to set the checking interval for your alert.
7. Click Trigger Condition.
Note: For more information about configuring trigger conditions, see
Setting a Trigger Condition for an Advanced Alert on page743.
8. Select Node as the Type of Property to Monitor.
9. Confirm that the linked text in the alert definition field displays all.
Note: Click the linked text to select the number of conditions that you want
to apply (all, any, none, not all). For more information about linked text
conditions, see Understanding Condition Groups on page750.
10. Click Browse (), and then click Add a Simple Condition.
11. Click the first asterisk (*), and then select Network Nodes > Node
Details> Node Name.
12. Confirm that is equal to is the linked condition text in the trigger definition.
Note: Click the linked text to select the condition you want to apply (equal,
greater, less, ). For more information about linked text conditions, see
Understanding Condition Groups on page750.
13. Click the second asterisk (*), and then select your production web server
from the list of monitored nodes.
14. Click Add, and then click Simple Condition.
15. Click the first asterisk (*) in the second condition, and then select Network
Nodes > Node Status> Node Status.
16. Confirm that is equal to is the linked condition text in the second trigger
definition.
Note: Click the linked text condition to select the condition you want to
apply (equal, greater, less, ). For more information about linked text conditions, see Understanding Condition Groups on page750.

770

Chapter 18: Alerting and Reporting

17. Click the second asterisk (*) in the second condition, and then select
Down.
18. To apply any reset conditions to your escalated alert, click Reset
Condition, and then provide appropriate conditions. For more information,
see Setting a Reset Condition for an Advanced Alert on page749.
19. To apply any alert suppressions to your escalated alert, click Alert
Suppression, and then provide appropriate suppression conditions. For
more information, see Setting a Suppression for an Advanced Alert on
page747.
20. To restrict when your escalated alert is valid, click Time of Day, designate the Valid Time of Day for your escalated alert, and then select the
Days of the Week on which your escalated alert is valid. For more information, see Setting the Monitoring Period for an Advanced Alert on
page748.
Note: By default, your escalated alert is always valid.
21. Click Trigger Actions, and then click Add New Action.
22. Select Send an E-mail / Page, and then click OK.
23. Click E-mail/Pager Addresses, and then complete the To, CC, BCC,
Name, and Reply Address fields for your Level 1 contact.
Note: You must provide at least one email address in the To field. When
entering multiple addresses in a field, y separate addresses with a comma.
24. Click Message, and then type the Subject and Message of your escalated
alert email.
25. Notes:
l Messaging is disabled if both Subject and Message fields are
empty.
l For more information about variables in email subjects and messages, see Sending an E-mail / Page on page755.
26. Click SMTP Server, and then provide the Hostname or IP Address of
your SMTP Server and the designated SMTP Port Number.
Note: The SMTP server hostname or IP address field is required. You cannot send an email/page alert without identifying the SMTP server.
26. If your SMTP server requires authentication, check This SMTP Server
requires Authentication.
27. To restrict when your escalated alert is valid, check Execute this
Action only between specific hours, and then configure the appropriate
settings.
Note: By default, your escalated alert is always valid. For more information, see Setting the Monitoring Period for an Advanced Alert on
page748.

771

Creating and Viewing Reports

28. Click Alert Escalation.
29. Check Do not execute this Action if the Alert has been Acknowledged.
30. To execute the action repeatedly as long as the trigger condition
exists, check Execute this Action repeatedly while the Alert is
Triggered, and then provide an appropriate action execution interval.
31. To delay alert action execution, check Delay the execution of this
Action, and then provide an appropriate interval the alert engine should
wait after the alert condition is met before the alert action is executed.
Note: Typically, if you are configuring the first level alert, you should leave
this option unchecked. If you are configuring the second level alert, check
this option and provide the desired delay between the first and second notifications. If you are configuring the third level alert, check this option and
provide the desired delay between the first and third notifications.
32. Click OK.
33. If you want your escalated alert to perform any actions upon reset,
click the Reset Action tab, and then configure appropriate actions. For
more information, see Setting a Reset Action for an Advanced Alert on
page749.
34. When done, click OK.

Creating and Viewing Reports

Over time, your SolarWinds SAM database accumulates a great deal of
information. SolarWinds has developed Report Writer to provide a quick and easy
way for you to extract data from your database and present it in a useful form.
Several standard reports that you can modify are included in the Report Writer
distribution, and you can create new reports as necessary. Report Writer includes
powerful tools to help you format your information and easily preview your reports
before you display them. When you have finished editing your reports, you can
print them with the click of a button, and most reports are also enabled for viewing
through the Server & Application Monitor Web Console, by default. For more
information about adding reports to SolarWinds Web Console views, see
Customizing Views on page 204.
Note: Report Writer capabilities are enhanced when used in conjunction with the
Custom Property Editor. Once added, properties are available for report sort and
filter functionality.
Refer to the following sections for more information:
1. Predefined SolarWinds Reports
2. Viewing Reports

772

Chapter 18: Alerting and Reporting

3.
4.
5.
6.
7.
8.
9.

Using Report Writer

Creating and Modifying Reports
Customizing the Report Header and Footer Image
Exporting Reports
Example Device Availability Report
Using SolarWinds Report Scheduler
Reports and Account Limitations

Creating SolarWinds SAM-Specific Reports

SolarWinds SAM information is easily presented in a variety of formats using
SolarWinds Report Writer. SolarWinds provides Report Writer as a quick and
easy way for you to extract data from your database, including SolarWinds SAM
statistics, for presentation in a useful form. A number of predefined SolarWinds
SAM-specific reports are available with your installation of SolarWinds SAM.
Report Writer also enables custom SolarWinds SAM report creation, as
necessary, using criteria and conditions you choose. When you have finished
editing your reports, you can view them through the Web Console and print them
with the click of a button.
A report scheduling application is available to all customers with a current
maintenance agreement. This tool schedules automatic email reports that can be
sent to individual users or groups of users. Log in to the customer portal of
[Link] and download the Report Scheduler.
Report Writer capabilities are further enhanced when they are used in conjunction
with the Custom Property Editor. Custom properties are available for report
sorting and filtering.
Refer to the following sections for more information:
l
l
l
l
l

Using Predefined SolarWinds SAM Reports

Viewing SolarWinds Server & Application Monitor Reports
Filtering and Grouping Data in Resources
SQL Syntax
SWQL Syntax (SolarWinds Query Language)

Using Predefined SolarWinds SAM Reports

The following historical SolarWinds SAM reports are immediately available with
your SolarWinds SAM installation. You can modify reports to suit your Application
Monitoring report requirements. For more information about using SolarWinds
Report Writer, see Viewing SolarWinds Server & Application Monitor Reports on
page778.

773

Current Application and Component Status

Current Application and Component Status
The following reports are predefined for reporting current data on your
monitored applications.
Average Response Time of each Component
Generates a report including the node, application, component and the
component average and maximum response time.
Current CPU Load of each Component
Generates a report including the node, application, component, and percent
of CPU load.
Current Memory Utilization of each Component
Generates a report including the node, application, component, actual and
percent of physical and virtual memory used.
Current Status of each Application
Generates a report including the application and its status, for example, up
or down.
Current Status of each Component
Generates a report including the node, application, component, and the
individual status of the component, for example, up or down.

Current Hardware and Hardware Sensor Status

The following reports are predefined for reporting hardware sensor status:
Current Hardware Status
Generates a report that includes all hardware and their current status.
Current Status of each Hardware Sensor
Generates a report that includes the status of hardware sensors.

774

Chapter 18: Alerting and Reporting

Daily Application Availability

The following reports are predefined for reporting daily monitored
application availability:
Application Availability Last Month
Generates a report that includes all applications and their average
availability over the last month.
Application Availability This Month
Generates a report that includes all applications and their average
availability during the current month.
Application Availability This Year
Generates a report that includes all applications and their average
availability over the last year.

Hardware Health Power Consumption Cost Calculations

The following reports are predefined for reporting power consumption cost
calculations:
Historical Hardware Sensor Power Consumption Cost Calculations - Last 7
Days
Generates a report that includes hardware sensor power consumption cost
calculations over the last seven days.
Historical Hardware Sensor Power Consumption Cost Calculations - Last
Day
Generates a report that includes hardware sensor power consumption cost
calculations over the last day.
Historical Hardware Sensor Power Consumption Cost Calculations - Last
Month
Generates a report that includes hardware sensor power consumption cost
calculations over the last month.

775

Historical Application CPU and Memory Reports

Node Total Power Consumption Cost Calculations
Generates a report that includes node total power consumption cost
calculations.

Historical Application CPU and Memory Reports

The following reports are predefined for reporting historical data on your
monitored applications:
CPU Load for each Application Monitor Last Month
Displays the average CPU load for each monitor, grouped by node and
application name, through the previous month.
CPU Load for each Application Monitor This Month
Displays the average CPU load for each monitor, grouped by node and
application name, for the current month.
CPU Load for each Application Monitor This Year
Displays the average CPU load for each monitor, grouped by node and
application name, through the previous month.
Memory Load for each Application Monitor Last Month
Displays the average memory load for each monitor, grouped by node and
application name, through the previous month.
Memory Load for each Application Monitor This Month
Displays the average memory load for each monitor, grouped by node and
application name, for the current month.
Memory Load for each Application Monitor This Year
Displays the average memory load for each monitor, grouped by node and
application name, through the previous month.

776

Chapter 18: Alerting and Reporting

Historical Hardware Sensor Daily Availability

The following reports are predefined for reporting historical data on
hardware sensor availability:
Hardware Sensor Availability - Last Month
Generates a report that includes all hardware sensor availability for the last
month.
Hardware Sensor Availability - This Month
Generates a report that includes all hardware sensor availability for the
current month.
Hardware Sensor Availability - This Year
Generates a report that includes all hardware sensor availability for the last
year.
Historical Hardware Sensor Statistic
The following reports are predefined for reporting historical data on
hardware sensor statistics:
Hardware Sensor Statistic - Last Month
Generates a report that includes all sensor statistic activity for the last
month.
Hardware Sensor Statistic - This Month
Generates a report that includes all sensor statistic activity for the current
month.
Hardware Sensor Statistic - This Year
Generates a report that includes all hardware sensor availability for the
current year.

777

Historical Reports
The following reports are predefined for reporting historical data on page
file usage:
Page File Usage - Last 7 Days
Generates a report that includes all page file usage for the last seven days.
Page File Usage - Last Month
Generates a report that includes all page file usage for the last month.
Page File Usage - This Month
Generates a report that includes all page file usage for the current month.

Viewing SolarWinds Server & Application Monitor Reports

Before you can use Report Writer, you must have collected at least a few minutes
worth of data in a database that is populated with the devices that you want to
monitor. A variety of reports are included with Report Writer, and icons that
precede report names distinguish the different types of reports that are available.
The following procedure starts Report Writer.
To start Report Writer:
1. Click Start> All Programs > SolarWinds> Alerting, Reporting, and
Mapping > Report Writer.
2. Click File> Settings.
3. In the General tab of the Report Writer Settings window, select either of the
following as a default viewing mode:
l Preview displays the report as it will appear in printed form.
l Report Designer is the report creation and editing interface.
Note: You can toggle between Preview and Report Designer modes at
any time by clicking Preview or Design, respectively, on the toolbar.
4. To separate the data for individual network objects with horizontal
lines, click Report Style, and then check Display horizontal lines
between each row.
5. Click OK to exit Report Writer Settings.
6. If you want to open a predefined report, select one from the list in the left
pane of the main window.

778

Chapter 18: Alerting and Reporting

Note: SolarWinds Server & Application Monitor supplies the following predefined reports:
Current Application and Component Status
l
l
l
l
l

Average Response Time of each Component

Current CPU Load of each Component
Current Memory Utilization of each Component
Current Status of each Application
Current Status of each Component

Daily Application Availability

l
l
l

Application Availability Last Month

Application Availability This Month
Application Availability This Year

Historical Application CPU and Memory Reports:

l
l
l
l
l
l

CPU Load for each Application Monitor Last Month

CPU Load for each Application Monitor This Month
CPU Load for each Application Monitor This Year
Memory Load for each Application Monitor Last Month
Memory Load for each Application Monitor This Month
Memory Load for each Application Monitor This Year

Historical Reports
Page File Usage Last 7 Days
Page File Usage Last Month
l Page File Usage This Month
7. If you want to create a new report, click File> New Report.
l
l

Note: For more information on how to use the SolarWinds Report Writer
application, see Creating and Modifying Reports" on page 794.

Filtering and Grouping Data in Resources

You can reorganize and filter application data within a resource using SQL or
SolarWinds Query Language (SWQL), a SQL-like filter syntax. The filter
description on each resource tells you whether to use SQL or SWQL.
Grouping Applications
The following procedure walks you through changing the way node data is
grouped in a resource.

779

To group resource data by category:

To group resource data by category:
1.
2.
3.
4.
5.

Log on to the SolarWinds SAM Web Console.

Click the Applications tab.
Click Edit on the resource with the grouping you want to change.
Select the category that you want to group by from the Level 1 list.
If you want to group by more subcategories, select additional categories
from the Level 2 and the Level 3 lists.
6. Click Submit.
Filtering Data Using Filter Criteria
The following procedure explains how to limit the data sources in a resource by
setting filter criteria in SWQL syntax. For more information about the filter syntax,
see SWQL Syntax (SolarWinds Query Language) on page782.
To filter application data using filter syntax:
1.
2.
3.
4.
5.

Log on to the SolarWinds SAM Web Console.

Click the Applications tab.
Click Edit on the resource that you want to change.
Type your filter criteria in the Filter Applications (SWQL) field.
Click Submit.

For more information, see "Filter Syntax Reference" on page 1125.

SQL Syntax
Some resources allow you to filter data using the SQL syntax described below.
Wildcards
The wildcard character in SQL syntax is: %.
Example: [Link] Like 'AX3%'
Filtering by Custom Property
The property syntax to filter by custom property is:
[Link]
Example filter to only show nodes with the custom property City that
matches Atlanta:
[Link] = 'Atlanta'

780

Chapter 18: Alerting and Reporting

Filtering by Built-in Properties
Many properties have the same name between data types. To prevent
ambiguity, SolarWinds SAM prefixes the property names with the data
type.
Examples
Example filter to show only data from processes with the name [Link]:
[Link] like '[Link]'

Example filter to show data only from component monitors named Server Load
Monitor:
[Link] like 'Server Load Monitor'

Example filter to show data from devices beginning with "AX3":

[Link] Like 'AX3%'

Example filter to show data from Process Monitor SNMP (type 8) component
monitors:
[Link] = 8

Filtering by Status
To filter by the status, you must know the valid status levels.
Level Status
0

Unknown

Up

Down

Warning

14

Critical

Example filter to only show monitors that are not down:

[Link]<>2

Built-in SQL Application Properties

[Link] [Link]

781

Built-in SQL Component Monitor Properties

Built-in SQL Component Monitor Properties
[Link]

[Link]
ype

[Link]

[Link]
nID

[Link] [Link]
ty
tID

[Link]
p

[Link]
p

[Link]

[Link]

[Link]

[Link]
mory

[Link]

[Link]

[Link]
d

[Link]

[Link]-message

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

Built-in SQL Node Properties

[Link] [Link] [Link]

SWQL Syntax (SolarWinds Query Language)

Some resources allow you to filter data using the SWQL syntax described below.
Wildcards
The wildcard character in SWQL syntax is: %.
Example: [Link] Like 'AX3%'
Filtering by Custom Property
The property syntax to filter by custom property is:

782

Chapter 18: Alerting and Reporting

[Link]
Example filter to only show nodes with the custom property City that
matches Atlanta:
[Link] = 'Atlanta'

Filtering by Built-in Properties

Many properties have the same name between data types. To prevent
ambiguity, SolarWinds SAM prefixes the property names with the data
type.
Examples
Example filter to show data from Cisco devices:
[Link] = 'Cisco'

Example filter to show data from Windows Server 2003-2008 applications:

[Link] = 'Windows Server 2003-2008'

Example filter to show data from devices beginning with "AX3":

[Link] Like 'AX3%'

Example filter to show data from Process Monitor SNMP type component
monitors:
[Link] = 8

Filtering by Status
To filter by the status property, you must know the valid status levels.
Level Status
0

Unknown

Up

Down

Warning

14

Critical

Example filter to only show monitors that are not down:

[Link]<>2

783

Built-in SWQL Application Properties

Built-in SWQL Application Properties
[Link]

[Link]

[Link]
deID

[Link] [Link] [Link]

TemplateID
managed
[Link] [Link] [Link]
m
ageUntil
eated
[Link]
d

Built-in SWQL Application Status Properties

[Link]
onID

[Link]
lity

[Link]

[Link]
Up

Built-in SWQL Component Monitor Properties

[Link]
nID

[Link]
ype

[Link]

[Link]

[Link]

[Link]
eID

Built-in SWQL Component Monitor Status Properties

[Link] [Link] [Link]
ationID
ilability
mponentID
[Link] [Link] [Link]
entStatusID
tTimeUp
meStamp

784

Chapter 18: Alerting and Reporting

Built-in SWQL Nodes Properties

[Link]
me

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]
ime

[Link]

[Link]
me

[Link]

[Link]

[Link]

[Link]

[Link]
Used

[Link]

[Link]

[Link]

[Link]
tion

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

Predefined SolarWinds Reports

The following sections describe the reports that are immediately available with
your SolarWinds installation. These reports may be modified, as necessary, to
suit your network performance reporting requirements.
Note: If the report you require is not listed in any of the following sections, you
can use SolarWinds Report Writer to create your own custom report. For more
information about creating your own custom reports, see Using Report Writer on
page793.
Refer to the following predefined reports for more information:
l
l

Availability
Current Node Status

785

Availability
l
l
l
l
l
l
l
l
l
l
l
l

Current Volume Status

Daily Node Availability
Events
Historical CPU and Memory Reports
Historical Response Time Reports
Historical VMware ESX Server Reports
Groups: Current Groups and Groups Members Status
Groups: Daily Group Availability
Groups: Group Availability (with members)
Groups: Historical Groups Status
Historical Volume Usage Reports
Inventory

Availability
The following network availability reports are provided by default with
SolarWinds.
Availability Last Month
Displays the IP address and average availability of all monitored nodes
over the last month.
Availability This Year
Displays the IP address and average availability of all monitored nodes
over the last year.
Availability Yesterday
Displays the IP address and average availability of all monitored nodes
over the previous day.
Availability of Entire Network Last Month
Displays the availability of all monitored nodes on the entire network over
the last month.
Top 25 Percent Down Last Month
Displays the top 25 nodes, by percent downtime, over the last month.

Current Node Status

The following node status reports are provided by default with SolarWinds.
Average Response Time
Displays both average and peak response times for all monitored nodes.

786

Chapter 18: Alerting and Reporting

Current CPU Load
Displays current CPU load percentage for all monitored nodes with CPUs.
Current Response Time
Displays the IP address and current, average, and peak response times for
all monitored nodes.
Current Status of each Node
Displays the IP address and a verbal statement of the current operational
status of all monitored nodes.
Down Nodes
Displays all monitored nodes that are currently down.
Last Boot Time for each Node
Displays the machine type and the date and time of last boot for all nodes.

Current Volume Status

SolarWinds provides an Available Space on each Volume report by default.
This report displays the volume size, available space on the volume, and a
percentage measure of the available space on the volume for all monitored
volumes. Volumes are listed beneath their respective parent nodes.

Daily Node Availability

The following node availability reports are provided by default with SolarWinds.
Availability - Last Month
Displays the IP address and average daily availability of all monitored
nodes over the current month.
Availability - This Month
Displays the IP address and average daily availability of all monitored
nodes over the current month.
Availability - This Year
Displays the IP address and average daily availability of all monitored
nodes over the last 12 months.

Events
The following network events reports are provided by default with SolarWinds.

787

Historical CPU and Memory Reports

All Down Events
Displays a list of all events in the database involving nodes that have
stopped responding to polling over the last 12 months. For each down
event, this report displays the down event date and time, the node name
and IP address, and a verbal statement of the down event.
Down Events - Windows Devices
Displays a list of all events in the database involving Windows devices that
have stopped responding to polling over the last month. For each down
event, this report displays the down event date and time, the node name,
and a verbal statement of the down event.
Last 250 Events
Displays the last 250 events involving any monitored device. For each
event, this report displays the event date and time, the node involved, and a
message describing the event.
Nodes that went down - Last 24 Hours
Displays a list of all nodes that have stopped responding over the last 24
hours. For every event of a node going down, this report displays the event
date and time, an icon representing the current node status, the node name,
and a verbal statement of the down event.
Triggered Alerts - Last 30 Days
Displays a list of all triggered alerts over the past 30 days. For each
triggered alert event, this report displays the date and time of the alert
trigger, the node that triggered the alert, and a message describing the
triggered alert event.
Triggered and Reset Alerts - Last 30 Days
Displays a list of all triggered and reset alerts over the past 30 days. For
each triggered or reset alert event, this report displays the date and time of
the alert event, the node that triggered or reset the alert, and a message
describing the alert event.

Historical CPU and Memory Reports

SolarWinds provides a CPU Load - Last Month report by default. This report
displays the vendor icon and average and peak CPU load percentages for all
monitored nodes with CPUs over the previous calendar month.

788

Chapter 18: Alerting and Reporting

Historical Response Time Reports

The following response time reports are provided by default with SolarWinds.
Response Time - Last Month
Displays average and peak response times for all monitored nodes over the
previous calendar month.
Response Time - Top 10 Last Month
Displays the average and peak response times for the top ten monitored
nodes over the previous calendar month.

Historical VMware ESX Server Reports

SolarWinds SAM provides the following VMware ESX Server performance
reports by default.
Network Traffic by VM for Last 7 Days
For each monitored VMware ESX Server, this report displays the average
daily network traffic on the ESX Server per hosted VM for the last 7 days.
Network Traffic by VM for Last Month
For each monitored VMware ESX Server, this report displays the average
daily network traffic on the ESX Server per hosted VM for the last month.
Percent of CPU by VM for Last 7 Days
For each monitored VMware ESX Server, this report displays the average
daily CPU load on the ESX Server due to each hosted VM for the last 7
days.
Percent of CPU by VM for Last Month
For each monitored VMware ESX Server, this report displays the average
daily CPU load on the ESX Server due to each hosted VM for the last
month.
Percent of Memory by VM for Last 7 Days
For each monitored VMware ESX Server, this report displays the average
daily memory load on the ESX Server due to each hosted VM for the last 7
days.
Percent of Memory by VM for Last Month

789

Groups: Current Groups and Groups Members Status

For each monitored VMware ESX Server, this report displays the average
daily memory load on the ESX Server due to each hosted VM for the last
month.
Percent of Time Running vs. Stopped
For each monitored VMware ESX Server, this report displays both the
percentage of time that each hosted VM has been running and the
percentage of time that each hosted VM has been stopped.

Groups: Current Groups and Groups Members Status

The following group and group members status reports are provided by default
with SolarWinds.
Current Status of each Group
Current Status of each Group
Current Status of each Group Member
Current Status of each Group Member
Groups and Group Members
Groups and Group Members

Groups: Daily Group Availability

The following group availability reports are provided by default with SolarWinds.
Group Availability Last Month
Group Availability Last Month
Group Availability This Month
Group Availability This Month
Group Availability This Year
Group Availability This Year

Groups: Group Availability (with members)

The following group availability reports that include member availability are
provided by default with SolarWinds.
Group Availability (with members) Last Month
Group Availability (with members) Last Month
Group Availability (with members) This Month

790

Chapter 18: Alerting and Reporting

Group Availability (with members) This Month
Group Availability (with members) This Year
Group Availability (with members) This Year

Groups: Historical Groups Status

The following historical group status reports are provided by default with
SolarWinds.
Historical Status of each Group Last 7 Days
Historical Status of each Group Last 7 Days
Historical Status of each Group Last Month
Historical Status of each Group Last Month
Historical Status of each Group This Month
Historical Status of each Group This Month

Historical Volume Usage Reports

SolarWinds provides an Average Disk Space Used - Last 12 Months report by
default. For all monitored volumes, this report displays the volume type and size,
percentage of the volume space that is currently available, amount of the
available space that is currently used, and the amount of volume space that is
currently available. Volumes are listed beneath their respective parent nodes.

Inventory
The following network inventory reports are provided by default with SolarWinds.
All Disk Volumes
For all monitored volumes, this report displays the volume type and size,
available space on the volume, amount of the available space that is
currently used, and the peak amount of the available space that has been
used on the volume, with the month in which peak usage occurred, over the
last 12 months. Volumes are listed beneath their respective parent nodes.
Device Types
Displays a list of monitored machine types and the number of each type that
are currently monitored.
IOS Versions of Cisco Devices

791

Viewing Reports
For all monitored Cisco devices, this report displays the device name,
machine type, and Cisco IOS Version and Image.

Viewing Reports
All reports, custom or predefined, are available for viewing in both the SolarWinds
Web Console and in Report Writer, as shown in the following procedures:
l
l

Viewing Reports in the SolarWinds Web Console

Viewing Reports in the SolarWinds SAM Report Writer

Note: By default, no report folder is configured for newly created users. If a new
user is not seeing reports, you may need to select a Report Folder for the new
user. For more information, see Configuring an Account Report Folder on
page307.
Viewing Reports in the SolarWinds Web Console
The following procedure opens reports for viewing in the SolarWinds Web
Console.
To view reports in the SolarWinds Web Console:
1.
2.
3.
4.

Click Start> All Programs> SolarWinds> SolarWindsWeb Console.

Log in to the SolarWinds Web Console, and then click Home> Reports.
Select a report group name to expand the report group.
Click the title of the report you want to view, and it displays directly in the
web console browser.

It is also possible to include a report within a web console view as a Report from
SolarWinds Report Writer resource. For more information about adding the
Report from SolarWinds Report Writer resource, see Editing Views on
page205.
Viewing Reports in the SolarWinds SAM Report Writer
The following procedure opens reports for viewing in the SolarWinds SAM Report
Writer.
To view reports with SolarWinds SAM Report Writer:
1. Click Start> All Programs> SolarWinds> Alerting, Reporting, and
Mapping> Report Writer.

792

Chapter 18: Alerting and Reporting

2. If report groups are not already expanded in the left pane, click [+] next
to a report group name to expand the group, and then click the title of the
report you want to view.
3. Click Preview.

Using Report Writer

Before using Report Writer, you must have collected at least a few minutes worth
of data in a database populated with devices you want to monitor. A variety of
reports are included with Report Writer, and icons that precede report names
distinguish available report types. The following procedure starts Report Writer.
To start Report Writer:
1. Click Start> All Programs> SolarWinds> Alerting, Reporting, and
Mapping> Report Writer.
2. Click File> Settings.
3. In the General tab of the Report Writer Settings window, select either of the
following as a default viewing mode:
l Preview displays the report as it will appear in printed form. For more
information, see Preview Mode on page793.
l Report Designer is the report creation and editing interface. For
more information, see Design Mode on page794.
Note: You can toggle between Preview and Report Designer modes
at any time by clicking Preview or Design, respectively, on the toolbar.
4. To separate the data for individual network objects with horizontal
lines, click Report Style, and then check Display horizontal lines
between each row.
5. Click OK to exit Report Writer Settings.
Preview Mode
Preview mode shows a report as it will print. When you open a report in Preview
mode, or switch to Preview mode from Design mode, SolarWinds runs the query
to generate the report, and then Report Writer displays the results.
The Preview window toolbar provides the following actions and information:
l
l
l

Current page number and total number of pages in the report.

Page navigation buttons: First Page, Page Up, Page Down, and Last Page
Zoom views

Note: Double-click a preview to zoom in and double-right-click to zoom out.

793

Design Mode
Print report
Use Print Report to print the report.
Design Mode
Use Design mode to create new reports and modify or rename existing reports.
The options available for both creating and modifying reports are the same.
Design mode options are also dynamic, based upon the type of report, included
report data, and report presentation. Available options differ according to the type
of report that you are designing, but all reports require that you select the data to
include and decide how that data will be sorted, ordered, filtered, and presented.

Creating and Modifying Reports

Use the following procedure to modify or create reports in Report Writer.
To open a report with Report Writer:
1. To modify an existing report, click an existing report from the inventory in
the left pane of the main Report Writer window.
2. To create a new report, click File> New Report, select the type of report
that you would like to create, and then click OK.
Each report offers different configuration options, so, depending on the report,
some formatting tabs described in the following sections may not be available.
Notes:
l The SQL query used to generate a report may be viewed in an additional
tab. Click Report> Show SQL to add a read-only SQL tab to the Design
window.
l A preview of your report is also available at any time. Click Preview to enter
Preview Mode, and then click Design to return to Design Mode.
Refer to the following sections for more information:
l
l
l
l
l
l
l
l

General Options Tab

Select Fields Options Tab
Filter Results Options Tab
Top XX Records Options Tab
Time Frame Options Tab
Summarization Options Tab
Report Grouping Options Tab
Field Formatting Options Tab

794

Chapter 18: Alerting and Reporting

General Options Tab
The General tab opens by default and shows titling and display options.
To configure General options:
1. Specify the Report Group, Report Title, Subtitle, and Description.
Note: If you use an existing report group name, the new report is added to
that existing group in the left pane of the main window.
2. Select the display Orientation of your report.
3. If you are configuring an historical report and you do not want to
group data by days, clear Group historical data by days.
Note: By default, data in some availability and historical reports is
grouped by days when displayed in the SolarWinds Web Console. Data
grouping by days is not viewable in Report Viewer.
4. If you do not want to make this report available on your SolarWinds
Web Console, clear Make this Report available from the SolarWinds
website.
Note: By default, most reports are made available for display in the SolarWinds
Web Console. For more information, see Customizing Views on page204.
Select Fields Options Tab
The Select Fields tab allows you to select the data fields in a report.
To select and configure fields:
1. Click Select Fields.
2. If you are creating a new report or adding fields to an existing report,
click the ellipsis, select Add a new field, and then dynamically define each
new report field as follows:
a. Click the asterisk after Field:, and then select the type of information to
include in the current report field.
b. To sort the data in the current field, click the sort asterisk and select
a sort order.
c. To perform an operation on the data in the current field, click the
function asterisk and select an operation.
3. If you are modifying an existing report, click the Field, sort, or function
that you want to change and select a new value as follows.
a. Click the asterisk after Field:.
b. Select the type of information to include in the current report field.

795

Filter Results Options Tab

c. To sort the data in the current field, click the sort asterisk and select
a sort order.
d. To perform an operation on the data in the current field, click the
function asterisk and select an operation.
4. To test your selections as you assemble your report, click Execute
SQL Query to view the current query results.
5. To delete a field or rearrange the order of the fields that are listed in
your report, select a field, click Browse (), and then select the appropriate action.
Note: Unchecked fields are not displayed in your report, but their sort and
function configurations are retained.
6. To preview your report, click Preview.
Filter Results Options Tab
The Filter Results tab allows you to generate filter conditions for field data by
selecting appropriate descriptors from the linked context menus. Results filters
are configured as follows.
To configure results filters:
1. Click Browse (), and then select from the following options:
l Select Add a new elementary condition to generate a condition
that is based on a direct comparison of network object data fields.
l Select Add a new advanced elementary condition to generate a
condition based on a comparison of device data fields and values.
l Select Add a new complex condition to define a condition that filters other defined conditions.
l Select Delete current condition to remove a selected condition.
l Select Move current condition forward or Move current condition backward to change the order of your conditions accordingly.
Note: The lists of available linked descriptors are dynamically generated in consideration of all other variables within the same condition. For more information about condition groups and their
application, see Understanding Condition Groups on page750.
2. Check or clear individual filter conditions to enable or disable their application, respectively, to your report.

796

Chapter 18: Alerting and Reporting

Top XX Records Options Tab
The Top XX tab allows you to limit the number of records that are shown in your
report to either a top number or a top percentage of all results. Top XX options are
configured as shown in the following procedure.
To configure Top XX records:
1. To show all records in your report, select Show All Records.
2. To specify a truncated list of eligible items for your report, complete
the following steps:
a. Select either Show only the Top number Records or Show the Top
percentage % of Records
b. Provide appropriate number or percentage values.
Time Frame Options Tab
The Time Frame options tab allows you to limit the scope of your report to a
specific period of time. To configure Time Frame options, select a Named,
Relative, or Specific Time Frame, and then select or provide required values.
Notes:
l If you receive a SQL Timeout error message, you may edit the timeout setting in the [Link] file. By default, this file is located in the
C:\ProgramFiles\SolarWinds\Orion directory
l Since the Relative Time Frame is continuously variable, reports run with it
may show different results, even if they are run close together in time.
Summarization Options Tab
The Summarization tab allows you to generate summaries of your results over
specific periods of time. Summarization options are configured as follows.
To configure results summarization:
1. If you do not want to summarize your results, confirm that Do not Summarize the Results is selected.
2. To summarize your results, complete the following steps:
a. Select Summarize the Results by Hour, Date, Month, and so on,
and then select the summarization period.
b. Specify the location of the summary field for your report.
c. Select a location for the Summary Date/Time field.

797

Report Grouping Options Tab

Report Grouping Options Tab
The Report Grouping tab allows you to group results by field descriptor within
your report. Add, edit and delete report groups to organize the data in your report.
Establish and edit report groups as follows.
To add and edit report groups:
1. add a new report group, select a field from the list to define your group,
and then click Add Report Group to add your selected field to the Report
Groups list.
Note: Use up and down arrows to change the grouping order accordingly.
2. To edit an existing report group, select the field from the Report Groups
list, and then click Edit Report Group.
3. The following options may be changed as needed:
l The Group Header is the text that designates groups on your
report.
l The Web URL is the dynamic location of your published report with
respect to your SolarWinds Web Console.
l Font size, face, color, and background may all be modified by clicking associated ellipses.
l Alignment may be left, center, or right.
l Check Transparent Background for better results when publishing
your report to the Web.
l If you want to change the grouping order, use the up and down
arrows to change the grouping order accordingly.
Field Formatting Options Tab
The Field Formatting tab allows you to customize the format of the various results
fields in your report. To format results fields, select the field you want to format,
and then edit labels and select options as appropriate.
Notes:
l The formatting options available for each field may be different according
to the nature of the data contained in that field.
l Check Hidden Field to hide any field in your report.
l To view your changes at any time, click Preview.

798

Chapter 18: Alerting and Reporting

Customizing the Report Header and Footer Image

The image that is displayed at the top and bottom of each report can be changed.
To add your company logo as the report header and footer, save your logo as
[Link] in the SolarWinds\Common\WebResources folder, typically located in
C:\Program Files\, and then click Refresh.
Note: The image must be in JPEG format with a height of 150 pixels or less.

Exporting Reports
SolarWinds Report Writer gives you the ability to present your created reports in
any of the following industry-standard formats:
l
l
l
l
l
l
l

Comma-delimited (*.csv, *.cdf)

Text (*.txt)
HTML (*.htm, *.html)
MIME HTML, with embedded images (*.mhtml)
Excel spreadsheet (*.xls)
Adobe PDF (*.pdf)
Image (*.gif)

The following procedure presents the steps required to export an open report from
SolarWinds Report Writer into any of the previously listed formats.
To export a report from Report Writer:
1. Create a report to export by clicking any of the following:
Select a report from the file tree in the left pane:
l File> Open to open an existing report
l File> New Report to create a new report. For more information about creating reports, see Creating and Viewing Reports on page772.
2. Select File> Export and then click the format in which you want to export
your report:
3. Check the fields in your open report that you want to export into the selected format, and then click OK.
4. Select a location to save your file.
5. Provide a File name, and then click Save.

Example Device Availability Report

The following procedure generates an example report of network device
availability information over the previous week. The final report is sorted so that

799

To generates an example report of network device availability information:

the worst errors are viewed first. Down nodes that are still down are at the top with
all devices listed in order of increasing availability.
Note: At any point during the creation of a report (or perhaps at many points), you
may save what you have done by clicking File> Save. The first time you save
you must give your report a filename or accept the default, which will be the report
title that you assign in the following procedure.
To generates an example report of network device availability information:
1. Click Start> All Programs> SolarWinds> Alerting, Reporting, and
Mapping> Report Writer.
2. Click File> New Report.
3. The example calls for a report on availability over the past week, so select
Historical Availability Details, and then click OK.

4. Type My Reports in the Report Group field, and then enter Last Weeks Availability as the Report Title.

800

Chapter 18: Alerting and Reporting

5. Select Portrait for the paper orientation, and then confirm that Make this
Report available from the SolarWinds website is checked.

6. Click Select Fields.

7. Click Browse (), and then select Add a new field.

8. Click the Field asterisk, and then select Network Nodes> Node Details>
Node Name.

801

To generates an example report of network device availability information:

9. Click Browse (), and then select Add a new field.

10. Click the Field asterisk, and then select Network Nodes> Node Status>
Status Icon.
Note: While this field makes a distinct visual difference for a report viewed
in color, it will make little or no difference if printed in black and white.

11. Click Browse (), and then select Add a new field.

802

Chapter 18: Alerting and Reporting

12. Click the Field asterisk, and then select Network Nodes> Node Status>
Status.

13. Click Execute SQL Query to view the report data in the preview window.
Note: The report preview should show information about both current and
historical status. Current status entries must be relabeled to avoid confusion.

14. Click Field Formatting.

15. Click Status in the Select a Field list, and then change the Column
Header entry to Current Status.

803

To generates an example report of network device availability information:

16. Click Status_Icon in the Select a Field list, and then change the Column
Header entry to Current Status.
17. Click Execute SQL Query.
Note: Column widths are adjustable. To change a column width, place
your cursor on the column divider and drag it to a different position.
18. Click Select Fields.
19. Click the sort asterisk on the Status field line, and then select
descending.

20. Click Execute SQL Query to confirm your choice.

21. Click Browse (), and then select Add a new field.

804

Chapter 18: Alerting and Reporting

22. Click the Field asterisk, and then select Historical Response Time and
Availability> Availability.

23. Click the Sort asterisk on the new line, and then select ascending.
24. Click Execute SQL Query to view the report.
25. Click Time Frame.

26. Select Relative Time Frame, type 7 in the text field, and then select Days
from the list.

27. To break down the report day-by-day, click Summarization and specify
your choices.

805

Reports and Account Limitations

28. To filter your report, click Filter Results and specify filter rules, as on the
Select Fields tab.

29. Click File> Save to save your work.

Reports and Account Limitations

Reports created with SolarWinds Report Writer respect SolarWinds Web Console
account limitations. For security, by default, reports are not available to users with
limited accounts unless a SolarWinds administrator specifically provides access.
The following procedure creates a reports folder for an account-limited user and
configures the account-limited user to access SolarWinds reports from it.
Note: For more information about creating user accounts, see Creating
Accounts on page298. For more information about applying account limitations
to user accounts, see Setting Account Limitations on page303.
To allow account-limited users access to reports:
1. Open the SolarWinds Reports folder.
Note: All reports created or predefined in SolarWinds Report Writer are, by
default, stored, in C:\Program Files\SolarWinds\Orion\Reports.
2. Create a new folder using the name of the account-limited user.
3. Copy the reports you want the account-limited user to see from the
SolarWinds Reports folder into the new, account-limited user folder.
4. Click Start> All Programs> SolarWinds> SolarWinds Web Console.
5. Log in to the SolarWinds Web Console as an administrator.
6. Click Settings in the top right of the web console.

806

Chapter 18: Alerting and Reporting

7. Click Manage Accounts in the Accounts grouping of the SolarWinds Website Administration page.
8. Select the account-limited user, and then click Edit.
9. In the Default Menu Bar and Views section, select the Report Folder you
created in the SolarWinds Reports folder for the account-limited user.
10. Click Submit.

Web Console Based Reports

Over time, your SolarWinds SAM database accumulates a great deal of
information. SolarWinds has developed web console based Report Writer to
provide a quick and easy way for you to extract data from your database and
present it in a useful form. SAM comes with over 100 standard reports that you
can modify to suit your needs. In addition to standard reports, Report Writer
includes powerful tools to help you format your information and easily preview
your reports before you display them. When you have finished editing your
reports, you can print them with the click of a button.
Refer to the following sections for more information:
l
l
l
l
l
l
l
l
l
l

Predefined SolarWinds Reports

Viewing Reports
Using Report Writer
Creating and Modifying Reports
Customizing the Report Header and Footer Image
Exporting Reports
Example Device Availability Report
Using SolarWinds Report Scheduler
Reports and Account Limitations
Creating a Scheduled Report

Using Predefined Web Console Based Reports

Report Writer capabilities are further enhanced when they are used in conjunction
with the Custom Property Editor. Custom properties are available for report
sorting and filtering.
Navigating to the Report Writer:
1. From the web console, click Reports in the toolbar.

807

Predefined SAM Web Console Based Reports

Predefined SAM Web Console Based Reports

The following standard reports are available within SAM. You can modify these
reports to suit your needs.
Note: The data can be sorted by clicking the headers of each column.
Application Reports
The following reports are predefined for reporting historical data on your
monitored applications.
Application Availability Last Month
Generates a report that displays the availability of each application for each
node for the last month.
Application Availability This Month
Generates a report that displays the availability of each application for each
node for the current month.
Application Availability This Year
Generates a report that displays the availability of each application for each
node for the current year.
Average Response Time of each Component
Generates a report displaying the maximum and average response times for
each component. The node and application the listed component belongs to
is also displayed.
CPU Load for each Application Monitor Last Month
Generates a hierarchal report grouped by node, application, and component
monitor, that displays CPU load statistics in percentage format for the last
month.
CPU Load for each Application Monitor This Month
Generates a hierarchal report grouped by node, application, and component
monitor, that displays CPU load statistics in percentage format for the
current month.

808

Chapter 18: Alerting and Reporting

CPU Load for each Application Monitor This Year
Generates a hierarchal report grouped by node, application, and component
monitor, that displays CPU load statistics in percentage format for the
current year.
Current CPU Load of each Component
Generates a hierarchal report grouped by node, application, and component
monitor, that displays CPU load statistics in percentage format.
Current Memory Utilization of each Component
Generates a hierarchal report grouped by node, application, and component
monitor, that displays memory statistics.
Current Status of each Application
Generates a hierarchal report grouped by node and application that
displays the current application status for each application.
Current Status of each Component
Generates a hierarchal report grouped by node, application, and component
monitor, that displays the current component status for each component.
Memory Load for each Application Monitor Last Month
Generates a hierarchal report grouped by node, application, and component
monitor, that displays memory statistics for each component monitor for the
last month.
Memory Load for each Application Monitor This Month
Generates a hierarchal report grouped by node, application, and component
monitor, that displays memory statistics for each component monitor for the
current month.
Memory Load for each Application Monitor This Year
Generates a hierarchal report grouped by node, application, and component
monitor, that displays memory statistics for each component monitor for the
current year
Page file Usage Last 7 Days
Generates a report that displays page file usage for the last seven days.
Page file Usage Last Month
Generates a report that displays page file usage for the last month.

809

Group Reports
Page file Usage This Month
Generates a report that displays page file usage for the current month.
Group Reports
The following reports are predefined for reporting historical data for groups.
Current Status of each Group
Generates a report that displays the status of each group.
Current Status of each Group Member
Generates a report that displays the status of each group member.
Group Availability Last Month
Generates a report that displays the availability status of each group for the
last month.
Group Availability This Month
Generates a report that displays the availability status of each group for the
current month.
Group Availability This Year
Generates a report that displays the availability status of each group for the
current year.
Group Availability (with members) Last Month
Generates a report that displays the availability status of each group and the
group's members for the last month.
Group Availability (with members) This Month
Generates a report that displays the availability status of each group and the
group's members for the current month.
Group Availability (with members) This Year
Generates a report that displays the availability status of each group and the
group's members for the current year.
Group and Group Members
Generates a report that displays group and group member statuses.
Historical Status of each Group Last 7 Days

810

Chapter 18: Alerting and Reporting

Generates a report that displays the historical status of each group for the
last seven days.
Historical Status of each Group Last Month
Generates a report that displays the historical status of each group for the
last month.
Historical Status of each Group This Month
Generates a report that displays the historical status of each group for the
current month.
Hardware Health Reports
The following reports are predefined for reporting historical data for hardware
health.
Current Hardware Status
Generates a report displaying hardware information about the listed node
including its current status.
Current Status of each Hardware Sensor
Generates a hierarchal report grouped by IP address displaying hardware
information about the listed hardware sensor including its name and current
status.
Hardware Sensor Availability Last Month
Generates a report displaying hardware sensor availability for the last
month.
Hardware Sensor Availability This Month
Generates a report displaying hardware sensor availability for the current
month.
Hardware Sensor Availability This Year
Generates a report displaying hardware sensor availability for the current
year.
Interface Reports
The following reports are predefined for reporting historical data for interfaces.
95th Percentile Traffic Rate Last 7 Days

811

Interface Reports
Generates a report displaying interfaces with the highest traffic rates (top
5%) for the last seven days.
95th Percentile Traffic Rate Last Month
Generates a report displaying interfaces with the highest traffic rates (top
5%) for the last month.
95th Percentile Traffic Rate This Month
Generates a report displaying interfaces with the highest traffic rates (top
5%) for the current month.
Average and Peak Traffic Rates Last 7 Days
Generates a report displaying the average and peak traffic rates for
interfaces for the last seven days.
Average and Peak Traffic Rates Last Month
Generates a report displaying the average and peak traffic rates for
interfaces for the last month.
Average and Peak Traffic Rates This Month
Generates a report displaying the average and peak traffic rates for
interfaces for the current month.
Average and Peak Traffic Rates WAN Interfaces Last 7 Days
Generates a report displaying the average and peak traffic rates for each
WAN interface for the last seven days.
Current Percent Utilization Top 25 Interfaces
Generates a report displaying the top 25 utilized interfaces.
Down Interfaces
Generates a report displaying interfaces that are down.
Interface Availability Last 7 Days
Generates a report displaying the availability status of interfaces for the last
seven days.
Interface Availability Last Month
Generates a report displaying the availability status of interfaces for the last
month.
Interface Availability This Month

812

Chapter 18: Alerting and Reporting

Generates a report displaying the availability status of interfaces for the
current month.
Interface Bandwidth
Generates a report displaying the configured bandwidth for each interface.
Interface Types
Generates a report displaying the number of types of interfaces that are
being monitored.
Total Bytes Transferred by Cisco Devices Last 7 Days
Generates a report displaying the total number of bytes that were transferred
over Cisco devices for the last seven days.
Total Bytes Transferred by Interface Last Month
Generates a report displaying the total number of bytes that were transferred
over all interfaces for the last month.
Total Bytes Transferred by Interface This Month
Generates a report displaying the total number of bytes that were transferred
over all interfaces for the current month.
Total Bytes Transferred by Node Last 7 Days
Generates a report displaying the total number of bytes that were transferred
for each node for the last seven days.
Total Bytes Transferred by Node Last Month
Generates a report displaying the total number of bytes that were transferred
for each node during the last month.
Total Bytes Transferred by Node This Month
Generates a report displaying the total number of bytes that were transferred
for each node during the current month.
Node Reports
The following reports are predefined for reporting historical data for nodes.
% of CPU by VM for Last 7 Days
Generates a report displaying the percentage of CPU usage for virtual
machines for the last seven days.
% of CPU by VM for Last Month

813

Node Reports
Generates a report displaying the percentage of CPU usage for virtual
machines for the last month.
% of Memory by VM for Last 7 Days
Generates a report displaying the percentage of memory usage for virtual
machines for the last seven days.
% of Memory by VM for Last Month
Generates a report displaying the percentage of memory usage for virtual
machines for the last month.
All Disk Volumes
Generates a report grouped by node displaying detailed volume
information.
All Down Events
Generates a report displaying events that we down for the last 12 months.
Availability Last Month
Generates a report showing the availability of nodes for the last month.
Availability This Year
Generates a report showing the availability of nodes for the current year.
Availability Yesterday
Generates a report showing the availability of nodes for the previous day.
Availability of Entire Network Last Month
Generates a report showing the average availability of the entire network for
the last month.
Available Space on Each Volume
Generates a report grouped by node displaying space statistics for each
volume.
Available Disk Performance Last 7 Days
Generates a report grouped displaying average and peak disk space for the
past seven days.
Available Disk Performance Last 12 Months
Generates a report grouped displaying average and peak disk space for the
past 12 months.

814

Chapter 18: Alerting and Reporting

Average Response Time
Generates a report grouped by node displaying average and peak response
times.
CPU Load Last Month
Generates a report displaying the average CPU loads for all nodes during
the past month.
Current CPU Load
Generates a report displaying the current CPU load for each node.
Current Response Time
Generates a report displaying the current, average, and peak response
times for each node.
Current Status of each Node
Generates a report displaying the current status of each node.
Device Polling Details
Generates a report displaying the next rediscovery and next poll time for
each node.
Device Types
Generates a report displaying the number of device types being monitored.
Down events Windows Devices
Generates a report displaying the Down events for all Windows devices for
the past 30 days.
Down Nodes
Generates a report displaying all nodes that are currently down.
IOS Versions of Cisco Devices
Generates a report displaying the IOS version and image for each Cisco
Device.
Last 100 Audit Events
Generates a report displaying the last 100 audit events.
Last 250 Events
Generates a report displaying the last 250 events.
Last Boot Time for each Node

815

Node Reports
Generates a report displaying the time of the last reboot for each node.
Network Traffic by VM for Last 7 Days
Generates a report displaying the network traffic of virtual machines for the
last seven days.
Network Traffic by VM for Last Month
Generates a report displaying the network traffic of virtual machines for the
last month.
Node Availability Last Month
Generates a report that displays the availability of each node for the last
month.
Node Availability This Month
Generates a report that displays the availability of each node for the current
month.
Node Availability This Year
Generates a report that displays the availability of each node for the current
year.
Node that went Down Last 24 Hours
Generates a report that displays the nodes that went down in the last 24
hours.
Response Time Last Month
Generates a report that displays the average and peak response times for
all nodes in the past month.
Response Time Top 10 Last Month
Generates a report that displays the response times for the top 10 nodes in
the past month.
Top 25 Percent Down Last Month
Generates a report that displays the top 25% nodes that were down based
on the amount of time they were down in the past month.
Triggered Alerts Last 30 Days
Generates a report that displays all alerts that were triggered for the last 30
days.
Triggered and Reset Alerts Last 30 Days

816

Chapter 18: Alerting and Reporting

Generates a report that displays all alerts that were triggered and reset for
the last 30 days.
Asset Inventory Reports
General Asset Inventory
Generates a report concerning Asset Inventory.
Inventory Fixed Asset Report
Generates a report fixed assets.
Out of Band Management Report
Generates a report concerning Out of Band Management.
Software Inventory Report
Generates a report concerning installed software.
Warranty Status Report
Generates a report concerning warranty status.
AppInsight for Exchange Reports
Triggered Alerts - Last 30 Days web-based
Generates a report displaying alerts over the past 30 days.
Users By Mailbox Quota
Generates a report displaying the mailbox quota by user.
Users By Mailbox Size
Generates a report displaying the mailbox size by user.
Users By Messages Sent This Week
Generates a report displaying the messages sent this week by user.
VLAN Interfaces grouped by VLAN ID
Generates a list of VLAN interfaces grouped by their identification number.

Creating and Editing Web Based Reports

Editing existing reports is the easiest way of creating new reports to suit your
needs since existing reports have many fields replete with data and rules. In this
way, much of the work is already done for you. You can however, create custom
reports based on your own criteria.

817

Creating and Editing Web Based Reports

Important: If you edit a predefined report and save it, you will not be able to
recover the predefined report in its default state. If you intend to create a new
report based on a predefined report, it is recommended you use the Duplicate &
Edit button, as opposed to the Edit button.
Creating a New Report by Editing an Existing one:
1. Navigate to the web based report writer:
a. From the web console, click Reports in the toolbar under the Home
tab:

2. Click Manage Reports in the upper right-hand corner of the web console.
3. From the Manage Reports screen, locate a Web-based report as indicated
by the Type column:

4. Check the box next to the name of the report to select it. (In this example,
the All Disk Volumes Inventory Report will be used.)
5. Click Duplicate & Edit on the toolbar above the list of reports.
6. The following screen appears which divides the report into three sections:
Header, Content, and Footer:

818

Chapter 18: Alerting and Reporting

Edit Report Screen:

At this point, you can begin customizing your report. You can customize your
report by examining and editing the various sections and fields. Each field of each
section is explained in detail below:
Report Width:
The Report Width field allows you to specify a fixed width in pixels. (A default
number is provided.) Additionally, you can choose any width you want, or click Fit
to Window Width to have the width of the report automatically resized to fit the
width of your window.

819

Header Section:

Header Section:
The Header section includes the Title, Subtitle, and Logo of your report.

The name of your new report will be based on the Title text. For example, if you
change the Title to read, "My New Report," the name of this report as shown in
the Manage Reports list (see step 3 earlier) will also be "My New Report." A field
is also available for a smaller Subtitle to be entered.
Note: You must complete the wizard for the name change to take effect. If you
click the Back button of your browser before reaching the end of the wizard, your
report will not be saved and the report will be duplicated with its original name in
the Manage Reports list.
Logo
If you decide you want to have a logo in your report, check the Logo box, then
click Browse for Logo to search for your logo. Un-checking the Logo box will
suppress any image you have chosen.

820

Chapter 18: Alerting and Reporting

Content Section:
The Content section (in between the header and footer sections) includes the
following content and layout options:
l
l
l
l
l
l

Page Layout
Layout Columns
For dropdown (with Edit)
Edit Table
Duplicate
Add Content

Page Layout
The Page Layout option allows you to format your report using a different
combination of columns and rows, as shown:

821

Page Layout

By selecting the highlighted option above, the layout of the Content section
changes to include a header, footer, and three columns, as shown:

822

Chapter 18: Alerting and Reporting

Layout Columns
The Layout Columns option allows you adjust the number of columns used in
your report.

Note: The icon to the left of this field indicates that the current section (in this
case, Content) can be repositioned on the page by dragging and dropping it with
the mouse.
For Dropdown Menu
Since this is a duplicate of a predefined report, this field is populated by default,
along with the option to add a new data source.

823

Edit Table

Edit Table
Clicking Edit Table will take you to the Edit Resource screen.

Edit Resource Screen

The Edit Resource screen allows you to manipulate the report's layout.

824

Chapter 18: Alerting and Reporting

Table Layout
The Table Layout section shows the layout of table by showing the column
headers of the table for the current report. These columns can be repositioned by
simply dragging and dropping them between one another. The repositioning of
columns will be reflected in your report when it is displayed.

825

Table Layout
Examine the following diagram. The numbers in the illustration correspond to the
numbered explanations below.

1. Click Edit Table to be taken to the Table Layout section on the Edit
Resource screen.
2. Reposition the column heads of the table. Once repositioned, the table will
be displayed in the Content section of your choice.
3. In this example, the table has been placed into the top, full-width column
section. The arrows denote the column heads of the table.
4. You can now view the report with the column heads and table in the
desired layout.

826

Chapter 18: Alerting and Reporting

Table Layout

Edit Column Widths: Clicking this link will bring you to the Resource Preview
screen where you can choose automatic column widths, or custom column
widths. Choosing custom column widths will enable you to drag the previewed
column width to your desired location on the report page. When done editing,
click Save Column Widths to save your changes.

Note: Some of the data in the report preview contains live links that will take you
to the details page for that item.
Table Layout (Column Details)
Clicking [+] More Details expands the column head layout to reveal options
concerning the current column, as shown. Conversely, clicking [-] Less Details
hides this information. Clicking will allow you to add additional columns.

827

Table Layout (Column Details)

The fields displayed here provide you with the following options:
2. Database Column: The database column added to custom table
l Display Name: Allows you to change the text of the column head.
o Hide column by default in web console: Checking this box will
hide the current column.
l Display Setting: Shows the transformation of the display of data in the
column.
l Add Display Setting: Dropdown selection.
l Data Aggregation: Allows you to choose how the current data is displayed.
l Alignment: Allows you to choose how the data is aligned within the
column,

828

Chapter 18: Alerting and Reporting

Display Settings

Time-based settings: If you select Yes, you will be prompted to add a

Date/Time column if one has not been added already.
Sort Results By: You can sort the results by clicking Ascending or Descending and choose a second column to sort by from the drop down list. If
you choose to click X to close this sorting option, you can then choose to
sort by the available columns.
Group Results By: You can group the results by the available options and
choose a second column to sort by from the drop down list. If you choose to
click X to close this grouping option, you can then choose to group by the
available columns.
Filter Results: You can choose to show all records, a specific number of
records, or a percentage of the available records by selecting the available
radio buttons and entering a number where applicable.

Creating a Scheduled Report

The following procedures are included in this page:
l
l
l

Scheduling a Web-Based Report

Creating a Web-Based Report Schedule
Using an Existing Web-Based Report Schedule

829

Scheduling a Web-Based Report

Scheduling a Web-Based Report
The following procedure regularly schedules a printed or emailed web-based
report.
Note: The following procedure assumes that you are scheduling an existing
report.
To schedule a web-based report:
1. From the Web Console, log in using an account with administrative privileges.
2. Click Home > Reports.
3. Click Manage Reports.
4. Select a report grouping criterion in the Group by: field.
5. Click the desired report group from the list in the left pane.
6. Select the report you want to schedule from the list in the main pane.
a. If you need to create a new schedule, click Schedule Report >
Create New Schedule.
b. If you need to assign an existing schedule, click Schedule Report >
Assign Existing Schedule.
Creating a Web-Based Report Schedule
The following procedure configures a new web-based report schedule.
Note: The following procedure assumes that you are scheduling an existing
report.
To create a new schedule for a web-based report:
1. On the Schedule Properties view, provide an appropriate Schedule Name
and Description.
a. If you want to add any additional reports to this schedule, click Assign
another Report, select the report(s) to add, and then click Assign
Reports(s).
b. If you want to add any additional websites to this schedule, click
Assign Webpage, and then provide the URL you want to view.
Note: Click the eye icon to see a preview of the provided website as it
is currently published.
c. If you want to apply any account limitations to this schedule, click [+]
to expand Advanced Settings, select Another user, and then provide
the corresponding user credentials.
Note: Click Test to confirm the provided credentials.
2. Click Next.

830

Chapter 18: Alerting and Reporting

3. If a schedule frequency is not listed on the Schedule Frequency view, click
Add Frequency, and then complete the following steps:
Note: The Specific Date(s) option enables you to designate specific, though
not necessarily regular, date(s) and time(s) for your schedule.
a. In the Add Frequency wizard, provide an appropriate Frequency
Name, and then select an appropriate Frequency.
b. If you selected Specific Date(s), select the date(s) and time(s) when
you want to run your report or view your website, and then click Add
Frequency.
Note: Click Add Time to select additional dates and times.
c. If you selected Daily, complete the following steps:
i. Select the number of days between publications.
Note: If you only want to run the report on work days, select
Working Day (Mon - Fri).
ii. Select the time(s) when you want to run your report or view your
website.
Note: Click Add Time to add additional dates and times.
a. If you do not want the schedule to start immediately upon
completion, select Specific Date(s) in the Starting On
field, and then select the date and time when you want the
report schedule to start.
b. If you want the schedule to end at some point, check Ending On, and then select the date and time when you want
the report schedule to end.
iii. Click Add Frequency.
d. If you selected Weekly, complete the following steps:
i. Check the days of the week on which you want to publish.
ii. Select the time(s) when you want to run your report or view your
website.
Note: Click Add Time to add additional dates and times.
a. If you do not want the schedule to start immediately upon
completion, select Specific Date(s) in the Starting On
field, and then select the date and time when you want the
report schedule to start.
b. If you want the schedule to end at some point, check Ending On, and then select the date and time when you want
the report schedule to end.
iii. Click Add Frequency.

831

Creating a Web-Based Report Schedule

e. If you selected Monthly, complete the following steps:
i. Check the months in which you want to publish.
ii. Select a day of the month, either by calendar day number or
week order, when you want to run your report or view your website.
iii. Select the time(s) when you want to run your report or view your
website.
Note: Click Add Time to add additional dates and times.
a. If you do not want the schedule to start immediately upon
completion, select Specific Date(s) in the Starting On
field, and then select the date and time when you want the
report schedule to start.
b. If you want the schedule to end at some point, check Ending On, and then select the date and time when you want
the report schedule to end.
iv. Click Add Frequency.
4. Click Next.
5. Click Add Action, select an action (Email, Print, or Save to Disk) to
execute on the configured schedule, and then click Configure Action.
6. If you selected Email, complete the following steps:
a. Provide an email Name of action.
b. In the To field, provide the email addresses of all recipients.
Note: Separate email addresses with a semicolon.
i. If you need to add CC or BCC addresses, click CC and/or BCC
field, and then provide the email addresses of all recipients.
Note: Separate email addresses with a semicolon.
c. Provide the Name of Sender and an appropriate Reply Address.
d. Click Message, and then provide an appropriate Subject and Message.
Note: You may compose the message either as HTML or as Plain
Text.
i. If you also want a printable version of your emailed reports,
check Retrieve a Printable Version of Reports.
ii. Check the format(s) in which you want to provide the emailed
report (PDF, CSV, Excel, or HTML).
e. If you want to include the URL of the emailed report to access it
remotely, check Include Report's URL.
f. Click SMTP Server.
i. If you have already configured an SMTP server, select the Name
of SMTP Server, and then click Save.

832

Chapter 18: Alerting and Reporting

7.

8.

9.
10.

ii. If you have not already configured an SMTP server, select Add
New Server, and then complete the following steps:
a. Provide the Hostname or IP Address of your SMTP
Server and the designated SMTP Port Number.
Note: The SMTP server hostname or IP address field is
required. You cannot send an email without identifying the
SMTP server.
i. If you want to use SSL encryption for your emailed
report, check Use SSL.
Note: Opting to use SSL automatically changes the
SMTP port number to 465.
ii. If your SMTP server requires authentication, check
This SMTP Server requires Authentication, and
then provide requested credentials.
b. Click Save.
If you selected Print, complete the following steps:
a. Provide a Windows User name, using Domain\Username format, and
Password for a user with access to the printer on which you want to
print your report.
b. Click Printer Settings.
c. Click Select, and then select a Destination printer.
d. Enter the number of Copies, and then select appropriate Layout,
Color, and Margins options.
e. Click Save.
If you selected Save to Disk, complete the following steps:
a. Provide a Network Share Location where you want to save the
report.
i. If you also want a printable version of your saved report, check
Retrieve a Printable Version of Reports.
b. Provide a Windows User name, using Domain\Username format, and
Password for a user with access to the printer on which you want to
print your report.
c. Check the format(s) in which you want to provide the saved report
(PDF, CSV, or Excel).
d. Click Save.
Click Next.
Review the summary, and then click Create.

833

Using an Existing Web-Based Report Schedule

Using an Existing Web-Based Report Schedule
The following procedure configures a web-based report to use an existing report
schedule.
Note: The following procedure assumes that you are scheduling an existing
report, as directed in the section "Scheduling a Web-Based Report" above. For
more information about creating or editing reports, see "Creating Reports in the
Web Console".
To use an existing schedule for a web-based report:
1.
2.
3.
4.

Select a schedule grouping criterion in the Group by: field.

Click the desired schedule group from the list in the left pane.
Select the schedule(s) you want to assign from the list in the main pane.
Click Assign.
a. If you want to apply any account limitations to this schedule, click [+]
to expand Advanced Settings, select Another user, and then
provide the corresponding user credentials.
Note: Click Test to confirm the provided credentials.
5. Click Next.
6. Review the summary, and then Save

834

Chapter 19:
Monitoring Hardware Health
SAM monitors hardware by polling nodes and utilizing the Hardware Monitoring
Agent software provided by the hardware manufacturer. SAM can monitor
hardware from VMware hosts, HP ProLiant, Dell PowerEdge, and the IBM XSeries using this software, which can be found using the links below:
HP System Insight Manager (SIM v6.2 or higher is recommended)
Dell OpenManage Server Administrator
IBM Director (Common Agent, v6.3 or higher is recommended)

l
l
l

SAM can also monitor the health of the following Server Blade Chassis without
the need for additional software:
HP C7000
HP C3000
Dell M1000e

l
l
l

Hardware monitoring is achieved by polling via SNMP or WMI, depending upon

the node. For SNMP and WMI nodes, hardware monitoring must be enabled
manually through SAM's web console. For more information, see "Adding Server
Hardware Monitoring" on page 838.
If you run a scheduled Network Sonar Discovery of your existing servers, SAM
will automatically collect any servers that support hardware health information the
next time the discovery runs. For more information, see: "Managing Scheduled
Discovery Results" on page 275
Monitoring your hardware's health does not count against your allotted licenses.
Note: Only SAM administrators can enable hardware health monitoring.
________________________

HP Insight Management WBEM Providers for Windows Server 2003/2008 is an optional component for
HP System Insight Manager that must be installed for SAM to monitor hardware via WMI. This component
can be found using the following link:
HP Insight Management WBEM Providers for Windows Server 2003/2008
Additionally, you may need to install the HP ProLiant Support Pack for Windows. This link can be found here:
HP Proliant Support Pack

835

Chapter 19: Monitoring Hardware Health

Hardware monitoring has been tested on HP's firmware versions [Link] and [Link].
Dell does not make array and hard disk health information visible from WMI managed nodes. To monitor storage

health on Dell servers, use SNMP. Hardware monitoring has been tested on Dell's OpenManage firmware versions
6.2.0, 6.3.0, 6.5.0, 7.0.0, and 7.1.0.
IBM's ServeRAID Manager must be installed on IBM X-Series servers for storage hardware health information to
be displayed in SolarWinds SAM. Installation instructions can be found using the following links:
IBM's ServeRAID ManagerMegaRAID Storage Management Application (Optional: Only needed for MegaRAID
Controller support.)
Hardware monitoring has been tested on IBM's Director Platform Agent 6.3.
Hardware monitoring has been tested on HP's BladeSystem Onboard Administrator 3.10.
Hardware monitoring has been tested on Dell's Chassis Management Controller (CMC) 3.01 and higher.

Hardware Items Monitored by SAM

l
l
l
l
l
l
l
l
l

Fan status
Power Supply status
Temperature
Disk status
Battery status
Array Controller status
Physical Memory status
Chassis Intrusion status
CPU Temperature and/or status

Hardware Monitoring and VMware

Hardware monitoring is automatically enabled for VMware ESX and ESXi
servers. Monitoring of VMware servers uses the CIM protocol which should be
enabled by default after the installation of ESX/ESXi hosts. If installing Hardware
Monitoring Agent software on a VMware host, hardware information will be
detected by SAM and the check box to monitor Hardware Health of Servers will
be displayed, even where hardware information might already be collected via
the vCenter using the VMWare API. When this option is displayed for a VMware
host, checking it will not change the hardware polling method when Poll for
VMware is also selected.
If you are polling your hosts though the vCenter, you will not see the hardware
option listed when you click List Resources as these nodes tend to be ICMP.
This information is automatically collected by SAM, when available, through the
VMware [Link] will need to ensure you have the vCenter Hardware Status
plug-in enabled on your V-Center for this information to be available though the
VMware API, as shown below:

836

Accessing Hardware Monitoring Agent Software

Note: Port 5989 must be opened when polling VMware servers using the CIM
protocol.
If you run a scheduled Network Sonar Discovery of your existing servers, SAM
will automatically collect any servers that support hardware health information the
next time the scheduled discovery runs.
For more information, see:
l
l

"Managing Scheduled Discovery Results" on page 275.

"Virtualization" on page 319.

Accessing Hardware Monitoring Agent Software

Each vendors hardware monitoring agent software includes a web server that
operates on a unique port.
Note: Server Blade Chassis (HP C7000, HP C3000, and Dell M1000e) does not
use hardware monitoring agent software.
Navigating to [Link] successfully will validate that the
agent software is installed. Refer to the table below for the list of ports used by
each vendor:
Vendor: HP
Port:

2381

Dell

IBM

1311

423

For example: Navigating to [Link] in your web browser will take

837

Chapter 19: Monitoring Hardware Health

you to the Dell OpenManage Server Administrator page on the remotely
monitored host.
___________________________________

If HP Insight Management WBEM Providers for Windows Server 2003/2008 is installed for HP System
Insight Manager, the Data Source in the SIM web interface will read "WBEM." If this component is not
installed, the Data Source will read "SNMP."

The IBM Director web-based access is an optional component for version 6.x and is not installed by
default.
For information on troubleshooting hardware health polling, see "Troubleshooting Hardware Health" on
page 1338.

Adding Server Hardware Monitoring

There are two ways for administrators to add server hardware monitoring for
nodes; through the Add Node wizard, and through the Node Details group of the
Node Details page.
Add Node Wizard
From the Add Node wizard, the option to display Hardware Health of Servers is
available after a node has been defined. Check this box to enable hardware
health monitoring.

Manually Add Hardware Monitoring

To add hardware health monitoring without using the Add Node wizard,
follow these steps:
1. Click the Home tab in the SAM web console.
2. In the All Nodes group, click the node you want to monitor.
3. In the Node Details group of the Node Details page, click the List
Resources button as shown below:

838

Hardware Details

The following screen appears:

Here you can select the available hardware you want to monitor by checking the
appropriate boxes and then clicking Submit.
To disable hardware monitoring, navigate back to this screen and uncheck
Hardware Health of Servers, then click Submit.
For information on troubleshooting hardware health polling, see "Troubleshooting
Hardware Health" on page 1338.

Hardware Details
Once you have chosen the hardware you want to monitor, the Hardware Health
Details group appears on the Node Details page and looks similar to the
following illustration, providing general information about your hardware and its
status:

839

Chapter 19: Monitoring Hardware Health

Note: This view will be hidden if hardware monitoring is disabled.

For more information, see "Current Hardware Health Status" on page 840.
For information on troubleshooting hardware health polling, see "Troubleshooting
Hardware Health" on page 1338.

Current Hardware Health Status

The current status of your hardware's health can be determined by the Current
Hardware Health grouping, as shown below. The status for most items will read
OK, Warning, or Critical, depending upon the set threshold values and the
returned values. The icon colors for each item will change between green, yellow,
and red, respectively. Gray icons indicate a status of Unknown, which suggests a
polling failure.
You can click on the [+] and [-] icons to expand and collapse a particular tree
branch of hardware that is being monitored. When collapsed, the top level view
(or roll-up status) of each hardware item will display the worst status of an item in
that branch.

840

Hardware Health Overview Chart

Note: The default temperature measurement is in degrees, Fahrenheit (F). To

change this to Celsius (C), from the web console, navigate to Settings >
Manage Accounts > Select Account > Edit. The Temperature Unit dropdown
menu can be found under the Server & Application Monitor Settings category.

Hardware Health Overview Chart

This resource provides a status overview of your monitored hardware's health.
Mousing over each pie segment will provide a tooltip with more detailed
information.

841

Chapter 19: Monitoring Hardware Health

Clicking a server icon in the Overview Chart will bring up a list of the servers with
the indicated status, as shown below. From here, you can navigate to the Details
page of each server by clicking any icon in the list.

Changing Threshold Values

Threshold values for each monitored item cannot be set within SAM; however,
some values can be configured through the Hardware Monitoring Agent Software
installed on your hardware. Dell OpenManage Server Administrator is one such
example. The illustration below shows how threshold values for the temperature
can be changed from the default values using Dell's software.

842

Hardware Health Chart

Different default thresholds exist for different items in the Hardware Monitoring
Agent Software. Some of these thresholds may be accessible and open to
editing, some may not. Consult your Hardware Monitoring Agent Software user
guide for specific information about editing thresholds.
You can manually define alerting thresholds for any hardware sensor or category
in theAdvanced Alert Manager.
For information, see:
l
l

"Manually Changing Alert Thresholds" on page 847.

"Accessing Hardware Monitoring Agent Software" on page 837.

Hardware Health Chart

This chart allows you to visualize multiple hardware statistics simultaneously.
The advantage of this view is that you can easily see how your hardware objects
are performing over a given period of time in relation to one another.
Tabs at the top of the chart allow you to quickly navigate between different groups
of hardware, allowing you to see the performance and status of an entire group of
the same hardware on a single page.

843

Chapter 19: Monitoring Hardware Health

Note: This view will be hidden if hardware monitoring is disabled.

Customizing the Hardware Health Chart

Click Edit at the top-right of the chart to be taken to the following screen. You can
customize the following user-specific aspects of the chart display:
l

l
l
l

Sample Interval: This is the interval of time that will be displayed on the
chart.
Title: This will give a title to display for your chart.
Subtitle: This will give a subtitle to display for your chart.
Temperature Display: This allows you to set the temperature units. This
will affect all charts that display temperature for the current user.
Note: For information on changing the measurement units between
Fahrenheit and Celsius, see "Server & Application Monitor Settings" on
page 308.

844

Customizing the Hardware Health Chart

l

Time Period for Chart: This allows you to select the span of time the chart
will display.

Click Submit to save the settings.

Clicking the chart itself opens the following screen which allows you to edit
multiple, self-explanatory settings pertaining to the Hardware Chart.

845

Chapter 19: Monitoring Hardware Health

Click Submit to save the settings.

Note: The Raw Data button will deliver the chart data by downloading an Excel
spreadsheet. The Chart Data button displays the data in a web page.
For information on troubleshooting hardware health polling, see "Troubleshooting
Hardware Health" on page 1338.

Alerting on Hardware Health

SAM has the ability to create alerts on all aspects of monitored hardware. You
can access these alerts in the Advanced Alert Manager by navigating to the
Trigger Condition tab, then selecting either APM: Hardware, APM: Hardware
Type, or APM: Hardware Sensor from the Type of Property to Monitor
dropdown menu, as shown in the following illustration:

846

Manually Changing Alert Thresholds

For a list of hardware variables, see "Hardware Specific Variables" on page 965.
For information on Alerting and Reporting, see "Configuring SolarWinds SAM
Alerts" on page 723.
For information on troubleshooting hardware health polling, see "Troubleshooting
Hardware Health" on page 1338.

Manually Changing Alert Thresholds

You can manually define alerting thresholds for any hardware sensor or category
in theAdvanced Alert Manager. The illustration below shows an example of how
to define an alert for when a fan's speed exceeds 3600 RPM.

847

Chapter 19: Monitoring Hardware Health

For a list of hardware variables, see "Hardware Specific Variables" on

page 965.
For information on Alerting and Reporting, see "Configuring SolarWinds
SAM Alerts" on page 723.
For information on hardware health alerting, see "Alerting on Hardware
Health" on page 846.
For information on troubleshooting hardware health polling, see
"Troubleshooting Hardware Health" on page 1338.

848

Chapter 20:
Managing Processes, Services,
Tasks, and Events in Real Time
l

To manage and monitor real time processes, see "Real Time Process
Explorer" on page 849.
To manage and monitor real time services, see "Service Control Manager"
on page 859.
To manage and monitor scheduled tasks, sWindows Scheduled Task Monitor
To view and monitor real time events, see "Real Time Event Viewer" on
page 872.

Real Time Process Explorer

The Real Time Process Explorer (RTPE) is available for WMI and SNMP
monitored nodes. This feature is similar to the Processes tab found in the
Windows Task Manager. The advantage of the RTPE is that you no longer need
to physically, or remotely, log in to a particular computer and run the Task
Manager to retrieve that machine's vital statistics. Information for both monitored
and unmonitored processes is displayed directly through SAM using the RTPE.

849

Chapter 20: Managing Processes, Services, Tasks, and Events in Real Time

Notes:
l

l
l

l
l

Only SAM administrators can end processes as well as enable and disable the RTPE.
The User Name and Command Line columns are hidden by default.
Using the RTPE on a node monitored via ICMP, which has no working
component, will require you to select Windows credentials manually. Consider promoting the selected node to SNMP or WMI to avoid this prompt.
For more information, see:
"Promoting a Node from ICMP to SNMP Monitoring" on page 193.
"Promoting a Node to WMI Monitoring " on page 195.

Accessing the Real Time Process Explorer

There are three places within SAM that you can access the RTPE: the Node
Details page, the Application Details page, and the Component Details page.
Node Details page
On the Node Details page, the Real-Time Process Explorer button can be found
at the bottom of each Top 10 list, as highlighted below:

850

To navigate to the Node Details page:

To navigate to the Node Details page:

1. Click the Home tab in the SAM web console.
2. In the All Nodes group, click a node.
Note: The Real-Time Process Explorer button will not be available on the Node
Details page in situations where Top 10 lists are hidden, or when an assigned
application template does not contain an SNMP Process Monitor or
WMI/Windows Service Monitor.
Clicking Real-Time Process Explorer will open the RTPE in a new window and
will be sorted by the Top 10 category. For example, clicking the Real-Time
Process Explorer button from the Top 10 Monitored Processes by CPU Load
category will open the RTPE window with the processes sorted by CPU usage.
The same is true for each Top 10 category.
Note: Pop-ups must be enabled in your browser to view the Real Time Process
Explorer.
Application Details page
The RTPE window can be accessed from the Application Details page, as
highlighted below:

851

Chapter 20: Managing Processes, Services, Tasks, and Events in Real Time
To navigate to the Application Details page:
1. Click the Home tab in the SAM web console.
2. In the All Applications group, click an Application.
Component Details page
On the Component Details page, the Real-Time Process Explorer button can be
found by the Management field, as highlighted in the following illustration:

To navigate to the Component Details page:

1. Click the Home tab in the SAM web console.
2. In the All Applications group, click an Application.
3. Click a component.

Monitoring Unmonitored Processes

Processes currently monitored by SAM are indicated by the application icon with
the name of the assigned application beside it. Processes that are not currently
monitored by SAM are indicated by the [+] symbol, followed by the words, Start
monitoring.

852

To have SAM monitor a process that is not being monitored:

To have SAM monitor a process that is not being monitored:
1. Click Start monitoring.
2. From here, you will be taken to the Edit Properties section of the Component Monitor Wizard. At this point, you can begin customizing the selected component monitor.

Using the Real Time Process Explorer

Different information is displayed in the RTPE depending on what protocol you
use to monitor a particular node. The table below shows the differences in the
information gathered based on the protocol used:
Available RTPE processes via:
Monitored Process:

WMI

SNMP

Name

Yes

Yes

Process ID

Yes

Yes

Assigned Application Yes

Yes

CPU usage

Yes

Yes

Physical Memory

Yes

Yes

Virtual Memory

Yes

No

Disk I/O

Yes

No

User Name

Yes

No

Command Line

Yes

Yes

Polling interval

Five seconds

Up to two minutes

Notes:
l

Windows servers do not update their SNMP statistics more frequently than
every two minutes. It takes at least two updates to these statistics to
provide an accurate calculation. This means data displayed in the RTPE
via SNMP can take up to four minutes to display. If this is unacceptable,
consider changing the protocol to WMI.
SNMP uses significantly less bandwidth than WMI.

853

Chapter 20: Managing Processes, Services, Tasks, and Events in Real Time
____________________________________
Information on certain processes may not be exposed which can result in certain rows being blank.

Each column can be sorted by clicking the column head or hovering over the
column name and clicking the dropdown arrow. Columns can also be added or
removed this way. Each column can also be resized and/or re-arranged by
dragging the separators between each column head to change the width, or the
column heads themselves to change their position.
Note: By default, all available columns, with the exception of the User Name and
Command Line, are shown for the top ten running processes.

To show all running processes:

1. Click Show All at the bottom-left of the window.
To show a set number of running processes:
1. Change the number in the text box next to the Show All button from 10 to
any number that suits your needs.
To pause polling:
1. Click Pause Polling at the top-left of the window when available.
To end processes:
1. Check the boxes next to the processes you want to end and then click End
Process.

854

To start polling:
Note: This option is only available when the RTPE is using a WMI connection.
To start polling:
1. Click Start Polling at the top-left of the window.

For Windows based nodes, you can change the credentials used by clicking the
Use Different Credentials button to bring up the credential library dialog box.
Clicking Refresh

will re-poll the running processes.

Real Time Process Explorer Alerts

Three alerts are included with the Real Time Process Explorer:
l

High CPU Percent Utilization with Top 10 Processes. (This alert will
send an email when the CPU utilization is greater than 80%.)
High Physical Memory Utilization with Top 10 Processes. (An alert will
be sent when physical memory usage is at or above 90%.)
High Virtual Memory Utilization with Top 10 Processes. (An alert will be
sent when virtual memory usage is at or above 90%.)

These alerts can be found in the Alert Manager as highlighted in the following
illustration:

855

Chapter 20: Managing Processes, Services, Tasks, and Events in Real Time

As with all alerts, these three can be customized to suit your needs by selecting
an alert via the check box and clicking the Edit button. For more information, see
"Adding Alert Actions" on page 755.
Note: Alerts may lag if you are monitoring hardware via SNMP. It takes at least
two updates to these statistics to provide an accurate calculation, meaning an
alert can take up to four minutes to reach its recipient. If this is unacceptable,
consider changing the protocol to WMI, which updates every five seconds. Also
consider adjusting the trigger time to a value greater than two minutes. For more
information, see "Using the Real Time Process Explorer" on page 853.

Real Time Process Information in Top XX Alerts

SAM provides additional troubleshooting information for high CPU, memory, and
virtual memory by sending email alerts. This is done by utilizing the Top
Offending Processes metric running on the server at the time of the alert.
To edit an alert:
1. Open the Alert Manager by navigating to Start > SolarWinds Orion >
Advanced Alert Manager.
2. Click Configure Alerts.
3. Highlight a hardware alert from the list and then click Edit.

856

To edit an alert:
4. Click the Trigger Actions tab.
5. Highlight Execute Program and then click Edit.
6. Click the Execute Program tab as shown below:

Following is the path where the executable

[Link] is located along with its command line
arguments:
C:\Program Files (x86)\SolarWinds\Orion\APM\
[Link]
Command line argument syntax:
[Link] -n=<NodeID> [-count=<NumberOfProcesses>]
[-sort=<SortBy>] [-timeout=<PollingTimeout>] [-alert=<AlertDefID>]

Command line argument variables:

Variable

Definition

Definition

-n

Defines the ID of a Node (NodeID), which

will be polled.

-count

Defines the number of processes to show.

-sort

Defines the criteria to use for the selection

of top processes. Possible values:

857

Chapter 20: Managing Processes, Services, Tasks, and Events in Real Time

Process
CPU

Processor time. This is the

default value if the command line argument isnot
specified.

PhysicalMemory

Process physical memory.

VirtualMemory

Process virtual memory.

DiskIO

Process disk I/O per

second.

-timeout

Defines timeout for polling in seconds.

-alert

Defines AlertDefID of associated triggered

alert. If this argument is provided, then alert
notes are updated with the results from
polling.

-activeObject

Defines the ActiveObject property of the

associated triggered alert. If this argument
is not provided, NodeID is used.

Example 1:
This example will return the top 20 processes with the highest virtual
memory consumption running on the host with node ID 123.
[Link] -n=123 -count=20 sort=VirtualMemory -timeout=300

Example 2:
This example uses the Execute an External Program alert action:
[Link] -n=${NodeID} -alert=${AlertDefID}

Example 3:
This example uses the Execute an External Program alert action for an alert
defined for the Volume object type
[Link] -n=${NodeID} -alert=${AlertDefID} activeObject=${NetObjectID} -sort=VirtualMemory

858

Service Control Manager

Service Control Manager

The Service Control Manager (SCM) is similar to the Real Time Process
Explorer, with the main difference being that it allows you to manage the services
of monitored Windows nodes, as opposed to processes. The advantage of the
SCM is that you no longer need to physically, or remotely, log in to a particular
Windows computer to view and control its services. Information for both running
and stopped services is displayed directly through SAM using the Service Control
Manager.
Note: Services viewed in the Service Control Manager are polled every 25
seconds using WMI.

Accessing the Service Control Manager

There are four places within SAM that you can access the SCM: the Application
Details page, the Component Details page, the Node Details, and the
Management Resource page.
Application Details page
On the Application Details page, the Service Control Manager button can be
found at the top of the Application Details resource, as highlighted below:

859

Chapter 20: Managing Processes, Services, Tasks, and Events in Real Time
To navigate to the Application Details page:
1. Click the Home tab in the SAM web console.
2. In the All Applications group, click an Application.
Note: Pop-ups must be enabled in your browser to view the Service Control
Manager.
Component Details page
On the Component Details page, the Service Control Manager button can be
found at the top of the Component Details resource, as highlighted below:

To navigate to the Application Details page:

1. Click the Home tab in the SAM web console.
2. In the All Applications group, click an Application.
3. Click a component.
Node Details page
On the Node Details page, the Service Control Manager button can be found at
the bottom of each Top 10 list, as highlighted below:

860

To navigate to the Node Details page:

To navigate to the Node Details page:
1. Click the Home tab in the SAM web console.
2. In the All Nodes group, click a node.
Note: The Service Control Manager button will not be available on the Node
Details page in situations where Top 10 lists are hidden. Clicking Service Control
Manager will open the SCM in a new window and the services will be sorted
alphabetically.
Note: Pop-ups must be enabled in your browser to view the Service Control
Manager.
Management Resource
On the Node Details page, the Service Control Manager button can be found in
the Management resource, as highlighted below:

Using the Service Control Manager

The Service Control Manager (SCM) shows all the services, running or not, that
are on the monitored computer. Hovering the mouse over the row of any service
will give you detailed information about that service in a tool tip, as shown below:

861

Chapter 20: Managing Processes, Services, Tasks, and Events in Real Time
Starting and Stopping a Service:
1. Click the row of a service to select it.
2. At the top of the window, Select either Stop Service, Start Service or
Restart service.
Services currently monitored by SAM are indicated by the application icon with
the name of the assigned application beside it. Services that are not currently
monitored by SAM are indicated by the [+] symbol, followed by the words, Start
monitoring this service.
To Monitor a Service with SAM:
1. Click Start monitoring this service in the row of the service you want to
monitor.
2. From here, you will be taken to the Edit Properties section of the Component Monitor Wizard wizard. At this point, you can begin customizing the
selected component monitor.
Once the Service Control Manager is activated, each column can be sorted by
clicking the column head or hovering over the column name and clicking the
dropdown arrow. Columns can also be added or removed this way. Each column
can also be resized and/or re-arranged by dragging the separators between each
column head to change the width, or the column heads themselves to change
their position.
The table below shows the default settings for the Service Control Manager:
Action

Description

Default
Setting

Service Job
Life Time

This is used to specify how long the information

for a service exists.

3
minutes

Service Poll
Interval

This is used to specify the refresh frequency of the

information reported by the service.

25
seconds

Service Action
Job Timeout

This reports the timeout for a service.

3
minutes

Note: By default, all available columns are shown.

862

Windows Scheduled Task Monitor

Windows Scheduled Task Monitor

The Windows Scheduled Task Monitor (WSTM) is a resource designed to
provide you with quick visual access to the status of scheduled tasks configured
on your Windows nodes.

The WSTM comes with an alert which will notify you of any task execution
failures, as well as web based reports that allow you to view all scheduled tasks
configured across all servers in your environment. Additionally, there is a
dedicated Task Failure Report you can view or have emailed to you on a regular
basis.
Note: This resource is hidden when the WSTM is not being monitored on a node.
For more information, refer to the following sections:
l
l
l
l
l

Requirements for the Windows Scheduled Task Monitor

Enabling the Windows Scheduled Task Monitor
Accessing the Windows Scheduled Task Monitor
Understanding the Windows Scheduled Task Monitor
Alerting Using Windows Scheduled Task Monitor Macros

Requirements for the Windows Scheduled Task Monitor

The WSTM supports monitoring tasks on the following operating systems:
Windows 2003
Windows 2003 R2
Windows 2008
Windows 2008 R2
Windows 2012

863

Chapter 20: Managing Processes, Services, Tasks, and Events in Real Time
Windows 2012 R2
Notes:
l

When SAM is installed on Windows 2003 or 2003 R2, scheduled tasks on

Windows 2008 or later cannot be polled by the Windows Scheduled Task
Monitor (WSTM).
The WSTM consumes five license units per node.

Enabling the Windows Scheduled Task Monitor

There are several locations available that allow you to enable the WSTM:
l
l
l

When adding a new WMI managed node.

When listing resources on an existing WMI managed node.
When employing the Network Sonar Discovery Wizard. (Both one-time discovery, and scheduled discovery options are available using this method.)

Notes:
l

The Windows Scheduled Tasks option is hidden when a task is not found
on the target machine.
The Windows Scheduled Tasks option is unchecked by default when at
least one task is found on the target machine.
The Windows Schedule Tasks option is checked when tasks are already
being monitored.

To enable the WSTM via adding a WMI managed node:

1. From the web console, navigate to Settings > Manage Nodes.
2. Click [+] Add Node.

864

Enabling the Windows Scheduled Task Monitor

3. Select the Windows Servers: WMI and ICMP option and enter the proper
credentials.
4. Click Next.
5. Check Windows Scheduled Tasks.
To enable the WSTM via listing the resources of a WMI managed node:
1. From the web console's Home tab, find the All Nodes resource.
2. Expand the Windows tree by clicking Windows.
3. Click a Windows node to be taken to the Node Details page for that node.

4. From the Management resource, click List Resources, as shown:

865

Chapter 20: Managing Processes, Services, Tasks, and Events in Real Time
5. Check Windows Scheduled Tasks, and then click Submit.

To enable the WSTM via Network Sonar Discovery:

1. From the web console, click Settings in the upper right-hand corner of the
screen.
2. In the Getting Started with Orion grouping, click Network Sonar Discovery.
3. Continue through the wizard.
4. When prompted, on the Scheduled Discovery Results tab, check Windows
Scheduled Tasks, as highlighted, and then click Submit:

Accessing the Windows Scheduled Task Monitor

When monitored, you will find the Windows Schedule Task Monitor resource only
on the Node Details view of the monitored server.
To view the WSTM on the Node Details page:

866

Understanding the Windows Scheduled Task Monitor

1.
2.
3.
4.

From the web console's Home tab, find the All Nodes resource.
Expand the Windows tree by clicking Windows.
Click a Windows node to be taken to the Node Details page for that node.
On the Node Details page, find the Windows Scheduled Task resource, as
shown:

Note: The WSTM is not shown in the All Applications resource.

Understanding the Windows Scheduled Task Monitor

The WSTM has four columns that provide the following information:
l
l
l
l

Task Name: This column displays the detailed name of the scheduled task.
Status: This displays the current status of the listed task.
Last Run Time: This displays the last time the listed task executed.
Last Run Result: This displays the result of the listed task's last execution
as an icon.

Tips:
l

Hovering over any item in the Task Name column will provide a tooltip with
detailed information about the listed task.
You can sort the display by clicking the head of each column.

867

Chapter 20: Managing Processes, Services, Tasks, and Events in Real Time

Clicking >>Edit Settings at the bottom of the resource will allow you to:
l Change the polling frequency.
l Change the polling timeout period.
l Change credentials.
l Add custom notes.

Alerting Using Windows Scheduled Task Monitor Macros

The following variables are associated with the Windows Scheduled Task
Monitor and can be used in alerting:
l
l
l
l
l
l
l
l
l
l
l
l

${WindowsScheduledTaskDetailsURL}
${ApplicationID}
${Author}
${DateOfCreation}
${Description}
${ID}
${LastRunResult}
${LastRunTime}
${Name}
${NextRunTime}
${NodeID}
${TaskState}

These variables can be found in the Advanced Alert Manager by navigating to

Start > SolarWinds Orion > Advanced Alert Manager.

868

Windows Scheduled Task Monitor Returned Status Codes

Following is an example email using alert macros with the Windows Scheduled
Task Manager:
Subject:
Scheduled Task ${Name} on ${[Link]} had an unsuccessful
last run.
Body:
The Windows Scheduled Task ${Name} on server ${[Link]}
reports ${LastRunResult}. The task executed on ${LastRunTime} and
is scheduled to run again ${NextRunTime}.
<br>

Task Description: ${Description}.

Task Creation Date: ${DateOfCreation}.
Task Author: ${Author}.
For more information on the status of this task, click:
${APMWstm:TaskDetailsURL}.

WSTM Alerts
The following is a list associated with the WTSM:
l

Windows Scheduled Tasks: Alert me when the task last run result is nonsuccessful.
Note: By default, this alert is disabled.

For more information, see Creating Alerts

Windows Scheduled Task Monitor Returned Status Codes

Following is a list of status codes and their meanings that may appear in the
WSTM resource:
Hex Status
Code

Description

(0x0)

The operation completed successfully.

(0x1)

Incorrect or unknown function called.

(0x2)

File not found.

869

Chapter 20: Managing Processes, Services, Tasks, and Events in Real Time

(0xA)

The environment is incorrect.

(0x41300)

The task is ready to run at its next scheduled time.

(0x41301)

The task is currently running.

(0x41302)

The task will not run at the scheduled times because it has
been disabled.

(0x41303)

The task has not yet run.

(0x41304)

There are no more runs scheduled for this task.

(0x41305)

One or more of the properties that are needed to run this task
on a schedule have not been set.

(0x41306)

The last run of the task was terminated by the user.

(0x41307)

Either the task has no triggers or the existing triggers are

disabled or not set.

(0x41308)

Event triggers do not have set run times.

(0x4131B)

The task is registered, but not all specified triggers will start
the task.

(0x4131C)

The task is registered, but may fail to start. Batch logon

privilege needs to be enabled for the task principal.

(0x41325)

The Task Scheduler service has asked the task to run.

(0x8004020D)

Cannot modify or delete an object that was not added using

the COM+ Admin SDK.

(0x80041309)

A task's trigger is not found.

(0x8004130A)

One or more of the properties required to run this task have

not been set.

(0x8004130B)

There is no running instance of the task.

(0x8004130C)

The Task Scheduler service is not installed on this computer.

(0x8004130D)

The task object could not be opened.

(0x8004130E)

The object is either an invalid task object or is not a task

object.

870

Windows Scheduled Task Monitor Returned Status Codes

(0x8004130F)

No account information could be found in the Task Scheduler

security database for the task indicated.

(0x80041310)

Unable to establish existence of the account specified.

(0x80041311)

Corruption was detected in the Task Scheduler security

database; the database has been reset.

(0x80041312)

Task Scheduler security services are available only on

Windows NT.

(0x80041313)

The task object version is either unsupported or invalid.

(0x80041314)

The task has been configured with an unsupported

combination of account settings and run time options.

(0x80041315)

The Task Scheduler Service is not running.

(0x80041316)

The task XML contains an unexpected node.

(0x80041317)

The task XML contains an element or attribute from an

unexpected namespace.

(0x80041318)

The task XML contains a value which is incorrectly formatted

or out of range.

(0x80041319)

The task XML is missing a required element or attribute.

(0x8004131A)

The task XML is malformed.

(0x8004131D)

The task XML contains too many nodes of the same type.

(0x8004131E)

The task cannot be started after the trigger end boundary.

(0x8004131F)

An instance of this task is already running.

(0x80041320)

The task will not run because the user is not logged on.

(0x80041321)

The task image is corrupt or has been tampered with.

(0x80041322)

The Task Scheduler service is not available.

(0x80041323)

The Task Scheduler service is too busy to handle your

request. Please try again later.

(0x80041324)

The Task Scheduler service attempted to run the task, but the
task did not run due to one of the constraints in the task

871

Chapter 20: Managing Processes, Services, Tasks, and Events in Real Time

definition.
(0x80041327)

The task has properties that are not compatible with earlier
versions of Windows.

(0x80041328)

The task settings do not allow the task to start on demand.

(0x80070002)

The system cannot find the file specified.

(0x800700C1)

Not valid Win32 application.

(0x800704C7)

The operation was canceled by the user.

(0x800704DD)

The operation being requested was not performed because

the user has not logged on to the network. The specified
service does not exist.

(0xC000013A)

The application terminated.

(0xC06D007E)

Unknown software exception.

For a complete list of error codes, see [Link]

Real Time Event Viewer

The Real Time Event Viewer (RTEV) allows you to view Windows event logs in
real time using the WMI protocol. Event logs can be filtered by log type, event
source, and the level of severity. You can also select which event logs you want
to monitor from within this resource.

872

Accessing the Real Time Event Viewer

Accessing the Real Time Event Viewer

The RTEV is accessible from the Management resource found on the Node
Details page and the Application Details page, as shown below. It is also
available on the Component Details view of the Windows Event Log component,
as well as from every component within an application assigned to a node
recognized as being Windows.

To navigate to the Node Details page:

1. Click the Home tab in the SAM web console.
2. In the All Nodes group, click a node.
To navigate to the Application Details page:
1. Click the Home tab in the SAM web console.
2. In the All Applications group, click an application.
To navigate to the Component Details page:
1. Click the Home tab in the SAM web console.
2. In the All Applications group, click an application.
3. Click the Windows Event Log component (if available).

Filtering Events
Different events are displayed in the RTEV depending upon the log type and
filters you choose.
Once you select a Log Type from the dropdown list, SAM will immediately begin
collecting these logs and display them in the message window to the right, as
shown:

873

Chapter 20: Managing Processes, Services, Tasks, and Events in Real Time

To Select a Log Type:

1. Select a Log Type from the drop down menu.
Once the events of the selected Log Type are collected and displayed in the right
window, you can filter the results with various criteria.
To Filter Collected Events:
1. Select Custom Sources from the Event Sources dropdown menu.

874

To Select a Log Type:

2. Check only the sources you want to keep when the filter is applied, as highlighted below:

3. Select the type of messages you want the filter to keep by checking the
appropriate Event Level check boxes. (Note that the icons in this legend
correspond to messages in the display window.)

4. Click Apply Filter to have the events filtered and displayed.

875

Chapter 20: Managing Processes, Services, Tasks, and Events in Real Time

Reading Events
Once filtering is complete, you can hide and unhide the filtering pane on the left
by clicking either of the two arrows, highlighted in red:

The display window shows a list of the most recent events. Should any new
events occur while this window is open, a green bar at the top of the window will
indicate that new events have arrived, as shown in the above image. You can
click the green bar to add these new events to the display window.
Note: The Level column icons correspond to the Event Level icons in the legend
of the events pane.
Clicking on any message in the display window will bring up a message box
providing the entire message along with additional details, as shown:

Monitoring Events
There are three ways to begin monitoring events from within the RTEV:
l
l

Click Start Monitoring in the Message Details view.

Click [+] Start Monitoring in the Assigned Application column in the row
of the event you want to monitor.
Select multiple events from the list window by checking the appropriate
boxes and then click [+] Start Monitoring at the top of the window.

All three methods (highlighted below) will take you to the Add Component Monitor
wizard and allow you to create an application based on your selection.

876

Component Monitor Wizard

Component Monitor Wizard

Once you begin the Component Monitor Wizard, you will encounter the option to
Disable Keyword Matching.

This dropdown menu will help you better filter the results you want.

877

Chapter 21:
Monitoring Syslog Messages
Syslog messages are one type of real time notification that network devices can
send in response to designated network events. SolarWinds SAM provides the
SolarWinds Syslog Service, allowing SolarWinds to receive Syslog messages
from any monitored network device. The SolarWinds Syslog Service also has the
ability to open multiple connections to your SQL server, so it can handle large
numbers of simultaneously incoming Syslog messages from all your monitored
devices.
SolarWinds SAM uses the SolarWinds Syslog Service to listen on UDP port 514
for incoming Syslog messages. Received messages are then decoded and
stored in the SolarWinds database. Until they are acknowledged, Syslog
messages are available for viewing either in the web console Syslog view or in
the Syslog Viewer application. The Syslog view in the SolarWinds Web Console
provides quick access to current messages, filtered by any or all of the following
criteria:
l
l
l

Name or type of network object sending the message.

Message Severity, Facility, Type, or Pattern
Time Period in which the message was sent.

The Syslog Viewer application also allows you to tailor your view of Syslog
messages using fully customizable rules. Additionally, the Syslog Viewer gives
you the ability both to search your SolarWinds database and to configure
Syslog-specific alerts for received Syslog messages.
Note: When configuring your network devices to send Syslog messages, confirm
that messages are sent to the IP address assigned to your SolarWinds SAM
server. To ensure the proper configuration of a network device for Syslog
messaging, refer to the documentation supplied by the device vendor.

Configuring the SolarWinds Syslog Port

SolarWinds listens for Syslog messages on port 514 (UDP). You can configure
this port in the [Link] file, as indicated in the following procedure.

878

Chapter 21: Monitoring Syslog Messages

Note: Running the Configuration Wizard will revert any and all changes made to
the [Link] file. If you run the Configuration Wizard, you must
repeat this procedure to restore your required port setting.
To configure the Syslog port:
1. Log on to your SolarWinds server using an account with administrative privileges.
2. Open [Link] in a text editor.
Note: By default, [Link] is located in C:\Program
Files\SolarWinds\Orion\.

3. Locate the following line: <add key="UDPListenPort" value="514">

4. Edit value="514" as required to indicate the port on which your monitored
devices are configured to send Syslog messages to your SolarWinds
server.
5. Save [Link].

Syslog Messages in the Web Console

The SolarWinds Web Console provides both Syslog-specific resources and a
Syslog view that provides a table of Syslog messages received by your
SolarWinds server. The following sections provide an overview of available
Syslog resources and procedures for viewing and acknowledging Syslog
messages within the SolarWinds Web Console.

Syslog Resources
SolarWinds SAM provides the following Syslog-related resources for inclusion
within web console views.
Advanced Syslog Counts
Every Syslog message has a designated severity. For more information
about Syslog severities, see Syslog Severities on page892. The
Advanced Syslog Counts resource groups by severity all Syslog messages
received by the currently viewed node. For each severity, this resource
provides the number of received Syslog messages.
Advanced Syslog Parser
The Advanced Syslog Parser resource provides a comprehensive view of
the Syslog messages most recently received by the viewed node. The most
recent messages of each severity are listed. For more information about
Syslog severities, see Syslog Severities on page892.

879

Viewing Syslog Messages in the Web Console

Advanced Syslog Summary
The Advanced Syslog Summary resource groups by message type all
Syslog messages received by the currently viewed node, where the
message type is encoded in the Syslog message packet. For each
message type, this resource provides the severity, the hostname or IP
address of the message originator, and the total number of Syslog
messages received.
Last 25 Syslog Messages
The Last 25 Syslog Messages resource provides a list of the last 25 syslog
messages that have been sent by monitored network devices to the viewed
node. For each message, this resource presents the date and time the
message was sent, the hostname and IP address of the device sending the
message, and the message text.
Clicking the hostname, IP address, or message text opens the
corresponding Object Details page, providing extensive diagnostic
information about the monitored network object sending the message.
Clicking Edit opens the Edit Last 25 Syslog Messages page where you can
set the maximum number of displayed messages, select the time period for
viewing messages, and establish filters to limit the messages this resource
displays. For more information, see Using Node Filters on page233.
Syslog Summary
The Syslog Summary resource lists the number of Syslog messages
received by the viewed node from monitored network devices over a
specified period of time.

Viewing Syslog Messages in the Web Console

You can customize the list view by using the following procedure to select your
preferred message grouping criteria.
To view Syslog messages in the Web Console:
1. Click Start> All Programs> SolarWinds> SolarWindsWeb Console.
2. Log in to the SolarWinds Web Console, and then click Syslog in the
Views toolbar.
3. If you want to view Syslog messages for a specific Syslogenabled network object, specify the selected object in the Network Object field.

880

Chapter 21: Monitoring Syslog Messages

4.
5.

6.

7.

8.

9.
10.
11.
12.

Note: Only objects that have sent a Syslog message to the SolarWinds
server will be listed in this field.
If you want to filter your Syslog messages table by device type, select
the type to which you want to limit your view in the Type of Device field.
If you want to filter your Syslog messages table by severity, select the
severity level to which you want to limit your view in the Select Severity
field.
Note: For more information, see Syslog Severities on page892.
If you want to filter your Syslog messages table by facility, select the
facility to which you want to limit your view in the Select Facility field.
Note: For more information, see Syslog Facilities on page890.
If you want to limit your Syslog messages table to show only messages of a designated type, type the appropriate string in the Message
Type field.
If you want to limit your Syslog messages table to show only messages containing a designated pattern, provide the appropriate string in
the Message Pattern field.
Note: An asterisk (*) is required as a wildcard character, both before and
after the pattern string, unless the provided pattern is any of the following:
l The beginning of the message
l The end of the message
l The full message
If you only want to see Syslog messages from a specific period of
time, select a time period from the Time Period menu.
Confirm the number of messages displayed in the Show Messages field.
If you want cleared or acknowledged messages to remain in the Syslog view, check Show Cleared Messages.
Click Refresh to update the Syslog messages list with your new settings.

Acknowledging Syslog Messages in the Web Console

Acknowledging Syslog messages is straightforward in the SolarWinds Web
Console, as shown in the following procedure.
To acknowledge Syslog messages in the SolarWinds Web Console:
1.
2.
3.
4.

Click Start> All Programs> SolarWinds> SolarWindsWeb Console.

Log in to the SolarWinds Web Console.
Click Syslog in the Views toolbar.
Provide filter criteria for the Syslog messages table. For more information,
see Viewing Syslog Messages in the Web Console on page880.
5. Click Refresh to ensure that all selected view criteria take effect.

881

Using the Syslog Viewer

6. Check the messages you want to acknowledge, and then click Clear
Selected Messages.

Using the Syslog Viewer

SolarWinds also provides the standalone Syslog Viewer application for viewing
and acknowledging Syslog messages on your network. Syslog Viewer collects
Syslog messages from your network and presents them in a readily reviewable
and searchable list so that you can easily monitor your network. The following
sections provide a guide to using the Syslog Viewer application for viewing,
acknowledging, and triggering alerts in response to Syslog messages on your
network.
To open the Syslog Viewer, click Start> All Programs> SolarWinds> Syslog
and SNMP Traps> Syslog Viewer.

Viewing and Acknowledging Current Messages

The Syslog Viewer makes it easy to view and acknowledge messages. The
following procedure views and then acknowledges current Syslog messages.
To view and acknowledge current Syslog messages:
1. Click View> Current Messages
2. Acknowledge current messages using either of the following methods:
l Right-click any message, and then select Acknowledge Selected.
l Add an Acknowledged column to the Syslog Viewer, and then check
each message that you want to acknowledge. For more information, see
Syslog Server Settings on page883.

Searching for Syslog Messages

Collected Syslog messages may be searched within Syslog Viewer. The
following steps both search for Syslog messages and format search results.
To search the Syslog message list:
1. Click View> Search Messages.
2. Enter appropriate search criteria, and then click Search Database.
3. If you want to group messages for easier navigation, select the type of
grouping from the Grouping list.
Note: Messages can be acknowledged in the search results just as they
can be acknowledged in the Current Messages view. For more information, see Syslog Server Settings on page883.

882

Chapter 21: Monitoring Syslog Messages

4. If you want to limit the number of messages that are shown, enter or
select a number in the Maximum number of messages to display field.
5. If you want to view messages that meet your search criteria as they
arrive, select a number for the Auto Refresh every number seconds
field.
Note: Auto Refresh is only available when you are viewing current messages. The Date/Time Range must be set to Today, Last 24 Hours, Last
2 Hours, or Last Hour.

Syslog Server Settings

Use the following procedure as a guide to starting and configuring the Syslog
Viewer.
To start and configure the Syslog Viewer:
1. Click Start> All Programs> SolarWinds> Syslog and SNMP Traps>
Syslog Viewer.
2. Click File> Settings.
3. Click the General tab in the Syslog Server Settings window.
4. Adjust the Maximum number of messages to display in Current Messages view slider to set the number of messages you want to display.
5. If you want to Automatically Refresh the Current Messages View,
check the option accordingly, and then set the refresh rate with the middle
slider.
6. Adjust Retain Syslog messages for how many days? to set the length of
time Syslog messages should stay in the database.
7. Click the Displayed Columns tab.
8. Use the arrow keys to select and order the fields of information you want to
see in the Current Messages view.
Note: You can make it easier to acknowledge Syslog messages by selecting the Acknowledged column to add to your view.
9. If you want to wrap Syslog message text in the Current Messages
view, check Word wrap long messages.
10. If you do not expect to use Syslog Server as your primary viewer for
Syslog messages, select the Message Parsing tab, and then complete
the following steps:
Note: The following data points are saved within the Syslog tables in your
SolarWinds database. Removing the added data from each record helps
you to proactively reduce the size of your database.

883

Configuring Syslog Viewer Filters and Alerts

11. Check Remove embedded Date/Time from Syslog Messages, Remove
Message Type from Syslog Messages, and Remove Domain Name
from DNS Lookups.

Configuring Syslog Viewer Filters and Alerts

The Syslog Viewer can be configured to signal SolarWinds alert actions when
Syslog messages that are received from network devices match defined rules.
The steps in the following procedure establish rules that filter Syslog messages
and initiate alert actions as you determine.
Note: Syslog rules may not be applied to nodes in an unmanaged state. For more
information about designating nodes as unmanaged, see Setting Node
Management States on page197.
To configure Syslog Viewer filters and alerts:
1. Click Start> All Programs> SolarWinds> Syslog and SNMP Traps>
Syslog Viewer.
2. Click File> Settings.
3. Click Alerts/Filter Rules.
4. If you are creating a new rule, click Add New Rule.
5. If you are editing an existing rule, select the rule, and then click Edit
Selected Rule.
6. On the General tab, complete the following steps:
a. Provide or edit the Rule Name, and then check Enabled.
b. Select appropriate servers from the Apply this Rule to list.
c. Enter the IP addresses or subnets to which this rule applies in the
Source IP Addresses area.
Note: Use the examples provided on this tab to ensure that the list of
source IP addresses is properly formatted.
7. If you want to limit the rule to only messages from specific hosts,
domains, or hostname patterns, on the DNS Hostname tab enter a DNS
Hostname Pattern.
Notes:
l The DNS Hostname Pattern rule is case sensitive.
l When Use Regular Expressions in this Rule is checked, you may
use regular expressions in place of like statements. For more information about using regular expressions in SolarWinds SAM, see
Regular Expression Pattern Matching on page941.

884

Chapter 21: Monitoring Syslog Messages

8. If you want to limit the rule to only specific message types or text within
a Syslog message, on the Message tab enter rules as appropriate for Message Type Pattern and Syslog Message Pattern.
Notes:
l Use the examples listed on this tab to format the list properly.
l When Use Regular Expressions in this Rule is checked, regular
expressions can be used in place of like statements. For more
information about using regular expressions in SolarWinds SAM, see
Regular Expression Pattern Matching on page941.
9. If you want to apply specific severity or facility types, on the Severity /
Facility tab check the severity and facility types you want to apply.
Note: By default, all message severities and facilities are selected. For
more information about Syslog severities and facilities, see Syslog Message Priorities on page890.
10. If you want to limit rule application to within a specific period of time,
select the Time of Day tab, check Enable Time of Day checking, enter the
time period, and then check the days of the week on which to apply the rule.
Notes:
l Enabling Time of Day checking creates more overhead for the CPU.
l Messages received outside the specified time frame will not trigger
alerts.
11. If you want to suppress alert actions until a specified number of messages arrive that match the rule, complete the following procedure:
a. Select the Trigger Threshold tab.
b. Check Define a Trigger Threshold for this Rule.
c. Enter option values as appropriate.
Note: When Suspend further Alert Actions for is checked, alert
actions are not sent until the specified amount of time has expired.
Once the time period has expired, only new alerts are sent. All alerts
suppressed during the time period are discarded.
12. Configure Syslog alert actions on the Alert Actions tab, as shown in the following steps:
a. If you are associating a new action to the rule, click Add New
Action. For more information about available actions, see Available
Syslog Alert Actions on page886.
b. If you want to edit an existing action for the rule, select an action
from the list, and then click Edit Selected Action.
c. Configure the action as appropriate. For more information about available actions, see Available Syslog Alert Actions on page886.
Note: Syslog alerts use a unique set of variables.

885

Available Syslog Alert Actions

Previous reboot was at ${LastBoot-Previous}.Alert: ${NodeName} has exceptionally high response time. Average Response Time is ${AvgResponseTime} and is varying from ${MinResponseTime} to
${MaxResponseTime}.Current packet loss for ${NodeName} is ${%Loss}.
Average Response time is ${AvgResponseTime} and is varying from
${MinResponseTime} to ${MaxResponseTime}.Alert: The SNMP Community
string used to query ${NodeName} has been changed from ${Community-Previous} to ${Community}. SolarWinds uses the new Community String to
query ${NodeName}.

d. If you need to delete an action, select the action, and then click
Delete Action.
e. Use the arrow buttons to set the order in which actions are performed.
Note: Actions are processed in the order listed, from top to bottom.
f. Click OK to save all changes and return to Syslog Viewer Settings.
13. Use the arrow buttons to arrange the order in which the rules are applied.
Note: Rules are processed in the order they appear, from top to bottom.

Available Syslog Alert Actions

The following list provides definitions of the actions available for each Syslog
alert type. For more information about how to assign alert actions, see
Configuring Syslog Viewer Filters and Alerts on page884.
Discard the Syslog Message
Allows you to delete unwanted Syslog messages sent to the Syslog server.
Tag the Syslog Message
Allows you to add a custom tag to received Syslog messages. Ensure you
include the Tag column in the viewer when assigning a tag.
Modify the Syslog Message
Modify the severity, facility, type, or contents of a Syslog message.
Log the Message to a file
Allows you to specify a file and a series of variables with which to tag
Syslog messages sent to the file. Ensure you have already created the log
file you want to use. The alert cannot create a file.
Windows Event Log
Write a message to local or remote Windows Event Logs.
Forward the Syslog message
Specify the IP address or hostname and the port to forward a Syslog event.

886

Chapter 21: Monitoring Syslog Messages

Send a new Syslog message
Trigger a new Syslog message, sent to a specific IP address or hostname,
on a specific port, with a customizable severity, facility, and message.
Send an SNMP Trap
Allows you to send a trap to an IP address following a specific trap template
and using a specific SNMP community string.
Play a sound
Allows you to play a sound when a matching Syslog message is received.
Text to Speech output
Define the speech engine, speed, pitch, volume, and message to read.
Execute an external program
Allows you to specify an external program to launch using a batch file. This
action is used when creating real time change notifications in SolarWinds
SAM.
Execute an external VB Script
Allows you to launch a VB Script using the selected script interpreter engine
and a saved script file.
Send a Windows Net Message
Allows you to send a net message either to a specific computer or to an
entire domain or workgroup.
Note: The only operating systems supporting Windows Net Messaging on
which SolarWinds supports SolarWinds installations are Windows Server
2003 and Windows XP. SolarWinds only supports evaluation installations
of SolarWinds on Windows XP.
Send an E-mail / Page
Send an email from a specified account to a specified address, using a
specific SMTP server, and containing a customizable subject and message.
Stop Processing Syslog Rules
Stops the processing of Syslog rules for the matching Syslog message.

Forwarding Syslog Messages

The Syslog message forwarding action allows you to forward received Syslog
messages. Additionally, if you have WinPCap version 3.0 or higher installed on

887

To configure the forward Syslog message action:

your SolarWinds SAM server, you can forward Syslog messages as spoofed
network packets. The following procedure configures available options for
forwarded Syslog messages.
Note: The following procedure assumes you are editing a Forward the Syslog
Message alert action. For more information about Syslog alert actions, see
Configuring Syslog Viewer Filters and Alerts on page884.
To configure the forward Syslog message action:
1. Provide the hostname or IP address of the destination to which you want to
forward the received Syslog message.
2. Provide the UDP Port you are using for Syslog messaging.
Note: The default is UDP port 514.
3. If you want to retain the IP address of the source device, complete the
following steps:
a. Check Retain the original source address of the message.
b. If you want to designate a specific IP address or hostname as the
Syslog source, check Use a fixed source IP address (or hostname),
and then provide the source IP address or hostname.
c. If you want to spoof a network packet, check Spoof Network
Packet, and then select an appropriate Network Adapter.
4. Click OK to complete the configuration of your Syslog forwarding action.

Syslog Alert Variables

The following variables can be used in Syslog alert messages. Each variable
must begin with a dollar sign and be enclosed in curly braces as, for example,
${VariableName}. Syslog alerts also support the use of Node alert variables. For
more information, see SolarWinds Variables and Examples on page939.

Syslog Date/Time Variables

Syslog Date/Time
Variable

Description

${AbbreviatedDOW} Current day of the week. Three character

abbreviation.
${AMPM}

AM or PM corresponding to current time (before or

after noon)

888

Chapter 21: Monitoring Syslog Messages

${D}

Current day of the month

${DD}

Current day of the month (two digit number, zero

padded)

${Date}

Current date. (Short Date format)

${DateTime}

Current date and time. (Windows control panel

defined Short Date and Short Time format)

${DayOfWeek}

Current day of the week.

${DayOfYear}

Numeric day of the year

${H}

Current hour

${HH}

Current hour. Two digit format, zero padded.

${Hour}

Current hour. 24-hour format

${LocalDOW}

Current day of the week. Localized language format.

${LongDate}

Current date. (Long Date format)

${LocalMonthName} Current month name in the local language.

${LongTime}

Current Time. (Long Time format)

${M}

Current numeric month

${MM}

Current month. Two digit number, zero padded.

${MMM}

Current month. Three character abbreviation.

${MediumDate}

Current date. (Medium Date format)

${Minute}

Current minute. Two digit format, zero padded.

${Month}

Full name of the current month

${N}

Current month and day

${S}

Current second.

889

Other Syslog Variables

${Second}

Current second. Two digit format, zero padded.

${Time}

Current Time. (Short Time format)

${Year2}

Two digit year

${Year}

Four digit year

Other Syslog Variables

Syslog Variable

Description

${Application} SolarWinds application information

${Copyright}

Copyright information

${DNS}

Fully qualified node name

${Hostname}

Host name of the device triggering the alert

${IP_Address}

IP address of device triggering alert

${Message}

Status of device triggering alert

${MessageType} The name of the triggered alert

${Severity}

A number (0-7) corresponding to the designated severity

of a message. For more information, see Syslog
Severities on page892.

${Version}

Version of the SolarWinds software package

Syslog Message Priorities

Included at the beginning of each Syslog message is a priority value. The priority
value range spans between 0 and 191 and is enclosed in angle bracket (< and >)
delimiters. The priority value is calculated using the following formula:
Priority = Facility * 8 + Severity

Syslog Facilities
The facility value indicates which machine process created the message. The
Syslog protocol was originally written on BSD Unix, so Facilities reflect the

890

Chapter 21: Monitoring Syslog Messages

names of UNIX processes and daemons, as shown in the following table.
Note: If you are receiving messages from a UNIX system, consider using the User
Facility as your first choice. Local0 through Local7 are not used by UNIX and are
traditionally used by networking equipment. Cisco routers, for example, use
Local6 or Local7.
Number Source

Number Source

kernel messages

12

NTP subsystem

user-level messages

13

log audit

mail system

14

log alert

system daemons

15

clock daemon

security/authorization messages

16

local use 0
(local0)

messages generated internally by

Syslog

17

local use 1
(local1)

line printer subsystem

18

local use 2
(local2)

network news subsystem

19

local use 2
(local3)

UUCP subsystem

20

local use 2
(local4)

clock daemon

21

local use 2
(local5)

10

security/authorization messages

22

local use 2
(local6)

11

FTP daemon

23

local use 2
(local7)

891

Syslog Severities

Syslog Severities
The following table provides a list of Syslog severity levels with descriptions and
suggested actions for each.
Number Severity

Suggested Actions

Emergency

A "panic" condition affecting multiple applications,

servers, or sites. System is unusable. Notify all
technical staff on call.

Alert

A condition requiring immediate correction, for

example, the loss of a backup ISP connection. Notify
staff who can fix the problem.

Critical

A condition requiring immediate correction or

indicating a failure in a primary system, for example,
a loss of a primary ISP connection. Fix CRITICAL
issues before ALERT-level problems.

Error

Non-urgent failures. Notify developers or

administrators as errors must be resolved within a
given time.

Warning

Warning messages are not errors, but they indicate

that an error will occur if required action is not taken.
An example is a file system that is 85% full. Each
item must be resolved within a given time.

Notice

Events that are unusual but are not error conditions.

These items might be summarized in an email to
developers or administrators to spot potential
problems. No immediate action is required.

Informational Normal operational messages. These may be

harvested for network maintenance functions like
reporting and throughput measurement. No action is
required.

Debug

Information useful to developers for debugging an

application. This information is not useful during
operations.

892

Chapter 22:
Monitoring SNMP Traps
SNMP traps signal the occurrence of significant events by sending unsolicited
SNMP messages to a monitoring device. The SolarWinds Trap Server listens for
incoming trap messages on UDP port 162 and then decodes, displays, and stores
the messages in the SolarWinds SAM database. The SolarWinds Trap Service
allows SolarWinds SAM to receive and process SNMP traps from any type of
monitored network device, and, because the SolarWinds Trap Service is multithreaded, it can handle large numbers of simultaneously incoming traps.
You can view SNMP traps in the Trap Viewer application. The Trap Viewer
application allows you to configure trap-specific alerts, to view and search traps,
and to apply powerful trap filtering.
Note: When configuring devices to send SNMP traps, confirm that traps are sent
to the IP address assigned to the SolarWinds SAM server. To ensure proper
configuration, refer to the documentation supplied by the vendor of your devices.

The SNMP Trap Protocol

SNMPv1 (Simple Network Management Protocol) and SNMPv2c, along with the
associated Management Information Base (MIB), allow you to take advantage of
trap-directed notification. When monitoring a large number of devices, where
each device may have a large number of its own connected objects, it can
become impractical to request information from every object on every device.
Consider having each managed device notify the SolarWinds SAM SNMP Trap
Server of any issues without solicitation. In this configuration, a problem device
notifies the server by sending a message. This message is known as a trap of the
event. After receiving the event, the Trap Viewer displays it, allowing you to
choose to take action or automatically trigger an action based on the nature of the
event.

Viewing SNMP Traps in the Web Console

Customize the Traps view as shown in the following procedure.

893

Chapter 22: Monitoring SNMP Traps

To view SNMP traps in the Web Console:
1. Click Start> All Programs> SolarWinds> SolarWinds Web Console.
2. Click Traps in the Views toolbar.
3. If you want to filter your traps table view by device, select the device to
which you want to limit your view in the Network Object field.
4. If you want to filter your traps table by device type, select the device
types you want to view in the Type of Device field.
5. If you want to limit your traps table to show only traps of a designated
type, select the appropriate type in the Trap Type field.
6. If you want to limit your traps table to show only traps originating from
a specific IP address, type the IP Address in the Source IP Address
field.
7. If you want to limit your traps table to show only traps with a designated community string, select the appropriate community string in the
Community String field.
8. If you only want to see traps from a specific period of time, select the
time period from the Time Period menu.
9. Confirm the number of traps displayed in the Show Traps field.
10. Click Refresh to update the Traps view with your new settings.

Using the Trap Viewer

After the monitored devices on your network are configured to send traps to the
SolarWinds SAM server, configure the SolarWinds Trap Viewer to display
received trap information, as shown in the following sections.
Notes:
l To ensure proper configuration of your network devices, refer to the documentation supplied by the vendor of your network devices.
l The SolarWinds Trap Viewer receives traps on UDP port 162.

Viewing Current Traps

Trap Viewer makes it easy to view trap messages, as shown in the following
steps.
To view current trap messages:
1. Click Start> All Programs> SolarWinds > Syslog and SNMP Traps>
Trap Viewer.
2. Click View> Current Traps.

894

Searching for Traps

3. Click a column header to order listed traps by the selected trap characteristic.
4. Configure the Trap Viewer by clicking and dragging columns to order the
presentation of trap characteristics.

Searching for Traps

Collected trap messages may be searched within Trap Viewer. The following
steps both search for trap messages and format the search results list.
To search the trap message list:
1. Click Start> All Programs> SolarWinds > Syslog and SNMP Traps>
Trap Viewer.
2. Click View> Search Traps.
3. Enter appropriate search criteria, and then click Search Database.
4. If you want to group messages for easier navigation, select the type of
grouping from the Grouping list.
5. If you want to limit the number of messages that are shown, enter or
select a number in the Maximum number of messages to display field.
6. If you want to view messages that meet your search criteria as they
arrive, select a number for the Auto Refresh every number seconds
field.
Note: Auto Refresh is only available when you are viewing current messages. The Date/Time Range must be set to Today, Last 24 Hours, Last
2 Hours, or Last Hour.
7. If you want to hide the search criteria pane, toggle the pane open and
closed by clicking the double up arrows in the top right of the page.

Trap Viewer Settings

Use the following procedure to start and configure the Trap Viewer.
To start and configure the Trap Viewer:
1. Click Start> All Programs> SolarWinds> Syslog and SNMP Traps>
Trap Viewer.
2. Click File> Settings.
3. On the General tab, configure the following Trap server settings:
a. Position the top slider to set the Maximum number of traps to display
in Current Traps view.

895

Chapter 22: Monitoring SNMP Traps

b. If you want SolarWinds SAM to Automatically Refresh the Current
Traps View, check the option accordingly, and then position the middle
slider to set the refresh rate.
c. Position the Retain Trap messages for how many days? slider to set
the length of time that traps remain in the database.
4. On the Displayed Columns tab, use the arrow keys to select and order the
fields of information you want to see in the Current Traps view.
5. If you do not need the domain name from your trap messages, check
Remove Domain Name from DNS Lookups on the Message Parsing
tab.
Note: Checking this option will remove the domain name from your trap
messages, and this will help to reduce the size of your database.

Configuring Trap Viewer Filters and Alerts

The Trap Viewer can be configured to trigger SolarWinds SAM alert actions when
received trap messages match defined rules. The following steps establish rules
to filter trap messages and initiate alert actions as you determine.
Notes:
l With the exception of the asterisk (*) wildcard, SolarWinds recommends
against using non-alphanumeric characters in filter definitions.
l Trap rules are not applied to unmanaged nodes. For more information, see
Setting Node Management States on page197.
To configure Trap Viewer filters and alerts:
1. Click Start> All Programs> SolarWinds> Syslog and SNMP Traps>
Trap Viewer.
2. Click File> Settings, and then click the Alerts / Filter Rules tab.
3. If you are creating a new rule, click Add Rule.
4. If you are editing an existing rule, click Edit Rule.
5. Click the General tab,
6. Enter a Rule Name, and then check Enabled to enable the rule.
7. Select appropriate servers from the Apply this Rule to list.
8. Enter the IP addresses or subnets to which this rule applies.
Note: Use the examples listed on this tab to format the list properly.
9. If you want the rule limited to messages from specific hosts, domains,
or hostname patterns, click DNS Hostname, and then enter a DNS Hostname Pattern.
Notes:

896

To configure Trap Viewer filters and alerts:

The DNS Hostname Pattern rule is case sensitive.
l When Use Regular Expressions in this Rule is checked, regular
expressions can be used in place of like statements. For more
information about using regular expressions in SolarWinds SAM,
see Regular Expression Pattern Matching on page941.
If you want the rule limited on the basis of content within the Trap
Details field, click Trap Details, and then enter a Trap Details Pattern.
Note: When Use Regular Expressions in this Rule is checked, regular
expressions can be used in place of like statements. For more information about using regular expressions in SolarWinds SAM, see Regular
Expression Pattern Matching on page941.
If you want the rule limited to specific community strings, click Community String, and then enter appropriate patterns in the Community
String Pattern field.
Note: When Use Regular Expressions in this Rule is checked, regular
expressions can be used in place of like statements. For more information about using regular expressions in SolarWinds SAM, see Regular
Expression Pattern Matching on page941.
Click Conditions, and then generate trigger conditions for rule application
in the text field as follows:
a. Select appropriate object identifiers and comparison functions from
the linked context menus.
b. Click Browse () to Insert an OR condition, to Insert an
AND condition, or to Delete a condition as necessary.
Note: For more information about conditions and condition groups,
see Understanding Condition Groups on page750.
If you want to limit rule application to within a specific period of time,
click Time of Day, check Enable Time of Day checking, enter the time
period, and then select days of the week on which to apply the rule.
Notes:
l

10.

11.

12.

13.

Enabling Time of Day checking creates more overhead for the

CPU.
Messages received outside the specified timeframe will not trigger alerts.

14. If you want to suppress alert actions until a specified number of traps
arrive that match the rule, click Trigger Threshold, check Define a Trigger Threshold for this Rule, and then enter option values as appropriate.
Note: When Suspend further Alert Actions for is checked, alert actions

897

Chapter 22: Monitoring SNMP Traps

15.
16.

17.

18.
19.
20.
21.

are not sent until the specified amount of time has expired. Once the time
period has expired, only new alerts are sent. All alerts that are suppressed
during the time period will never be sent.
Click Alert Actions.
If you are associating a new action to the rule, click Add New Action,
and then select an action from the list to configure. For more information
about adding alert actions, see Adding Alert Actions on page755.
If you are editing an existing action for the rule, select an action from
the list, click Edit Action, and then configure the action. For more information about adding alert actions, see Adding Alert Actions on page755.
Use the arrow buttons to set the order in which actions are performed.
Note: Actions are processed in the order they appear, from top to bottom.
If you need to delete an action, select the action, and then click Delete
Action.
Click OK to save all changes and return to Trap Viewer Settings.
Use the arrow buttons to arrange the order in which the rules are applied.
Note: Rules are processed in the order they appear, from top to bottom.

Available Trap Alert Actions

The following actions are available for trap alerts. For more information about
assigning and configuring alert actions, see Adding Alert Actions on page755.
Discard the Trap
Allows you to delete unwanted traps sent to the SNMP Trap server.
Tag the Trap
Allows you to add a custom tag to received traps. Ensure you include the
Tag column in the viewer when assigning a tag.
Flag the Trap with a specific color
Allows you to assign a specific color for display in the SolarWinds Web
Console and the Trap Viewer to flag traps matching the rule.
Log the Trap to a file
Allows you to specify a file and a series of variables with which to tag traps
sent to the file. Ensure you have already created the log file you want to use.
The alert cannot create a file.
Windows Event Log

898

Available Trap Alert Actions

Allows you to write a message to the local Windows Event Log or to a
remote Windows Event Log.
Forward the Trap
Allows you to specify the IP address or hostname and the port on which to
forward the trap. Specify the IP address or hostname of the trap destination
and the port on which the trap should be sent. Check Include Source
Address to include the IP address of the trap source.
Play a sound
Allows you to play a sound when a matching SNMP trap is received.
Text to Speech output
Allows you to define a specific speech engine, the speed, pitch, volume,
and message to read.
Execute an external program
Allows you to specify an external program to launch using a batch file. This
action is used when creating real time change notifications in SolarWinds
SAM.
Execute an external VB Script
Allows you to launch a VB Script using the selected script interpreter engine
and a saved script file.
Send a Windows Net Message
Allows you to send a Windows Net message either to a specific computer or
to an entire domain or workgroup.
Note: The only operating systems supporting Windows Net Messaging on
which SolarWinds supports SolarWinds installations are Windows Server
2003 and Windows XP. SolarWinds only supports SolarWinds evaluations
on Windows XP.
Send an E-mail / Page
Allows you to send an email from a specified account to an address, using a
specific SMTP server, and containing a customizable subject and message.
Stop Processing Trap Rules
Stops the processing of SNMP trap rules for the matching trap.

899

Chapter 22: Monitoring SNMP Traps

Trap Alert Variables

The following variables can be used in trap alert messages with the SolarWinds
SAM Trap Server. You must begin each variable with a dollar sign and enclose
each variable identifier in curly braces as, for example, ${VariableName}.
Note: Trap alerts may also use any valid node variables. For more information
about node alert variables, see SolarWinds Variables and Examples on
page939.

Trap Date/Time Variables

Trap Date/Time Variable

Description

${AbbreviatedDOW}

Current day of the week. Three character

abbreviation.

${AbbreviatedMonth} Current month of the year. Three character

abbreviation.
${AMPM}

AM or PM corresponding to current time (before or

after noon)

${D}

Current date. (MM/DD/YYYY format)

${DD}

Current day of the month (two digit number, zero

padded)

${Date}

Current date. (MM/DD/YYYY format)

${DateTime}

Current day, date and time. (DAY NAME MONTH

DD, YYYY HH:MM AM/PM)

${Day}

Current date. (MM/DD/YYYY format)

${DayOfWeek}

Current day of the week.

${DayOfYear}

Numeric day of the year

${H}, ${Hour}

Current hour. 24-hour format

${HH}

Current hour. Two digit format, zero padded.

900

Other Trap Variables

${LocalDOW}

Current day of the week. Localized language

format.

${LongDate}

Current date. (DAY NAME, MONTH DAY, YEAR)

${LongTime}

Current Time. (HH:MM:SS AM/PM)

${M}

Current numeric month

${MM}

Current month. Two digit number, zero padded.

${MMM}

Current month. Three character abbreviation.

${MMMM}

Full name of the current month

${MediumDate}

Current date. (DAY NAME, MONTH DAY, YEAR)

${MediumTime}

Current Time. (HH:MM:SS AM/PM)

${Minute}

Current minute. Two digit format, zero padded.

${MonthName}

Full name of the current month

${S}

Date-time to current second (YYYY-MMDDTHH:MM:SS)

${Second}

Current second. Two digit format, zero padded.

${Time}

Current Time. (HH:MM AM/PM)

${Year}

Four digit year

${Year2}

Two digit year

Other Trap Variables

Trap Variable

Description

${Application} SolarWinds application information

${Community}

Node community string

${Copyright}

Copyright information

901

Chapter 22: Monitoring SNMP Traps

${DNS}

Fully qualified node name

${Hostname}

Host name of the device triggering the trap

${IP}

IP address of device triggering alert

${IP_Address}

IP address of device triggering alert

${Message}

Message sent with triggered trap and displayed in Trap

Details field of Trap Viewer

${MessageType} Name or type of trap triggered

${Raw}

Raw numerical values for properties sent in the

corresponding incoming trap.

${RawValue}

Raw numerical values for properties sent in the

corresponding incoming trap. The same as ${Raw}.

${vbData1}

Trap variable binding value

${vbName1}

Trap variable binding name

902

Chapter 23:
Managing the SolarWinds SAM Database
All SolarWinds network monitoring and management products use a Microsoft
SQL Server database to store web console settings and collected network
performance and configuration data. The following database utilities are
packaged with SolarWinds products to help you manage your SolarWinds
database.
Database Manager
Allows you to perform queries, edit database values, export data, and
perform database repair and compaction on your SolarWinds database. For
more information, see Using Database Manager on page903.
Database Maintenance
Allows you to summarize, clean, and compact your SolarWinds database.
For more information, see Database Maintenance on page912.
The database SolarWinds uses is hosted on a Microsoft SQL Server. When
installing SQL Server, you have the option of installing the SQL Server
Management Studio. If you are the database administrator for the SQL Server
hosting your SolarWinds database, SolarWinds generally recommends that you
install this utility as it provides a number of features that are not currently available
in the SolarWinds Database Manager. For more information, see Using SQL
Server Management Studio on page909.
Note: SolarWinds Network Configuration Manager maintains its own additional
database for device configurations and user activity logging.

Using Database Manager

The Database Manager can be used to perform queries, view database and table
details, export data, and edit database values. You may also repair, compact,
restore, or backup the database from the Database Manager application. The

903

Chapter 23: Managing the SolarWinds SAM Database

following procedures present some of the basic database management
operations that are available with Database Manager.

Adding a Server
If you have not already designated a database for use with SolarWinds as a
backup or supplement, use the following steps to add a SQL server to the
Database Manager. Once added, your selected server and associated databases
display in the tree structure in the left pane of Database Manager.
To add a SQL server to Database Manager:
1. Click Start> All Programs> SolarWinds> Advanced Features> Database Manager.
2. Click File> Add Server.
3. Select from the SQL Server list or enter the IP address of the SQL server.
4. Select the login style.
Note: You may choose to Log in using Windows NT Integrated Security
to automatically pass the Windows user ID and password to the SQL
server, or select Log in using an SQL Server userid and password to
use a separate login. Upon selecting the latter option, the window changes
to provide fields to enter the separate SQL Server User Name and Password that you want to use.
5. Click Connect to Database Server.

Creating Database Backups

You should periodically back-up your databases. For more information about
scheduling regular database backups, see Creating a Database Maintenance
Plan on page1. The following procedure is used to back-up your databases in
Database Manager.
To back-up a database in Database Manager:
1. Click Start> All Programs> SolarWinds> Advanced Features> Database Manager.
2. If the SQL Server hosting your SolarWinds database is not listed in
the left pane, you must add the SQL Server hosting your SolarWinds database. For more information, see Adding a Server on page904.
3. Click [+] to expand the SQL Server hosting your SolarWinds database..
4. Right-click the name of the database you want to back-up, and then click
Backup Database.
5. Provide a Description of the database backup.

904

Restoring a Database
6. Specify a path for the Backup Filename either by clicking Browse ()
and navigating to the location or by entering the path directly.
Note: Typically, the default backup location for a SolarWinds database is
designated as C:\ProgramFiles\SolarWinds\. Ensure that the target location
for the database backup has sufficient available disk space.
7. Select either Append to the end of the Backup File or Overwrite
Backup File, as appropriate, and then click OK.

Restoring a Database
The following steps restore a database that you have backed up.
To restore a database from backup:
1. Click Start> All Programs> SolarWinds> Advanced Features> Database Manager.
2. If the SQL Server hosting your SolarWinds database is not listed in
the left pane, you must add the SQL Server hosting your SolarWinds database. For more information, see Adding a Server on page904.
3. Click [+] in the left pane to expand the SQL Server hosting your
SolarWinds database, and then click your SolarWinds database.
4. Click Database> Restore Database.
5. Click Browse () to navigate to the database that you want to restore, or
enter a valid SQL backup database name and path.
Note: Typically, the default location for a SolarWinds database backup is
C:\ProgramFiles\SolarWinds\.
6. Click Verify to ensure that you have selected a valid SQL database.
Notes:
l

When you select a database, the remaining fields are completed for you. The Database Name field is populated with the
name that SQL Server uses to refer to the specified database.
The remaining two fields display the data (.mdf) and transaction
log (.ldf) files for the database. You can change the values
provided.
Database Manager does not create directories. You may only
specify a path that already exists.
You also cannot restore a database that is currently in use.

7. Click OK to restore the selected database.

905

Chapter 23: Managing the SolarWinds SAM Database

Compacting your Database

Compacting a database shrinks it, re-indexes it, and removes whitespace. You
can compact a database by performing the following steps.
To compact a database with Database Manager:
1. Click Start> All Programs> SolarWinds> Advanced Features> Database Manager.
2. If the SQL Server hosting your SolarWinds database is not listed in
the left pane, you must add the SQL Server hosting your SolarWinds database. For more information, see Adding a Server on page904.
3. Click [+] in the left pane to expand the SQL Server hosting your
SolarWinds database, and then click your SolarWinds database.
4. Click Database> Compact Database.
Note: Upon completion, Database Manager displays a window comparing
the size of the database before and after compaction. If the sizes are the
same, there may not be enough free space in the database to rearrange
data. If you need to free up more space for database compaction to occur,
see Compacting Individual Tables on page906.

Compacting Individual Tables

If you are not able to perform a full database compaction due to limited server disk
space, you can compact database tables individually, using the Database
Manager application, as shown in the following procedure.
To compact individual tables:
1. Click Start> All Programs> SolarWinds > Advanced Features> Database Manager.
2. If the SQL Server hosting your SolarWinds database is not listed in
the left pane, you must add the SQL Server hosting your SolarWinds database. For more information, see Adding a Server on page904.
3. Click [+] in the left pane to expand the SQL Server hosting your
SolarWinds database, and then click your SolarWinds database.
Note:SolarWinds Orion is the default name of the SolarWinds database.
4. Click a table to compact in the expanded database, and then click Table>
Compact/Rebuild Indexes.

906

Viewing Database Details

Viewing Database Details

The Database Details window in Database Manager presents two tabs that
display property and tables information about a selected database. The following
procedure is a guide to the information that is available in the Database Details
window.
To view database details:
1. Click Start> All Programs> SolarWinds> Advanced Features> Database Manager.
2. If the SQL Server hosting your SolarWinds database is not listed in
the left pane, you must add the SQL Server hosting your SolarWinds database. For more information, see Adding a Server on page904.
3. Click [+] in the left pane to expand the SQL Server hosting your
SolarWinds database, and then click your SolarWinds database.
Note:SolarWinds Orion is the default name of the SolarWinds database.
4. Click Database> Database Details.
Notes:
l

The Properties tab provides general statistics and descriptions

of the selected database.
The Tables tab shows a list of the tables in the selected database and their respective sizes.

5. If the Last Backup field on the Properties tab is blank, you have not
generated a backup of the selected database. For more information about
scheduling a recommended regular database backup, see Creating a
Database Maintenance Plan on page1.

Viewing Table Details

The Database Manager Table Details window provides property, column, and
index information about the selected table. You can also query the selected table
directly from the Table Details window., as shown in the following procedure.
To view table details:
1. Click Start> All Programs> SolarWinds> Advanced Features> Database Manager.
2. If the SQL Server hosting your SolarWinds database is not listed in
the left pane, you must add the SQL Server hosting your SolarWinds database. For more information, see Adding a Server on page904.

907

Chapter 23: Managing the SolarWinds SAM Database

3. Click [+] in the left pane to expand the SQL Server hosting your
SolarWinds database, and then click [+] to expand your SolarWinds database.
Note:SolarWinds Orion is the default name of the SolarWinds database.
4. Click a table to view in the expanded database.
5. Click Table> Table Details.
Note: The Properties tab includes general statistics relating to the
table size and creation date; the Columns tab describes the columns
in the table, table keys, and field types; and the Indexes tab lists
indexes used within the table.
6. If you want to query the open table, click Query in the tool bar.
Warning: Special care should be taken while editing database values as
you can easily compromise the integrity of your database. For more information, see Editing Database Fields on page908.
Note: A default SQL statement is provided, as well as radio buttons for
displaying the data in read or read/write view.

Editing Database Fields

Database fields may be edited within the Database Manager application from the
query view. The following procedure directs you in editing database fields in
SolarWinds Database Manager.
Warning: Be very careful when you are editing database values as you can
jeopardize the integrity of your database.
To edit database fields with Database Manager:
1. Stop the SolarWinds Network Performance Monitor service as follows:
a. Click Start> All Programs> SolarWinds> Advanced Features>
Orion Service Manager
b. Click SolarWinds Network Performance Monitor under Services,
and then click Stop.
2. Click Start> All Programs> SolarWinds> Advanced Features> Database Manager.
3. If the SQL Server hosting your SolarWinds database is not listed in
the left pane, you must add the SQL Server hosting your SolarWinds database. For more information, see Adding a Server on page904.
4. Click [+] in the left pane to expand the SQL Server hosting your
SolarWinds database, and then click [+] to expand your SolarWinds database.
Note:SolarWinds Orion is the default name of the SolarWinds database.

908

Detaching a Database
5.
6.
7.
8.
9.

Click a table to view in the expanded database.

Click Table> Query Table.
Use the provided SQL statement or enter your own in the query field.
If you want to view the query results in table view, click Refresh.
If you want to edit table fields, select Read/Write at the top of the window, and then edit fields as necessary.
10. If you use the same SQL query often, you can save time by making the
query a favorite, as follows:
a. Enter the query in the query field.
b. Click Add to Favorites.
c. Enter a name for the command, and then click OK.
Note: Database Manager saves the command with the name that you
have provided. You can now use this command again, directly, by clicking Paste from Favorites.

Detaching a Database
Detaching a database removes its reference from the SQL Server, allowing you to
safely move files to different locations. Database Manager allows you to detach a
database and leave the data files of a database intact, as shown in the following
procedure.
Note: SolarWinds does not recommend using the Detach Database option to
migrate a database from one SQL Server to another. For more information, see
Migrating your Database on page913.
To detach a database:
1. Click Start> All Programs> SolarWinds> Advanced Features> Database Manager.
2. If the SQL Server hosting your SolarWinds database is not listed in
the left pane, you must add the SQL Server hosting your SolarWinds database. For more information, see Adding a Server on page904.
3. Click [+] in the left pane to expand the SQL Server hosting your
SolarWinds database, and then click your SolarWinds database.
Note:SolarWinds Orion is the default name of the SolarWinds database.
4. Click Database> Detach Database from the menu.

Using SQL Server Management Studio

If you have a licensed, Standard or Enterprise Edition copy of SQL Server 2005 or
2008 with SQL Server Management Studio installed, you can use it to maintain

909

Chapter 23: Managing the SolarWinds SAM Database

your SolarWinds SAM database. The following procedure is a basic guide to
configuring a daily SolarWinds database maintenance plan in SQL Server
Management Studio.
Notes:
l
l

Your specific environment may require additional configuration.

You may need to contact your database administrator to gain access to
SQL Server Management Studio for your SolarWinds database.
The following procedure clears historical maintenance records and creates
a backup of your SolarWinds database. In general, however, SolarWinds
recommends that you contact your database administrator and reference
the Microsoft documentation provided with SQL Server for instructions on
using SQL Server Management Studio to manage your SolarWinds database.

To use SQL Server Management Studio to manage your database:

1. Click Start> Microsoft SQL Server> SQL Server Management Studio.
2. Click View> Object Explorer.
3. Expand the SQL Server instance containing your SolarWinds database in
the Object Explorer pane on the left.
Note: Expand the Databases folder for any instance to confirm included
databases. By default, the SolarWinds database is named SolarWinds
Orion.
4. Expand the Management folder, right-click the Maintenance Plans folder,
and then click Maintenance Plan Wizard.
5. Click Next to start the SQL Server Maintenance Plan Wizard.
6. Provide an appropriate Name and Description for your maintenance plan.
7. Click Browse () next to the Server field.
8. Check your SQL Server\Instance, and then click OK.
Note: If your SQL Server\Instance is not in the list, provide it manually.
9. Select the authentication type that is used to connect to the SQL server,
and, if required, provide appropriate User name and Password credentials.
Note: Use the same authentication type and credentials you provided in
the SolarWinds Configuration Wizard to access your SolarWinds database.
10. Check Clean Up History and Back Up Database (Full)
Note: When a task is clicked, the Maintenance Plan Wizard provides a
brief task description.

910

To use SQL Server Management Studio to manage your database:

11. Click Next.
12. Set the order of task execution, top to bottom, by selecting tasks and clicking Move Up and Move Down as needed.
Note: The following steps assume the Clean Up History task precedes the
Back Up Database (Full) task.
13. Click Next when the task execution order is set.
14. On the Define Cleanup History Task view, check the types of historical
data to delete, and then set the threshold age for historical data removal.
15. Click Next.
16. On the Database Back Up (Full) view, complete the following steps:
a. Click the Databases field.
b. Select These databases.
c. Check your SolarWinds database.
17. Click OK.
18. Select Database in the Backup component area.
19. In the Destination area, complete the following steps:
a. Select Disk.
b. Select Create a backup file for every database.
c. Click Browse () to select an appropriate database backup file destination with sufficient free space.
20. Click Next.
21. On the Select Plan Properties view, click Change.
22. Configure the database maintenance job schedule as follows:
a. Provide an appropriate Name for the new job schedule.
b. Select Recurring as the Schedule type.
c. Check Enabled, and then select Daily in the Occurs field.
d. Provide an off-peak network usage time in the Occurs once at field.
e. Select a Start date, and then select No end date.
23. Click OK.
24. Click Next, and then check Write a report to a text file.
25. Click Browse () to select an appropriate maintenance report file destination.
26. Review wizard results, click Finish, and then, when the wizard successfully finishes, click Close.
For additional help with using SQL server Management Studio, visit the Microsoft
Support Website at [Link]

911

Chapter 23: Managing the SolarWinds SAM Database

Database Maintenance
The primary tasks that are available for maintaining a SQL database are data
summarization and database compaction. Data summarization occurs
automatically as a part of the nightly maintenance program. You can also run
database maintenance on demand from the Windows Start menu.

Running Database Maintenance

Database maintenance performs a series of data summarizations that help you
optimize the size of your SolarWinds database. Data summarization consists of
gathering all the collected network data for a defined period of time, calculating
statistics from the data, and then discarding the data itself while retaining the
statistics. By regularly running database maintenance, you can realize significant
space savings and performance improvements.
Database maintenance can either be run directly from the Start menu, or
scheduled for a set Archive Time and initiated from the SolarWinds Polling
Settings view in the SolarWinds Web Console. In either case, once started,
database maintenance normally proceeds without further attention. For more
information about setting the Archive Time for database maintenance on the
SolarWinds Polling Settings view, see SolarWinds Polling Settings on
page312. The following procedure provides the steps to perform Database
Maintenance:
Note: Administrative privileges are required to run Database Maintenance.
To run the Database Maintenance utility:
1. If you want to run database Maintenance from the SolarWinds Web
Console, complete the following steps:
a. Click Settings in the top right of the web console, and then click
Polling Settings in the Settings group.
b. Select the Archive Time field in the Database Settings area and adjust
the time accordingly, then click Submit. (Note: If you want to run this utility immediately, set the time to one minute in the future).
2. If you want to run database Maintenance from the Start menu, click
Start> All Programs> SolarWinds> Advanced Features> Database
Maintenance, and then click Start.

912

Migrating your Database

Migrating your Database

If you are modifying your SolarWinds SAM implementation to use a different
database server, you can migrate data from one SolarWinds database to another.
Both the database from which you export data and the database into which you
want to import data must be from the same version of SolarWinds.
Warning: You will not lose Web Console customizations when you overwrite
your website, unless you have manually overwritten or modified the HTML within
the .asp pages.
Note: Do not skip tabs or deviate from the tab order. Click Start, and then click
Continue to complete the wizard in order. Completing tabs out of order may
adversely affect the install process.
Stopping SolarWinds Services
It is important to stop the services that are currently writing to the database. This
ensures that you do not have data inconsistencies when you bring your new
database server online.
To stop SolarWinds services:
1. Click Start> All Programs> SolarWinds Orion > Advanced Features>
Orion Service Manager.
2. Expand Services.
3. Click each service, except the SQL Server service, and then click Stop.
Notes:
l

If you have more than one Polling Engine, you will need to
stop each additional Polling Engine before continuing.
Do not stop the SQL Service. The SQL Service needs to be
running in order to make the necessary changes to the database.

4. Click File> Exit.

Migrating SolarWinds SAM
The following procedure walks you through a migration from one server to
another using the Orion database manager.

913

Chapter 23: Managing the SolarWinds SAM Database

To migrate SAM:
1. Log on to the computer that hosts your current SAM server.
2. Click Start > All Programs> SolarWinds Orion> Database Utilities>
Database Manager.
3. If your SQL Server is not listed in the left pane, add your server, as
shown in the following steps:
a. Click Add Server.
b. Select the name of the SQL instance from the SQL Server list. If your
server is not listed, type the name or IP address.
c. Select the appropriate authentication type, and then click Connect to
Database Server.
4. Locate and right-click your database in the Database Manager tree in the
left pane, and then click Backup Database.
5. Type a Description of the database backup, and then specify a Backup
Filename, including the path.
Note: Click the ellipsis to directly select the Backup Filename.
6. Select either of the following options:
l If you want to attach your new database backup to the end of the
selected backup file, select Append to the end of the Backup
File.
l If you want to overwrite the selected backup file, select Overwrite
Backup File.
7. Click OK.
8. If you are moving the SQL database to the new SAM server, copy the
new backup file (typically named [Link]) to a folder on the new
server.
9. Install SAM on the new server, but do not run the Configuration Wizard yet.
Reboot the server if prompted, and then register the software.
Note: A new license key is required, and you will need to install
SolarWinds License Manager to manage the required license migration.
10. On the new server, click Start> SolarWinds Orion> Database Utilities>
Database Manager.
11. If your SQL Server is not listed in the left pane, add your server, as
shown in the following steps:
a. Click Add Server.
b. Select the name of the SQL instance from the SQL Server list. If your
server is not listed, type the name or IP address.
c. Select the appropriate authentication type, and then click Connect to
Database Server.

914

Creating a Database Backup File with SQL Server Management Studio Express
12. Locate and right-click on your server in the Database Manager tree in the
left pane, and then click Connect to Server.
13. If you moved the SQL database to the new server, perform the following
steps:
a. Click Database> Restore Database.
b. Click the ellipsis to Select the Database file to Restore.
c. If you want to verify the validity of the selected database, click
Verify.
d. Confirm or edit the name of the restored database in the Restore Database as the following Database name field.
e. If you want to restore the database as .MDF or .LOG files, provide appropriate filenames in the Restore Database in the following MDF and
LOG files fields.
f. Click OK.
Note: Database Manager cannot create new folders. Therefore, specify
a path that already exists.
14. Run the Configuration Wizard and specify the existing (or newly restored)
database on the Database setup section of the wizard. When prompted,
click Yes to use the existing database.
Note: Do not skip tabs or deviate from the tab order. Click Start, and then
click Continue to complete the wizard in order. Completing tabs out of
order may adversely affect the install process.
Creating a Database Backup File with SQL Server Management Studio
Express
Complete the following procedure if your new database server uses SQL Server
2005 Express edition:
To backup your database using SQL Server Management Studio Express:
1. Log on to the new database server using an administrator account.
2. Click Start > All Programs > Microsoft SQL Server 2005 > SQL Server
Management Studio Express.
3. Specify the name of the current SAM Database server on the Connect to
Server window.
4. If you are using SQL Server Authentication, click SQL Server Authentication in the Authentication field, and then specify your credentials in the
User name and Password fields.
5. Click Connect.

915

Chapter 23: Managing the SolarWinds SAM Database

6. Expand the name of your SAM server, and then expand Databases in the
left pane.
7. Right-click the name of your SAM database (for example, right-click NetPerfMon), and then click Tasks > Backup.
8. Click Add, and then specify and remember the Destination you provide.
This is the directory and name of your backup. For example, you might specify c:\[Link].
Note: Remember, this file is created on the remote database server. It is
not created locally.
9. Click Options in the Select a page pane on the left.
10. Check Verify backup when finished.
11. Click OK.
12. Copy the .bak file from your current SAM database server to your new database server.
Creating a Database Backup File with SQL Server Management Studio
Complete the following procedure if your new database server uses SQL Server
2005 or 2008:
To backup your database using SQL Server Management Studio:
1. Log on to the new database server using an administrator account.
2. Click Start > All Programs > Microsoft SQL Server 200X > SQL Server
Management Studio.
3. Specify the server name of the current SAM Database server on the Connect to Server window.
4. If you are using SQL Server Authentication, click SQL Server Authentication in the Authentication field, and then specify your credentials in the
User name and Password fields.
5. Click Connect.
6. In the pane on the left, expand the name of the server hosting the SQL
instance you are using for SAM, and then expand Databases.
7. Right-click the name of your SAM database (for example, right-click NetPerfMon), and then click Tasks > Back Up.
8. In the Source area, select Full as the Backup type.
9. In the Backup set area, provide an appropriate Name and Description for
your database backup.
10. If there is not already an appropriate backup location listed in the Destination area, click Add, and then specify and remember the destination path
and file name you provide. This is the location where your backup is
stored.

916

To restore your database backup file on a server running SQL Express Server:

11.
12.
13.
14.

Note: Remember, if your database is on a remote server, as recommended, this backup file is also created on the remote database server. It
is not created locally.
Click Options in the Select a page pane on the left.
In the Reliability area, check Verify backup when finished.
Click OK.
Copy the .bak file from your current SAM database server to your new database server.

Restoring the Backup File on Your New Database Server

The following procedures walk you through the restoration of your SAM database
backup file on your new database server.
Restoring a Database Backup File for SQL Express Server
Complete the following procedure if you are restoring your SAM database backup
file to a database server running SQL Express Server.
Note: Remember that SQL Express has a 4GB data store limitation. If at all
possible, consider using a production version of SQL Server.
To restore your database backup file on a server running SQL Express
Server:
1. Log on to the new database server using an administrator account.
2. Click Start > All Programs > Microsoft SQL Server 2005 > SQL Server
Management Studio Express.
3. Click File > Connect Object Explorer.
4. Specify the name of the new SAM Database server on the Connect to
Server window.
5. If you are using SQL Server Authentication, click SQL Server Authentication in the Authentication field, and then specify your credentials in the
User name and Password fields.
6. Click Connect.
7. Click the name of your server to view an expanded list of objects associated with your server.
8. Click Databases, and then click Restore Database.
9. Leave To database blank.
10. Click From device, and then Browse () to the location of your .bak file.
11. Click Add, and then navigate to the .bak file and click OK.
12. Click OK on the Specify Backup window.
13. Check Restore.

917

Chapter 23: Managing the SolarWinds SAM Database

14. Select the name of your database from the To database field. It will now be
populated with the correct name. For example, select NetPerfMon.
15. Click Options in the left Select a page pane.
16. Check Overwrite the existing database.
17. Ensure you select a directory that already exists for the files listed in the
Restore As column.
18. Click OK.
19. Open and run the configuration wizard to update your SAM installation.
Restoring a Database Backup File for SQL Server 2005
Complete the following procedure if you are restoring your SAM database backup
file to a database server running SQL Server 2005.
To restore your database backup file on a server running SQL Server 2005:
1. Log on to the new database server using an administrator account.
2. Click Start > All Programs > Microsoft SQL Server 2005 > SQL Server
Management Studio.
3. Click File > Connect Object Explorer.
4. Specify the name of the new SAM Database server on the Connect to
Server window.
5. If you are using SQL Server Authentication, click SQL Server Authentication in the Authentication field, and then specify your credentials in the
User name and Password fields.
6. Click Connect.
7. Click the name of your server to view an expanded list of objects associated with your server, and then right-click Databases.
8. Click Restore Database.
9. Leave To database blank.
10. Click From device, and then Browse () to the location of your .bak file.
11. Click Add, and then navigate to the .bak file and click OK.
12. Click OK on the Specify Backup window.
13. Check Restore.
14. Select the name of your database from the To database field. It will now be
populated with the correct name. For example, select NetPerfMon.
15. Click Options in the left Select a page pane.
16. Check Overwrite the existing database.
17. For each Original File Name listed, complete the following steps to ensure
a successful restoration:
a. Click Browse ().
b. Select a directory that already exists.

918

To restore your database backup file on a server running SQL Server 2008:
c. Provide a name for the Restore As file that matches the Original File
Name, and then click OK.
18. Select Leave the database ready to use by rolling uncommitted transactions(RESTORE WITH RECOVERY).
19. Click OK.
20. Open and run the configuration wizard to update your SAM installation.
Note: Due to the nature of security identifiers (SIDs) assigned to SQL Server
2005 database accounts, SolarWinds recommends that you create and use a
new account for accessing your restored database on the Database Account
window of the Orion Configuration Wizard.
Restoring a Database Backup File for SQL Server 2008
Complete the following procedure if you are restoring your SAM database backup
file to a database server running SQL Server 2008.
To restore your database backup file on a server running SQL Server 2008:
1. Log on to the new database server using an administrator account.
2. Click Start > All Programs > Microsoft SQL Server 2008 > SQL Server
Management Studio.
3. Click File > Connect Object Explorer.
4. Specify the name of the new SAM Database server on the Connect to
Server window.
5. If you are using SQL Server Authentication, click SQL Server Authentication in the Authentication field, and then specify your credentials in the
User name and Password fields.
6. Click Connect.
7. Click the name of your server to view an expanded list of objects associated with your server, and then right-click Databases.
8. Click Restore Database.
9. Leave To database blank.
10. Select From device, and then click Browse ().
11. Confirm that File is selected as the Backup media.
12. Click Add.
13. Navigate to the .bak file, select it, and then click OK.
14. Click OK on the Specify Backup window.
15. In the Destination for restore area, select the name of your database from
the To database field.
Note: The To database field is now populated with the correct name. For
example, select NetPerfMon.

919

Chapter 23: Managing the SolarWinds SAM Database

16.
17.
18.
19.
a.
b.
c.
20.
21.

Check Restore next to the database backup you are restoring.

Click Options in the left Select a page pane.
Check Overwrite the existing database (WITH REPLACE).
For each Original File Name listed, complete the following steps to ensure
a successful restoration:
Click Browse ().
Select a directory that already exists.
Provide a name for the Restore As file that matches the Original File
Name, and then click OK.
Select Leave the database ready to use by rolling uncommitted transactions(RESTORE WITH RECOVERY), and then click OK.
Open and run the configuration wizard to update your installation.
Note: Due to the nature of security identifiers (SIDs) assigned to SQL
Server 2008 database accounts, SolarWinds recommends that you create
and use a new account for accessing your restored database on the Database Account window of the Orion Configuration Wizard.

To update SAM to use a new database:

1. Log on to your SAM server, and then
2. Click Start> All Programs> SolarWinds Orion> Configuration and
Auto-Discovery> Configuration Wizard.
Note: In older versions of SAM/APM, the correct path may be Start> All
Programs> SolarWinds Orion> Configuration Wizard.
3. Check Database, and then click Next.
4. Specify your new database server in the SQL Server field.
5. If you want to use SQL authentication, check Use SQL Server Authentication, and then provide the appropriate credentials.
Note: SolarWinds recommends that you use the SA login and password
for your database server to ensure that you are able to properly configure
the SAM database user account.
6. Click Next.
7. Select Use an existing database, select or type the Existing Database
name, and then click Next.
8. If you are prompted to use the existing database, click Yes.
9. Select Create a new account, and then provide a New Account name.
Notes:
l Creating a new account ensures that SAM has required access to
your migrated database.
l The New Account must be a member of the securityadmin server
role.

920

Moving SAM to a New Server

The sysadmin role and the SA user account are always members of
securityadmin.
10. Provide and confirm an account Password.
11. Click Next to start database configuration, and then click Finish to exit the
Configuration Wizard
l

Moving SAM to a New Server

Orion users that have SAM as a module installed will need to follow the steps in
this section. SAM encrypts your sensitive data with a security certificate stored on
the original Orion server. To grant a new server access to this encrypted data, you
must copy the original security certificate to the new server.
Warning: If you do not replicate the original certificate, SAM on the new server
cannot access any credentials used by your component monitors, and all of those
component monitors will fail.
To replicate the original certificate:
1. Export the credential from the original server.
a. On the Start Menu, click Run, type MMC, and then click OK.
b. On the File menu, click Add/Remove Snapin, and then click Add.
c. Select Certificates and then click Add.
d. Select Computer account and then click Next.
e. Select Local computer and then click Finish.
f. Click Close.
g. Click OK.
h. Expand the Certificates (Local Computer) group.
i. Expand the Personal group.
j. Expand the Certificates group.
k. Right-click SolarWinds SAM Engine, point to All Tasks on the shortcut menu, and then click Export.
l. Click Next in the Certificate Export Wizard.
m. Select Yes, export the private key, click Next, and then click Next
again.
n. Type and confirm a password for this private key, and then click Next.
o. Specify the file name to which you want to save the certificate, click
Next, and then click Finishthe certificate is saved with a .pfx file
name extension.
2. Copy the .pfx certificate file to the new server.
3. Import the certificate to the new server.

921

Chapter 23: Managing the SolarWinds SAM Database

a.
b.
c.
d.
e.
f.
g.
h.
i.
j.
k.
l.
m.
n.
o.
p.
q.

On the Start Menu, click Run, type MMC, and then click OK.
On the File menu, click Add/Remove Snapin, and then click Add.
Select Certificates, and then click Add.
Select Computer account, and then click Next.
Select Local computer, and then click Finish.
Click Close.
Click OK.
Expand the Certificates (Local Computer) group.
Expand the Personal group.
Expand the Certificates group.
If there is a SolarWinds SAM Engine item in the list, right-click
SolarWinds SAM Engine and select Delete from the shortcut menu.
Right-click the CertificatesPersonalCertificates node, point to All
Tasks in the shortcut menu, and then click Import.
Click Next in the Certificate Import Wizard.
Specify the .pfx certificate file you copied to the server and then click
Next.
Enter the password for the private key, check Mark this key as exportable, and then click Next.
Select Place all certificates in the following store, and then select
Personal as the Certificate Store.
Click Next and then click Finish.

To export data from one SolarWinds database and import it into another:
1. Connect to your database server with Database Manager. For more information, see Adding a Server on page904.
2. Select your database, and then click Database> Backup Database.
3. Enter a Description of the database backup.
4. Enter a path or click Browse () and then navigate to a Backup Filename.
5. Click OK.
6. Copy the newly created backup file to a folder on the new server.
Note: The backup file is named after your SolarWinds database and given
a .bak extension. For example, if you have designated OrionDB as the name
of your SolarWinds database, the backup is named [Link].
7. Click Start> All Programs> SolarWinds> Advanced Features> Database Manager.
8. Click Add Server.

922

To export data from one SolarWinds database and import it into another:
9. Select the name of the SQL instance from the SQL Server list. If your
server is not listed, complete the procedure in Adding a Server on
page904.
10. Select the appropriate authentication type, and then click Connect to Database Server.
11. Select your new server in the list, and then click Server> Connect to
Server.
12. Click Server> Restore Database.
13. Enter the path to the database backup file on the server or click Browse
() and then navigate to the location of the database backup file.
14. Click OK.
15. Close the Database Manager.
16. Click Start> All Programs> SolarWinds> Configuration and AutoDiscovery> Configuration Wizard.
17. Specify the newly restored database in the Database Setup section of the
wizard.
18. When prompted, click Yes to use the existing database.

923

Chapter 24:
Creating Custom Properties
SolarWinds SAM allows you to create custom properties using the Manage
Custom Properties Editor. This allows you to add a custom property to any
monitored device. Custom properties are additional fields, such as country,
building, asset tag, or serial number, that you can define and store in your
SolarWinds database. After properties are added, they are available for display
and filtering both within the SolarWinds Web Console and within the Report
Writer application. A few more examples of how custom properties may be used
are as follows:
l
l
l

l
l

Add information to nodes, such as contact, owner, or support contract.

Add a custom property that is used as an account limitation on nodes.
Add a custom property to nodes for grouping them on the web or in a
report.
Add a custom property and display it as an annotation on a chart.
Add a custom property to an application to show the severity to your environment if this application is down.

The Manage Custom Properties Editor lets you choose from a provided collection
of the most commonly used properties, or you can easily and efficiently build your
own custom properties. For more information, see Creating a Custom Property
on page924.
Once your custom property is defined, the Import Wizard allows you to populate
your new property from either a text- or comma-delimited file. For more
information, see Importing and Exporting Custom Property Data on page927.
Alternatively, if you only have a few individual changes or additions, you may
choose to make those changes using the Edit view. For more information, see
Editing Custom Properties on page929.

Creating a Custom Property

The following procedure provides steps required to create a custom property
using the Manage Custom Properties Editor.

924

Chapter 24: Creating Custom Properties

To create a property with Manage Custom Properties Editor:
1. From the web console, navigate to Settings > Manage Custom Properties.

2. Click Add Custom Property.

3. Select the property object type from the dropdown menu, and then
click Next.
4. Select a predefined tag from the Property Templates column to have the
remaining fields populated automatically, or select <Custom> to fill in the
fields yourself, as shown below:

5. Click Next.
6. On the following screen, click Select Nodes to bring up the following
screen, which allows you to select the nodes you want by moving them to
the right-hand column and clicking Add, in green:

925

Removing a Custom Property

7. Click Submit.
8. Once your nodes are successfully added, the following message appears
with a link:

9. Clicking Show Assignments will take you to the Manage Nodes page, as
shown below:

Removing a Custom Property

Custom properties are easily removed using the Custom Property Editor, as
shown in the following procedure.
To remove a custom property:
1. From the web console, navigate to Settings > Manage Custom Properties.

926

Chapter 24: Creating Custom Properties

2. Select the properties to be removed using the check boxes next to the
name of the property.
3. Click Delete.

Importing and Exporting Custom Property Data

Once you have defined custom properties, the Manage Custom Properties Editor
Import Values and Export Values buttons assists in populating and saving the
custom property data. For example, you may already possess a spreadsheet
listing the asset tags of all your network nodes, and you would like to have this
information available for reporting and publication in the web console. In this
scenario, Asset Tag is added as a custom property, and then the import wizard is
used to populate the asset tag values from the spreadsheet. The following steps
outline the process for importing custom properties data.
To import custom property data:
1. From the web console, navigate to Settings > Manage Custom Properties.
2. Click Import Values, as highlighted below:

927

To export custom property data:

3. Navigate to the file that contains your custom property data, and then click
Next.
4. Select the Relationship and the Database Column settings from the
provided dropdown menus, as shown below, and then click Import.:

To export custom property data:

1. From the web console, navigate to Settings > Manage Custom Properties.
2. Click Export Values, as highlighted below:

3. Next, select the columns and properties that you would like to have exported.
4. Finally, choose the file type your exported data should be saved as from
the dropdown menu, and then click Export.

928

Chapter 24: Creating Custom Properties

Editing Custom Properties

The Manage Custom Properties Editor allows you to easily modify custom
properties.
To edit a custom property:
1. From the web console, navigate to Settings > Manage Custom Properties.
2. Check the properties you want to edit and then click Edit.
3. Click Submit when done.
To edit a custom property's value:
1. From the web console, navigate to Settings > Manage Custom Properties.
2. Check the properties you want to edit and then click View/Edit Values, as
shown below:

929

To edit a custom property's value:

Note: Selection and editing of multiple properties is permitted if the objects

are of the same type, as highlighted above.
3. Next, edit the cells you want by clicking in them and then click, Save
Changes.

930

Chapter 25:
Additional Polling Engine and Web
Console
Installing additional pollers and Web Consoles help you extend your SolarWinds
Server & Application Monitor (SAM) implementation. You can install additional
polling engines to aid you in load balancing and configure additional websites to
ensure redundant access through more than one web server. By sharing the
same database, you can also share a unified user interface, making the addition
of polling engines transparent to your staff.
The following sections provide descriptions and installation procedures for
adding polling engines and websites. These components are licensed and
purchased separately from your main SolarWinds Server & Application Monitor
install and require the installation of the SolarWinds SAM Additional Polling
Engine. For more information about purchasing licenses, contact your sales
representative (sales@[Link]) or customer service.
Refer to the following sections for more information:
l
l
l
l

Understanding How Polling Engines Work

Requirements for Installing an Additional Polling Engine
Installing an Additional Polling Engine
Installing an Additional Web Console

Understanding How Polling Engines Work

Before you install an additional SolarWinds Server & Application Monitor
(SolarWinds SAM) polling engine, review the following sections and ensure you
understand how SolarWinds SAM polls when first installed and how SolarWinds
SAM additional polling engines work.
Refer to the following sections for more information:
l
l

SolarWinds SAM is Poller-Unaware By Default

SolarWinds SAM Additional Polling Engines are Poller-Aware

931

Chapter 25: Additional Polling Engine and Web Console

SolarWinds SAM is Poller-Unaware By Default

When you install SolarWinds SAM on your SolarWinds server, SolarWinds SAM
is poller-unaware. This means that SolarWinds SAM can poll all nodes that are
monitored by SAM.

SolarWinds SAM Additional Polling Engines are Poller-Aware

After you install an additional SolarWinds SAM polling engine, the additional
polling engines (as well as the main polling engine) on the SolarWinds SAM
server become poller-aware. Poller-aware means each polling engine, including
the SolarWinds SAM server, polls only those nodes assigned to it.

932

Requirements for Installing an Additional Polling Engine

Nodes are assigned to particular polling engines by selecting the desired Polling
Engine when adding a node using the Add Node wizard.
An additional method for assigning nodes to polling engines is to use the Poller
Load Balancing option in the Monitor Polling Engines tool. For more information,
see To assign nodes to polling engines: on page935.

Requirements for Installing an Additional Polling

Engine
System requirements for adding an additional polling engine are the same as for
installing SolarWinds SAM. For more information about SolarWinds SAM
requirements, refer to Requirements for SolarWinds SAM on page98 and
Additional SolarWinds SAM Requirements on page103.

933

Chapter 25: Additional Polling Engine and Web Console

Installing an Additional Polling Engine

Download the special installation package for SolarWinds SAM additional polling
engines ([Link], where x is the major release
number, y is the minor release number, and z is the point release number) to the
server where you want to install the additional polling engine.
Note: You will find the SAM installer for the additional polling engine packaged in
the following product in your customer portal: SolarWinds Additional Polling Engine
v2011.1, or higher.
Note: After completing the following procedure, SolarWinds SAM polling engines
monitor only those applications on nodes associated with the SolarWinds SAM
additional polling engine.

934

To install the additional polling engine:

To install the additional polling engine:
1. Log on with a Windows administrator account to the server where you want
to install the additional polling engine.
2. Run the installer for the SolarWinds SAM Poller downloaded above.
3. Review the Welcome page, and then click Next.
4. Accept the license agreement, and then click Next.
5. Chose a destination location (or accept the default), and then click Next.
6. Click Next to start copying files.
7. Click Finish to complete the Installation Wizard.
8. Click Enter Licensing Information to enter your license, or click
Continue Evaluation.
9. Review the Configuration Wizard Welcome page, and then click Next.
10. Configure the database for your environment by selecting the appropriate
SQL Server database and Authentication information, and then click Next.
11. Configure the database by selecting Use an existing database, and then
selecting the name of the SQL Server database for the SolarWinds SAM
server. Then click Next.
12. Select whether to Create a new account, or Use an existing account,
and then enter the account information. Then click Next.
13. If the Website Settings page is displayed, configure the IP Address,
Port, and Website Root Directory as appropriate and select whether you
want to enable automatic login. Then click Next.
14. Ensure that all the services displayed in the Service Settings page are
checked, including the SAM Job Engine Plug-in, and then click Next.
15. Review the Configuration wizard Summary page, and then click Next.
16. Click Finish to complete the Configuration Wizard.
Note: If you encounter any issues with the additional polling engine, rerun
the Configuration Wizard on the SolarWinds SAM server.
To assign nodes to polling engines:
You can assign nodes to the polling engines by selecting the desired Polling
Engine in the Add Node wizard.
You can also perform Poller Load Balancing using the Monitor Polling Engines
tool to assign nodes to polling engines. Click Start> All Programs>
SolarWinds> AdvancedFeatures> Monitor Polling Engines. Then click
Servers > Poller Load Balancing to display a dialog where you can assign
nodes to particular polling engines. For more information, see Understanding
How Polling Engines Work" on page 931.

935

Chapter 25: Additional Polling Engine and Web Console

Installing an Additional Web Console

Download the special installation package for SAM additional web consoles
([Link], where x is the major release number, y is
the minor release number, and z is the point release number) to the server where
you want to install the additional web console.
Note: You will find the SAM installer for the additional web console packaged in
the following product in your customer portal: SolarWinds Additional Web Server
v2011.1, and higher.
TCP port 17777 must be open on both the SolarWinds SAM server and the
website.
To install an additional Web Console:
1. Log on to your current SolarWinds SAM additional Web Console server
with a Windows administrator account.
2. Run the SolarWinds SAM installerthe installer automatically detects the
SolarWinds SAM Additional Web Console if present.
3. Review the Welcome page, and then click Next.
4. Accept the license agreement, and then click Next.
5. Choose a destination location (or accept the default), and then click Next.
6. Click Next to start copying files.
7. Click Finish to complete the Installation Wizard.
8. Review the Configuration Wizard Welcome window, and then click Next.
9. Specify the appropriate information on the Database Settings window, and
then click Next.
10. Specify the appropriate database to use, and then click Next. Ensure you
have stopped your polling engines before continuing.
11. Specify the appropriate database account on the Database Account window, and then click Next.
12. Select the IP address, port, and Website root directory on the Website Settings window, and then click Next.
13. Review the configuration summary, and then click Next.
14. Click Finish to complete the Configuration Wizard.
Copying the Default Reports
Additional Web Console installations do not include the default SAM reports. To
ensure your default SAM reports are available on your Additional Web Console

936

Copying the Default Reports

install, copy the Reports folder to your Additional Web Console server. This folder
is typically C:\Program Files\SolarWinds\Orion\Reports

937

Chapter 26: Status Icons and Identifiers

The following table lists SAM icons with associated status indications:
Icon Status Indication
Application is Up
Application s in a Warning state
Application is in a Critical state
Application is Down
Application is in an Unknown state
Component is Up
Component is in a Warning state
Component is in a Critical state
Component is Down
Component is in an Unknown state

938

Chapter 27:
SolarWinds Variables and Examples
SolarWinds SAM product components, including the Advanced Alert Manager,
both the Traps Viewer and the Syslog Viewer, and Network Atlas can employ
SolarWinds variables. These variables are dynamic and, in the case of alerts,
parse when the alert is triggered or reset. For example, the variable
${ResponseTime} will parse with the current response time of the node that is
triggering the alert.
Note: In some cases, the database table name may be required for alert
variables, as in ${[Link]}. If a variable does not respond as intended,
include the relevant table name for the desired variable.

Variable Modifiers
The variables in the following sections can be modified by appending any of the
variable modifiers in the following table:
Variable Modifier

Description

-Raw

Displays the raw value for the statistic. For example, if

Transmit Bandwidth is set to 10 Mbps, then the raw value
would be10000000. The cooked value would be 10
Mbps.

-Previous

Displays the previous value for the statistic before the

Alert was triggered

-Cooked

Displays the cooked value for the statistic. For example,

if Transmit Bandwidth is set to 10 Mbps, then the raw
value would be 10000000 and cooked value would be
10 Mbps.

Displays the previous cooked value for the statistic

PreviousCooked before the Alert was triggered

939

Chapter 27: SolarWinds Variables and Examples

95th Percentile Calculations

Calculation of the 95th percentile, a well-known statistical standard used to
discard maximum spikes, is based on 5 minute data samples. The calculation
gathers these values every 5 minutes for however long you select, throws away
the top 5%, yielding the 95th percentile value at the beginning of the list.
Consider the following example of how the 95th percentile is calculated for a 10
hour work day from 8am to 6pm (600 minutes):
1. Over the 10 hours, the following 120 values were collected for inbound
traffic (Mb/s):
0.149 0.623 0.281 0.136 0.024 0.042 0.097 0.185 0.198 0.243 0.274 0.390 0.971
0.633 0.238 0.142 0.119 0.176 0.131 0.127 0.169 0.223 0.291 0.236 0.124 0.072
0.197 0.105 0.138 0.233 0.374 0.290 0.871 0.433 0.248 0.242 0.169 0.116 0.121
0.427 0.249 0.223 0.231 0.336 0.014 0.442 0.197 0.125 0.108 0.244 0.264 0.190
0.471 0.033 0.228 0.942 0.219 0.076 0.331 0.227 0.849 0.323 0.221 0.196 0.223
0.642 0.197 0.385 0.098 0.263 0.174 0.690 0.571 0.233 0.208 0.242 0.139 0.186
0.331 0.124 0.249 0.643 0.481 0.936 0.124 0.742 0.497 0.085 0.398 0.643 0.074
0.590 0.771 0.833 0.438 0.242 0.092 0.376 0.231 0.627 0.249 0.663 0.181 0.636
0.224 0.342 0.697 0.285 0.108 0.211 0.074 0.490 0.271 0.133 0.338 0.242 0.519
0.376 0.331 0.227
2. When reordered from high to low:
0.971 0.942 0.936 0.871 0.849 0.833 0.771 0.742 0.697 0.690 0.663 0.643 0.643
0.642 0.636 0.633 0.627 0.623 0.590 0.571 0.519 0.497 0.490 0.481 0.471 0.442
0.438 0.433 0.427 0.398 0.390 0.385 0.376 0.376 0.374 0.342 0.338 0.336 0.331
0.331 0.331 0.323 0.291 0.290 0.285 0.281 0.274 0.271 0.264 0.263 0.249 0.249
0.249 0.248 0.244 0.243 0.242 0.242 0.242 0.242 0.238 0.236 0.233 0.233 0.231
0.231 0.228 0.227 0.227 0.224 0.223 0.223 0.223 0.221 0.219 0.211 0.208 0.198
0.197 0.197 0.197 0.196 0.190 0.186 0.185 0.181 0.176 0.174 0.169 0.169 0.149
0.142 0.139 0.138 0.136 0.133 0.131 0.127 0.125 0.124 0.124 0.124 0.121 0.119
0.116 0.108 0.108 0.105 0.098 0.097 0.092 0.085 0.076 0.074 0.074 0.072 0.042
0.033 0.024 0.014
3. Drop the first 6, as these equal the top 5% of the values:
0.771 0.742 0.697 0.690 0.663 0.643 0.643 0.642 0.636 0.633 0.627 0.623 0.590
0.571 0.519 0.497 0.490 0.481 0.471 0.442 0.438 0.433 0.427 0.398 0.390 0.385
0.376 0.376 0.374 0.342 0.338 0.336 0.331 0.331 0.331 0.323 0.291 0.290 0.285
0.281 0.274 0.271 0.264 0.263 0.249 0.249 0.249 0.248 0.244 0.243 0.242 0.242

940

Regular Expression Pattern Matching

0.242 0.242 0.238 0.236 0.233 0.233 0.231 0.231 0.228 0.227 0.227 0.224 0.223
0.223 0.223 0.221 0.219 0.211 0.208 0.198 0.197 0.197 0.197 0.196 0.190 0.186
0.185 0.181 0.176 0.174 0.169 0.169 0.149 0.142 0.139 0.138 0.136 0.133 0.131
0.127 0.125 0.124 0.124 0.124 0.121 0.119 0.116 0.108 0.108 0.105 0.098 0.097
0.092 0.085 0.076 0.074 0.074 0.072 0.042 0.033 0.024 0.014
4. The 95th percentile is 0.771.

Regular Expression Pattern Matching

When editing comparison criteria, the following regular expressions can be used
for pattern matching. Examples are provided at the end of this section.
Characters
Character

Description

Example

Any character
except
[,\,^,$,.,|,?,*,+,
(,),

All characters except the listed special

characters match a single instance of
themselves.

a matches a

\ (backslash)
followed by
any of
[,\,^,$,.,|,?,*,+,
(,),

A backslash escapes special characters to

suppress their special meaning.

\+ matches +

\xFF where FF
are 2
hexadecimal
digits

Matches the character with the specified

ASCII/ANSI value, which depends on the
code page used. Can be used in character
classes.

\xA9 matches
when using the
Latin-1 code
page.

\n, \r and \t

Match an LF character, CR character and a

tab character respectively. Can be used in
character classes.

\r\n matches a
DOS/Windows
CRLF line
break.

Character Classes or Character Sets [abc]

Character

Description

Example

941

Chapter 27: SolarWinds Variables and Examples

Classes or
Sets
[(opening
square
bracket)

Starts a character class. A character class

matches a single character out of all of the
possibilities offered by the character class. Inside
a character class, different rules apply. The rules
in this section are only valid inside character
classes. The rules outside this section are not
valid in character classes, except \n, \r, \t and
\xFF

Any
character
except ^,-,],\
add that
character to
the possible
matches for
the character
class.

All characters except the listed special

characters.

[abc]
matches a,
b or c

\ (backslash)
followed by
any of ^,-,],\

A backslash escapes special characters to

suppress their special meaning.

[\^\]]
matches ^
or ]

- (hyphen)
except
immediately
after the
opening [

Specifies a range of characters. (Specifies a

hyphen if placed immediately after the opening [)

[a-zA-Z0-9]
matches
any letter
or digit

^ (caret)
immediately
after the
opening [

Negates the character class, causing it to match a

single character not listed in the character class.
(Specifies a caret if placed anywhere except after
the opening [)

[^a-d]
matches x
(any
character
except a, b,
c or d)

942

Anchors

\d, \w and \s

Shorthand character classes matching digits 0-9,

word characters (letters and digits) and
whitespace respectively. Can be used inside and
outside character classes

[\d\s]
matches a
character
that is a
digit or
whitespace

Anchors
Anchors Description

Example

^ (caret)

Matches at the start of the string to which the regular

expression pattern is applied. Matches a position rather
than a character. Most regular expression flavors have
an option to make the caret match after line breaks (i.e.
at the start of a line in a file) as well.

^.
matches
a in
abc\ndef.
Also
matches
d in
"multiline"
mode.

$(dollar)

Matches at the end of the string to which the regular

expression pattern is applied. Matches a position rather
than a character. Most regular expression flavors have
an option to make the dollar match before line breaks
(i.e. at the end of a line in a file) as well. Also matches
before the very last line break if the string ends with a
line break.

.$
matches
f in
abc\ndef.
Also
matches
c in
"multiline"
mode.

\A

Matches at the start of the string to which the regular

\A.
expression pattern is applied to. Matches a position
matches
rather than a character. Never matches after line breaks. a in abc

\Z

Matches at the end of the string to which the regular

expression pattern is applied. Matches a position rather

943

.\Z
matches

Chapter 27: SolarWinds Variables and Examples

\z

than a character. Never matches before line breaks,

except for the very last line break if the string ends with
a line break.

f in
abc\ndef

Matches at the end of the string to which the regular

expression pattern is applied. Matches a position rather
than a character. Never matches before line breaks.

.\z
matches
f in
abc\ndef

Quantifiers
Quantifiers Description

Example

? (question
mark)

Makes the preceding item optional. The optional item

is included in the match, if possible.

abc?
matches
ab or abc

??

Makes the preceding item optional. The optional item

is excluded in the match, if possible. This construct is
often excluded from documentation due to its limited
use.

abc??
matches
ab or abc

* (star)

Repeats the previous item zero or more times. As

many items as possible will be matched before trying
permutations with fewer matches of the preceding
item, up to the point where the preceding item is not
matched at all.

.*
matches
"def"
"ghi" in
abc "def"
"ghi" jkl

*? (lazy
star)

Repeats the previous item zero or more times. The

engine first attempts to skip the previous item before
trying permutations with ever increasing matches of
the preceding item.

.*?
matches
"def" in
abc "def"
"ghi" jkl

#NAME?

Repeats the previous item once or more. As many

items as possible will be matched before trying
permutations with fewer matches of the preceding
item, up to the point where the preceding item is

.+
matches
"def"
"ghi" in

944

Quantifiers

matched only once.

abc "def"
"ghi" jkl

+? (lazy
plus)

Repeats the previous item once or more. The engine

first matches the previous item only once, before
trying permutations with ever increasing matches of
the preceding item.

.+?
matches
"def" in
abc "def"
"ghi" jkl

{n} where n
is an
integer >=
1

Repeats the previous item exactly n times.

a{3}
matches
aaa

{n,m}
where n >=
1 and m >=
n

Repeats the previous item between n and m times.

Will try to repeat m times before reducing the
repetition to n times.

a{2,4}
matches
aa, aaa
or aaaa

{n,m}?
where n >=
1 and m >=
n

Repeats the previous item between n and m times.

Will try to repeat n times before increasing the
repetition to m times.

a{2,4}?
matches
aaaa,
aaa or
aa

{n,} where
n >= 1

Repeats the previous item at least n times. Will try to

match as many items as possible before trying
permutations with fewer matches of the preceding
item, up to the point where the preceding item is
matched only m times.

a{2,}
matches
aaaaa in
aaaaa

{n,}? where
n >= 1

Repeats the previous item between n and m times.

The engine first matches the previous item n times
before trying permutations with ever increasing
matches of the preceding item.

a{2,}?
matches
aa in
aaaaa

945

Chapter 27: SolarWinds Variables and Examples

Dot
Dot
Description
Character
. (dot)

Example

Matches any single character except line . matches x or most

break characters \r and \n.
any other character

Word Boundaries
Word Boundary

Description

Example

\b

Matches at the position

.\b
between a word character
matches
(anything matched by \w)
c in abc
and a non-word character
(anything matched by [^\w] or
\W) as well as at the start
and/or end of the string if the
first and/or last characters in
the string are word
characters.

\B

Matches at the position

\B.\B
between two word characters matches
(i.e the position between
b in abc
\w\w) as well as at the
position between two nonword characters (i.e. \W\W).

Alternation
Alternation Character

Description

Example

Causes the regular

expression engine to
match either the part
on the left side or the

abc|def|xyz
matches
abc, def or
xyz

(vertical bar or pipe)

946

Regular Expression Pattern Matching Examples

part on the right side.

Can be strung
together into a series
of options.
|
(vertical bar or pipe)

The vertical bar has

the lowest precedence
of all operators. Use
grouping to alternate
only part of the regular
expression.

abc
(def|xyz)
matches
abcdef or
abcxyz

Regular Expression Pattern Matching Examples

The following examples illustrate uses of regular expression pattern matching:
snmp-server community public

Finds any line that includes the text snmp-server community public. There can
be text before and/or after the string on the same line. service tcpkeepalives-in.*\n(.*\n)*.*service tcp-keepalives-out

Finds the first line service tcp-keepalives-in and then looks for service tcpkeepalives-out on any line after that. The regular expression string .*\n(.*\n)*.* is
used to search any number of lines between strings. access-list 105 deny.*tcp
any any eq 139 log

Finds the line with access-list 105 deny, followed by any number of characters
of any type, followed by tcp any any eq 139 log on the same line. The regular
expression string .* finds any character and any number of characters on the
same line. This expression can be used to find spaces, tabs, numbers,
letters, or special characters. ntp clock-period \d*
Finds any line that includes ntp clock-period, followed by any number. The
regular expression string \d* will find any number at any length, such as 3,
48, or 2394887.
user \x2a

947

Chapter 27: SolarWinds Variables and Examples

Finds any line that includes user *. The regular expression string \x, followed
by a hexadecimal value, specifies an individual character. In this example,
\x2a represents the asterisk character, which has a hexadecimal value of 2a.

Advanced Alert Engine Variables

The following variables can be used in alert messages within SolarWinds SAM
and SolarWinds Modules. You must begin each variable with a dollar sign and
enclose each variable identifier in braces as, for example, ${ObjectName}.

General
The following are valid, general advanced alert variables:
General Variable

Description

${Acknowledged}

Acknowledged status

${AcknowledgedBy}

Who the alert was acknowledged by

${AcknowledgedTime}

Time the alert was acknowledged

${AlertTriggerCount} Count of triggers

${AlertTriggerTime}

Date and time of the last event for this Alert.

(Windows control panel defined Short Date
and Short Time)

${Application}

SolarWinds application information

${CR}

Line Feed Carriage Return

${Copyright}

Copyright information

${ObjectName}

Description/Name of the object in the alert

${Release}

Release information

${Version}

Version of the SolarWinds software package

Date/Time
The following are valid date and time variables:

948

Date/Time

Date/Time Variable

Description

${AMPM}

AM/PM indicator

${AbreviatedDOW}

Current day of the week. Three character

abbreviation.

${D}

Current day of the month

${DD}

Current day of the month (two digit number, zero

padded)

${Date}

Current date. (Short Date format)

${DateTime}

Current date and time. (Windows control panel

defined Long Date and Long Time format)

${DayOfWeek}

Current day of the week.

${DayOfYear}

Numeric day of the year

${H}

Current hour

${HH}

Current hour. Two digit format, zero padded.

${Last2Hours}

Last two hours

${Last24Hours}

Last 24 hours

${Last7Days}

Last seven days (Short Date format)

${LastHour}

Last hour

${LocalDOW}

Current day of the week. Localized language format.

${LocalMonthName} Current month name in the local language.

${LongDate}

Current date. (Long Date format)

${M}

Current numeric month

${MM}

Current month. Two digit number, zero padded.

949

Chapter 27: SolarWinds Variables and Examples

${MMM}

Current month. Three character abbreviation.

${MMMM}

Full name of the current month

${MediumDate}

Current date. (Medium Date format)

${Minute}

Current minute. Two digit format, zero padded.

${S}

Current second.

${Second}

Current second. Two digit format, zero padded.

${Time}

Current Time. (Short Time format)

${Today}

Today (Short Date format)

${Year}

Four digit year

${Year2}

Two digit year

${Yesterday}

Yesterday (Short Date format)

Group Variables
The following are valid group variables:
Group Variable

Description

${GroupDetailsURL}

URL of the Group Details

view for a selected group

${GroupFrequency}

Interval on which group

membership is evaluated and
group snapshots are taken.

${GroupID}

Designated identifier for a

defined group

${GroupMemberDisplayName}

Display name of group

member type: Node, Volume,
Component, Application, and
so on.

950

Group Variables

${GroupMemberDisplayNamePlural}

Display name of multiple

group members of a type:
Nodes, Components,
Applications, and so on.

${GroupMemberFullName}

Full name of a group member,

including location

${GroupMemberName}

Name of a group member

${GroupMemberPercentAvailability} Percent availability of a group

member when group member
status is Up, Warning, or
Critical and 0% if status is
anything else.
${GroupMemberSnapshotID}

Unique identifier of group

member snapshot.

${GroupMemberStatusID}

Identifier assigned to a group

member indicating its status.
For more information see
Status Variables on
page953.

${GroupMemberStatusName}

Name of group member

status. For more information
see Status Variables on
page953.

${GroupMemberUri}

Uri used by SolarWinds

Information Service (SWIS) to
refer to the selected group
member within the web
console.

${GroupName}

Name of the group.

${GroupOwner}

SolarWinds product
appropriate to the group type

951

Chapter 27: SolarWinds Variables and Examples

${GroupPercentAvailability}

100% when group status is

Up, Warning, Critical and 0%
if status is anything else.

${GroupStatusCalculatorID}

Name of roll-up logic

calculator that evaluates
status of group based on
member statuses. (0 = Mixed,
1 = Worst, 2 = Best)

${GroupStatusCalculatorName}

Name of roll-up logic

calculator that evaluates
status of group based on
member statuses. (Mixed,
Worst, Best)

${GroupStatusID}

Identifier assigned to a group

indicating its status. For more
information see Status
Variables on page953.

${GroupStatusName}

Name of group status. For

more information see Status
Variables on page953.

${GroupStatusRootCause}

A list of all group members

that are not Up

${NodeID}

NULL every time - just for

legacy support.

SQL Query
Any value you can collect from the database can be generated, formatted, or
calculated using a SQL query as a variable. To use a SQL query as a variable in
SolarWinds SAM, use ${SQL:{query}} as shown in the following example that
returns the results of the SQL query Select Count(*) From Nodes:
${SQL:Select Count(*) From Nodes}

952

Status Variables

Status Variables
When using the ${Status} variable with a monitored object, status values are
returned, as appropriate. The following table provides a description for each
status value:
Status Value Description
0

Unknown

Up

Down

Warning

Shutdown

Testing

Dormant

Not Present

Lower Layer Down

Unmanaged

10

Unplugged

11

External

12

Unreachable

14

Critical

15

Mixed Availability

16

Misconfigured

17

Could Not Poll

19

Unconfirmed

953

Chapter 27: SolarWinds Variables and Examples

22

Active

24

Inactive

25

Expired

26

Monitoring Disabled

27

Disabled

28

Not Licensed

Node Variables
The following are valid node variables:
Node Variable

Description

${AgentPort}

Node SNMP port

number

${Allow64BitCounters}

Node allows 64-bit

counters (1), or not
(0)

${AvgResponseTime}

Average node
response time , in
msec, to ICMP
requests

${BlockUntil}

Day, date, and time

until which node
polling is blocked

${BufferBgMissThisHour}

Device-dependent
count of big buffer
misses on node in
current hour,
queried with MIB
[Link].[Link].30

954

Node Variables

${BufferBgMissToday}

Device-dependent
count of big buffer
misses on node in
current day, queried
with MIB
[Link].[Link].30

${BufferHgMissThisHour}

Device-dependent
count of huge buffer
misses on node in
current hour,
queried with MIB
[Link].[Link].62

${BufferHgMissToday}

Device-dependent
count of huge buffer
misses on node in
current day, queried
with MIB
[Link].[Link].62

${BufferLgMissThisHour}

Device-dependent
count of large buffer
misses on node in
current hour,
queried with MIB
[Link].[Link].38

${BufferLgMissToday}

Device-dependent
count of large buffer
misses on node in
current day, queried
with MIB
[Link].[Link].38

${BufferMdMissThisHour}

Device-dependent
count of medium
buffer misses on
node in current

955

Chapter 27: SolarWinds Variables and Examples

hour, queried with

MIB
[Link].[Link].22
${BufferMdMissToday}

Device-dependent
count of medium
buffer misses on
node in current day,
queried with MIB
[Link].[Link].22

${BufferNoMemThisHour}

Count of buffer
errors due to low
memory on node in
current hour

${BufferNoMemToday}

Count of buffer
errors due to low
memory on node in
current day

${BufferSmMissThisHour}

Device-dependent
count of small buffer
misses on node in
current hour,
queried with MIB
[Link].[Link].14

${BufferSmMissToday}

Device-dependent
count of small buffer
misses on node in
current day, queried
with MIB
[Link].[Link].14

${Caption}

User friendly node

name

${Community}

Node community

956

Node Variables

string
${Contact}

Contact information
for person or group
responsible for
node

${CPULoad}

Node CPU
utilization rate at
last poll

${CustomPollerLastStatisticsPoll}

Day, date, and time

of last poll attempt
on node

${CustomPollerLastStatisticsPollSuccess} Day, date, and time

that node was last
successfully polled
${Description}

Node hardware and

software

${DNS}

Fully qualified node

name

${DynamicIP}

If node supports
dynamic IP address
assignment via
BOOTP or DHCP
(1); static IP
address return (0)

${EngineID}

Internal unique
identifier of the
polling engine to
which node is
assigned

${GroupStatus}

Filename of status
icon for node and,

957

Chapter 27: SolarWinds Variables and Examples

in SolarWinds
NPM, its interfaces
${IOSImage}

Family name of
Cisco IOS on node

${IOSVersion}

Cisco IOS version

on node

${IP_Address}

Node IP address

${LastBoot}

Day, date and time

of last node boot

${LastSync}

Time and date of

last node database
and memory
synchronization

${Location}

Physical location of
node

${MachineType}

Node manufacturer
or distributor and
family or version
information

${MaxResponseTime}

Maximum node
response time , in
msec, to ICMP
requests

${MemoryUsed}

Total node memory

used over polling
interval

${MinResponseTime}

Minimum node
response time , in
msec, to ICMP
requests

958

Node Variables

${NextPoll}

Day, date and time

of next scheduled
node polling

${NextRediscovery}

Time of next node

rediscovery

${NodeID }

Internal unique
identifier of node

${ObjectSubType}

States if node
supports SNMP or
is ICMP-only

${PercentLoss}

ICMP packet loss

percentage when
node last polled

${PercentMemoryUsed}

Percentage of total
node memory used
over polling interval

${PollInterval}

Node polling
interval, in seconds

${RediscoveryInterval}

Node rediscovery
interval, in minutes

${ResponseTime}

Node response
time, in
milliseconds, to last
ICMP request

${RWCommunity}

Node read/write
community string;
acts as security
code for read/write
SNMP access

${RWSNMPV3AuthKey}

SNMPv3 read/write

959

Chapter 27: SolarWinds Variables and Examples

credential
authentication key
${RWSNMPV3AuthKeyIsPwd}

States if the
SNMPv3 read/write
credential
authentication key
is the password

${RWSNMPV3AuthMethod}

SNMPv3 read/write
credential
authentication
method

${RWSNMPV3Context}

SNMPv3 read/write
security context
information

${RWSNMPV3PrivKey}

SNMPv3 read/write
credential key

${RWSNMPV3PrivKeyIsPwd}

States if the
SNMPv3 read/write
credential privacy
key is the password

${RWSNMPV3PrivMethod}

SNMPv3 read/write
credential privacy
encryption method

${RWSNMPV3Username}

User friendly name

for SNMPv3
read/write
credential

${Severity}

A network health
score determined
additively by
scoring the status of

960

Node Variables

monitored objects.
For example, in
SolarWinds NPM 1
point is provided for
an interface in a
warning state, 1000
points for a down
interface, and 1
million points for a
down node.
${SNMPV2Only}

States if node only

supports SNMPv1
or SNMPv2

${SNMPV3AuthKey}

SNMPv3
authentication key

${SNMPV3AuthKeyIsPwd}

States if node
SNMPv3
authentication key
is password

${SNMPV3AuthMethod}

SNMPv3
authentication type

${SNMPV3Context}

Group or domain of
user with SNMPv3
access to node

${SNMPV3PrivKey}

SNMPv3 credential
key

${SNMPV3PrivKeyIsPwd}

States if node
SNMPv3 credential
key is the password

${SNMPV3PrivMethod}

SNMPv3 credential
key type

961

Chapter 27: SolarWinds Variables and Examples

${SNMPV3Username}

User friendly name

for SNMPv3
credential

${SNMPVersion}

States the version

of SNMP used by
the node

${StatCollection}

Statistics collection
frequency, in
minutes

${Status}

Numerical node
status. For more
information, see
Status Variables
on page953.

${StatusDescription}

User friendly node

status

${StatusLED}

Filename of node
status icon

${SysName}

String reply to
SNMP SYS_NAME
OID request

${SysObjectID}

Vendor ID of the
network
management
subsystem in OID
form. Clearly
determines the type
of node.

${SystemUpTime}

Time, in hundredths
of a second, since
network monitoring
started

962

Volume Variables

${TotalMemory}

Total node memory

available

${UnManaged}

States if node is
currently
unmanaged

${UnManageFrom}

Day, date, and time

when node is set to
Unmanaged

${UnManageUntil}

Day, date, and time

when node is
scheduled to be
managed

${Vendor}

Node manufacturer
or distributor

${VendorIcon}

Filename of node
vendor logo

Volume Variables
The following are valid volume variables:
Volume Variable

Description

${Caption}

User friendly volume name

${FullName}

User friendly volume name

including captions of
parent node and, in
SolarWinds NPM, interface

${LastSync}

Time and date volume last

synchronized in database
and memory models

${NextPoll}

Day, date and time of next

scheduled volume polling

963

Chapter 27: SolarWinds Variables and Examples

${NextRediscovery}

Scheduled time of next

volume rediscovery

${NodeID}

Internal unique identifier of

parent node

${PollInterval}

Volume status polling

interval, in seconds

${RediscoveryInterval}

Volume rediscovery
interval, in minutes

${StatCollection}

Statistics collection
frequency, in minutes

${Status}

Numerical volume status:

(0=Unknown, 1=Up,
2=Shutdown,
3=Testing)

${StatusLED}

Filename of volume status

icon

${VolumeAllocationFailuresThisHour} Number of volume

allocation errors for this
volume in last hour
${VolumeAllocationFailuresToday}

Number of volume
allocation errors for this
volume in current day

${VolumeDescription}

User friendly volume

description

${VolumeID}

Internal unique identifier of

volume

${VolumeIndex}

Unique index of this

volume within the parent
node

964

Hardware Specific Variables

${VolumePercentUsed}

Percentage of volume
currently in use

${VolumeResponding}

(Y) = volume is currently

responding to SNMP
queries

${VolumeSize}

Size of volume, in bytes

${VolumeSpaceAvailable}

Total space available on

volume, in bytes

${VolumeSpaceUsed}

Total space used on

volume, in bytes

${VolumeType}

Volume type, as reported

by hrStorageType OID
(Removable Disk/Fixed
Disk/Compact Disc/Virtual
Memory/RAM/and so on)

${VolumeTypeIcon}

Filename of icon for

volume type

Hardware Specific Variables

Variables for hardware come in three groups; Hardware Status, Node Hardware
Type, and Node Hardware Status. Use these variables to receive specific alerts
and reports on various aspects of your hardware.
Note: Hardware variables intentionally have the "APM" prefix.
Hardware Status
The following are valid hardware status variables:
Hardware Variable

Description

${APM_HardwareAlertData.HardwareStatus}

Current
hardware status

${APM_
Current
[Link]} description of

965

Chapter 27: SolarWinds Variables and Examples

hardware status
${APM_HardwareAlertData.Manufacturer}

Manufacturer

${APM_HardwareAlertData.Model}

Hardware model

${APM_HardwareAlertData.ServiceTag}

Service
tag/Serial
Number

${APM_HardwareAlertData.LastPollTime}

Time of the last

poll

${APM_HardwareAlertData.LastPollMessage}

Message or
error message
returned from
the last poll

${APM_HardwareAlertData.NodeName}

Name of the
node

${APM_HardwareAlertData.IsPollingDisabled}

Information
relating to nodes
for which polling
is disabled

${APM_HardwareAlertData.SensorsWithStatus}

Comma
separated list of
all child
hardware
components and
their statuses

${APM_HardwareAlertData.SensorsWithProblems} Comma
separated list of
all child
hardware
components (in
status other than
"Up") and their
statuses

966

Node Hardware Type

Node Hardware Type
The following are valid node hardware type variables:
Hardware Variable

Descripti
on

${APM_
[Link]}

Rollup
status for
this
hardware
type

${APM_
[Link]
ption}

Current
hardware
description

${APM_HardwareTypeAlertData.TypeName}

Type of
hardware
(Fan,
Battery,
and so
on.)

${APM_HardwareTypeAlertData.NodeName}

Name of
the node

${APM_HardwareTypeAlertData.SensorsWithStatus}

Comma
separated
list of all
child
hardware
componen
ts and their
statuses

${APM_
[Link]}

Comma
separated
list of all
child

967

Chapter 27: SolarWinds Variables and Examples

hardware
componen
ts (in
status
other than
"Up") and
their
statuses
Node Hardware Sensor
The following are valid node hardware sensor variables:
Hardware Variable

Description

${HardwareTypeStatus}

Status of the parent object

${HardwareTypeStatusDescription} Description of the status of the

parent object
${CategoryName}

Name of the parent hardware

type (Fan, Battery, and so on.)

${NodeName}

Name of the node

${SensorUniqueName}

Unique name of the sensor

${SensorDisplayName}

Display name of the sensor

${SensorValue}

Value returned from the last

poll

${SensorUnit}

Sensor unit (Degree F, Watts,

and so on.)

${SensorOrionStatus}

Sensor status

${SensorOrionStatusDescription}

Sensor status description

${SensorOriginalStatus}

Original status returned by the

remote node

968

I/O Operations Macros

Message or error message

from the last poll

${SensorMessage}

I/O Operations Macros

These Macros are related to processes and services only. Do not confuse these
with similar macros used for volumes:
Macro

Description

${IOReadOperationsPerSec}

Number of I/O read operations per second

${IOWriteOperationsPerSec}

Number of I/O write operations per second

${IOTotalOperationsPerSec}

Total I/O operations per second

${Threshold-IOReadOperationsPerSec-Warning}

Warning threshold for the number of I/O

read operations per second

${Threshold-IOReadOperationsPerSec-Critical}

Critical threshold for the number of I/O read

operations per second

${Threshold-IOWriteOperationsPerSec-Warning}

Warning threshold for the number of I/O

write operations per second

${Threshold-IOWriteOperationsPerSec-Critical}

Critical threshold for the number of I/O write

operations per second

${Threshold-IOTotalOperationsPerSec-Warning}

Warning threshold for the total number of

I/O operations per second

${Threshold-IOTotalOperationsPerSec-Critical}

Critical threshold for the total number of I/O

operations per second

Asset Inventory Alert Macros

The following are based on the Node Warranty object:
Macro

Description

${Contact}

Contact is a default custom property for

the node

969

Chapter 27: SolarWinds Variables and Examples

${CriticalThresholdDays}

Number of days set for Critical threshold

for the Warranty Summary resource

${DeviceTimeZone}

Current time zone of the node

${DNSName}

DNS name of the node

${Domain}

Domain of the node

${HardwareSerialNumber}

Serial number of the current node

${HostName}

Host name of the current node

${Manufacturer}

Manufacturer of the current node

${Model}

Model of the current node

${NodeID}

ID number of the current node

${NodeName}

Name of the current node

${NodeWarrantyDetailsURL} URL of warranty details for the current

node
${OperatingSystem}

Operating system of the current node

${OSArchitecture}

Architecture (32-bit or 64-bit) of the

current node

${OSVersion}

Operating system of the current node

${ServicePack}

Service pack version of the current node

${SystemName}

System name of the current node

${WarningThresholdDays}

Number of days set for the Warning

threshold for the Warranty Summary
resource

${WarrantyExpirationDate} Date of the warranty expiration

${WarrantyExpirationDays} Number of days until the Warranty
expires

970

Example Messages Using Variables

Status for the warranty of the current

node

${WarrantyStatus}

Example Messages Using Variables

The following examples illustrate some of the uses of variables:
l
l
l

l
l

Previous reboot was at ${LastBoot-Previous}.Alert

Current packet loss for ${NodeName} is ${%Loss}.
Average Response time is ${AvgResponseTime} and is varying from ${MinResponseTime} to ${MaxResponseTime}.
Alert: The SNMP Community string used to query ${NodeName} has been
changed from ${Community-Previous} to ${Community}.
SolarWinds SAM uses the new Community String to query ${NodeName}.
${NodeName} has an exceptionally high response time. Average Response
Time is ${AvgResponseTime} and is varying from ${MinResponseTime} to
${MaxResponseTime}.

Syslog Alert Variables

The following variables can be used in Syslog alert messages within Server &
Application Monitor applications. You must begin each variable with a dollar sign
and enclose each variable identifier in curly braces as, for example, ${ObjectName}.

Syslog Date/Time Variables

Syslog Date/Time
Variable

Description

${AbreviatedDOW}

Current day of the week. Three character abbreviation.

${AMPM}

AM or PM corresponding to current time (before or after

noon)

${D}

Current day of the month

${DD}

Current day of the month (two digit number, zero

padded)

${Date}

Current date. (Short Date format)

${DateTime}

Current date and time. (Windows control panel defined

Short Date and Short Time format)

971

Chapter 27: SolarWinds Variables and Examples

${DayOfWeek}

Current day of the week.

${DayOfYear}

Numeric day of the year

${H}

Current hour

${HH}

Current hour. Two digit format, zero padded.

${Hour}

Current hour. 24-hour format

${LocalDOW}

Current day of the week. Localized language format.

${LongDate}

Current date. (Long Date format)

${LocalMonthName} Current month name in the local language.

${LongTime}

Current Time. (Long Time format)

${M}

Current numeric month

${MM}

Current month. Two digit number, zero padded.

${MMM}

Current month. Three character abbreviation.

${MediumDate}

Current date. (Medium Date format)

${Minute}

Current minute. Two digit format, zero padded.

${Month}

Full name of the current month

${N}

Current month and day

${S}

Current second.

${Second}

Current second. Two digit format, zero padded.

${Time}

Current Time. (Short Time format)

${Year2}

Two digit year

${Year}

Four digit year

Other Syslog Variables

Syslog Variable

Description

${Application} SolarWinds application information

972

Trap Alert Variables

${Copyright}

Copyright information

${DNS}

Fully qualified node name

${IP_Address}

IP address of device triggering alert

${Message}

Status of device triggering alert

${MessageType} Assigned alert name

${Release}

Release information

${Severity}

A network health score providing 1 point for an interface

in a warning state, 1,000 points for a down interface, and
1 million points for a down node.

${Version}

Version of the SolarWinds software package.

Trap Alert Variables

The following variables can be used in trap alert messages within SolarWinds
products.

Other Trap Variables

Trap Variable

Description

${Application} SolarWinds application information

${Community}

Node community string

${Copyright}

Copyright information

${DNS}

Fully qualified node name

${Hostname}

Host name of the device triggering the trap

${IP}

IP address of device triggering alert

${IP_Address}

IP address of device triggering alert

${Message}

Message sent with triggered trap and displayed in Trap

Details field of Trap Viewer

973

Chapter 27: SolarWinds Variables and Examples

${MessageType} Name or type of trap triggered

${Raw}

Raw numerical values for properties sent in the

corresponding incoming trap.

${RawValue}

Raw numerical values for properties sent in the

corresponding incoming trap. The same as ${Raw}.

${vbData1}

Trap variable binding value

${vbName1}

Trap variable binding name

Trap Date/Time Variables

Trap Date/Time Variable

Description

${AbbreviatedDOW}

Current day of the week. Three character

abbreviation.

${AbbreviatedMonth} Current month of the year. Three character

abbreviation.
${AMPM}

AM or PM corresponding to current time (before or

after noon)

${D}

Current day of the month

${DD}

Current day of the month (two digit number, zero

padded)

${Date}

Current date. (MM/DD/YYYY format)

${DateTime}

Current date and time. (MM/DD/YYYY HH:MM

format)

${Day}

Current day of the month

${DayOfWeek}

Current day of the week

${DayOfYear}

Numeric day of the year

974

Trap Date/Time Variables

${H}

Current hour

${HH}

Current hour. Two digit format, zero padded.

${Hour}

Current hour. 24-hour format

${LocalDOW}

Current day of the week. Localized language

format.

${LongDate}

Current date. (DAY NAME, MONTH DAY, YEAR

format)

${LongTime}

Current Time. (HH:MM:SS AM/PM format)

${M}

Current numeric month

${MM}

Current month. Two digit number, zero padded.

${MMM}

Current month. Three character abbreviation.

${MMMM}

Full name of the current month

${MediumDate}

Current date. (DD-MMM-YY format)

${MediumTime}

Current time. (HH:MM AM/PM format)

${Minute}

Current minute. Two digit format, zero padded.

${MonthName}

Full name of the current month

${S}

Current second.

${Second}

Current second. Two digit format, zero padded.

${Time}

Current Time. (HH:MM format)

${Year}

Four digit year

${Year2}

Two digit year

975

Chapter 27: SolarWinds Variables and Examples

Script Macros
the following can be used with Windows, Linux/Unix, Nagios, and PowerShell
Script Monitors:
Macro

Description

${IP}

Current IP address

${USER}

Current User

${PASSWORD}

Current Password. (Supported only in Windows,

Linux, and Nagios scripts)

${CREDENTIAL}

Use in place of ${USER} and ${PASSWORD} when working with PowerShell Script Monitors

${PORT}

Current Port. (Supported only in Linux and Nagios

scripts.)

${[Link]}

System name of the node

${[Link]}

User defined node name

${[Link]}

DNS of the node

${[Link]}

ID of the node

${[Link]}

ID of the component

${[Link]}

Name of the component

${[Link]}

ID of the Application
Note: When passing ${[Link]} into script
arguments, the test will fail because the macro will
not be replaced. Edit the script with constant string
values and replace them with macros when the script
is ready.

${[Link]}

Name of the Application

${[Link]}

Template ID of the Application

976

Node Custom Property Macros

${[Link]}

Threshold values for the Warning state

${[Link]}

Threshold values for the Critical state

Node Custom Property Macros

Macro

Description

${[Link]}

Custom Property Name for Node

Application Custom Property Macros

Macro

Description

${[Link]}

Custom Property Name for Application

Baseline Threshold Macros

The baseline threshold macros can only be used when editing an application or a
template. These macros cannot be used in alerts.
Macro

Description

${USE_
BASELINE}

Currently used baseline. Cannot be used with math functions. Can

only be used in the threshold fields of individual SAM component
monitors.

${MEAN}

Current Mean or Average. Can be used with math functions.

${STD_
DEV)

Standard Deviation. Can be used with math functions.

Notes:
${USE_BASELINE} cannot be used with math functions. To have this information
available for use as Warning and Critical thresholds, replace ${USE_BASELINE}
with the following formulas:
l
l

Warning: ${MEAN} + 2 * ${STD_DEV} (or ${MEAN} - 2 * ${STD_DEV})

Critical: ${MEAN} + 3 * ${STD_DEV} (or ${MEAN} - 3 * ${STD_DEV})

977

Chapter 28:
Network Atlas
Network Atlas is a powerful tool for creating custom maps and network diagrams.
The maps created in Network Atlas enable users to view a graphical depiction of
their network in the SolarWinds Web Console. You can also use Network Atlas
maps to create your own network documentation, which can then be printed and
exported as needed.

What is in a Map?
Map objects can be SolarWinds SAM applications and components. The
numerous presentation options for your network maps include:
l

A large set of predefined background colors, textures, and images for use in
your maps, and the ability to use your own custom background graphics
The ability to project real time weather or natural disaster maps onto your
network maps using linked web graphics as a background
The ability to customize the shape, size, color, and style of map links to illustrate the status or the relative bandwidth of associated objects
The ability to show map objects in multiple styles to display application
status
Map nesting that selectively reveals increasing levels of map detail with the
status of child objects on nested maps bubbled up to the parent map

Linked Backgrounds
The linked backgrounds feature allows you to create maps with
backgrounds sourced directly from the Internet. Using a linked background,
you can create maps that include dynamic weather information relevant to
your distributed network sites. For more information, see Selecting a
Background Image.
AutoArrange
AutoArrange options allow you to quickly structure or reorganize objects on
your map. For more information, see Selecting Automatic Layout Styles."

978

Chapter 28: Network Atlas

Example Maps
The following figures are examples of the types of maps you can create using
Network Atlas:

979

Installing Network Atlas

Installing Network Atlas

Network Atlas is pre-installed on SolarWinds EOC v1.1 and higher. Users can
also run Network Atlas as a standalone application on any remote computer
meeting the stated minimum requirements.

Network Atlas Requirements

The following table provides the minimum requirements for a Network Atlas
installation:
Note: To take full advantage of Network Atlas features, users of Network Atlas
must either have node management rights in SolarWinds SAM or be assigned the
administrator role in SolarWinds EOC.
Server
Requirements
Component
Operating
System

Microsoft Windows XP, Windows Vista, Windows 7, Windows

Server 2003, or Windows Server 2008 R2.

Memory

1 GB

Hard Drive
Space

150 MB

Ports

Remote instances of Network Atlas require TCP on port 17777 to

either the SolarWinds NPM or the SolarWinds EOC server.

Network Atlas Requirements

The following table provides the minimum requirements for a Network Atlas
installation:
Note: To take full advantage of Network Atlas features, users of Network Atlas
must either have node management rights in SolarWinds SAM or be assigned the
administrator role in SolarWinds EOC.
Server
Requirements
Component

980

Chapter 28: Network Atlas

Operating
System

Microsoft Windows XP, Windows Vista, Windows 7, Windows

Server 2003, or Windows Server 2008 R2.

Memory

1 GB

Hard Drive
Space

150 MB

Ports

Remote instances of Network Atlas require TCP on port 17777 to

either the SolarWinds NPM or the SolarWinds EOC server.

Creating a Basic Map

Creating a map can be as easy as selecting a background image, dragging
network resources onto the drawing area, and connecting the objects with lines.
This section provides procedures to accomplish the following tasks:
l
l
l
l
l
l
l
l
l

Starting Network Atlas

Adding Map Objects
Connecting Map Objects Manually
Using Object Links to Represent Interface Status
Interpreting Map Links
Using Anchor Points to Reshape Map Links
Adding a Background
Saving Maps
Opening Maps

Starting Network Atlas

The following procedure launches Network Atlas:
Note: To take full advantage of Network Atlas' features, users of Network Atlas
must either have node management rights in Network Atlas or be assigned the
administrator role in SolarWinds EOC.
To start Network Atlas:
1. Log on to the computer hosting your Network Atlas installation.
2. Click Start> SolarWinds> Network Atlas.
3. Connect to your SolarWinds server, as directed in the following procedure:
a. Provide your SolarWinds Login and Password.
Note: Your SolarWinds Login and Password correspond to your

981

Adding Map Objects

b.
c.
d.
e.

SolarWinds Web Console User Name and Password.

Provide your SolarWinds server IP address or hostname in the
Address field.
If you are connecting to an Network Atlas server, select Orion as
the Connect to target.
If you are connecting to a SolarWinds EOC server, select EOC as
the Connect to target.
Click Connect.

Adding Map Objects

Any objects monitored by SolarWinds SAM may be added to a Network Atlas
map.
The following procedure adds monitored network objects to your Network Atlas
map:
To add monitored objects to your map:
1. If you are creating a new map, click the Network Atlas button ( ), and
then click New Map.
2. If you are adding objects to an existing map, complete the following
steps:
a. Click the Network Atlas button ( ).
b. Click Open Map.
c. Navigate to your existing map, and then click Open.
3. Expand and navigate the node tree in the left pane to locate the network
nodes and monitored objects you want to add to your map.
Note: All monitored applications, application components, and volumes
associated with monitored nodes, in addition to other maps listed in the left
pane, are available as map objects. Click [+] to expand any listed node
and object types and view associated volumes and/or applications.
4. Drag selected objects onto the drawing area.
Notes:
l If you want to add all the objects of a selected type on a selected
node to your map in a single operation, click [+] next to the node
name to reveal all its associated monitored network objects, and then
drag all objects in the desired object group onto the drawing area.
l A checkmark (
) next to a node indicates you have already added it
to your map.
l To view details about a map object, hover over it with the mouse
pointer.

982

Chapter 28: Network Atlas

To locate a specific map object in your map, click its network resource in the left
pane. This selects the map object.

Connecting Map Objects Manually

You can represent network links in your map by drawing lines between map
objects. If a connected object is down, any connected links change color to red.
To manually connect map objects:
1.
2.
3.
4.
5.
6.

Click Home.
Click Straight ( ) or Curved Line ( ) in the Lines group, as appropriate.
Click an object with the line drawing tool to begin drawing the link
Click and drag as needed to set optional anchor points along the link path.
Click a second object to finish drawing the link.
If you want the links connecting your mapped objects to communicate the status of connected interfaces, complete the following
steps:
a. Right-click a link, and then select Properties.
b. Select Status in the left pane of the Link Properties page.
c. Drag the appropriate interface objects from the left pane of the
SolarWinds Network window to the link status assignment areas.

Using Object Links to Represent Interface Status

The following procedure configures an object link to represent the status of its
connected interfaces:
To use object links to represent actual interface states:
1. Right-click a link, and then select Properties.
2. Select Status in the left pane of the Link Properties page.
3. Drag the appropriate interface objects from the left pane of the SolarWinds
Network window to the link status assignment areas.

Interpreting Map Links

Links created on maps are not merely connectors between network objects. Map
links display the states of the applications through which your linked objects are
connected. Node states are determined from SolarWinds SAM polling data.

983

Using Anchor Points to Reshape Map Links

Using Anchor Points to Reshape Map Links

You can use anchor points to change the shape of object links on your map, as
shown in the following procedure:
Note: Use multiple anchor points to create more complex shapes and curves.
To use object link anchor points:
1. Click Select in the Tools group or click the middle mouse button.
2. Click and drag the link you want to reshape.

Adding a Background
You can select colors, textures, and locally-hosted or Internet-hosted images to
serve as your map backgrounds:
l
l
l
l

Selecting a Background Color

Selecting a Background Texture
Selecting a Background Image
Clearing the Background

Selecting a Background Color

Network Atlas supports 24-bit color backgrounds.
To set a map background color:
1. Click Home.
2. Click Background > Background Color ( ).
3. Select a color from the palette, or click More Colors to select a custom
color.
Selecting a Background Texture
Network Atlas also provides numerous colored textures that can serve as map
backgrounds.
To set a map background textures:
1. Click Home.
2. Click Background > Background Texture ( ).
3. Enter appropriate values for the Width and Height of your map in the Map
Size in Pixels area.

984

Chapter 28: Network Atlas

Note: The default values are the smallest area bounding the existing map
objects and labels.
4. Select a texture to apply as your map background, and then click OK.
Selecting a Background Image
Network Atlas allows you to use images as your map background. The source of
the background image can be a graphics file on your hard drive or a URL link to a
graphics file on the Internet in any of the following graphics formats:
l
l
l
l
l

Graphics Interchange Format (.gif, non-animated)

Tagged Image File Format (.tiff)
Joint Photographic Experts Group (.jpg)
Microsoft Windows Bitmap (.bmp)
Portable Network Graphics (.png)

Linked backgrounds are updated when the map is accessed or when the browser
page is refreshed. In a typical use case, a linked background is used to provide
weather data from an Internet weather service on a network map.
Notes:
l Files used for linked backgrounds must be continuously accessible by
URL reference.
l Files used for static backgrounds must be available within the local file system.
l Background images you supply display at their full size in the SolarWinds
Web Console, so consider their dimensions. You may rescale images
within the application, but images displayed at full scale provide optimal
quality.
l In determining map size and resolution, consider web page layouts and
potential display screen resolutions.
l Example background images are in the NetworkAtlas Backgrounds folder located in your default shared documents folder. Clicking Background
Image always starts you in this background images folder.
To select a background image:
1. Click Home.
2. If you want to use a background image from disk, click Background >
Background Image ( ), and then navigate to the image you want to use.
3. If you want to use a background image from the Internet, complete the
following steps:

985

Clearing the Background

Note: In the web console, map background images linked from the Internet are
refreshed with the SolarWinds Web Console refresh.
If the SolarWinds SAM server is behind a web proxy, the proxy settings entered
into Microsoft Internet Explorer are used to create the Internet connection. If the
web proxy requires authentication, you cannot link directly to the background
image. A workaround is to write a script that periodically downloads the Internet
image and saves it to a folder on the web server. You can then specify the saved
image as the linked background image.
a.
b.
c.
d.

Click Background > Linked Background (

Type the URL of the image you want to use.
Click Validate.
Click OK.

).

Clearing the Background

To clear the current map background, click Home, and then click Background >
Clear Background ( ).

Saving Maps
Network Atlas saves your maps directly to the server to which you are connected.
Note: To save a map to your hard drive instead of your SolarWinds server, click
> Export> Export Map.
To save a map:
1. Click the Network Atlas button ( ), and then click Save.
2. If you are saving the map for the first time, name the map, and then click
OK.
3. If you want to save your map to your hard drive, complete the following
steps:
a. Click > Export> Export Map.
b. Navigate to an appropriate location on your hard drive.
c. Provide a File name, and then click Save.

Opening Maps
Maps are loaded from the SolarWinds server to which you are connected. They
appear in the left pane of the Network Atlas window.

986

Chapter 28: Network Atlas

To open a map:
1. Click [+] to expand the Maps group in the left pane of the Network Atlas
window.
2. Double-click the map you want to open.

Displaying Maps in the Web Console

You can display saved maps in the SolarWinds web console Network Map
resource. The procedure for selecting Network Maps is different between
SolarWinds EOC and Network Atlas, and maps created for one are not
compatible with the other. Select either of the following procedures, as
appropriate:
l
l
l

Map Resources in the Network Atlas Web Console

Displaying Maps in the SolarWinds Web Console
Displaying Maps in the SolarWinds EOC Web Console

Map Resources in the Network Atlas Web Console

The following map-related resources are available in the SolarWinds SAM Web
Console:
Network Map
The Network Map resource displays a selected map within the SolarWinds
Web Console. Objects on the map a user is not permitted to see are hidden
from the user, as are any connections to those objects. For more information
about including Network Atlas maps in the SolarWinds Web Console, see
Displaying Maps in the Web Console.
All Maps
This resource provides a list of all available network maps. Clicking any
map name opens a view containing the selected map with a list of the
objects included in the map. Clicking an object name or its description
opens the corresponding SolarWinds SAM device details page, providing
extensive diagnostic information about the selected map object.
Custom List of All Maps
This resource is a customizable version of the All Maps resource.
List of Objects on Network Map

987

Displaying Maps in the SolarWinds Web Console

This resource lists all objects displayed on the map shown in the Network
Map resource. Clicking an object name or its description opens the
corresponding SolarWinds SAM Device Details page, providing extensive
diagnostic information about the selected map object.

Displaying Maps in the SolarWinds Web Console

The following procedure opens a saved map in the SolarWinds Web Console:
To display a saved map in the Home view of the SolarWinds Web Console:
1. Log on to the SolarWinds Web Console using an account with administrative privileges..
2. Click Edit in the Network Map resource.
3. Select your map from the Select Network Map list.
4. Click Submit.

Displaying Maps in the SolarWinds EOC Web Console

The following procedure opens a saved map in the SolarWinds EOC Web
Console:
To display a saved map in the Home view of the SolarWinds EOC web console:
1. Log on to the SolarWinds EOC web console with an Administrator
account.
2. Click Settings.
3. Click Manage Views.
4. Select Home, and then click Edit View.
5. Click Resource.
6. Click Network Map in the Added list.
7. Select your map from the Select Network Map list, and then click Save.
8. Click OK, Save Changes.
9. If prompted to confirm your changes, click OK.
10. Click the Home view to see your map.

Advanced Mapping Techniques

You can apply a number of advanced mapping techniques to enhance the
usefulness of your maps. This section discusses the following topics:

988

Chapter 28: Network Atlas

l
l
l
l
l
l
l
l
l

Zooming In and Out of a Map

Creating Nested Maps
Displaying Map Object Metrics
Adding Independent Map Objects and Floating Labels
Changing the Appearance of Map Objects
Changing the Appearance of Links
Changing the Appearance of Labels
Linking Map Objects to URLs
Linking or Embedding Maps in Web Pages

Zooming In and Out of a Map

Network Atlas allows you to zoom into a map to enlarge details or to zoom out to
reduce its size. Zoom level is a visual aid, and it is not saved with the map. Use
any of the following methods to zoom in or out on a displayed map:
l
l

Press and hold CTRL while rotating the mouse wheel button.
Click the Zoom slider on the status bar, and then slide the zoom control to the
zoom level you want

Click View, and then select the type of zoom you want to use from the Zoom
group.

Creating Nested Maps

Nested maps allow you to navigate through a map to see multiple levels of detail.
For example, a map of the United States can include an icon for a child map of
Oklahoma. You can then click the Oklahoma object to open the child map.

989

To create a nested map:

The map of Oklahoma can then become a parent map to a network diagram.

Each child map can include a view of the objects, either devices or other maps,
deployed on it. Any nested objects can then be clicked to view the next level of
map detail, until the level of the final network device is reached and all available
network information is displayed.
Note: The total number of objects on a map, including those displayed on child
maps, affects how fast the map loads in the SolarWinds Web Console. If your
maps load slowly, decrease the number of map objects.
To create a nested map:
1. Drag a map from the Maps group in the left pane onto the parent map, and
then position the map icon appropriately.
2. If you want the status of a child map to also indicate the status of its
child objects, complete the following steps:
a. Right-click the child map icon on the map, and then select Properties.
b. Check Include child status on the Status properties page, and then
click OK. The object status icon now includes the secondary status
indicator.

990

Chapter 28: Network Atlas

Displaying Map Object Metrics

The status of a map object icon reflects its current state, such as up or down. You
can add a secondary status indicator to a map object to reflect metrics such as
response time, CPU load, or the state of any child objects. This secondary status
indicator appears at the bottom right corner of the status icon.
To add the secondary status indicator:
1. Right-click the map object, and then select Properties.
2. Check Include child status on the Status properties page, and then click
OK.
To change the thresholds of the metrics:
1. Right-click the map object, and then select Properties.
2. Click Metrics to view the Metrics properties page.
3. If you want to change the warning or critical threshold for a metric,
click the threshold value, and then type a new value.
4. If you want to ignore a metric, uncheck the metric.
5. Click OK.
Notes:
l The secondary status indicator respects the SolarWinds web console
Status Rollup Mode setting for displaying status.
l All child objects and selected metric thresholds are taken into account
to determine secondary status.

Adding Independent Map Objects and Floating

Labels
You can add independent map objects and labels that do not have associations
to network nodes or resources.
To add an independent object:
1. Click Home.
2. Click Add Object in the Objects group to add a gray map object to the
map.
Independent labels may also be placed anywhere on your map.

991

To add an independent label:

To add an independent label:
1. Click Home.
2. Click Add Label in the Labels group. A label is added to the map.

Changing the Appearance of Map Objects

Changing the graphics that represent map objects is an excellent way of
increasing the information density of your map without increasing the map
complexity.
You can set the default representation style for all map object of a certain type, or
you can change the appearance of selected map objects.
To set the default representations of map objects:
1. Click the Network Atlas button , and then click Network Atlas Settings.
2. Click Graphic Styles in the left column.
3. Select an appropriate default style for each available map object.
Changing the representation of selected map objects opens up another level of
graphical information. For example, you can set an object icon to display a
mainframe graphic, visually designating the type of device being monitored. You
can then select a status style, such as 3D Pad Underneath, to illustrate the map
object status.
To change the representation of selected map objects:
1. Right-click a map object, and then select Properties.
2. Click Appearance in the left column of the Properties page.
3. If you want the map object to appear as a fixed-size, LED-type
graphic, complete these steps:
a. Select SolarWinds LED Status Icon.
b. Select a style from the SolarWinds LED Status Icon Style list, and then
click OK.
4. If you want the map object to appear as a scalable shape, complete
these steps:
a. Select Shape
b. Select a style from the Shape Style list, and then click OK.
c. Drag a corner handle on the map object to resize the shape.
5. If you want the map object to appear as a scalable graphic, complete
these steps.
a. Select Graphic.
b. Click Select Graphic, select an appropriate graphic, and then click OK.

992

Chapter 28: Network Atlas

c. Select a status style from the Graphic Style list, and then click OK.
d. Drag a corner handle on the map object to resize the graphic.

Pasting Custom Icons from the Windows Clipboard

You can paste graphics from the Windows clipboard directly into your Network
Atlas maps and then display an overlay behind them to depict the status.
Icons that you paste into Network Atlas are saved to the SolarWinds database,
and made available for reuse in other maps under the "Imported" icon grouping.
Pasted icons saved to the SolarWinds database can be accessed and used by
remote instances of Network Atlas.
To paste a custom icon into Network Atlas:
1.
2.
3.
4.

Open the icon image in a graphics program such as Visio or Photoshop.

Copy the image to the Windows clipboard with the Copy command.
Open the desired map in Network Atlas.
Paste the image as a new object following these steps:
a. Right-click on the map and then click Paste.
b. Select Paste the image from the Clipboard as a new object.
c. Enter a name for the this new image in the Please enter a name for
the new image field.
d. Click OK.

Icons added in this manner are also saved on the SolarWinds SAM server in the
path %APPDATA%\SolarWinds\NetworkAtlas\Maps\Orion\<orion server
address>\NetObjects\Imported. %APPDATA% is typically C:\Documents and
Settings\<logged on user>\Application Data for Windows XP, and C:\Users\<logged on
user>\AppData\Roaming for Windows Server 2008.
To delete a custom icon:
1. Determine which file on the SolarWinds SAM server contains the icon (for
example, [Link]).
2. Add .del to the file name (for example, [Link])
3. Start Network Atlas on the SolarWinds SAM server to delete the icons from
the database.

993

Adding Custom Icons from Graphics Files

Adding Custom Icons from Graphics Files

You can use any Windows Media File (.wmf) or Graphics Interchange Format (.gif)
format graphic as a custom icon, but you must name the graphic files according to
their roles. The file name must not contain any other dash (-) characters other than
depicted in this table.
Role

File name

Down status

[Link]

External status

[Link]

Icon with no status

[Link]

Unknown status

[Link]

Unmanaged status

[Link]

Unplugged status

[Link]

Unreachable status [Link]

Up status

[Link]

Warning status

[Link]

To add custom icons from graphics files:

1. On your SolarWinds SAM server, create the folder:
%APPDATA%
\SolarWinds\NetworkAtlas\Maps\Orion\<orionserveraddress>\NetObjects\User
Graphics.

%APPDATA% is typically C:\Documents and Settings\<logged on user>\Application Data for Windows XP, and C:\Users\<logged on user>\AppData\Roaming for Windows Server 2008.
2. Copy the graphics files to this folder.
3. Start Network Atlas on the SolarWinds SAM server to finalize the additional icons.
After copying the graphics files to their location, you can assign them as an icon
as you would any other graphic image.

994

Chapter 28: Network Atlas

To assign a custom icon to an object:
1. Right-click the object on the map, and then click Select Graphic.
2. Select User Graphics in the left pane.
3. Select your desired graphic image, and then click OK.

Changing the Appearance of Links

Network Atlas allows you to change the appearance of network links by
customizing their width, color, and line styles.
To change the appearance of a link:
1.
2.
3.
4.
5.
6.

Right-click a link, and then select Properties.

Select Appearance in the left column of the Properties page.
Select a line width in pixels from the Width list.
Select a line color from the Color list.
Select a line style from the Style list.
Click OK.
Note: The color setting only changes the color of links that have Up status.

Changing the Appearance of Labels

Network Atlas allows you to change the appearance of labels by changing text
attributes, borders, and background colors.
To move a label:
1. Drag the label to the desired location.
To edit the text in a label:
2. Double-click the label.
3. Press SHIFT+ENTER to separate multiple lines within the same label.
To change the appearance of a label:
1. Right-click the label, and then select Properties.
2. Select Appearance in the left column of the Properties page.
3. If you want to change the font attributes, click the button, select
appropriate font attributes, then click OK.
4. If you want to change the text alignment, select an alignment from the
Text Alignment list.

995

Linking Map Objects to URLs

5. If you want to change the text color, click the Text Color color box, and
then select a new color.
6. If you want to add a label border, select the border width in pixels from
the Border Width list.
7. If you want to change the label border color, click the Border Color
color box, and then select a new color.
8. If you want to remove a label border, select 0 from the Border Width list.
9. If you want to add a label background, uncheck Transparent Background.
10. If you want to change the label background color, click the Background Color box, and then select a new color.
11. If you want to remove a label background, check Transparent Background.
12. Click OK.

Linking Map Objects to URLs

Network Atlas allows users to click on map objects in the SolarWinds web
console to see more details. By default, map objects are linked to the most
relevant SolarWinds details page for the object. You can customize the URL
hyperlink to link to external web sites and pages as necessary.
To link a map object to a URL.
1. Right-click the map object, and then select Edit Hyperlink.
2. If you want to link to the relevant SolarWinds page for the map object,
select Logical page in SolarWinds.
3. If you want to link to a custom URL, select Manually set address, and
then type the URL.
4. Click OK.

Linking or Embedding Maps in Web Pages

You can link or embed your maps in other web pages by referencing the URL for
the map. The map URL is in the form:
[Link]

orionServer
This is the IP address or host name of your SolarWinds SAM server.
mapName

996

Chapter 28: Network Atlas

This is the display name of the map. If the map display name contains
space characters, substitute %20 for the spaces when specifying the name.

Customizing SolarWinds Web Console Tooltips

In the web console, hovering over map objects displays a tooltip providing current
identification and status information about the object. Tooltips are customizable
for all map object types, and you can customize the tooltips in the SolarWinds
SAM web console to display additional information by inserting SolarWinds alert
variables, custom properties, and other text.
Notes:
l Tooltip customizations are global and affect all maps.
l SolarWinds EOC does not support custom web console tooltips.
l For a complete list of variables available for use in Network Atlas tooltips, see,
"Network Atlas Tooltip Variables."
Use ${CR} to enter a carriage return.
To add additional information to map object tool tips:
1.
2.
3.
4.

Log on to SolarWinds SAM as an administrator.

Click Edit in the Network Map resource.
Click Customize map tooltips.
Type the variables and any text you want to add in the text field for the
appropriate map object type.
5. Click Submit.
Example Custom SolarWinds Node Tooltip
Enter this custom node tooltip definition in the [Link] field to display node
location and contact information:
[Link]: ${Location}${CR}Contact: ${Contact}

997

Advanced Map Layouts

For more information about available tooltip variables, see Network Atlas Tooltip
Variables."

Advanced Map Layouts

You can improve the visual layout and organization of your maps by using the
advanced layout tools to help you align and distribute your objects and links. This
section discusses the following topics:
l
l
l
l

Displaying Grid Guides

Aligning Map Objects
Distributing Map Objects
Selecting Automatic Layout Styles

Displaying Grid Guides

A grid guide helps you maintain structural and spatial relationships as you
arrange your map objects. Network Atlas allows you to select two kinds of grids
and to change the grid spacing.
Grids are not map objects, and are neither saved with a map nor displayed in the
SolarWinds Web Console.
To display a grid:
1. Click View.
2. Click Show Grid

in the Grid group.

To customize the grid:

1.
2.
3.
4.

Click View.
If you want grid lines, click Grid Option > Grid Lines.
If you want grid points, click Grid Options >Grid Points.
If you want to change the grid size, click Grid Options > Grid Size, and
then select a grid size.

Aligning Map Objects

You can change the relative alignment of your map objects using the alignment
tools.
1. Click Edit.
2. Select the map objects you want to align.

998

Chapter 28: Network Atlas

3. Click the appropriate button in the Align group to arrange your selected
objects
Button Function

Description

Align Left

Aligns all selected objects on the left edge of

the group

Align Right

Aligns all selected objects on the right edge

of the group

Align Bottom

Aligns all selected objects on the bottom

edge of the group

Align Top

Aligns all selected objects on the top edge of

the group

Center
Vertically

Centers all selected objects vertically

Center
Horizontally

Centers all selected objects horizontally

Distributing Map Objects

You can distribute your map objects evenly across the selection area using the
distribution tools.
1. Click Edit.
2. Select the map objects you want to distribute.
3. Click the appropriate button in the Distribute group to arrange your selected objects
Button Function

Description

Distribute
Distributes all objects so that they are
Horizontally equidistant from the left edge of the leftmost
object to the right edge of the rightmost object
Distribute
Vertically

Distributes all objects so that they are

equidistant from the top edge of the topmost
object to the bottom edge of the bottommost
object

999

Selecting Automatic Layout Styles

Selecting Automatic Layout Styles

You can select from the following five styles to automatically change the relative
positioning of objects your map:
Circular
Emphasizes the clusters inherent in the topology of a map. It emphasizes
prominent links between main objects and its peripherals. Object groups
have radial placements. Use circular layouts for maps containing ring and
star network topologies.
Symmetrical
Emphasizes the symmetrical patterns inherent in the map topology. It
emphasizes an even distribution of objects, and minimizes edge crossings.
Object groups have star spiral placements. Use symmetrical layouts for
maps that have fairly homogenous or uniform clusters.
Hierarchical
Emphasizes mapped dependency relationships by placing objects at
different levels. Use hierarchical layouts to depict data dependencies.
Orthogonal
Emphasizes compact drawings and uses only horizontal and vertical edges.
Objects are enlarged if necessary to provide enough space for edge
connections. Use orthogonal layouts for maps that need to depict multiple
clusters in a space-efficient manner.
Tree
Emphasizes parent and child relationships. Child objects are arranged
farther from the root object than their parent objects. Use tree layouts for
maps that have a central control object.
Reorganize
Moves all mapped objects back to the center of the map view.
Arrange Labels
Restores the default relative position of all object labels.

1000

Chapter 28: Network Atlas

To arrange map objects according to a layout style:
1. Click Edit.
2. Click an appropriate layout style from the AutoArrange group.

Map Properties
The Map Properties window allows you to configure options regarding the
following aspects of your map:
l
l

Setting the Map Up Status Threshold

Overriding Account Limitations

Setting the Map Up Status Threshold

The UP status threshold is the percentage of map objects that must be in an up
state on a given map for the map to be represented as up on the parent map.
To set the percentage of map objects that determine Up status of a map:
1. Right-click any empty portion of the map, and then select Map Properties.
2. Slide the Map status will be UP slider to configure an appropriate up state
threshold on the Map Properties page.
Overriding Account Limitations
For security reasons, you may wish to prevent web console users who have
account limitations from seeing network nodes on the map they are not allowed to
see. By hiding the restricted nodes and links, users with account limitations
remain unaware that the nodes even exist.
To hide nodes from users who have account limitations:
1. Right-click any empty portion of the map, and then select Map Properties.
2. Select Remove nodes that users do not have permission to view.
If you choose to reveal restricted nodes to all users, all web console users can
see the restricted nodes, but users with account limitations cannot retrieve any
additional information about the restricted node.
To reveal nodes to all users:
1. Right-click any empty portion of the map, and then select Map Properties.
2. Select Allow all users to view all nodes on this map.
Note: A SolarWinds SAM user with account limitations, but who has

1001

Network Atlas Settings

permission to run and use the Network Atlas application, can change this
setting in the map and see the presence of restricted nodes. Although the
user cannot retrieve any information regarding the restricted nodes, this
can still be considered a security risk. If this is a concern, do not give node
management permissions to SolarWinds SAM users who have account limitations.

Network Atlas Settings

You can customize the default icon styles, map defaults, and node tree
specifications from the Network Atlas Settings window.
To open the Network Atlas Settings window, click the Network Atlas button ( ),
and then click Network Atlas Settings.
The following sections describe the options available in the Network Atlas
Settings window:
Connection Settings
The options in this section allow you to select the default SolarWinds server
details.
Map Defaults
The options in this section allow you to set a device threshold for the overall
map status. The status indicator reflects the state of many objects at once;
therefore, SolarWinds recommends that the map status be set at 100%. At
this setting, when any device on a map or sub-map is down, the problem
status will be indicated.
Node Tree
The options in this section allow you to customize the view of the node tree
located on the left pane of the Network Atlas main window. Some users find
it helpful to display the status icons of each node and interface, while others
find the vendor network node and interface icons more useful. You may also
specify that node names and/or IP addresses be included in the display.
Graphic Styles
The options in this section allow you to select the default graphical styles
for Network Atlas. You can change the default style types for network
objects, and you can select a color scheme for Network Atlas itself.

1002

Chapter 28: Network Atlas

Network Atlas Tooltip Variables

Many of the variables that are available for use in SolarWinds SAM alerts are also
available for use in Network Atlas tooltips. These variables are dynamic, and they
parse when the tooltip is opened. For example, the variable ${CPULoad} will parse
with the current processor utilization of the node you are viewing. The following
sections provide tables of variables corresponding to the types of objects you can
map with Network Atlas.
Notes:
l For more information about viewing and customizing Network Atlas tooltips,
see Customizing SolarWinds Web Console Tooltips.
l In some cases, the table name may be required for alert variables, as in
${[Link]}. The following tables provide the table name in listed variables when it is required.
In earlier versions of Network Atlas, variables were referred to as macros.

Application Variables
The following application variables are valid for use in Network Atlas tooltips:
Variable

Description

${ApplicationID}

Internal unique identifier of the application

${ApplicationTemplateID Internal unique identifier of the parent

}
template
${Name}

Application name

${NodeID}

Internal unique identifier of assigned node

${Status}

Numerical application status code. For more

information see Status Icons and
Identifiers in the SolarWinds Network
Performance Monitor Administrator Guide.

1003

Application Component Monitor Variables

${StatusDescription}

User friendly application status

${UnManaged}

States if application is currently unmanaged

Application Component Monitor Variables

The following application component monitor variables are valid for use in
Network Atlas tooltips:
Variable

Description

${ApplicationId}

Internal unique identifier of the associated

application

${ComponentId}

Internal unique identifier of the component

${ComponentType}

Numerical component monitor type code. For

more information, see Alerting and Reporting"
on page 722.

${Name}

Component monitor name

${Status}

Numerical application status code. For more

information see Status Icons and Identifiers in
the SolarWinds Network Performance Monitor
Administrator Guide.

${StatusDescription} User friendly application status

${TemplateID}

Internal unique identifier of the parent template

Date and Time Variables

The following date and time variables are valid for Network Atlas tooltips:
Variable

Description

${AbreviatedDOW}

Abbreviated current day of the week.

${AMPM}

AM/PM indicator

1004

Chapter 28: Network Atlas

${D}

Current day of the month

${Date}

Current date. (Short Date format)

${DateTime}

Current date and time. (Windows control panel

defined Short Date and Short Time format)

${DayOfWeek}

Current day of the week.

${ DayOfYear}

Numeric day of the year

${DD}

Current day of the month (two digit number, zero

padded)

${H}

Current hour

${HH}

Current hour. Two digit format, zero padded.

${Last24Hours}

Time period: the last 24 hours

${Last2Hours}

Time period: the last 2 hours

${Last7Days}

Time period: the last 7 days

${LastHour}

Time period: the last hour

${LocalDOW}

Current day of the week. Localized language format.

${LocalMonthName} Current month name in the local language.

${LongDate}

Current date. (Long Date format)

${M}

Current numeric month

${MediumDate}

Current date. (Medium Date format)

${Minute}

Current minute. Two digit format, zero padded.

${MM}

Current month. Two digit number, zero padded.

${MMM}

Current month. Three character abbreviation.

${MMMM}

Full name of the current month

1005

General Variables

${S}

Current second.

${Second}

Current second. Two digit format, zero padded.

${Time}

Current Time. (Short Time format)

${Today}

Time period: today

${Year}

Four digit year

${Year2}

Two digit year

${Yesterday}

Time period: yesterday

General Variables
The following general variables are valid for use in Network Atlas tooltips:
Variable

Description

${Acknowledged}

Acknowledged status

${AcknowledgedBy}

Who the alert was acknowledged by

${AcknowledgedTime}

Time the alert was acknowledged

${AlertTriggerCount} Count of triggers

${AlertTriggerTime}

Date and time of the last event for this Alert.

(Windows control panel defined Short Date and
Short Time)

${Application}

SolarWinds application information

${Copyright}

Copyright information

${CR}

Line Feed Carriage Return

${ObjectName}

Description/Name of the object in the alert

${Release}

Release information

${Version}

Version of the SolarWinds software package

1006

Chapter 28: Network Atlas

Node Variables
The following node variables are valid for use in tooltips:
Variable

Description

${AgentPort}

Node SNMP port

number

${Allow64BitCounters}

Node allows 64-bit

counters (1), or not
(0)

${AvgResponseTime}

Average node
response time , in
msec, to ICMP
requests

${BlockUntil}

Day, date, and time

until which node
polling is blocked

${Caption}

User friendly node

name

${Community}

Node community
string

${CPULoad}

Node CPU
utilization rate at
last poll

${CustomPollerLastStatisticsPoll}

Day, date, and time

of last poll attempt
on node

${CustomPollerLastStatisticsPollSuccess} Day, date, and time

that node was last
successfully polled
Current date and

${DateTime}

1007

Node Variables

time. (Windows
control panel
defined Long Date
and Long Time
format)
${Description}

Node hardware and

software

${DNS}

Fully qualified node

name

${DynamicIP}

If node supports
dynamic IP address
assignment via
BOOTP or DHCP
(1); static IP
address return (0)

${EngineID}

Internal unique
identifier of the
polling engine to
which node is
assigned

${External}

States if node is
currently
designated as
external

${GroupStatus}

Filename of status
icon for node and its
interfaces

${IOSImage}

Family name of
Cisco IOS on node

${IOSVersion}

Cisco IOS version

on node

1008

Chapter 28: Network Atlas

${IP_Address}

Node IP address

${LastBoot}

Day, date and time

of last node boot

${LastSync}

Time and date of

last node database
and memory
synchronization

${MachineType}

Node manufacturer
or distributor and
family or version
information

${MaxResponseTime}

Maximum node
response time , in
msec, to ICMP
requests

${MemoryUsed}

Total node memory

used over polling
interval

${MinResponseTime}

Minimum node
response time , in
msec, to ICMP
requests

${NextPoll}

Day, date and time

of next scheduled
node polling

${NextRediscovery}

Time of next node

rediscovery

${NodeID}

Internal unique
identifier of node

${NodeName}

Node hostname.

1009

Node Variables

Defaults to node IP
address ${IP_
Address} if hostname
does not resolve.
${ObjectSubType}

States if node
supports SNMP or
is ICMP-only

${PercentLoss}

ICMP packet loss

percentage when
node last polled

${PercentMemoryUsed}

Percentage of total
node memory used
over polling interval

${PollInterval}

Node polling
interval, in seconds

${RediscoveryInterval}

Node rediscovery
interval, in minutes

${ResponseTime}

Node response
time, in
milliseconds, to last
ICMP request

${RWCommunity}

Node read/write
community string;
acts as security
code for read/write
SNMP access

${Severity}

A network health
score providing 1
point for an
interface in a
warning state, 1000
points for a down

1010

Chapter 28: Network Atlas

interface, and 1
million points for a
down node.
${SNMPVersion}

States the version

of SNMP used by
the node

${StatCollection}

Statistics collection
frequency, in
minutes

${Status}

Numerical node
status. For more
information see
Status Icons and
Identifiers in the
SolarWinds
Network
Performance
Monitor
Administrator
Guide.

${StatusDescription}

User friendly node

status

${StatusLED}

Filename of node
status icon

${SysName}

String reply to
SNMP SYS_NAME
OID request

${SysObjectID}

Vendor ID of the
network
management
subsystem in OID
form. Clearly

1011

Volume Variables

determines the type

of node.
${SystemUpTime}

Time, in hundredths
of a second, since
monitoring started

${TotalMemory}

Total node memory

available

${UnManaged}

States if node is
currently
unmanaged

${UnManageFrom}

Day, date, and time

when node is set to
Unmanaged

${UnManageUntil}

Day, date, and time

when node is
scheduled to be
managed

${Vendor}

Node manufacturer
or distributor

${VendorIcon}

Filename of node
vendor logo icon

Volume Variables
The following volume variables are valid for use in Network Atlas tooltips.
Variable

Description

${Caption}

User friendly volume name

${FullName}

User friendly volume name

including captions of
parent node and interface

1012

Chapter 28: Network Atlas

${LastSync}

Time and date volume last

synchronized in database
and memory models

${NodeID}

Internal unique identifier of

parent node

${Status}

Numerical volume status:

(0=Unknown, 1=Up,
2=Shutdown,
3=Testing)

${StatusLED}

Filename of volume status

icon

${VolumeAllocationFailuresThisHour} Number of volume

allocation errors for this
volume in last hour
${VolumeAllocationFailuresToday}

Number of volume
allocation errors for this
volume in current day

${VolumeDescription}

User friendly volume

description

${VolumeID}

Internal unique identifier of

volume

${VolumeIndex}

Unique index of volume

within the parent node

${VolumePercentUsed}

Percentage of volume
currently in use

${VolumeResponding}

(Y) = volume is currently

responding to SNMP
queries

${VolumeSize}

Size of volume, in bytes

1013

Wireless Variables

${VolumeSpaceAvailable}

Total space available on

volume, in bytes

${VolumeSpaceUsed}

Total space used on

volume, in bytes

${VolumeType}

Volume type, as reported

by hrStorageType OID
(Removable Disk/Fixed
Disk/Compact Disc/Virtual
Memory/RAM/etc)

${VolumeTypeIcon}

Filename of icon for

volume type

Wireless Variables
The following wireless variables are valid for use in Network Atlas tooltips:
Variable

Description

${WirelessAP}

States if node is being polled by the wireless

poller (1) or not (0)

${
Date and time node last polled by wireless
WirelessLastStatPoll } poller
${
Interval, in minutes, between wireless polling
WirelessPollInterval } attempts on node
${
Date and time node may be polled again by
WirelessStatBlockUntil wireless poller
}

Group Variables
The following group variables are valid for use in Network Atlas tooltips:
Variable

Description

1014

Chapter 28: Network Atlas

${ContainerID}

Designated identifier for a mapped group

${DetailsURL}

URL of the Group Details view for a mapped group

${Frequency}

Interval on which group membership is evaluated

and group snapshots are taken.

${IsDeleted}

When a group is marked for deletion, it is not

deleted immediately. If a group is marked for
deletion but not yet deleted, ${IsDeleted} returns 1.

${LastChanged}

The date and time of the last change made to the

definition of a group. This does not include
changes made to group members resulting from
dynamic queries.

${Name}

The name assigned to the mapped group

${Owner}

SolarWinds product appropriate to the mapped

group type

${RollupType}

Name of roll-up logic calculator that evaluates

status of the mapped group based on member
statuses. 0 = Mixed, 1 = Worst, 2 = Best. The Worst
method reports group status as the worst status of
any of its members. The Mixed method reports
group status as Warning when members are of
multiple different statuses. The Best method
reports group status as the best status of any of its
members.

${Status}

Status of the mapped group. For more information,

see Managing the Display of Group Status in the
SolarWinds Common Components Administrator
Guide.

${StatusCollector} Name of roll-up logic calculator that evaluates

status of the mapped group based on member
statuses. 0 = Mixed, 1 = Worst, 2 = Best. The Worst
method reports group status as the worst status of

1015

Group Variables

any of its members. The Mixed method reports

group status as Warning when members are of
multiple different statuses. The Best method
reports group status as the best status of any of its
members.
${Uri}

Uri used by SolarWinds Information Service

(SWIS) to refer to the selected group member
within the web console.

${WebUri}

URL of the Group Details view for a mapped group

For a complete list of SAM specific variables, "Configuring SolarWinds SAM

Alerts" on page 723.

1016

Chapter 29:
Configuring Automatic Login
The SolarWinds SAM Web Console allows you to log in using any of the
following methods:
l
l

Windows Active Directory Authentication, available in all Orion products.

Windows Pass-through Security. If you choose to employ Windows Passthrough Security, SolarWinds SAM users can be authenticated through Windows Security, with no need to log in using a separate SolarWinds SAM
Account or User Name and Password. For more information, see Using
Windows Pass-through Security on page1017.
DirectLink. If a DirectLink account is activated, any URL referring directly to
an Orion Web Console page will bypass the Orion Web Console login page
by logging the user into the DirectLink account. For more information, see
Using the DirectLink Account on page1020.
URL Pass-through. For more information, see Passing Login Information
Using URL Parameters on page1019.

SolarWinds SAM prioritizes user login in the following manner:

1. Windows Active Directory Authentication is enabled. To enable Windows
Active Directory Authentication, check the Windows Authentication option
when configuring the Orion Web Console in the Configuration Wizard.
2. The Account or User ID and Password passed on the URL.
3. The Account or User ID and Password entered on the [Link] page.
4. The Windows User if IIS NT Security is enabled, logging the user in using
NT Security.
5. The Windows Domain to which the User belongs, for example, Development\Everyone.
6. The presence of a DirectLink Account.

Using Windows Pass-through Security

On all Orion products released before Orion NPM version 10.1, you may take
advantage of the Windows Pass-through Security functionality when IIS NT
Security is enabled. SolarWinds SAM users can be authenticated through

1017

Chapter 29: Configuring Automatic Login

Windows Security, with no need to log in using a separate SolarWinds SAM
account or User Id and Password. Pass-through Security can be configured to
employ either Domain or Local computer security. Both may also be used at the
same time. The Server & Application Monitor Account or User ID and Passwords
must then be set up to match the Account or User ID and Passwords that are used
for the Domain and/or Local computer security. Use the following procedure to
enable IIS NT Security for logging in to the SolarWinds Web Console with
Windows Pass-through Security.
Note: When authenticating users with Windows Security, ensure your
SolarWinds server uses the NetBIOS domain name, instead of the fully qualified
domain name.
To enable IIS NT security for Windows Pass-through Security:
1. If you are using NT Domain Authentication Format for pass-through
accounts, create these pass-through accounts in the SolarWinds Web Console Account Manager using Domain\UserID as the User Name, as follows:
Washington\Edward
StLouis\Bill

Note: For more information about creating accounts using the SolarWinds
Web Console Account Manager, see Creating Accounts on page298.
2. If you are using Local Computer Authentication Format for
passthrough accounts, create these accounts in the SolarWinds Web
Console Account Manager using Computer\UserID as the User Name, as
follows:
SolarWindsS2\Edward
Server3\JonesR

Note: For more information about creating accounts using the

SolarWinds Web Console Account Manager, see Creating
Accounts on page298.
3. Click Start> Control Panel> Administrative Tools> Internet Information Services (IIS) Manager.
4. If you are using Windows Server 2003, complete the following steps:
a. Expand Internet Information Services> Local Computer> Web Sites
in the left pane.
b. Select SolarWinds NetPerfMon.
c. Click Action> Properties.
d. Click the Directory Security tab.
e. Click Edit within the Authentication and access control area.

1018

Passing Login Information Using URL Parameters

f. Clear Enable anonymous access.
g. Check Integrated Windows authentication in the Authenticated
access group.
h. Click OK to close the Authentication Methods window.
i. Click Apply, if available, and then click OK to close the SolarWinds
NetPerfMon Properties window.
j. Collapse Internet Information Services> Local Computer> Web
Sites.
k. Collapse Internet Information Services> Local Computer in the left
pane.
l. Click Action> All Tasks> Restart IIS.
m. Confirm that Restart Internet Services on Local Computer is selected,
and then click OK.
n. Close the IIS Manager.
5. If you are using Windows Server 2008, complete the following steps:
a. Click Start> Administrative Tools> Server Manager.
b. Expand Roles.
c. Click Web Server (IIS).
d. In the Role Services area, confirm that Web Server> Security> Windows Authentication is installed.
e. If Windows Authentication is not installed, click Add Role Services,
check Web Server> Security> Windows Authentication, click Next,
and then complete the service installation.
f. Click Start> Administrative Tools> Internet Information Services
(IIS) Manager.
g. Select your SolarWinds server in the left pane.
h. Click Authentication in the IIS group of the main pane.
i. Right-click Anonymous Authentication, and then click Disable.
j. Right-click Windows Authentication, and then click Enable.
k. Click your SolarWinds server, and then click Restart in the Actions
pane.
6. Close the IIS Manager.
7. Log in to the SolarWinds Web Console using the Windows account credentials you have already established.

Passing Login Information Using URL Parameters

The user ID and password can be passed as parameters within the URL. This
allows you to create a favorite or bookmark within a browser, or on your desktop.
Create a favorite with a link in the following form to pass the login information:
[Link]

1019

Chapter 29: Configuring Automatic Login

Provide the hostname or IP address of your SolarWinds server as the DOMAIN.
Provide your SolarWinds User ID as the USER, and then provide your SolarWinds
user account password as the PASSWORD.
Warning: HTTP requests are not encrypted, so User IDs and Passwords sent in
HTTP requests are not secure. For more information about enabling HTTPS on
your SolarWinds server, consult [Link].

Using the DirectLink Account

Enabling a DirectLink account allows you to make direct hyperlinks to specific
web console views available to individuals who do not already have SolarWinds
Web Console user accounts. Any URL referring directly to a SolarWinds SAM
web page bypasses the login screen, logging the user into the DirectLink
account. The DirectLink account is created like any other account, and it can
include custom views and account limitations. For more information web console
accounts, see Creating Accounts on page298.
To enable a DirectLink account for the SolarWinds Web Console:
1. Log in to the SolarWinds Web Console as an administrator.
2. Click Settings in the top right of the web console, and then click Manage
Accounts in the Accounts grouping.
3. Click Add.
4. Type DirectLink as the new User Name.
5. Type a Password, confirm it, and then click Submit.
6. Edit DirectLink account options, as necessary, for your installation of
SolarWinds Network Performance Monitor. For more information about editing account options, see Editing User Accounts on page299.
7. Create a custom view to be used as the home page of the DirectLink
account. For more information, see Creating New Views on page205.
8. Specify the new DirectLink view as a default view in Account Manger. For
more information, see Editing User Accounts on page299.
9. If you would like to limit the DirectLink account to specific devices or
device types, see Setting Account Limitations on page303.

1020

Chapter 30:
Component Monitor Types
The available component monitors are as follows:
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l

"DHCP User Experience Monitor" on page1022

"Directory Size Monitor" on page1024
"DNS Monitor - TCP" on page1026
"DNS Monitor - UDP" on page1029
"DNS User Experience Monitor" on page1027
"Download Speed Monitor" on page1030
"Exchange Web Services User Experience Monitor" on page 1031.
"File Change Monitor" on page1038
"File Count Monitor" on page1035
"File Existence Monitor" on page1037
"File Size Monitor" on page1040
"FTP Monitor" on page1044
"FTP User Experience Monitor" on page1041
"HTTP Form Login Monitor" on page1045
"HTTP Monitor" on page1048
"HTTPS Monitor" on page1051
"IMAP4 Monitor" on page1055
"IMAP4 User Experience Monitor" on page1056
"JMX Monitor " on page 1058.
"LDAP User Experience Monitor" on page 1060.
"Linux/Unix Script Monitor" on page1062
"MAPI User Experience Monitor" on page1064
"Nagios Script Monitor" on page 1067.
"NNTP Monitor" on page 1069.
"ODBC User Experience Monitor" on page1070
"Oracle User Experience Monitor" on page1073
"Performance Counter Monitor" on page1078
"POP3 Monitor" on page1081
"POP3 User Experience Monitor" on page1082
"Process Monitor - SNMP" on page1084
"Process Monitor - WMI" on page1086
"RADIUS User Experience Monitor" on page1088

1021

Chapter 30: Component Monitor Types

l
l
l
l
l
l
l
l
l
l
l
l
l
l
l

"Service Status SNMP" on page1089

"SSL Certificate Expiration Date Monitor" on page 1099.
"SMTP Monitor" on page1090
"SNMP Monitor" on page1091
SOAP Component Monitor
"SQL Server User Experience Monitor" on page1096
"TACACS+ User Experience Monitor" on page1100
"TCP Port Monitor" on page1102
"Tomcat Server Monitor" on page1103
"VMware Performance Counter Monitor" on page1105
"Web Link Monitor" on page1109
"Windows Event Log Monitor" on page1111
"Windows PowerShell Monitor" on page1115
"Windows Script Monitor" on page 1118.
"WMI Monitor" on page 1122.

DHCP User Experience Monitor

This component monitor measures how long it takes to get a lease from a DHCP
server. The monitor verifies that the DHCP responds with an IP address, but
neither confirms nor accepts the lease.
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see "Configuring SolarWinds
SAM Alerts" on page 723.
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
UDP Request Port
The UDP port used for the DHCP request. The default value is 67.

1022

Field Descriptions:
UDP Response Port
The UDP port used for the DHCP response. The default value is 68.
Sender Adapter IP Address (optional)
For SolarWinds servers with multiple network adapters configuration, this
field specifies which of the multiple network adapters is used for the DHCP
User Experience monitor. If this setting is not specified, the default (primary)
network adapter is used.
Note: This setting does not affect SolarWinds servers with only one
network adapter.
DHCP Discovery Request Type
Select the DHCP Discovery Request Type:
Unicast This is the default DHCP Discovery Request Type. The
broadcast flag is not set, the ciaddr (Client IP Address) is set to the
local address, and the giaddr (Relay Agent IP Address) is not set. The
DHCP client sends a unicast DHCP DISCOVER to the DHCP server
IP address and the UDP Request Port (defaults to 67). The DHCP
server then sends a unicast DHCP Offer to the ciaddr address and the
UDP Response Port (defaults to 68).
This option can be used to monitor DHCP servers on the same subnet
as the SolarWinds SAM server or on a different subnet.
Broadcast The broadcast flag is set, the ciaddr (Client IP Address)
is set to the local address, and the giaddr (Relay Agent IP Address) is
not set. The DHCP client sends a unicast DHCP DISCOVER to the
DHCP server IP address and the UDP Request Port (defaults to 67).
The DHCP server then sends a broadcast DHCP Offer to the UDP
Response Port (defaults to 68).
This option can be used to monitor DHCP servers on the same subnet
as the SolarWinds SAM server
Relay Agent The broadcast flag is not set, the ciaddr (Client IP
Address) is set to the local address, and the giaddr (Relay Agent IP
Address) is set to the local address. The DHCP client sends a unicast
DHCP DISCOVER to the DHCP server IP address and the UDP
Request Port (defaults to 67). The DHCP server then sends a unicast

1023

Chapter 30: Component Monitor Types

DHCP Offer to the giaddr (Relay Agent IP Address) and the UDP
Request Port (defaults to 67).
This option can be used to monitor DHCP servers on the same subnet
as the SolarWinds SAM server or on a different subnet.
Note: You can use the Broadcast or Relay Agent DHCP discovery
request type to handle the issue with some DHCP servers (for
example Internet Systems Consortium DHCP Server) that do not send
a DHCP Offer back to the SolarWinds SAM Server IP address. They
send it to the newly leased IP address (the IP address being offered)
instead. To handle this issue, set the DHCP Discovery Request
Type to either Broadcast or Relay Agent.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
"Configuring SolarWinds SAM Alerts" on page 723.

Directory Size Monitor

This component monitor determines the disk space used by the files in a
directory, optionally including all subdirectories. Files that do not match the File
Extensions Filter are not included in the disk space calculation.
Note: It may be difficult to monitor the size of a folder containing hundreds or
thousands of files, because the monitor timeout duration may lapse before the
target computer can finish computing the file sizes and sending the response.

1024

Statistic
Note: See Requirements for Component Monitors and Templates that use WMI,
on page 407 for information about requirements for WMI access.
Statistic
The disk space used in bytes.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a credential that has read access to the file. If the credential you need
is not already present in the credentials list, use the Quick Credentials
section to add a new credential.
Full directory Path
The path to the monitored directory. Specify the path in Universal Naming
Convention (UNC) format. For example: \\computername\c$\logfiles\. The path
can include the variable ${IP}, which represents the target node's IP
address.
File Extensions Filter
Determines which file extensions are included in the disk space usage
calculations for the directory size. It is a text matching filter, and * is a
wildcard.
Include Subdirectories
Determines whether the contents of sub-directories are included in the disk
space usage calculations for the directory size.
Convert Value

1025

Chapter 30: Component Monitor Types

Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the dropdown lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 15.

Statistic Critical Threshold

This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 5.

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
"Configuring SolarWinds SAM Alerts"

DNS Monitor - TCP

This component monitor tests a DNS server's ability to respond to a record query
and measures its response time. The record query is an A Name lookup for [Link]. The component monitor passes if it receives a valid DNS response
(positive or negative).
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is

1026

DNS User Experience Monitor

${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Port Number
The TCP port used for DNS queries. The default value is 53.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

DNS User Experience Monitor

This component monitor tests a DNS server's ability to respond to a record query,
compares the query response against a list of IP addresses, and measures the
response time. The component monitor passes if the DNS response matches the
expected IP addresses.
The DNS Monitor measures the time it takes the DNS get for the record query
referenced in the component monitor to load. This response time is measured in
milliseconds.
Statistic
This component monitor does not compute a statistic.

1027

Chapter 30: Component Monitor Types

Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Port Number
The port used for DNS queries. The default value is 53.
Protocol
The protocol to use for the DNS query.
Name (IP Address) To Resolve
The fully-qualified domain name (FQDN) or IP address to use for the DNS
query. If you specify an IP address, the query result should be a FQDN. If
you specify a FQDN, the query result should be one or more IP addresses.
Expected DNS Query Results
The IP addresses or FQDN you expect to result from the DNS query. Type
each entry on a new line. If you do not care about the DNS query result, you
can type the asterisk (*) as a wildcard character that successfully matches
any DNS query result.
Expect All Matches
Specifies that the result of the DNS query must include all expected entries
to be considered a successful test. If this check box is not checked, a single
match indicates a successful test.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.

1028

DNS Monitor - UDP

Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
"Configuring SolarWinds SAM Alerts"

DNS Monitor - UDP

This component monitor tests a DNS server's ability to respond to a record query
and measures its response time. The component monitor passes if it receives a
valid DNS response (positive or negative) within the response time threshold.
UDP is the primary method of communication for DNS servers.
Statistic
This component monitor does not compute a statistic.
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Port Number
The UDP port used for DNS queries. The default value is 53.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes

1029

Chapter 30: Component Monitor Types

SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

Download Speed Monitor

This component monitor measures the time it takes to download data from the
target node, and reports the speed in KB/s (1024 bytes per second). The target
node must be running a Character Generator service.
Statistic
The statistic for this component monitor is the download speed in KB/s
(1024 bytes per second).
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Port Number
The port used for the character generator service. The default value is 19.
Download Sample Size (kb)
The amount of data in kilobytes (kb) you want to download from the node for
testing the download speed.
Convert Value

1030

Exchange Web Services User Experience Monitor

Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the dropdown lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 15.

Statistic Critical Threshold

This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 5.

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

Exchange Web Services User Experience Monitor

This component monitor simulates an email round trip to test the ability of your
SMTP server to receive and distribute email, and the ability of your users to
retrieve email through Exchange Web Services.

1031

Chapter 30: Component Monitor Types

Note: If you receive a Server Error while browsing Exchange Web Services, refer
to the following Microsoft KB article located at:
[Link]
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state, not influencing
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a credential that has read access to the file. If the credential you need
is not already present in the credentials list, use the Quick Credentials
section to add a new credential.
Note: This credential must be the email address of the account which
is to be simulated and not the credentials of the Windows computer.
For example: Username@[Link].
Send Email From
Enter the email address where you want an email to be sent from
Send Email To
Enter the email address where you want an email to be sent to
Exchange Web Service URL
This field allows you to specify the URL of your Exchange Web Server.
Ignore CA Errors
Allows to choose whether or not to ignore Certificate Authority errors.
Ignore CN Errors
Allows to choose whether or not to ignore Common Name errors.
SMTP Server

1032

File Age Monitor

Enter your SMTP server address here.
SMTP Port
Enter your SMTP port number here.
Use Credentials for SMTP
Check this box if needed.
Credential for SMTP
If needed, select the proper credentials from the dropdown list.
SMTP Encryption
Choose the method of encryption from the dropdown list.
Response Time Threshold
Select the conditions from the dropdown lists for the Warning and Critical
thresholds, then set the time, in seconds, for these conditions to be met.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

File Age Monitor

This component monitor determines when a file was last modified. The statistic is
the number of elapsed hours since the file modification date.
This component monitor uses TCP/445 and UDP/445 ports.
Statistic
The number of elapsed hours since the file modification date.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component

1033

Chapter 30: Component Monitor Types

Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing SolarWinds
SAM application availability or status.
Credential for Monitoring
Select a credential that has read access to the file. If the credential you need
is not already present in the credentials list, use the Quick Credentials
section to add a new credential.
File Path
This field is the path to the monitored file, including the file name. Specify
the path in Universal Naming Convention (UNC) format. For example:
\\computername\c$\logfile\[Link]. The path can include the variable ${IP}
which represents the target node's IP address.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the dropdown lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 15.

Statistic Critical Threshold

This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 5.

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

1034

File Count Monitor

File Count Monitor

This component monitor counts the number of files in a directory, optionally
including its subdirectories. Files that do not match the file extension or file
attribute type are ignored.
This monitor may fail if you attempt to count more than 20,000 files in a directory
using the wildcard * filter extension. To get an accurate count of the files in such
large directories, you must instead create a Windows Script monitor that runs the
File Count script located in the script examples folder C:\Program
Files\SolarWinds\Orion\APM\SampleScriptMonitors\WindowsScripts.
Note: See Requirements for Component Monitors and Templates that use WMI
on page 407 for information about requirements for WMI access.
Statistic
The number of files in the directory that match the file extensions filter.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a credential that has read access to the file. If the credential you need
is not already present in the credentials list, use the Quick Credentials
section to add a new credential.
Full Directory Path
This field is the path to the directory. Specify the path in Universal Naming
Convention (UNC) format. For example: \\computername\c$\. The path can

1035

Chapter 30: Component Monitor Types

include the variable ${IP} which represents the target node's IP address.
There is a limit of 260 characters for this field.
File Extensions Filter
Specifies which files to include in the count based on the file extension. You
can specify multiple file extensions separated by commas or spaces. To
include all files, specify *.
Example for counting all files regardless of file extension
File Extensions Filter: *Example for counting files with .exe, .dll, and .bat
extensions
File Extensions Filter: exe, dll, bat
File Attributes Filter
Specifies which files to include in the count based on the file attributes. The
default value is All Files.
Include Subdirectories
Specifies the file count should also include files located inside
subdirectories
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the dropdown lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 15.

Statistic Critical Threshold

This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 5.

1036

File Existence Monitor

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

File Existence Monitor

This component monitor tests if a file exists at the given file path.
This component monitor uses TCP/445 and UDP/445 ports.
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a credential that has read access to the file. If the credential you need
is not already present in the credentials list, use the Quick Credentials
section to add a new credential.
File Path
This field is the path to the monitored file, including the file name. Specify
the path in Universal Naming Convention (UNC) format. For example:
\\computername\c$\logfile\[Link]. The path can include the variable ${IP}
which represents the target node's IP address.
File Exist Setting

1037

Chapter 30: Component Monitor Types

This field specifies whether the component monitor should test for whether
the file must exist file or must not exist.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

File Change Monitor

This component monitor tests if a file has been modified and then reports the time
in hours since the file was modified as a statistic. The component monitor
performs an MD5 checksum comparison on the file to verify it was not modified. If
SolarWinds SAM detects the monitored file was modified, the component monitor
will remain in a Down state until you recalculate the checksum.
This component monitor uses TCP/445 and UDP/445 ports.
Statistic
The number of elapsed hours since the file was modified.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a credential that has read access to the file. If the credential you need
is not already present in the credentials list, use the Quick Credentials
section to add a new credential.
File Path

1038

Field Descriptions:
This field is the path to the monitored file, including the file name. Specify
the path in Universal Naming Convention (UNC) format. For example:
\\computername\c$\logfile\[Link]. The path can include the variable ${IP}
which represents the target node's IP address.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the dropdown lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Current Snapshot Checksum
This field is the calculated checksum against which SolarWinds SAM is
comparing the monitored file. To calculate a new checksum, click Update
Checksum.
Select and upload a file for snapshot creation
This field is the local path to a file on the user's computer (where the web
browser is running) used to calculate the checksum against which the
monitored file is compared. Click Browse to open a Windows Choose File
dialog from which you can select the file directly. Click Update Checksum
to calculate the new checksum.
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 15.

Statistic Critical Threshold

This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 5.

User Notes

1039

Chapter 30: Component Monitor Types

This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

File Size Monitor

This component monitor measures the size of a file at the given file path and then
reports the file size in bytes as a statistic.
This component monitor uses TCP/445 and UDP/445 ports.
Statistic
The statistic for the component monitor is the file size in bytes.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a credential that has read access to the file. If the credential you need
is not already present in the credentials list, use the Quick Credentials
section to add a new credential.
File Path
This field is the path to the monitored file, including the file name. Specify
the path in Universal Naming Convention (UNC) format. For example:
\\computername\c$\logfile\[Link]. The path can include the variable ${IP}
which represents the target node's IP address.
Convert Value
Checking the Convert Value check box opens the Formula box.

1040

FTP User Experience Monitor

From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the dropdown lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 15.

Statistic Critical Threshold

This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 5.

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

FTP User Experience Monitor

This component monitor tests the ability of an FTP server to accept an incoming
session, process the user login, and then transmit the specified file to the
SolarWinds SAM server. After receiving the file, SolarWinds SAM performs a file
integrity test comparing the SHA1 checksum of the downloaded file against a
previously generated checksum. If the checksums match, the component monitor
reports its status as Up.
The FTP Monitor measures the time it takes the FTP get for the reference in the
component monitor to load. This response time is measured in milliseconds.
To configure the FTP User Experience Monitor and generate a snapshot
checksum:
1. Provide a credential that can log on to the FTP server.
2. If the FTP server is on a different port than the default port of 21,
change the value in the Port Number field.

1041

Chapter 30: Component Monitor Types

3. Upload a file named [Link] to the FTP server. The contents of the file do not
matter.
4. Change the Url field to match the path of the [Link] file you uploaded to the
FTP server.
5. Copy the same [Link] file to a local directory on the SolarWinds SAM server.
6. Click Browse next to the Select and upload a file for snapshot creation
field, navigate to and select the local [Link] file, and then click Open.
7. Click Update Checksum to create a snapshot checksum of the local [Link]
file.
8. Click Test.
9. If the test fails, correct the problem described in the error message and try
again.
Note: You must use the Update Checksum command to create a new snapshot checksum each time you update or modify the [Link] file on the FTP
server.
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts".
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a credential that can log on to the FTP server. For example, to
monitor an anonymous FTP server, select or add a credential containing
anonymous as the user name and your email address as the password. If the
credential you need is not already present in the credentials list, use the
Quick Credentials section to add a new credential.
Port Number

1042

Field Descriptions:
This field is the port number used for FTP sessions. The default value is 21.
Url
Allows you to specify the URL of the file you want to monitor. The URL can
include the variable ${IP} which represents the target node's IP address, and
the variable ${PORT} which represents the value in the Port Number field.
Use Proxy
This check box allows you to use a web proxy to access the web site.
Proxy Address
This field allows you to specify the address of a web proxy to access the
web site.
Passive Mode
This check box allows you to monitor the file using passive mode FTP. This
mode is typically used to circumvent a firewall that would otherwise filter the
incoming connection to the SolarWinds SAM server.
Current Snapshot Checksum
This field is the calculated checksum against which SolarWinds SAM is
comparing the monitored file. To calculate a new checksum, click Update
Checksum.
Select and upload a file for snapshot creation
This field is the local path to a file on the SolarWinds SAM server that is
used to calculate the checksum against which the monitored file is
compared. Click Browse to open a Windows Choose File dialog from
which you can select the file directly. Click Update Checksum to calculate
the new checksum.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes

1043

Chapter 30: Component Monitor Types

SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

FTP Monitor
This component monitor tests the ability of an FTP server to accept incoming
sessions and respond with the correct codes.
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Port Number
This field is the port number used for FTP sessions. The default value is 21.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold

1044

HTTP Form Login Monitor

This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

HTTP Form Login Monitor

This component monitor tests the ability of a web server to serve web pages
secured behind a forms-based login page. The test is performed by using the
credential as the user name and password for the login form, retrieving the page
behind the login form, and then searching the retrieved page for keywords that
indicate either a successful or a failed login attempt.
Note: The HTTP Form Login Monitor does not work on any login screens that are
pop up.
Statistic
This component monitor does not compute a statistic.
Troubleshooting
For most form-based login pages, this component monitor will function
without any customizations. But, some form-based login pages use
unconventional HTML form tag names or form input tag names, and
you need to assist the component monitor in identifying the names of
these tags before the component monitor can function correctly.
Note: This monitor does not work if the login control is located within
an IFRAME HTML control.
If the component monitor cannot match the tag names in the login
page against the list of expected keywords, you must add the actual
tag name to the keywords list. SolarWinds SAM assists you with this
by displaying an error status message if the component monitor is in a
fail state: the error message lists all the form and form input names
found in the HTML page, allowing you to identify the correct name so

1045

Chapter 30: Component Monitor Types

that you can type it in the appropriate Keywords field.
For example, consider the following HTML snippet with tags defining
a form and some form inputs:
<form name="login_form" method="post" action="[Link]"><p>Status
(optional): <input name="status" type="text" /></p><p>Username: <input
name="nick" type="text" /></p><p>Password: <input name ="pswd"
type="password" /></p><input type="submit" value="Submit" /></form>

In the example code, the actual login input tag name is "nick, but
testing the component monitor results in an error similar to the
following:
Response page matches login error keywords Page contains 1 form(s). Form
'login_form' inputs: ('cust_id' 'nick' 'pswd' ); Assumed form with name =
login_form as login form Assumed login input: name = status, password input:
name = pswd

The error status message informs you that the component monitor
incorrectly assumed the input tag with the name "status" was the login
input. Recognizing this error, you correct it by adding the correct tag
name "nick" to the list of keywords in the Login Control Keywords
field: (login)|(name)|(email)|(nick)
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a credential that can log on to the web site. If the credential you need
is not already present in the credentials list, use the Quick Credentials
section to add a new credential.

1046

Field Descriptions:
Port Number
This field is the port number used for HTTP forms-based login sessions.
The default value is 80.
Url
Allows you to specify the URL you want to monitor. The SolarWinds SAM
variable ${IP} contained in the default value for this field attempts to monitor
a web site at the IP address of the assigned node.
Host Header
Enter the address of the host header. For example, [Link].
Use Proxy
This check box allows you to use a web proxy to access the web site.
Proxy Address
This field allows you to specify the address of a web proxy to access the
web site.
Ignore CA Errors
If checked, this indicates that Certificate Authorization (CA) errors will be
ignored.
Ignore CN Errors
If checked, this indicates that Common Name (CN) errors will be ignored.
Accept Compression
If checked, indicates that compression is supported.
Login Form Keywords
This field lists the expected keywords that identify an HTML login form. The
keywords are matched against the name attribute of the <form> tags found
in the HTML of the login page. Each keyword in this list must be enclosed in
parentheses '()', and then separated from other keywords by a vertical bar
'|'. The default keywords are: (login)|(auth)|(email).
Login Control Keywords
This field lists the expected keywords that identify the form's user name
input element. The keywords are matched against the name attribute of the
<input> tags found in the HTML of the login page. Each keyword in this list

1047

Chapter 30: Component Monitor Types

must be enclosed in parentheses '()', and then separated from other
keywords by a vertical bar '|'. The default keywords are (login)|(name)|(email).
Password Control Keywords
This field lists the expected keywords that identify the form's password input
element. The keywords are matched against the name attribute of the
<input> tags found in the HTML of the login page. Each keyword in this list
must be enclosed in parentheses '()', and then separated from other
keywords by a vertical bar '|'. The default keywords are (password)|(pwd)|
(passwd)|(psswd)|(pswd).
Login Failed Regular Expression
This field contains the regular expression for matching an unsuccessful
login. This expression may appear anywhere in the HTML source of the
page.
Login Success Keywords
This field contains the regular expression for matching a successful login.
This expression may appear anywhere in the HTML source of the page.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

HTTP Monitor
This component monitor tests a web server's ability to accept incoming sessions
and transmit the requested page. The component monitor can optionally search

1048

Statistic
the delivered page for specific text strings and pass or fail the test based on that
search.
The HTTP Monitor measures the time it takes the HTTP get for the page
referenced in the component monitor to load. This response time is measured in
milliseconds.
Note: If a web page redirects to another page, the response time measures the
entire time from the original request until the last redirected page is loaded.
This monitor supports the following additional macros:
l
l
l
l

${[Link]}
${[Link]}
${[Link]}
${[Link]}

Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
If the web site is password-protected, select a credential that can access the
web site. If the credential you need is not already present in the credentials
list, use the Quick Credentials section to add a new credential.
If the web site is not password protected, do not specify a credential.
Port Number
The port used for the web site. The default value is 80.
Url

1049

Chapter 30: Component Monitor Types

This field allows you to specify the URL you want to monitor. The
SolarWinds SAM variables contained in the default value for this field
attempt to monitor a web site at the IP address of the assigned node ${IP}
and on the port specified in the Port Number field ${PORT}.
Proxy Servers: To prevent proxy servers from caching the monitored URL,
you can append a unique query string to the URL with the ${TimeStamp}
variable.
Example "cache buster" for simple URL: [Link]
Example "cache buster" for URL with existing query string:
[Link]

Host Header
Enter the address of the host header. For example, [Link].
Host Request
Enter the type of content. For example, POST.
Follow Redirect
This allows you to specify the component monitor to automatically follow
server-side redirects.
Use Proxy
This check box allows you to use a web proxy to access the web site.
Proxy Address
This field allows you to specify the address of a web proxy to access the
web site.
User Agent
This field allows you to emulate a specific user agent or browser type when
contacting the web site. For example, to emulate Internet Explorer version 7,
type Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0). For more information
about user agent strings, see [Link]
Search String
This field contains the text string indicating successful page retrieval. If the
specified string is found in the web page content, the monitor is considered
up.
Note: The search string is not case-sensitive.
1050

HTTPS Monitor
Fail if Found
This check box allows you to reverse the default behavior of the search
string. If the search string is found in the web page content, the monitor is
considered down instead of up.
Head Request
This field allows you to ensure the web site responds to the HTTP protocol,
but without checking the validity of the web page content. Search strings are
ignored if you select this option.
Accept Compression
If checked, indicates that compression is supported.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

HTTPS Monitor
This component monitor tests a web server's ability to accept incoming sessions
over a secure channel and then transmit the requested page. The component
monitor can also test the security certificate.
The HTTPS Monitor measures the time it takes the HTTPS get for the page
referenced in the component monitor to load. This response time is measured in
milliseconds.
Note: If a web page redirects to another page, the response time measures the
entire time from the original request until the last redirected page is loaded.

1051

Chapter 30: Component Monitor Types

This monitor supports the following additional macros:
l
l
l
l

${[Link]}
${[Link]}
${[Link]}
${[Link]}

Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
If the web site is password-protected, select a credential that can access the
web site. If the credential you need is not already present in the credentials
list, use the Quick Credentials section to add a new credential.
Port Number
The port used by the web site. The default value is 443.
Url
This field allows you to specify the URL you want to monitor. The
SolarWinds SAM variables contained in the default value for this field
attempt to monitor a web site at the IP address of the assigned node ${IP}
and on the port specified in the Port Number field ${PORT}.
Proxy Servers: To prevent proxy servers from caching the monitored URL,
you can append a unique query string to the URL with the ${TimeStamp}
variable.

1052

Field Descriptions:
Example "cache buster" for simple URL: [Link]
Example "cache buster" for URL with existing query string:
[Link]

Host Header
Enter the address of the host header. For example, [Link].
Host Request
Enter the type of content. For example, POST.
Follow Redirect
This allows you to specify the component monitor to automatically follow
server-side redirects.
Use Proxy
This check box allows you to use a web proxy to access the web site.
Proxy Address
This field allows you to specify the address of a web proxy to access the
web site.
Certificate Subject
This is used for selecting a private key when client authentication is used.
This field allows you to specify the X.509 certificate subject (DN). Use
spaces () or commas (,) to separate the different subject fields. Semicolons,
commas with spaces after them, and newline or carriage returns are not
acceptable separators.
It allows you to select a certificate from Current User > Personal
certificate store using its subject. The subject must equal the exact
format to find the certificate using .NET.
For example: To find a specific certificate, you need to use the
following format:
CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE
Ignore CA Errors
This check box allows you to specify the component monitor to ignore the
certificate authority (CA).
Ignore CN Errors

1053

Chapter 30: Component Monitor Types

This check box allows you to specify the component monitor to ignore the
certificate name (CN).
User Agent
This field allows you to emulate a specific user agent or browser type when
contacting the web site. For example, to emulate Internet Explorer version 7,
type Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0). For more information
about user agent strings, see [Link]
Search String
This field contains the text string indicating successful page retrieval. If the
specified string is found in the web page content, the monitor is considered
up.
Note: The search string is not case-sensitive.
Fail if Found
This check box allows you to reverse the default behavior of the search
string. If the search string is found in the web page content, the monitor is
considered down instead of up.
Head Request
This check box allows you to ensure the web site responds to the HTTPS
protocol, but without checking the validity of the web page content. Search
strings are ignored if you select this option.
Accept Compression
If checked, indicates that compression is supported.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
User Notes

1054

IMAP4 Monitor
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

IMAP4 Monitor
This component monitor tests the ability of an IMAP4 server to accept incoming
connections and respond with the correct code.
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Port Number
This field is the port number used for IMAP4 sessions. The default value is
143.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.

1055

Chapter 30: Component Monitor Types

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

IMAP4 User Experience Monitor

This component monitor tests an email round trip from your SMTP mail server to
your IMAP4 server and measures the time it takes to complete the trip. This
response time is measured in milliseconds.
This component monitor uses the following ports when used with a Microsoft
Exchange mail server:
l
l

143 and 993-IMAP4

25 - SMTP

Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a credential that can retrieve email from an IMAP4 server. If the
credential you need is not already present in the credentials list, use the
Quick Credentials section to add a new credential.
Send Email From
This field allows you to specify the From address of the test email message.

1056

Field Descriptions:
Send Email To
This field allows you to specify the recipient of the test email message. The
recipient should have a mailbox on the IMAP4 server you are monitoring.
IMAP4 Port
This field is the port number used for IMAP 4 sessions. The default value is
143. For Secure IMAP (IMAP4-SSL), use port 585. For IMAP4 over SSL
(IMAPS), use port 993.
IMAP4 Encryption
This list allows you to select an encryption protocol to connect to IMAP4
servers that support SSL or TLS encryption.
SMTP Server
This field allows you to specify the SMTP server that sends the test email
message.
SMTP Port
This field is the port number used for SMTP sessions. The default value is
25.
Use Credentials for SMTP
This check box allows you to use the user name and password from
Credentials for Monitoring to connect to SMTP servers that support or
require authentication.
SMTP Encryption
This list allows you to select an encryption protocol to connect to SMTP
servers that support SSL or TLS encryption.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.

1057

Chapter 30: Component Monitor Types

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

JMX Monitor
This template tests the overall performance of a Java Application Server
Prerequisites: The JMX connector must be enabled on the Java application
server.
Credentials: You may need either JMX credentials or none at all. This depends
on the credentials required based on the configuration of your Java application
server. For more information, see Configuring Java Applications Servers for
JMX" on page 1149.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Component Type
This describes the type of monitor you are using.
Enable Component
This option determines whether or not the component is enabled. Disabling
this component leaves it in the application as deactivated and does not
influence application availability or status.
Credential for Monitoring
This allows you to set JMX credentials for querying MBeans. If the
credential you need is not already present in the credentials list, use the
Quick Credentials section to add a new credential.
Port Number
This field allows you to specify the port number used for JMX connections.
Protocol

1058

Field Descriptions:
This field allows you to choose between using Remote Method Invocation
(RMI) and Invocation over Internet Inter-Orb Protocol (IIOP). Note: RMI
should be correctly referred to as RMI/JRMP and IIOP as RMI/IIOP based
on JMX Specifications.
URL Path
This field is for the last part of the JMX service URL. This follows
hostname:portnumber and begins with a slash. For example:
service:jmx:rmi:///jndi/rmi://HostName:portnumber/jmxrmi

Object Name
This field is for the unique string identifier of an MBean in the form of
<domain-name>:<key property>.

Attribute Name
This field is for the name of an MBean attribute.
Key
This is used for monitoring composite attributes, which consist of
key:value pairs. Note: SAM only supports monitoring of numerical data
type attributes.
Count Statistic as Difference
Changes the statistic to be the difference in query values between polling
cycles.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the dropdown lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 15.

1059

Chapter 30: Component Monitor Types

Statistic Critical Threshold
This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 5.

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

LDAP User Experience Monitor

This component monitor tests the capabilities of a Lightweight Directory Access
Protocol (LDAP) server, and measures the time it takes to perform an LDAP
query.
Statistic
The number of entries returned by the LDAP query.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a credential that has administrator access to the LDAP server. If the
credential you need is not already present in the credentials list, use the
Quick Credentials section to add a new credential.
Port Number

1060

Field Descriptions:
The port used for LDAP connections. The default value is 389. For LDAP
over SSL, use port 636.
Encryption Method
Specifies an encryption method for the LDAP connection. The default
setting is None.
Authentication Method
Specifies the authentication method for the LDAP connection. The default
setting is Simple.
Realm (user domain)
Specifies the realm to use for LDAP authentication.
LDAP Search Root
Specifies the LDAP root or suffix to use for the search.
LDAP Filter
Specifies the search parameters of the LDAP query. The default LDAP
Filter value is (&(objectClass=Person)(cn=someuser)), and it searches for all
entries that have objectClass=Person and cn=someuser.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the dropdown lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.

1061

Chapter 30: Component Monitor Types

Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 15.

Statistic Critical Threshold

This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 5.

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

Linux/Unix Script Monitor

This component monitor uses SSH to upload a script to a Linux/Unix server, runs
the script on the server, and then processes the return value and text output.
Note: A maximum of 10 output pairs can be returned. If you exceed the maximum
allowed, remove the excess output pairs or they will simply be ignored.
Statistic
The statistic for this component monitor is the Statistic value returned
by the script. For more information, see Creating a Linux/Unix Script
Monitor on page 375.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component

1062

Field Descriptions:
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Authentication Type
Choose either Username and Password or Username and Private Key. The
second option allows you to use cetificates for authentication. For more
information, see "Certificate Credentials Library" on page 340.
Credential for Monitoring
Select a credential that can access the Linux or Unix server over SSH, and
that has sufficient rights to run scripts. If the credential you need is not
already present in the credentials list, use the Quick Credentials section to
add a new credential.
Port Number
This field allows you to specify the port number used for the SSH
connection. The default value for this field is 22.
Script Working Directory
This field allows you to specify the working directory of the script
process.
Count Statistic as Difference
Changes the statistic to be the difference in query values between polling
cycles.
Command Line
This field allows you to specify the shell command run after the SSH
connection is established. The default command line value perl ${SCRIPT}
arg1 arg2 attempts to run in a Perl interpreter the script defined in the Script
Body field using the parameters arg1 arg2.
Note: The length of the Command Line field is limited to 266
characters for Solaris systems, minus the length of the ${SCRIPT}
variable after being resolved to a file name such as the following:
APM_937467589.pl. Since the length of the file name will typically be
around 16 characters, this means that the actual user Command Line
input cannot be longer than 266 16, or about 250 characters (not
including the length of the 9 characters for the ${SCRIPT} variable

1063

Chapter 30: Component Monitor Types

itself).
If you need to pass a longer command line to the target node, you can
create a shell script on the target node (for example [Link]) that
contains the long command line, and place the call to this script in the
Command Line field, for example: /opt/sw/[Link]
Script Body
This field allows you to specify the script you want to run on the Linux or
Unix server. For more information, see Creating a Linux/Unix Script
Monitor on page 375.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

MAPI User Experience Monitor

This component monitor sends an email from your SMTP mail server to your
Microsoft Exchange Server Mailbox and measures the time it takes to complete
the trip. You can use this component monitor to monitor the performance of
Outlook. This response time is measured in milliseconds.
The Exchange Server computer uses port 135 for client connections to the RPC
endpoint mapper service. After a client connects to a socket, the Exchange Server
computer allocates the client two random ports to use to communicate with the
directory and the information store.
For a complete list of network ports used by Microsoft Server Products, refer to the
following article: [Link]
Install the MAPI Client on Your SolarWinds SAM Server
This component monitor requires you to install the Microsoft Exchange Server
MAPI Client and Collaboration Data Objects on your SolarWinds SAM server.
You can download the MAPI Client from: The Microsoft Download Center.
[Link]

1064

Statistic
Statistic
This component monitor does not compute a statistic. The response
time is the difference between the time SolarWinds SAM sends the
email and the time it is received by the recipient.
Notes:
1. This component monitor waits for the email to arrive based on the default
job timeout of 20 minutes. If the email does not arrive within this period,
SolarWinds SAM marks the monitor as down.
2. The monitor goes through the following steps with respect to the mail flow:
a. Sends an email to the user mailbox via SMTP. The email has a
unique temporary subject name that starts with APM_prefix.
b. Connects to the user mailbox through MAPI, then searches the
emails by Subject.
c. If it does not find the email it is looking for, it waits and then
searches again. It will stop when: it finds the email, the timeout is
reached, or the maximum number of attempts is reached.
d. Once it finds the email, the monitor deletes it from the user inbox.
e. The monitor collects the total round trip time for the email and compares it with the thresholds set.
f. Once it knows the round trip time, status is given according to where
it falls with regard to the thresholds set.
If the email is not found within the timeout or the maximum number
of attempts, or SMTP or MAPI reported an error, SolarWinds SAM
will mark the monitor as Down.
3. Emails the monitor sends are deleted from user inboxes, but only if the
monitor successfully connected via MAPI. If the SMTP call succeeded, but
MAPI failed, the email remains in the user inbox.
4. It is not currently possible to use the monitor without SMTP and send the
email from the same server the monitor is running on via MAPI.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"

1065

Chapter 30: Component Monitor Types

Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a credential that is both a user who can log on to the SolarWinds
SAM server, and that has an Exchange account on the MAPI server. If the
credential you need is not already present in the credentials list, use the
Quick Credentials section to add a new credential.
Send Email From
This field allows you to specify the From address of the test email message.
Send Email To
This field allows you to specify the recipient of the test email message. The
recipient should have a mailbox on the MAPI server you are monitoring.
MAPI Profile Name
Allows you to specify the name of the MAPI profile
SMTP Server
This field allows you to specify the SMTP server that sends the test email
message.
SMTP Port
This field is the port number used for SMTP sessions. The default value is
25.
Use Credentials for SMTP
This check box allows you to use the user name and password from
Credentials for Monitoring to connect to SMTP servers that support or
require authentication.
SMTP Encryption
This list allows you to select an encryption protocol to connect to SMTP
servers that support SSL or TLS encryption.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes

1066

Nagios Script Monitor

SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

Nagios Script Monitor

This component monitor runs the Nagios script on the SolarWinds SAM server
and then processes the script's exit code and text output. This monitor has the
ability to return multiple values.
Note: A maximum of 10 output pairs can be returned. If you exceed the maximum
allowed, remove the excess output pairs or they will simply be ignored.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Component Type
This describes the type of monitor you are using.
Enable Component
This option determines whether or not the component is enabled. Disabling
this component leaves it in the application as deactivated and does not
influence application availability or status.
Credential for Monitoring

1067

Chapter 30: Component Monitor Types

Select a Windows credential that is both a user who can log on to the
SolarWinds SAM server, and has sufficient rights on the target node to do
whatever the script needs to do. For example, if the script does something
with WMI, the credentials also need WMI rights on the target node. If the
credential you need is not already present in the credentials list, use the
Quick Credentials section to add a new credential.
Port Number
This field allows you to specify the port number used for the SSH
connection. The default value is 22.
Script Working Directory
This field allows you to specify the working directory of the script
process.
Check Type
This determines how the return code is evaluated.
Return Code Service State Host State
0

OK

Up

Warning

Up or Down/Unreachable

Critical

Down/Unreachable

Unknown

Down/Unreachable

_______________________
If the Use Aggressive Host Checking option is enabled, return codes
of 1 will result in a host state of DOWN, otherwise return codes of 1
will result in a host state of UP.
Count Statistic as Difference
Changes the statistic to be the difference in query values between polling
cycles.
Command Line
This field is in the script editing window and allows you to specify the script
you want to run on the target node followed by the arguments. To enter your

1068

NNTP Monitor
script, click the Edit button that reveals the script editing window. For more
information, see [Link]
Body
This field is in the script editing window and allows you to enter your script
via typing or pasting.
Status Roll-Up
This option allows you to choose how you would like the monitor to report
based on the output provided by the script. The default selection is Show
worst status. For more information, see "Managing the Display of Group
Status" on page 292.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts".
For more information, see Creating a Nagios Script Monitor" on page 387.

NNTP Monitor
This component monitor tests the ability of an NNTP server to accept incoming
connections and respond with the correct code.
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts".
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.

1069

Chapter 30: Component Monitor Types

Port Number
This field is the port number used for NNTP connections. The default value
is 119.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts".

ODBC User Experience Monitor

This component monitor uses synthetic transactions to test the abilities of an
ODBC-accessible database such as MySQL. The component monitor connects to
the database, performs a query, and then retrieves the data. ODBC drivers for
your database type must be installed on the SolarWinds SAM server.
The SQL statement you use for this query must return a numerical value, not a
varchar.
Statistic
The statistic for this component monitor is the first row and column of
the data retrieved by the query. It must be a numerical value.
Install ODBC Drivers on the SolarWinds SAM Server.
You must install on the SolarWinds SAM server the ODBC drivers for
your database. For more information on acquiring or installing the
ODBC drivers, consult your database documentation.

1070

TCP Ports
Note: In some situations, monitors derived from this ODBC
component can fail because the bit mode setting (x32/x64) is set
incorrectly. This can happen to database servers that only install x64
drivers on a x64, making this monitor inaccessible in x32 mode.
TCP Ports
This component monitor uses port TCP/1630. Oracle Connection
Manager provides the listening port for Oracle client connections to
Oracle Connection Manager. You can configure Oracle Connection
Manager either through a custom installation, or configure it after
installation using Net Configuration Assistant.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts".
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a database credential that can access the database. If the credential
you need is not already present in the credentials list, use the Quick
Credentials section to add a new credential.
Connection String
This field allows you to specify the ODBC connection string for the
database. If you do not know the connection string to your ODBCaccessible database, you can look it up on
[Link] The connection string may include the
variables ${IP}, ${USER}, and ${PASSWORD}, which are replaced
respectively by the IP address of the database server, the credential user
name, and the credential password.

1071

Chapter 30: Component Monitor Types

If you are using the ODBC User Experience Monitor instead of the SQL
Server User Experience monitor for a SQL Server database that is not using
the default port 1433, perform the following to create a connection string.
To create the SQL Server connection string:
1. Using notepad, create an empty .udl file.
2. Double-click the .udl file to open the Data Link Properties dialog. Click
Next to navigate from tab to tab and configure and test your ODBC connection.
Note: Remember to select the desired database provider on the Provider
tab, in this case the provider for SQL Server.
3. If the option is present for the provider, check the allow saving password
option, as this will ensure that the connection string contains the password
when you next retrieve it.
4. When you are finished, and have tested that the connection works, click
OK.
5. Open the .udl file again in Notepad, and retrieve the connection string.
For additional information about creating and configuring Universal Data
Link (.udl) Files, refer to the MSDN article.
Sql Query
This field allows you to specify the SQL query used to test the database.
The retrieved data is then used as the component monitor statistic. You may
enter up to 4,000 characters.
Query Timeout
The amount of time, in seconds, until the SQL query will timeout.
Count Statistic as Difference
Changes the statistic to be the difference in query values between polling
cycles.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the dropdown lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,

1072

Oracle User Experience Monitor

see "Conversion Value."
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 15.

Statistic Critical Threshold

This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 5.

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

Oracle User Experience Monitor

This component monitor uses synthetic transactions to test the abilities of an
Oracle database. The component monitor connects to the database, performs a
query, and then retrieves the data. Oracle Net Services from the Oracle Client
must be installed on the SolarWinds SAM server.
The SQL statement you use for this query must return a numerical value, not a
varchar.

1073

Chapter 30: Component Monitor Types

Statistic
The statistic for this component monitor is the first row and column of
the data retrieved by the query. It must be a numerical value.
Install Oracle Client on the SolarWinds SAM Server.
This component monitor requires you to install the Oracle Net
Services from the Oracle Client on your SolarWinds SAM server. You
can download the Oracle Client from:
The SolarWinds customer portal "Additional Components" section.
[Link]
The Oracle Database Software Downloads web site.
[Link]
tml
Note: For information about using this monitor without the ODBC
connection, see the following SolarWinds knowledgebase article:
[Link]
TCP Ports
This component monitor uses ports TCP/1521 and TCP/1526. The
Oracle SQL*Net Listener allows Oracle client connections to the
database over Oracle's SQL*Net protocol. You can configure it during
installation. To reconfigure this port, use Net Configuration Assistant.
Monitoring Oracle Real Application Clusters
You must monitor each cluster member separately. For example, if
[Link] is the address of the cluster, but [Link] and [Link] are the
actual cluster members, you need to create separate applications for
each member, and monitor the database instances individually.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"

1074

Field Descriptions:
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a database credential that can access the database. If the credential
you need is not already present in the credentials list, use the Quick
Credentials section to add a new credential.
Port Number
This field allows you to specify the port number used to communicate with
the Oracle database. The default value for this field is 1521.
SQL Query
This field allows you to specify the SQL query used to test the database.
The retrieved data is then used as the component monitor statistic. You may
enter up to 4000 characters.
Destination Point Type
This option tells SolarWinds SAM whether you are accessing the database
by its Oracle System ID (SID) or by its service name.
SID:
Select this to access the database by its System ID.
Service_Name:
Select this to access the database by its service name. Though we
call this option 'net service name', do not enter the net service name.
Destination Point Name
This field allows you to specify either the service name or the SID to access
the Oracle database over a network. Do not enter the net service name. To
determine the name or SID of the database, refer to the [Link] Oracle
configuration file or ask your database administrator.
Example of a service name as a destination point name
Destination Point Name: [Link]
Destination Point Type: SERVICE_NAME
[Link]:

1075

Chapter 30: Component Monitor Types

ORA11 = (DESCRIPTION = (ADDRESS_LIST =
(ADDRESS = (PROTOCOL
= TCP)(HOST = [Link])(PORT = 1521))) (CONNECT_DATA = (SERVICE_
NAME = [Link])))

Example of a SID as a destination point name

Destination Point Name: ORA11DATABASE
Destination Point Type: SID
[Link]:
ORA11 = (DESCRIPTION = (ADDRESS_LIST =
(ADDRESS = (PROTOCOL
= TCP)(HOST = [Link])(PORT = 1521))) (CONNECT_DATA = (SID =
ORA11DATABASE)))

Oracle Driver Type

Allows you to select the driver from the dropdown list.
Count Statistic as Difference
Changes the statistic to be the difference in query values between polling
cycles.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the dropdown lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Statistic Warning Threshold

1076

Field Descriptions:
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 15.

Statistic Critical Threshold

This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 5.

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"
Scenario:
SAM requires two additional components in order to monitor Oracle
databases:
l
l

Oracle's Instant Client

SolarWinds Oracle Plug-in.

The steps below should result in a successfully tested and monitored

database.
1. The first item to install is the Oracle Instant Client Basic. (In
this scenario, we will also install the Instant Client ODBC and
SQLPlus packages).
l

Download the version specific to your

architecture:
[Link]
Instant Client Package - Basic (the core
Instant Client).

1077

Chapter 30: Component Monitor Types

Instant Client Package - ODBC (ODBC

functionality, requires additional configuration).
Instant Client Package - SQLPlus
(SQLPlus functionality).

2. Create the directory where the products will be stored. (i.e.:

c:\Oracle)
3. Unzip the files into the created directory and preserve the
path. (i.e.: Instantclient_11_2).
4. Modify your path to reference the directory that the Instant Client files were extracted to:
l Path: Add c:\oracle\instantclient_11_2
l Tns_Admin: Create if necessary, c:\oracle\instantclient_
11_2
5. Log out to ensure Windows identifies the variables you defined.
6. Create a [Link] file and save it in to c:\oracle\instantclient_11_2. (Note:
An example of [Link] can be found at: [Link]
7.
Install the SolarWinds Oracle Plug-in:
l Log in to the SolarWinds Customer Portal
l Click on Additional Components
l Click on Download Server & Application Monitor Components
l Click on the Oracle Client
l Run and install the [Link] file
Log in to SolarWinds and browse to the SAM Monitor:
l

Each application item was set up using a SERVICE_NAME point type,

with the database name as the Destination Port Name.
The User ID to be used for this test cannot be limited or restricted, otherwise it will return errors.
Test each component monitor.

Performance Counter Monitor

This component monitor reads Windows Performance Counter data using
Remote Procedure Calls (RPC) instead of Windows Management
Instrumentation (WMI). All performance counters are assumed to exist within the
root/CIMV2 namespace.

1078

Statistic
This monitor uses RPC, requiring the following ports:
TCP/135; RPC/named pipes (NP) TCP 139, RPC/NP TCP 445, RPC/NP UDP
137, RPC/NP UDP 138
For information about troubleshooting Windows performance counters, refer to the
KB article How can I troubleshoot SolarWinds SAM performance monitoring and
Windows performance counters?
[Link]
Statistic
The statistic for this component monitor is the performance counter
value.
Optionally, the statistic may be set as the difference in query values
between polling cycles by checking the option for Count statistic as
difference.
Note: the Count statistic as difference option is applicable only for
monitors whose counter value increases consistently during each
polling interval. Examples of when this option is not applicable include
cases such as the following:
l

Counter values sometimes increase and sometimes decrease

from one polling interval to another (typical behavior for many
counters)
Counter values consistently decrease from one polling interval
to another
In these cases where the option is not applicable, negative statistic data values will be replaced with zero (0), and the counter
monitor will show 0 as the statistic data value in resources and 0
as the value on statistic data charts for this interval.

Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Component Type

1079

Chapter 30: Component Monitor Types

Identifies the component type as a Performance Counter Monitor.
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a Windows credential that has RPC access to the target node. This
is typically a Windows administrator-level credential.
Count statistic as difference
This option changes the statistic to be the difference in counter values
between polling cycles.
Counter
Enter the name of the performance counter. For example: %ProcessorTime.
Instance
Enter the instance name of the performance counter. For example: _Total.
If the performance counter has multiple instances, you can monitor each
instance separately by creating a Performance Counter Monitor for each
instance. For example, the performance counter %ProcessorTime has two
instances if you have a dual-CPU system: 0 for the first CPU and 1 for the
second CPU. You can create a separate Performance Counter Monitor to
monitor each instance of the counter.
Category
Enter the category of the performance counter. All performance counters are
assumed to exist within the root/CIMV2 namespace. For example: Processor.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the dropdown lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Statistic Warning Threshold

1080

POP3 Monitor
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 15.

Statistic Critical Threshold

This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 5.

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

POP3 Monitor
This component monitor tests the ability of a POP3 server to accept incoming
connections and respond with the correct code.
This component monitor uses the following ports when used with a Microsoft
Exchange mail server:
l
l
l
l
l
l
l
l
l

102
110
119
143
389
563
636
993
995

X.400 MTA
POP3
NNTP
IMAP4
LDAP
POP3 over SSL.
LDAP over SSL.
IMAP4 over SSL.
POP3 over SSL.

Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which

1081

Chapter 30: Component Monitor Types

will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Port Number
This field is the port number used for POP3 connections. The default value
is 110. For Secure POP3 (SSL-POP) use port 995.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

POP3 User Experience Monitor

This component monitor tests an email round trip from your SMTP mail server to
your POP3 mail server and measures the time it takes to complete the trip. This
response time is measured in milliseconds.
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description

1082

Field Descriptions:
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a credential that has sufficient access rights to retrieve email from the
POP3 server. If the credential you need is not already present in the
credentials list, use the Quick Credentials section to add a new credential.
Send Email From
This field allows you to specify the From address of the test email message.
Send Email To
This field allows you to specify the recipient of the test email message. The
recipient should have a mailbox on the POP3 server you are monitoring.
POP3 Port
This field is the port number used for POP3 sessions. The default value is
110. For Secure POP3 (SSL-POP) use port 995.
POP3 Encryption
This list allows you to select an encryption protocol to connect to POP3
servers that support SSL or TLS encryption.
SMTP Server
This field allows you to specify the SMTP server that sends the test email
message.
SMTP Port
This field is the port number used for SMTP sessions. The default value is
25.
Use Credentials for SMTP

1083

Chapter 30: Component Monitor Types

This check box allows you to use the user name and password from
Credentials for Monitoring to connect to SMTP servers that support or
require authentication.
SMTP Encryption
This list allows you to select an encryption protocol to connect to SMTP
servers that support SSL or TLS encryption.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts."

Process Monitor - SNMP

This component monitor uses SNMP communication to test if a specified process
is running, and reports the CPU and physical memory used by all instances of the
process.
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is

1084

Field Descriptions:
${UserDescription}.

For more information, see Configuring SolarWinds

SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Command Line Filter
This optional field allows you to select which instances of a process you
want to monitor, based on the command line arguments of the process. This
is a text match, and partial matches are also valid.
Example to monitor only instances launched with myOption=NorthAmerica
Command Line Filter: myOption=NorthAmerica
Example to monitor any instances launched with America in any argument
Command Line Filter: America
Process Name
This field allows you to specify the process name you want to monitor. If you
do not know the process name, SolarWinds SAM can help you find
processes to monitor. For more information, see "Creating New Templates
Using the Browsing Method:
CPU Threshold
These fields allow you to set warning and critical threshold conditions
based on the percentage of CPU resources in use by the monitored
process.
Physical Memory Threshold
These fields allow you to set warning and critical threshold conditions
based on the amount of physical memory in use by the monitored process.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

1085

Chapter 30: Component Monitor Types

Process Monitor - WMI

This component monitor uses WMI or RPC communication to test if a specified
Windows process is running, and reports the CPU, virtual memory, and physical
memory used by all instances of the process.
The WMI Process Monitor retrieves two samples (after 5 seconds) from the
Win32_PerfRawData_PerfProc_Process class (PercentProcessorTime and
TimeStamp_Sys100NS properties). It then calculates the CPU usage from these
two samples.
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a Windows credential that has WMI rights on the target node. This is
typically a Windows administrator-level credential. If the credential you need
is not already present in the credentials list, use the Quick Credentials
section to add a new credential.
Fetching Method
Select the Fetching Method (Communication Type):
l

WMI (Windows Management Instrumentation) Use WMI

communication to test if the specified Windows process is running.

1086

Field Descriptions:
l

RPC (Remote Procedure Call) Use RPC communication to

test if the specified Windows process is running.

Command Line Filter

This optional field allows you to select which instances of a process you
want to monitor, based on the command line arguments of the process. This
is a text match and partial matches are also valid.
Example to monitor only instances launched with myOption=NorthAmerica
Command Line Filter: myOption=NorthAmerica
Example to monitor any instances launched with America in any argument
Command Line Filter: America
Process Name
This field allows you to specify the process name you want to monitor. If you
do not know the process name, SolarWinds SAM can help you find
processes to monitor using the Component Monitor Wizard wizard. For
more information, see "Creating New Templates Using the Browsing
Method:.
CPU Threshold
These fields allow you to set warning and critical threshold conditions
based on the percentage of CPU resources in use by the monitored
process.
Physical Memory Threshold
These fields allow you to set warning and critical threshold conditions
based on the amount of physical memory in use by the monitored process.
Virtual Memory Threshold
These fields allow you to set warning and critical threshold conditions
based on the amount of virtual memory in use by the monitored process.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

1087

Chapter 30: Component Monitor Types

RADIUS User Experience Monitor

This component monitor uses synthetic transactions to test user authentication
through the RADIUS protocol. The synthetic transaction does the following:
1.
2.
3.
4.

Connect to server.
Send RADIUS credential and shared secret.
Validate response.
Measure response time.

Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a RADIUS credential or create one in the Quick Credentials section.
Authentication Port Number
This field is the RADIUS protocol authentication port. The default value is
1812. Cisco devices may require port 1645.
Accounting Port Number
This field is the RADIUS protocol accounting port. The default value is
1813. Cisco devices may require port 1646.
Secret Key
This field is the RADIUS protocol shared key.
Response Time Threshold

1088

Service Status SNMP

These fields allow you to set warning and critical threshold conditions
based on the response time. The response time is the time in milliseconds it
takes SolarWinds SAM to determine that a component is not Down and to
retrieve any statistical data.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

Service Status SNMP

This component monitor tests and reports the status of a service using SNMP.
Service statuses are:
1.
2.
3.
4.

Running
Continue Pending
Pause Pending
Paused

Statistic
The statistic for this component monitor is the value for one of the
reported statuses: 1-4.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Net Service Display Name
This field is the Display name of the service to monitor. You can find the
Display name on Windows systems by clicking Start> Administrative

1089

Chapter 30: Component Monitor Types

Tools> Services and then locating the desired service. The Display name
for the service is the value in the Name column.
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 15.

Statistic Critical Threshold

This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 5.

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

SMTP Monitor
This component monitor tests the ability of an SMTP server to accept incoming
connections and respond with the correct code.
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.

1090

SNMP Monitor
Port Number
This field is the port number used for SMTP connections. The default value
is 25. For Secure SMTP (SSMTP), use port 465.
Response Time Warning Threshold
This field allows you to set the Warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

SNMP Monitor
This component monitor uses the SNMP protocol to retrieve an entry in a
Management Information Base (MIB) by its Object Identifier (OID), and returns the
value of the entry as a statistic.
Statistic
Value of the entry retrieved from the MIB.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Component Type
Describes how the component monitor works.

1091

Chapter 30: Component Monitor Types

Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Method Type
Get - A manager-to-agent request to retrieve the value of a variable or list of
variables. Desired variables are specified in variable bindings (values are
not used). Retrieval of the specified variable values is to be done as an
atomic operation by the agent. A Response with current values is returned.
Get Next - A manager-to-agent request to discover available variables and
their values. Returns a Response with variable binding for the
lexicographically next variable in the MIB. The entire MIB of an agent can
be walked by iterative application of GetNextRequest starting at OID 0.
Rows of a table can be read by specifying column OIDs in the variable
bindings of the request.
Object Identifier (OID)
Specify the OID of the entry in the MIB you want to retrieve.
Custom SNMP port (set to 0 to use default SNMP port)
This field is the port number of the custom SNMP port. Set this field to 0 to
use the default SNMP port defined in the Nodes properties.
Count Statistic as Difference
Changes the statistic to be the difference in query values between polling
cycles.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the dropdown lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by

1092

SOAP Component Monitor

a blank field for you to enter the value of this threshold. For example: Less
than 15.

Statistic Critical Threshold

This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 5.

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

SOAP Component Monitor

SOAP is a communication system that delivers and receives
messages/instructions.
Note: Currently, the SOAPmonitor within SAMcan detect the presence of a
string and return a status of either Up or Down.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Component Type
This describes the type of monitor you are using.
Enable Component
This option determines whether or not the component is enabled. Disabling
this component leaves it in the application as deactivated and does not
influence application availability or status.
Credential for Monitoring
Select the credentials needed for monitoring this component.
SOAPXMLRequest

1093

Chapter 30: Component Monitor Types

You can either choose to load XMLfrom a WSDLfile or manually enter the
XML. If you choose to manually enter the SOAPXMLrequest, you must
populate the following fields:
Manually entering the SOAPXML request displays the following fields:
l

Web Service Server URL: The http(s) address of web server.

For example: [Link]

SOAPAction: Indicates the intent of the SOAP HTTP request.

For example: [Link]

l
l

SOAPVersion: Select either 1.1 or 1.2 from the dropdown list.

SOAPXML: This is the XMLenvelope.

Loading the SOAPXML from a WSDL displays the following

fields once the WSDL is successfully loaded:
l

Web Service Server URL: The http(s) address of web server.

For example: [Link]

l
l

Binding: Displays the type of binding detected in the WSDL.

Service Name: Displays the service name detected in the
WSDL.
Method Name: Displays the method name detected in the
WSDL.
Query: This is a dynamically generated field for Simple and
Complex method parameters where you can input values that
you can include as part of the SOAP message. (May not be
present depending upon the type of argument used.)
Parameters: This is a dynamically generated field for Simple
and Complex method parameters where you can input values
that you can include as part of the SOAP message. (May not be
present depending upon the type of argument used.)
Method Name Space: The unique identifier for the method. This
definitional information is extracted from the WSDL file.
Schema Name Space: The unique identifier for the schema.
This definitional information is extracted from the WSDL file.
SOAPAction: The unique name for the method itself. This definitional information is extracted from the WSDL file.

1094

Field Descriptions:
l

SOAPVersion: Displays the SOAPversion detected in the

WSDL. This definitional information is extracted from the WSDL
file.
SOAPXML: Content for this field is dynamically generated by
changing the other SOAP settings. This field serves for reviewing the envelope. Advanced users can edit the content in this
field.
For more information, see SOAP Monitor.

HTTPUser Agent
This identifies the client that is making the request. For example,
Google Chrome identifies itself as Mozilla/5.0 (Windows NT 6.2;
Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/32.0.1667.0 Safari/537.36 Some web services may behave
differently based on the user agent.
HTTPContent Type
Indicates the format of the content of the message. With SOAP, this
can either be application/soap+xml or text/xml.
Accept Compression
Indicates to the server whether or not the client supports compression
of the data.
Certificate Subject
The subject of the certificate to match against.
Ignore CAErrors
Decide whether or not to ignore any errors verifying the Certificate
Authority. This can occur if the certificate is self-signed or if the
certificate was not installed correctly on the server.
Ignore CN Errors
Ignore Common Name error. This occurs when the Common Name of
the certificate does not match the name of the server that is in the
URL.

1095

Chapter 30: Component Monitor Types

Use Proxy
This option allows you to tell the monitor whether or not it is going through a
proxy connection.
Proxy Address
Enter the address for the proxy connection, if enabled.
Search String
Allows you to enter a string to test for its presence.
Fail if Found
Select either Yes or No to determine if this monitor reports a status of Fail if
the string is found.
Response Time Threshold
Select and enter appropriate thresholds for Warning and Critical statuses.
For more information, see Application Monitor Thresholds.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts.
For more information, see:
l
l

SOAP Monitor
Web Service Monitoring

SQL Server User Experience Monitor

This component monitor uses synthetic transactions to test the abilities of a
Microsoft SQL Server database. The component monitor connects to the
database, performs a query, and then retrieves the data.
The SQL statement you use for this query must return a numerical value, not a
varchar.
Statistic
The statistic for this component monitor is the first row and column of
the data retrieved by the query. It must be a numerical value.

1096

Field Descriptions:
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Port Number
Select the Default Port or a Static Port from the dropdown menu. If a static
port is chosen, only values between 1 and 65535 are acceptable. Typically,
port 1433 is used for this monitor.
Credential for Monitoring
Select a Windows credential or SQL Server credential that can access the
database. If the credential you need is not already present in the credentials
list, use the Quick Credentials section to add a new credential.
Sql Query
This field allows you to specify the SQL query used to test the database.
The retrieved data is then used as the component monitor statistic. You may
enter up to 4000 characters.
SQL Server Instance
This field allows you to specify the SQL Server instance required to access
the SQL Server database. Enter only the instance name. Do not prefix the
instance name with the server name. To access the default instance, leave
this field blank.
Initial Catalog
This field allows you to specify the initial database (catalog) for the
connection.
Use Windows Authentication first, then SQL authentication

1097

Chapter 30: Component Monitor Types

Select this check box to access a SQL Server that supports or requires
Windows Authentication, and specifies that the credential is a Windows
credential instead of a SQL Server credential.
Query Timeout
Allows you to specify when this query should timeout in seconds. The
default timeout period is 30 seconds.
Count Statistic as Difference
Changes the statistic to be the difference in query values between polling
cycles.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the dropdown lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 15.

Statistic Critical Threshold

This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by

1098

SSL Certificate Expiration Date Monitor

a blank field for you to enter the value of this threshold. For example: Less
than 5.

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

SSL Certificate Expiration Date Monitor

This component monitor tests a web server's ability to accept incoming sessions
over a secure channel and then test the security certificate's expiration date.
Note: This monitor does not currently support proxies.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Port Number
The default value for this port is 443.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the dropdown lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Response Time Warning Threshold

1099

Chapter 30: Component Monitor Types

This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 15.

Statistic Critical Threshold

This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 5.

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

TACACS+ User Experience Monitor

This component monitor uses synthetic transactions to test user authentication
through the TACACS+ protocol. The synthetic transaction does the following:
1.
2.
3.
4.

Connect to server.
Send TACACS+ credential and shared secret.
Validate response.
Measure response time.

Statistic
This component monitor does not compute a statistic.

1100

Field Descriptions:
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a TACACS+ credential or create one in the Quick Credentials
section.
Port Number
This field is the TACACS+ protocol connection port. The default value is 49.
Secret Key
This field is the TACACS+ protocol shared key.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

1101

Chapter 30: Component Monitor Types

TCP Port Monitor

This component monitor tests the ability of a TCP/IP-based service to accept
incoming sessions. The Monitor tries to establish a socket connection usingthe
Connect method of [Link] classin [Link] framework. The
elapsed time for a connection is saved as Response Time in the result. More
information can be found at [Link]
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Port Number
This field is the TCP protocol connection port. The default value is 80.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.

1102

Tomcat Server Monitor

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

Tomcat Server Monitor

This component monitor collects server resource information from Apache
Tomcat servers by retrieving status information from [Link]
/manager/status/?XML=true.
Statistic
One of the following Tomcat variables as specified in the Tomcat
Variables Name field.
Free Memory
Amount of heap space currently available to the Java Virtual Machine.
Total Memory
Total memory currently allocated to the Java Virtual Machine heap space.
Max Memory
Maximum size of the heap space not including the permanent generation
area.
Total Processing Time
Total processing time in milliseconds since server start.
Total Request Count
Total requests from server since server start.
Total Bytes Sent
Total bytes sent from server since server start.
Total Bytes Received
Total bytes sent to server since server start.
Total Error Count
Total error count from all request processors.

1103

Chapter 30: Component Monitor Types

Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a credential that can access the password-protected portion of the
web site. If the credential you need is not already present in the credentials
list, use the Quick Credentials section to add a new credential.
Port Number
This field allows you to specify the port number used by the web site. The
default value for this field is 8080.
Url
Allows you to specify the URL you want to monitor. The SolarWinds SAM
variables ${IP} and ${PORT} contained in the default value for this field
attempts to monitor a web site at the IP address of the assigned node.
Tomcat Variables Name
Specifies the Tomcat server variable to monitor.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the dropdown lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Response Time Warning Threshold

1104

VMware Performance Counter Monitor

This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 15.

Statistic Critical Threshold

This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 5.

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

VMware Performance Counter Monitor

The VMware Performance Counter monitor reads VMware performance counter
data using the VMware vSphere Web Services API.
The currently used vSphere Web Services API version is 4.0, which supports
vSphere 4.0 servers and also is compatible with previous releases of ESX/ESXi
and VirtualCenter Server, including the following:
l
l
l

ESX/ESXi 3.5.x or later

VirtualCenter Server 2.5 and VirtualCenter Server 2.0.x.
The vSphere Web Services SDK package includes WSDL files for
vSphere API 4.0, which is a superset of API versions starting with API 2.5,
and for VI API 2.0.

1105

Chapter 30: Component Monitor Types

For an example of monitoring VMware performance counters, see Monitoring VMware Performance Counters on page 164.

Statistic
The statistic for this component monitor is the value of the
performance counter data retrieved by the VMware API.
Optionally, the statistic may be set as the difference in retrieved values
between polling cycles by checking the option for Count statistic as
difference.
Note: the Count statistic as difference option is applicable only for
monitors whose counter value increases consistently during each
polling interval. Examples of when this option is not applicable include
cases such as the following:
l

Counter values sometimes increase and sometimes decrease

from one polling interval to another (typical behavior for many
counters)
Counter values consistently decrease from one polling interval
to another

In these cases where the option is not applicable, negative statistic

data values will be replaced with zero (0), and the counter monitor will
show 0 as the statistic data value in resources and 0 as the value on
statistic data charts for this interval.
Field Description:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Component Type
Identifies the component type as a VMware Performance Counter Monitor.
Enable Component

1106

Field Description:
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a VMware credential that can access the VMware API. This is
typically a vCenter/ESX Server administrator-level credential. If the
credential you need is not already present in the credentials list, use the
Quick Credentials section to add a new credential.
Note: Read-Only credentials are sufficient since VMware objects are
accessed solely in read-only mode.
Port Number
Port number to use for VMware API. The default is 443.
Url
URL to use for connecting to the VMware API.
Count Statistic as Difference
Changes the statistic to be the difference in query values between polling
cycles.
Entity Type
Select one of the following:
Cluster Compute Resource
(Only applicable if you are monitoring VirtualCenter Server) Data
object that aggregates the computation resources of its associated
Host System objects into one single computation resource for use by
virtual machines. The cluster services such as HA (High Availability),
DRS (Distributed Resource Scheduling), and EVC (Enhanced
vMotion Compatibility), enhance the usefulness of this single
computation resource. This Entity Type is specific to vCenter systems.
Host System Managed object type that provides access to a virtualization host
platform.
l

Resource Pool Represents a set of physical resources which may be a

single host, a subset of a host's resources, or resources spanning multiple
hosts. You can subdivide Resource pools by creating child resource pools.
In order to run, a virtual machine must be associated as a child of a

1107

Chapter 30: Component Monitor Types

resource pool. In a parent/child hierarchy of resource pools and virtual
machines, the root resource pool is the single resource pool that has no
parent pool.
Virtual Machine Managed object type for manipulating virtual machines,
including templates that can be repeatedly deployed as new virtual
machines. This object type provides methods for configuring and controlling a virtual machine.

Entity Name
Specifies the VMware entity name to monitor, for example VirtualMachine1.
For VMs, you can view these values using the VMware console.
This field may contain the special ${VMWARE_ENTITY_NAME} variable. When
the monitor runs, this variable will be resolved to the first available entity on
a target host with the desired Entity Type (for example, the first Host
System). For more information, refer to the Multiple systems case in step
11 of the section Monitoring VMware Performance Counters on page 164.
Group
Specifies the VMware group to which the counter belongs, for example:
CPU, memory, and so forth.
Counter
Specifies the VMware counter to fetch, for example: coreUtilization, and so
forth.
Note: Click Component Monitor Wizard on the SAM Settings page to
browse the counters available for monitoring, including their groups, rollup
types, and instance names. Then select one of the following component
monitor types, depending on what you want to monitor:
l

VMware ESX Performance Counter Monitor monitors performance counters for ESX servers
VMware vCenter Performance Counter Monitor monitors
performance counters for vCenter servers

Rollup Type
Specifies the way to roll up the VMware counter data, for example: average,
latest, summation, and so forth.
Instance
Specifies the instance to be fetched, for example: 0, 1, 2, and so forth.

1108

Web Link Monitor

Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the dropdown lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 15.

Statistic Critical Threshold

This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 5.

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

Web Link Monitor

This component monitor collects the number of broken or invalid links on a web
page.
Prerequisites: None
Credentials: None
Statistic
The number of broken or invalid links collected.
Field Descriptions:
Description

1109

Chapter 30: Component Monitor Types

This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a credential that can access the password-protected portion of the
web site. If the credential you need is not already present in the credentials
list, use the Quick Credentials section to add a new credential.
Url
Allows you to specify the URL you want to monitor. The SolarWinds SAM
variable ${IP} contained in the default value for this field attempts to monitor
a web site at the IP address of the assigned node.
Accept Compression
If checked, indicates that compression is supported.
Exclusion Filter
Allows you to create an exclusion filter if there are links the component
monitor should not attempt to validate. It is a text matching filter.
Example that excludes any links to .png graphics files
Exclusion Filter: png
Ignore External Links
This option excludes external links from validation. External links are links
that do not link back to the same second-level domain as the original URL.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the dropdown lists to manipulate the returned value, or

1110

Windows Event Log Monitor

you can select the Custom Conversion option. For more information,
see "Conversion Value."
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 15.

Statistic Critical Threshold

This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 5.

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

Windows Event Log Monitor

This component monitor can use both WMI and RPC communication to scan
Windows Event Logs for recent events matching your defined criteria. Events are
considered recent based on the age of the event as compared to the application
polling frequency. If a matching event is found, the component monitor changes
status.

1111

Chapter 30: Component Monitor Types

The component monitor eventually returns to its original status as time passes so
you may not notice a matching event unless you create an alert to email you
when the component goes down.
This component monitor uses the following ports:
TCP/135; RPC/named pipes (NP) TCP 139, RPC/NP TCP 445, RPC/NP UDP
137, RPC/NP UDP 138
Statistic
The number of recent events matching your defined criteria.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a Windows credential that has access to the Windows event logs on
the target node. This is typically a Windows administrator-level credential. If
the credential you need is not already present in the credentials list, use the
Quick Credentials section to add a new credential.
Fetching Method
Select either WMI or RPC.
Note: RPC uses significantly more bandwidth than WMI.
Log to Monitor
Select Any Log to match events found in any log or select a specific log to
restrict your search. If the log you want is not listed, select Custom.
Custom Log to Monitor

1112

Field Descriptions:
Enter the log names as they appear in the Windows event log viewer.
Separate multiple log names with commas. Example: Internet
Explorer, [Link]
Match Definition
Select Any error in log generates a match if that is sufficient for your
needs, or select Custom to further restrict the match criteria.
Log Source
Enter a log source to further restrict the match criteria or leave the field
blank to match all possible log sources.
Event ID
Select the desired option to further restrict the match criteria for event
IDs or leave the field blank to find all possible event IDs:
l
l

Find all IDs match all event IDs

Match only specific IDs match all event IDs listed (separate multiple IDs
with commas)
Note: When you use multiple event IDs separated by commas, the logic
used to combine these event IDs is OR, so all events that contain one of
the event IDs listed are matched.
Exclude specific IDs exclude all event IDs listed (separate multiple IDs
with commas)

Event Type
Select Any Event to match any event type in the log, or select a
specific event type to further restrict the match criteria.
User who generated Events
Enter a user name to further restrict the match criteria. Leave this field
blank to match any users. Enter "N/A" to select only events with no
specific user.
Include events
Select With Keywords Below to specify keywords or phrases as the
match criteria. Select Matching Regular Expression Below to

1113

Chapter 30: Component Monitor Types

specify regular expressions that match text that appears in the events.
For information about the regular expressions syntax, see .NET
Framework Regular Expressions, [Link]
Exclude events
Select With Keywords Below to specify keywords or phrases as the
match criteria. Select Matching Regular Expression Below to
specify regular expressions that match text that appears in the events.
For information about the regular expressions syntax, see .NET
Framework Regular Expressions, [Link]
Number of past polling intervals to search for events:
Enter the number of polling intervals worth of time you want to search
the event logs. For example, to always search the past 20 minutes of
event logs, you could set the application polling interval to five
minutes and then set the Number of Past Polling Intervals to four (4 x
5mins = 20mins). Fractional values are valid.
Collect Detailed Data of Matched Events
Message and other details of matched events will be available for
viewing and alerting when enabled.
If a match is found in a polling period, component is:
Select whether a found match should set the component status to Up or
Down. You can also take action using the Based on Event Types, or Based
on Event Count options.
l

Based on Event Types: With this option, the result status of the component
monitor will never be down for a successful poll:
o Critical (When there is at least one event with a severity of Error or
FailureAudit.)
o Warning (When there is at least one event with a severity of Warning.)
o Up (When all matched events are either Informational or SuccessAudit.)
Based on Event Count: With this option, the status of the component monitor will never be down for a successful poll and the thresholds for the

1114

Windows PowerShell Monitor

returned value will be applied against the number of matched events.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the dropdown lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 15.

Statistic Critical Threshold

This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 5.

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

Windows PowerShell Monitor

This component monitor runs a Windows PowerShell script on the SolarWinds
SAM server or a remote target node and then processes the script's exit code and
text output.
The Windows PowerShell Monitor requires Windows PowerShell 2.0. It does not
work with Windows PowerShell 1.0.
For an example of creating a Windows PowerShell Monitor, see Creating a
Windows PowerShell Monitor" on page 389.
If you are having trouble using the Windows PowerShell Monitor, see the
following KB article for some useful tips:
[Link]

1115

Chapter 30: Component Monitor Types

For information about Remote Execution, see Communicate with Remoting Host
Note: A maximum of 10 output pairs can be returned. If you exceed the maximum
allowed, remove the excess output pairs or they will simply be ignored.
Statistic
The statistic for this component monitor is the Statistic value returned
by the script.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a Windows credential that is both a user who can log on to the
SolarWinds SAM server, and has sufficient rights on the target node to do
whatever the script needs to do. For example, if the script does something
with WMI, the credentials also need WMI rights on the target node. If the
credential you need is not already present in the credentials list, use the
Quick Credentials section to add a new credential.
The PowerShell monitor handles requests from PowerShell for the
credentials to run the script and resolves them using the selected
Credential for Monitoring. However some PowerShell commands used in
scripts require the use of the ${CREDENTIAL} variable. See the note in the
Script Body section below regarding the use of the ${CREDENTIAL}
variable.
Execution Mode
This field allows you to specify where to run the PowerShell script:
Count Statistic as Difference

1116

Field Descriptions:
Changes the statistic to be the difference in query values between polling
cycles.
Run the script under specified account
Select this option to enable impersonation with the component's
credentials. (This works only in local script execution mode.)
l

l
l

Local Host can run scripts only locally, that is, on the
SolarWinds SAM server. This is the default value.
Remote Host can execute scripts remotely (on the selected target node) using the Windows Remote Management (WRM) system component. WRM should be configured separately to get it
working with the Windows PowerShell monitor.
If Remote Host is selected, the following options are available:
Use HTTPS Protocol if checked, specifies that the secure
HTTPS protocol should be used to send and receive WS-Management protocol requests and responses. Otherwise the HTTP
protocol is used.
URL Prefix specifies a URL prefix on which to accept HTTP
or HTTPS requests. The default is wsman.
Port Number specifies the TCP port for which this listener is
created. For WinRM 1.1 and earlier, the default HTTP port is 80.
For WinRM 2.0, the default HTTP port is 5985.

Script Body
This field allows you to specify the PowerShell script you want to run. For
more information, see Creating a Windows PowerShell Monitor" on page
389.
Note: Use the ${CREDENTIAL} variable in the script where the credentials
are required, as shown in the following example:
$avg = Get-WmiObject win32_process -ComputerName '${IP}' -Credential
'${CREDENTIAL}' |Where-Object {$_.Name -eq "[Link]" } | Measure-Object property ReadOperationCount -Average;

Some PowerShell commands (such as Get-WmiObject as shown in the

example above) require the use of this ${CREDENTIAL} variable. Therefore,
the user name from the specified Credential for Monitoring is stored
automatically in the ${CREDENTIAL} variable for you by the monitor. As a
result, the ${CREDENTIAL} variable should not be placed in the Script
Arguments field, since it is set automatically. When the script is run by

1117

Chapter 30: Component Monitor Types

PowerShell, since no password has been provided, it prompts for a
password and the password from the specified Credential for Monitoring
is provided automatically by the monitor.
Note: Custom Properties can be passed by using the following format:
${[Link]} where xxx is the name of the custom property.
Script Arguments
This field allows you to specify arguments to pass to the script. You may
include the variable ${IP}, which is replaced by the IP address of the target
node.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}.

Windows Script Monitor

This component monitor runs a Windows script on the SolarWinds SAM server
and then processes the script's exit code and text output. Beginning in version
4.2, this monitor has the ability to return up to ten pairs, i.e.: 10 statistic values +
10 [optional] messages. For more information, see "Creating a Windows Script
Monitor.
Note: A maximum of 10 output pairs can be returned. If you exceed the maximum
allowed, remove the excess output pairs or they will simply be ignored.
Statistic
The statistic for this component monitor is the value returned by the
script.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Component Type
This describes the type of monitor you are using.

1118

Field Descriptions:
Enable Component
This option determines whether or not the component is enabled. Disabling
this component leaves it in the application as deactivated and does not
influence application availability or status.
Credential for Monitoring
Select a Windows credential that is both a user who can log on to the
SolarWinds SAM server, and has sufficient rights on the target node to do
whatever the script needs to do. For example, if the script does something
with WMI, the credentials also need WMI rights on the target node. If the
credential you need is not already present in the credentials list, use the
Quick Credentials section to add a new credential.
Script Engine
This field allows you to specify the scripting language to be used. The
default value is vbscript. Below is a list of scripting engines that the Windows
Script Host supports:
Name

File Extensions Availability

VBScript

.vbs

Installed by default

JScript

.js

Installed by default

PerlScript

.pls

Freeware

ooRexxScript

.rxs

Freeware

PythonScript

.pys

Freeware

TclScript

.tcls

Freeware

ActivePHPScript

.phps

Freeware

RubyScript

.rbs

Freeware

Object Rexx engine

Commercial

Delphi scripting engine

Commercial

Count Statistic as Difference

1119

Chapter 30: Component Monitor Types

Changes the statistic to be the difference in query values between polling
cycles.
Script
This field allows you to enter the script you want to run on the target node.
To enter your script, click the Edit button that reveals the script editing
window.
Script Arguments
This field is in the script editing window and allows you to specify
arguments to pass to the script. You may include the variables ${IP},
${USER}, and ${PASSWORD}, which are replaced respectively by the IP
address of the target node, the credential user name, and the credential
password.
Body
This field is in the script editing window and allows you to enter your script
via typing or pasting.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

Windows Service Monitor

This component monitor uses WMI or RPC communication to test if a specified
Windows service is running, and reports the CPU, virtual memory, and physical
memory used by the service.
Statistic
This component monitor does not compute a statistic.
Field Descriptions
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"

1120

Field Descriptions
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a Windows credential that has WMI rights on the target node. This is
typically a Windows administrator-level credential. If the credential you need
is not already present in the credentials list, use the Quick Credentials
section to add a new credential.
Fetching Method
Select the Fetching Method (Communication Type):
l

WMI (Windows Management Instrumentation) Use WMI

communication to test if the specified Windows process is running.
RPC (Remote Procedure Call) Use RPC communication to
test if the specified Windows process is running.

SAM will poll the service state, and information about CPU/memory
usage will be retrieved using performance counters.
Net Service Name
This field is the Service name of the service to monitor. You can find the
Service name on Windows systems by clicking Start> Administrative
Tools> Services and then locating the desired service. Right-click the
service and select Properties from the context menu. The Service name is
the value of the Service name field in the Properties dialog.
CPU Threshold
These fields allow you to set warning and critical threshold conditions
based on the percentage of CPU resources in use by the monitored
process.
Physical Memory Threshold
These fields allow you to set warning and critical threshold conditions
based on the percentage of physical memory in use by the monitored
process.
Virtual Memory Threshold

1121

Chapter 30: Component Monitor Types

These fields allow you to set warning and critical threshold conditions
based on the percentage of virtual memory in use by the monitored process.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

WMI Monitor
Formerly known as the WMI Performance Counter Monitor, this component
monitor uses WMI communication to obtain the result of a WMI Query Language
(WQL) query. The typical result retrieves the performance data calculated by WMI
providers such as the Windows operating system or Microsoft Exchange Server.
All WQL queries are run within the root/CIMV2 namespace.
Note: Named instances of SQL Server may have custom class names that do not
match the built-in templates. You must manually change the class name in any
WMI Monitor monitoring a named SQL Server instance. For example, if the
named instance is "NAMED, you must change Win32_PerfFormattedData_
MSSQLSERVER_SQLServerBufferManager to Win32_PerfFormattedData_
MSSQLNAMED_SQLNAMEDServerBufferManager.
Statistic
The statistic for this component monitor is the value of the first row and
column of the data retrieved by the query.
Optionally, the statistic may be set as the difference in query values
between polling cycles by checking the option for Count statistic as
difference.
Note: the Count statistic as difference option is applicable only for
monitors whose counter value increases consistently during each
polling interval. Examples of when this option is not applicable include
cases such as the following:
l

Counter values sometimes increase and sometimes decrease

from one polling interval to another (typical behavior for many
counters)
Counter values consistently decrease from one polling interval
to another

1122

Field Descriptions:
In these cases where the option is not applicable, negative statistic
data values will be replaced with zero (0), and the counter monitor will
show 0 as the statistic data value in resources and 0 as the value on
statistic data charts for this interval.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a Windows credential that has WMI rights on the target node. This is
typically a Windows administrator-level credential.
WMI Namespace
Specifies the name of the namespace within which all WQL queries are run.
The default value is root\CIMV2.
WQL Query
Type the WQL query you want to run on the target node. This is typically a
performance counter Query, but it can be any WQL query. All WQL queries
are run within the root/CIMV2 namespace. The WQL query for this monitor
returns a numeric value. It will not report errors.
Count Statistic as Difference
Changes the statistic to be the difference in query values between polling
cycles.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a

1123

Chapter 30: Component Monitor Types

variety of mathematical possibilities. You can choose common
functions from the dropdown lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 15.

Statistic Critical Threshold

This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the dropdown followed by
a blank field for you to enter the value of this threshold. For example: Less
than 5.

User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"

1124

Chapter 31:
Filter Syntax Reference
Filters are optional database queries that you can add limit the Orion objects
listed inside a resource. You can apply filters based on any Orion object property,
be it custom or pre-defined within a resource, to help you better interpret the
monitoring data shown in the resources.
To apply a resource filter:
1. Click Edit in any resource that lists Orion objects.
2. Click Show Filter Examples > Show List of Properties to list the properties you can use for the filter criteria
3. Provide appropriate filter criteria in the Filter Nodes field and then click
Submit.

Filter Syntax
There are two slightly different filter syntax types: Structured Query Language
(SQL) syntax and SolarWinds Query Language (SWQL) syntax. The two main
differences between SQL and SWQL are:
l
l

The SWQL wildcard character is %. The SQL wildcard character is *.

If the resource you are trying to filter creates its list by joining two tables
together that contain properties that share the same name, you cannot filter on
that property unless you attach a particular SQL table name to the beginning
of the property name. The same is true also for SWQL queries, except you
must look up the SWQL name and use that as a prefix insteadof a SQL table
name.

SQL or SWQL?
It is not always obvious whether a resource requires SQL syntax or SWQL syntax
filters. Generally, the resources that have most recently been added to
SolarWinds Orion use SWQL syntax, while the oldest ones require SQL syntax.

1125

Chapter 31: Filter Syntax Reference

Look for additional guidance at the bottom of the Edit Resource page in the form
of words such as "SWQL query" or "SQL query".

SWQL Filter Syntax Examples

Wildcards
The wildcard character in SWQL syntax is: %.
Example: [Link] Like 'AX3%'
Filtering by Custom Property
The property syntax to filter by custom property is:
[Link]
Example filter to only show nodes with the custom property City that
matches Atlanta:
[Link] = 'Atlanta'

Filtering by Built-in Properties

Use the SWQL table name for selecting properties for your queries.
Examples
Example filter to show data from Cisco devices: [Link] =
'Cisco'

Example filter to show data from Windows Server 2003-2008

applications: [Link] = 'Windows Server 2003-2008'
Example filter to show data from devices beginning with "AX3":
[Link] Like 'AX3%'

Example filter to show data from Process Monitor SNMP type

component monitors: [Link] = 8
Filtering by Status
To filter by the status property, you must know the valid status levels:
Level Status
0

Unknown

1126

SQL Filter Syntax Examples

Up

Down

Warning

14

Critical
Example filter to only show monitors that are not down:
[Link]<>2

SQL Filter Syntax Examples

Wildcards
The wildcard character in SQL syntax is: *.
Example: [Link] Like 'AX3*'
Filtering by Custom Property
The property syntax to filter by custom property is:
[Link]
Example filter to only show nodes with the custom property City that
matches Atlanta:
[Link] = 'Atlanta'

Examples
Example filter to show only Cisco devices: Vendor = 'Cisco'
Example filter to show data only from component monitors named
Server Load Monitor: [Link] like 'Server Load Monitor'
Example filter to show data from devices beginning with "AX3":
[Link] Like 'AX3*'

Example filter to show only Nortel devices that are Down: Vendor Like
'Nortel*' AND Status=2

Filtering by Status
To filter by the status, you must know the valid status levels:

1127

Chapter 31: Filter Syntax Reference

Level Status
0

Unknown

Up

Down

Warning

14

Critical
Example filter to only show monitors that are not down:
[Link]<>2

SWQL Resource Matrix

The resource matrix helps you find the SWQL aliases you need to create filter
criteria for your resources. The SWIS entity names are provided so that you know
exactly how the SWQL alias maps to the SWIS entities in your SolarWinds
product databases.

EOC Filters
All Enterprise Operations Console (EOC) resources use SWQL filtering:
Alert Resource Filters
Resource

SQL Table Name SWQL Name

Global Last XX Active Alerts EOC.Alert2

[Link]

Alert
Orion

Orion SAM Resource Filters

Resource

SQL Table Name

SWQL
Name

Global All Applications

[Link]

[Link]

AT

1128

Orion SAM Resource Filters

[Link]

CAS

[Link]

[Link]

Orion

Global Application Health

Overview

[Link]

Status

[Link]

Orion

Global Applications by Status

[Link]

[Link]

AT

[Link]

CASN.

[Link]

[Link]

Orion

[Link]

[Link]

AT

[Link]

CAS

[Link]

[Link]

Orion

[Link]

[Link]

AT

[Link]

CAS

[Link]

[Link]

Orion

[Link]

[Link]

AT

[Link]

CAS

[Link]

[Link]

Orion

[Link]

Global Applications with High

Process CPU Load

Global Applications with High

Process Memory Used

Global Applications with High

Response Time

Global Down Applications

1129

Chapter 31: Filter Syntax Reference

Global Top XX Monitors by

Response Time

Global Top XX Process

Monitors by CPU Load

Global Top XX Process

Monitors by Physical Memory

Global Top XX Process

Monitors by Virtual Memory

Total Application by Type for

Each Local Orion

[Link]

CAS

[Link]

[Link]

Orion

[Link]

[Link]

AT

[Link]

CAS

[Link]

CS

[Link]

[Link]

Orion

[Link]

[Link] CCS
[Link]

CS

[Link]

[Link]

Orion

[Link]

[Link] CCS
[Link]

CS

[Link]

[Link]

Orion

[Link]

[Link] CCS
[Link]

CS

[Link]

[Link]

Orion

[Link]

AT

[Link]

1130

Events Filters
Events Filters
Resource

SQL Table Name SWQL Name

Global Events Summary [Link]

Global Last XX Events

Event

[Link]

EventType

[Link]

Orion

[Link]

Event

[Link]

EventType

[Link]

Node

[Link]

Orion

Inventory Filters
Resource

SQL Table Name SWQL Name

Number of Interfaces by Type

[Link]

[Link]

Node

[Link]

Orion

Number of Nodes by Device Type [Link]

Node

[Link]

Orion

[Link]

Node

[Link]

Orion

Number of Nodes by IOS/OS

EOC Filters
Resource

SQL Table Name

SWQL
Name

Global Top XX Errors & Discards This Hour

[Link]

[Link]

[Link]

Orion

1131

Chapter 31: Filter Syntax Reference

Global Top XX Error & Discards Today

[Link]

[Link]

[Link]

Orion

[Link]

[Link]

Node

[Link]

Orion

[Link]

[Link]

[Link]

Orion

[Link]

[Link]

Node

[Link]

Orion

Global Top XX Nodes by Average Response

Time

[Link]

Node

[Link]

Orion

Global Top XX Nodes by CPU Load

[Link]

Node

[Link]

Orion

Global Top XX Nodes by Current Response

Time

[Link]

Node

[Link]

Orion

Global Top XX Nodes by Percent Memory

Used

[Link]

Node

[Link]

Orion

Global Top XX Nodes by Percent Packet

Loss

[Link]

Node

[Link]

Orion

Global Top XX Volumes by Disk Space Used

[Link]

[Link]

Orion

Global Top XX Interfaces by percent

utilization

Global Top XX Interfaces by Relative

Multicast Packet Rate

Global Top XX Interfaces by Traffic

[Link] VS

1132

IP SLA Filters
IP SLA Filters
Resource

SQL Table Name

SWQL Name

Global Active IP SLA

Operation Alerts

[Link]

AlertStatus

[Link]

AlertDefinition

[Link]

IpSlaOperation

[Link]

IpSlaOperationType

[Link]

Orion

[Link]

AlertStatus

[Link]

AlertDefinition

[Link]

IpSlaOperation

Global All IP SLA

Operations

[Link] ipSlaOperationStatus

Global Top XX Call

Paths by Jitter

Global Top XX Call

Paths by Latency

[Link]

IpSlaOperationType

[Link]

SourceSite

[Link]

TargetSite

[Link]

Node

[Link]

Orion

[Link]

N1

[Link]

N2

[Link]

[Link]

[Link]

S1

[Link]

S2

[Link]

[Link]

N1

[Link]

N2

[Link]

[Link]

1133

Chapter 31: Filter Syntax Reference

Global Top XX Call

Paths by MOS

Global Top XX Call

Paths by Packet Loss

Global VoIP Call

Managers

Global VoIP Call Paths

[Link]

S1

[Link]

S2

[Link]

[Link]

N1

[Link]

N2

[Link]

[Link]

[Link]

S1

[Link]

S2

[Link]

[Link]

N1

[Link]

N2

[Link]

[Link]

[Link]

S1

[Link]

S2

[Link]

[Link]

[Link]

[Link]

[Link]

N1

[Link]

N2

[Link]

[Link]

[Link]

S1

[Link]

S2

[Link]

1134

NCM Filters

Global VoIP Collector

Services

[Link]

[Link]

Global VoIP Sites

Overview

[Link]

N1

[Link]

N2

[Link]

[Link]

[Link]

S1

[Link]

S2

[Link]

NCM Filters
Resource

SQL Table Name

SWQL Name

Global Configuration
Manager Nodes

[Link]

ConfigArchive

[Link]

NCMNode

[Link]

Node

[Link]

Orion

[Link]

ConfigArchive

[Link]

NCMNode

[Link]

Node

[Link]

Orion

[Link]

CacheDiffResults

Global Devices Backed

Up vs Not Backed Up

Global Last XX Config

Changes

[Link] ComparisonCache
[Link]

NCMNode

[Link]

Node

[Link]

Orion

1135

Chapter 31: Filter Syntax Reference

NTA Filters
Resource

SQL Table Name

Global Last XX Traffic Analysis Events [Link]

Global NetFlow Sources

SWQL Name
EventType

[Link]

Event

[Link]

Node

[Link]

Orion

[Link]

[Link] S

NetFlow Collector Services

[Link]

[Link]

[Link] S
[Link]

Wireless Filters
Resource

SQL Table Name

SWQL
Name

Global Wireless Clients

[Link]

[Link]

[Link] WI
Top XX Access Points by Number of
Clients

[Link]

[Link]

[Link] WI
Top XX Wireless Clients by Traffic
Rate

[Link]

[Link]

[Link]

WC

1136

Summary Report Filters

Summary Report Filters
Resource

SQL Table Name

SWQL Name

Global Down Interface

[Link]

[Link]

Node

[Link]

Orion

[Link]

Node

[Link]

Orion

[Link]

[Link]

Node

[Link]

Orion

[Link]

Node

Global Down Nodes

Global High Errors &

Discards Today

Global Node Status by

Site

[Link] NodeCustomProperty
[Link]

Orion

Global Nodes with High

CPU Load

[Link]

Node

[Link]

Orion

Global Nodes with High

Memory Utilization

[Link]

[Link]

Orion

Global Nodes with High

Packet Loss

[Link]

Node

[Link]

Orion

Global Nodes with High

Response Time

[Link]

Node

[Link]

Orion

Global Top XX Nodes

with Problems

[Link]

Node

Global Volumes with

High Percent usage

[Link] NodeCustomProperty
[Link]

Orion

[Link]

1137

Chapter 31: Filter Syntax Reference

Orion Summary
Statistics

[Link]

Orion

[Link]

[Link]

SysLog Filters
Resource

SQL Table Name SWQL Name

SysLog Summary [Link]

[Link]

Orion
SysLog

Trap Filters
Resource

SQL Table Name SWQL Name

Global Trap Resource [Link]

Orion

[Link]

Trap

IVIM Filters
All Integrated Virtual Infrastructure Management (IVIM) resources use SWQL
filtering:
Virtualization Summary
Resource

SQL Table
Name

Top 10 VMware Hosts by Percent Memory

Used

[Link] h

Top 10 VMware Hosts by Network Utilization

[Link] hosts

[Link]

[Link]

1138

SWQL
Name

Datacenter Details

Top 10 VMware Hosts by CPU Load

[Link] h
[Link]

Top 10 VMware Hosts by Number of Running

VMs

[Link] hosts
[Link]

nodes

Resource

SQL Table
Name

SWQL
Name

Top 10 VMware Hosts by Percent Memory

Used

[Link] hosts

Top 10 VMware Hosts by Network Utilization

[Link] hosts

Datacenter Details

[Link]

[Link]
Top 10 VMware Hosts by CPU Load

nodes

nodes

[Link] hosts
[Link]

Top 10 VMware Hosts by Number of Running

VMs

nodes

[Link] hosts
[Link]

nodes

Cluster Details
Resource

SQL Table Name

Top 10 Managed VMware Guests by

Current Response Time

[Link] vms

Top 10 Managed VMware Guests by

Percent Memory Used

SWQL
Name

[Link]

hosts

[Link]

nodes

[Link]

stats

[Link] vms
[Link]

hosts

[Link]

1139

Chapter 31: Filter Syntax Reference

Top 10 Managed VMware Guests by

CPU Load

[Link] vms

Top 10 Managed VMware Guests by

Network Usage

[Link]

hosts

[Link]

[Link] VM
[Link]

[Link]

SolarWinds SAM Filters

Resources for SAM use a mix of SWQL and SQL filters. Tables that start with
APM_ are SQL tables and use SQL filters. All the others are SWIS tables and use
SWQL filtering:
SAM Resource Filters
Resource

Table Name

SWQL Alias

All Applications
Tree

[Link]

Application

[Link]

ApplicationTemplate

[Link] Status
[Link]

Nodes

Applications with [Link]

Problems
[Link]

Application
Template

[Link] Status

Top XX
Components by
Statistic Data

[Link]

Nodes

APM_CurrentComponentStatus

MonitorStatus

APM_PortEvidence

pe

1140

SAM Resource Filters

Top XX
Components by
Response Time

Top XX
Processes by
CPU Load

Top XX
Processes by
Physical
Memory

Top XX
Processes by

APM_ComponentExt

Monitor

APM_Application

Application

APM_CurrentApplicationStatus

ApplicationStatus

APM_ThresholdsByComponent

thresholdRT

APM_ThresholdsByComponent

thresholdStat

APM_ErrorCode

ec

APM_StatusCodeType

sct

APM_StatusCode

sc

APM_CurrentComponentStatus

MonitorStatus

APM_PortEvidence

pe

APM_ComponentExt

Monitor

APM_Application

Application

APM_CurrentApplicationStatus

ApplicationStatus

APM_ThresholdsByComponent

Threshold

APM_CurrentComponentStatus

MonitorStatus

APM_PortEvidence

pe

APM_ComponentExt

Monitor

APM_Application

Application

APM_CurrentApplicationStatus

ApplicationStatus

APM_CurrentComponentStatus

MonitorStatus

APM_PortEvidence

pe

APM_ComponentExt

Monitor

APM_Application

Application

APM_CurrentApplicationStatus

ApplicationStatus

APM_ThresholdsByComponent

Threshold

APM_CurrentComponentStatus

MonitorStatus

APM_PortEvidence

pe

1141

Chapter 31: Filter Syntax Reference

Virtual Memory

APM_ComponentExt

Monitor

APM_Application

Application

APM_CurrentApplicationStatus

ApplicationStatus

APM_ThresholdsByComponent

Threshold

1142

Configuring and Integrating

This chapter provides a basic introduction to technologies associated with SAM. It
is designed to give system administrators an overview of how these technologies
work, as well as how they integrate with SAM. For more detailed information on
these technologies, explore resources outside of this guide.

JMX
JMX is an acronym for Java Management Extensions and allows remote clients
to connect to a Java Virtual Machine (JVM).
Using JMX, you can manage and monitor running applications in a JVM
environment. Using Java, management of applications in a virtual machine is
done through the use of Managed Beans, or MBeans.
MBeans are the soul of JMX. MBeans are the controllable end-points of an
application where remote clients can watch application activity as well as control
them. The MBean represents a resource running in the JVM, such as an
application. They can be used for collecting statistics like performance, resource
usage, problems, and so on.
To monitor a Java Virtual Machine through JMX, add the following argument into
the java command that publishes the platform MBean server to your local
environment for monitoring.
[Link]

Your Java Virtual Machine can now be monitored.

1143

Configuring and Integrating

JConsole
A common tool used to monitor a JVM is JConsole. JConsole is a free graphical
monitoring tool used to monitor JVMs, which can be found here:
[Link]
JConsole is not necessary to use the JMX component monitor within SAM. The
information provided here concerning JConsole is an introduction to using Java
as a means of monitoring. Detailed information on how to use JConsole can be
found by navigating to the following link:
[Link]
Once you have downloaded and installed JConsole, you can run it by navigating
to the folder where it was installed. Typically, the [Link] is located at:
C:\Program Files\Java\jdk1.7.0_02\bin\[Link].

Double-click [Link] to start the program. Following is a screenshot of

JConsole running, before being logged in:

1144

To login to JConsole:
To login to JConsole:
1.
2.
3.
4.

Select either the Local Process option or the Remote Process option.
Highlight your option by clicking on it.
Complete the credential fields (Username & Password).
Click Connect.

After you are successfully logged in, click on the tab entitled MBeans. Clicking the
MBeans tab brings you to this screen:

From here, you can drill down to any MBean you want by expanding the folder
tree in the left pane of the window. Select any MBean (file in the tree) to have
information about it displayed in the right pane. These MBeans are what
SolarWinds SAM uses when polling information from the JVM.

1145

Configuring and Integrating

Adding a JMX Component Monitor to SAM

Creating a standard template for this monitor is not practical because of the
amount of variables in any one specific environment. However, adding a JMX
monitor to your environment has been made simple with the use of a wizard
driven interface. The JMX wizard will automatically reveal the MBeans available
for monitoring.
To add a JMX Monitor to a node using the wizard:
1.
2.
3.
4.
5.

From the web console, click SAM Settings.

Click Component Monitor Wizard.
Select JMX Monitor from the dropdown list.
Click Browse to find the node you want to monitor.
Choose a credential from the Credential Library or create a new one using
the Username and Password fields.
Note: For step 6, the defaults are sufficient for most environments. If they
are not, you can change them to suit your environment.

1146

To add a JMX Monitor to a node using the wizard:

6. Add the Port number, Protocol type, URL path, and Credentials for the
remaining fields.

7. Click Next. The following MBean selection screen appears:

Note: Only values that return numerical data can be monitored. String data
is not supported at this time. Non-numerical data will be shown without a
check box when selecting MBeans to poll from within SAM, as illustrated

1147

Configuring and Integrating

below:

8. Expand the folders by clicking the arrows (or [+]) to expand the tree-view
folder structure. From here you can drill down to select the attributes you
want by checking them.
9. Click Next.
Now you are able to edit the JMX Component Monitor properties. Following is an
illustration of how polled MBeans will look when successfully added and
implemented within SAM:

1148

Configuring Java Applications Servers for JMX

If you choose not to use the wizard, you must manually enter values for each JMX
monitor, as shown in the illustration below. Entering the correct information can
be complicated and cumbersome. This method is best suited for an administrator
who is very familiar with the Java environment.

Configuring Java Applications Servers for JMX

The following sections discuss how to enable SNMP on JVM servers. Instructions
are given for Apache Tomcat, JBoss, Glassfish, IBM Websphere, and Oracle
Weblogic for both Linux and Microsoft Windows operating systems.
Additional JMX configuration information can be found here:
[Link]
Configuring Apache Tomcat (tested on version 7.0)
Windows Service
1. Open Tomcat configuration: Start > All Programs > Apache Tomcat >
Configure Tomcat.
2. Open the Java tab, and then add the following lines to the Java Options
box:
-[Link]
-[Link]=6969

1149

Configuring and Integrating

-[Link]=false
-[Link]=false

3.
4.
5.
6.
7.

Click Apply.
Go to the Windows Services console.
Right-click the Apache Tomcat service, and then click Properties.
Click the Log On tab, and then select Log on as this account.
Click Browse and find the user Administrator and type the Administrator
password twice.
8. Click OK.
9. In the Tomcat Configuration window, return to the General tab, and then
start the service.
Windows Command Line
1. Open the file %TOMCAT_HOME%\bin\[Link] and add the following
lines into the Debug, Run and Start sections where %TOMCAT_HOME%
is the path of your Tomcat installation:
set "JAVA_OPTS=%JAVA_OPTS% -[Link]"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=8686"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=false"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=false"

:doDebug
set "JAVA_OPTS=%JAVA_OPTS% -[Link]"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=8686"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=false"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=false"
shift

:doRun
set "JAVA_OPTS=%JAVA_OPTS% -[Link]"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=8686"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=false"
set "JAVA_OPTS=%JAVA_OPTS% -

1150

Configuring Apache Tomcat (tested on version 7.0)

[Link]=false"
shift

:doStart
set "JAVA_OPTS=%JAVA_OPTS% -[Link]"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=8686"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=false"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=false"
shift

2. Run %TOMCAT_HOME%\bin\[Link] to start Tomcat.

Linux
1. Open $TOMCAT_HOME/bin/[Link] and then add the following lines into
the Debug, Run and Start sections, where %TOMCAT_HOME% is the path to
your Tomcat installation:
JAVA_OPTS="$JAVA_OPTS -[Link]"
JAVA_OPTS="$JAVA_OPTS -[Link]=8686"
JAVA_OPTS="$JAVA_OPTS -[Link]=false"
JAVA_OPTS="$JAVA_OPTS -[Link]=false "

if [ "$1" = "debug" ] ; then

JAVA_OPTS="$JAVA_OPTS -[Link]"
JAVA_OPTS="$JAVA_OPTS -[Link]=8686"
JAVA_OPTS="$JAVA_OPTS -[Link]=false"
JAVA_OPTS="$JAVA_OPTS -[Link]=false "
if $os400; then

elif [ "$1" = "run" ]; then

JAVA_OPTS="$JAVA_OPTS -[Link]"
JAVA_OPTS="$JAVA_OPTS -[Link]=8686"
JAVA_OPTS="$JAVA_OPTS -[Link]=false"
JAVA_OPTS="$JAVA_OPTS -[Link]=false "
shift

1151

Configuring and Integrating

elif [ "$1" = "start" ] ; then

JAVA_OPTS="$JAVA_OPTS -[Link]"
JAVA_OPTS="$JAVA_OPTS -[Link]=8686"
JAVA_OPTS="$JAVA_OPTS -[Link]=false"
JAVA_OPTS="$JAVA_OPTS -[Link]=false "
if [ ! -z "$CATALINA_PID" ];

then

2. Run the $TOMCAT_HOME/bin/[Link] command to start Tomcat.

For more information, see "JMX" on page 1143.
Configuring JBoss (tested on versions 5.0.1, 5.1, and 6.0)
Windows Service
1. Edit %JBOSS_HOME%\bin\[Link] by adding the following lines, where
%JBOSS_HOME% is the path to your JBoss installation:
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=[Link]"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=8686"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=false"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=false"

rem Setup JBoss specific properties

set JAVA_OPTS=-[Link]=%PROGNAME% %JAVA_OPTS%
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=[Link]"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=8686"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=false"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=false"

2. Register JBoss as a service by running: %JBOSS_HOME%\bin\[Link]

install

1152

Configuring JBoss (tested on versions 5.0.1, 5.1, and 6.0)

3.
4.
5.
6.
7.

Go to the Windows Services console.

Right-click the JBoss Application Server service.
Click Properties.
Click the Log On tab and then select Log on as this account.
Click Browse, find the user Administrator, and then type the Administrator
password twice.
8. Click OK.
9. Start the JBoss service.
Windows Command Line
1. Edit %JBOSS_HOME%\bin\[Link] by adding the following lines, where
%JBOSS_HOME% is the path to your JBoss installation:
set "JAVA_OPTS=%JAVA_OPTS% [Link]=[Link].
[Link]"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]"
set "JAVA_OPTS=%JAVA_OPTS% [Link]=8686"
set "JAVA_OPTS=%JAVA_OPTS% [Link]=false"
set "JAVA_OPTS=%JAVA_OPTS% [Link]=false"
rem Setup JBoss specific properties
set JAVA_OPTS=-[Link]=%PROGNAME% %JAVA_OPTS%

set "JAVA_OPTS=%JAVA_OPTS% [Link]=[Link].

[Link]"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]"
set "JAVA_OPTS=%JAVA_OPTS% [Link]=8686"
set "JAVA_OPTS=%JAVA_OPTS% [Link]=false"
set "JAVA_OPTS=%JAVA_OPTS% [Link]=false"

Start JBoss by running %JBOSS_HOME%\bin\[Link].

Linux
1. Edit $JBOSS_HOME/bin/[Link] by adding the following lines, where $JBOSS_
HOME$ is the path to your JBoss installation:
JAVA_OPTS="$JAVA_OPTS -

1153

Configuring and Integrating

[Link]=[Link]"
JAVA_OPTS="$JAVA_OPTS -[Link] "
JAVA_OPTS="$JAVA_OPTS -[Link]=8686"
JAVA_OPTS="$JAVA_OPTS -[Link]=false"
JAVA_OPTS="$JAVA_OPTS -[Link]=false "
# Setup JBoss specific propertiesJAVA_OPTS="${JAVA_OPTS:+$JAVA_
OPTS -[Link]=$PROGNAME}"JAVA_OPTS="${JAVA_OPTS:--[Link]=$PROGNAME}"JAVA_OPTS="$JAVA_OPTS -[Link]=[Link]"
JAVA_OPTS="$JAVA_OPTS -[Link] "
JAVA_OPTS="$JAVA_OPTS -[Link]=8686"
JAVA_OPTS="$JAVA_OPTS -[Link]=false"
JAVA_OPTS="$JAVA_OPTS -[Link]=false "

2. Run JBoss by running $JBOSS_HOME/bin/[Link].

For more information, see "JMX" on page 1143.
Configuring GlassFish (tested on version 3.1):
1. Run the GlassFish Application Server.
2. Open a web browser and then navigate to: [Link] where
hostname is the name of your GlassFish server.
3. In the left panel, click Configurations: server-config.
4. In the main window, click JVM settings.
5. Click the JVM Options tab.
6. Click Add JVM Option and then type [Link]=[Link] in the blank field, where
[Link] is the hostname of your GlassFish server.
7. Click Add JVM Option and then type [Link]=false in the blank field.
8. Click Add JVM Option and then type [Link]=false in the blank field.
9. Click Save.
10. Restart the GlassFish server.
By default, GlassFish uses JMX on port 8686. To change the JMX port you
should find the jmx-connector section in: %GLASSFISH_

1154

Configuring IBM WebSphere (tested on version 7.0)

HOME%\glassfish\domains\<your_domain>\config\[Link], where
%GLASSFISH_HOME% is the path where GlassFish is installed, then change
the port value.
For more information, see "JMX" on page 1143.
Configuring IBM WebSphere (tested on version 7.0)
IBM WebSphere uses its own JDK installed at %WEBSHERE_HOME%\java,
where %WEBSHERE_HOME% is the path of your WebSphere installation.
Configure the IBM JDK in the following manner:
1. Go to the $JAVA_HOME/jre/lib/management folder.
2. Edit [Link] by adding the following:
[Link]=8686
[Link]=false
[Link]=false

3. Run the IBM WebSphere Application Server.

4. Open a web browser and then navigate to: [Link] where
hostname is the name of the IBM WebSphere server.
5. In the left pane, click Applications and WebSphere Enterprise
Applications.
6. Check to see if [Link] is in the list. If it is, skip to step 12. If
not, continue to step 7.
7. In the left pane, click Applications and New Application.
8. Click New Enterprise Application.
9. Select Local File System and then click Browse.
10. Find the WebSphere directory here: AppServer > InstallableApps >
[Link].
11. Click Next multiple times until your installation is complete.
12. In the left pane, click Monitoring and Tuning and Performance
Monitoring Infrastructure(PMI).
13. Select your server. In the Configuration tab, enable the PMI and set All
Statistics.
14. Set All Statistics in the Run time Tab.
15. Save all changes.
16. In the left panel, click Expand Servers and Server types.
17. Click WebSphere Application Servers.
18. In the main window, click your server.

1155

Configuring and Integrating

19. In the Server Infrastructure section, expand Java and Process
Management.
20. Click Process Definition.
21. In the Additional Properties section, click Java Virtual Machine.
22. In Generic JVM Arguments, add the following:
-[Link]= -[Link]
23. Save all changes.
24. Go to the Windows Services console.
25. Right click the IBM Websphere service.
26. Click Properties.
27. Click the Log On tab and then select Log on as this account.
28. Click Browse, find the user Administrator, and then type the
Administrator password twice.
29. Click OK.
30. Restart the IBM WebSphere Application Server.
For more information, see "JMX" on page 1143.
Configuring Oracle WebLogic (tested on version [Link])
Note: To add support for a WebLogic server, please refer to this KB article:
[Link]
tions/2687/Adding+support+for+a+WebLogic+server+to+poll+MBeans.
Windows
1. Edit the following file, where %MIDDLEWARE_HOME% is the path of your
WebLogic installation:
%MIDDLEWARE_HOME%\C:\Oracle\Middleware\user_
projects\domains\<your_domain>\bin\[Link]
Add the following lines to the end of the file:
set "JAVA_OPIONTS=%JAVA_OPTIONS% -[Link]"
set "JAVA_OPTIONS=%JAVA_OPTIONS% [Link]=8686"
set "JAVA_OPTIONS=%JAVA_OPTIONS% [Link]=false"
set "JAVA_OPTIONS=%JAVA_OPTIONS% [Link]=false"

Warning: This file is created by the Configuration Wizard. Your changes to

1156

Configuring Java Virtual Machines for SNMP

this script will be lost the next time you use the configuration wizard.
2. Restart WebLogic Server.
Linux
1. Edit the following file, where %MIDDLEWARE_HOME% is the path of your
WebLogic installation:
$MIDDLEWARE_HOME/user_projects/domains/<your_
domain>/bin/[Link]
Add the following

lines to the end of the file:

JAVA_OPTIONS="$JAVA_OPTIONS -[Link]"
JAVA_OPTIONS="$JAVA_OPTIONS [Link]=8686"
JAVA_OPTIONS="$JAVA_OPTIONS [Link]=false"
JAVA_OPTIONS="$JAVA_OPTIONS [Link]=false"

Warning: This file is created by the Configuration Wizard. Your changes to

this script will be lost the next time you use the configuration wizard.
2. Restart the WebLogic Server.
Note: If you are having difficulty configuring Weblogic to work with Java
and/or SNMP, the JMX Java options may not be set in the proper place for
your setup of Weblogic. Some implementations of Weblogic, under
Windows, require the Java JMX options to be placed in a registry key, as
opposed to the [Link] file. For information on this method of
configuration , refer to the following knowledge base article:
[Link]
+Weblogic+APM+template+to+work+in+APM+4.2
For more information, see "JMX" on page 1143.

Configuring Java Virtual Machines for SNMP

The following sections discuss how to configure JVM servers for SNMP
monitoring including those that are embedded with Apace Tomcat, JBoss,
Glassfish, IBM Websphere, and Oracle Weblogic. Configuration instructions are
given for both Linux and Microsoft Windows operating systems.

1157

Configuring and Integrating

Configuring a Standalone Java Virtual Machine
Windows
1. Download the JDK from the Oracle website: [Link] (tested on JDK
SE 6, update version 24).
2. Install the JDK.
3. On the license agreement page, read and accept the license and the click
Next.
4. Click Change to change the installation directory to C:\Program
Files\Java\jdk1.6.0_24, and then click OK.
5. Click Next.
6. Click Finish to exit from the installer.
7. Add a variable to the system with its path pointing to the JDK installation
folder. For example:
Variable name: JAVA_HOME
Variable value: C:\Program Files\Java\jdk1.6.0_24
Note: If you want to run Java commands from the command line, you
should add the JDK installation path to the PATH variable.
8. Navigate to the %JAVA_HOME%\jre\lib\management folder.
9. Rename the [Link] file to [Link]. Edit [Link] by replacing
its content with the following:
acl = {
{
communities = public, private
access = read-only
managers = localhost, sam-server
}
}

Where sam-server is the hostname of your SAM server.

10. Grant access to the [Link] file only for the Administrator. To grant
access only for the Administrator, refer to this topic at the following location: [Link]

1158

Configuring a Standalone Java Virtual Machine

Linux
1. Download the JDK from the Oracle website: [Link] (tested on JDK
SE 6, update version 24).
2. Unpack and run the JDK. In this case, the JDK was installed into the /usr/java/jdk1.6.0_24 folder.
3. Move this folder to /usr/local.
4. In the /usr/local/ directory, create a symbolic link to jdk1.6.0_24 named
Java. Now the JDK is installed in /usr/local/jdk1.6.0_24 and linked to
5.

/usr/local/java.
Add the /usr/local/java/bin

folder to the system path. (If it is only for your

account, add it in .bash_profile file in your home directory). In Slackware, it
should be in the .profile file. To make it a system wide environment, add it
in the /etc/profile.
6. Edit a line in .bash_profile to be similar to: PATHH=$PATH:$HOME/bin:/usr/local/java/bin. The path will be automatically
set at boot time. To set the path immediately, use the command:
$ export PATH=$PATH:/usr/local/java/bin

7. You can call java directly in your shell:

$ java version
java version "1.6.0_24"
Java(TM) SE Runtime Environment (build 1.6.0_24-b04)
Java HotSpot(TM) 64-Bit Server VM (build 14.3-b01, mixed mode)

8. Add a variable to the system with the path pointing to the JDK installation
folder.
9. Add the following lines to the /etc/profile file. Syntax dependencies may be
different in various Linux distributions. This example is shown for the
CentOS system:
l export JAVA_HOME=/usr/java/jdk1.6.0_24
l export PATH=$PATH:/usr/java/jdk1.6.0_24
10. To set this immediately, run the export commands in your shell. Or, logout
then log back in to your system.
11. Go to the $JAVA_HOME/jre/lib/management folder and rename the
[Link] file to [Link].
12. Edit [Link] by removing all lines and writing the following:
acl = {
{
communities = public, private
access = read-only
managers = localhost, SAM-server
}

1159

Configuring and Integrating

Where SAM-server is the hostname of your SAM server.

13. Grant access to the [Link] file only for the root user. Run the following
commands as the root user in your shell:
# chown [Link] $JAVA_HOME/jre/lib/management/[Link]
# chmod 600 $JAVA_HOME/jre/lib/management/[Link]

Testing a Standalone JVM in Linux

You can test that your JVM can respond to SNMP queries by adding
-[Link]=1161 -[Link]=[Link] to

the java command line.

Example:
java -[Link]=1161 [Link]=[Link] some_java_applet

In another window/shell, run the following command to test SNMP and the JDK
configurations:
snmpwalk -v 2c -c public [Link]:1161
[Link].[Link].[Link].1.2.11

The command should return a value similar to this:

SNMPv2-SMI::enterprises.[Link].[Link].11.0 = Counter64:
4803352

For more information, see "JMX" on page 1143.

Configuring Apache Tomcat (tested on version 7.0)
Windows Service
1. Open Tomcat configuration: Start > All Programs > Apache Tomcat >
Configure Tomcat.
2. Open the Java tab, and then add the following lines to the Java Options
box:
-[Link]=1161
-[Link]=[Link]

3.
4.
5.
6.

Click Apply.
Go to the Windows Services console.
Right-click the Apache Tomcat service.
Click Properties.

1160

Configuring Apache Tomcat (tested on version 7.0)

7. Click the Log On tab, and then select Log on as this account.
8. Click Browse, find the user Administrator and type the Administrator password twice.
9. Click OK.
10. In the Tomcat Configuration window, return to the General tab, and then
start the service.
Windows Command Line
1. Open the file %TOMCAT_HOME%\bin\[Link] and add the following
lines into the Debug, Run and Start sections (where %TOMCAT_HOME%
is the path to your Tomcat installation):
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=1161"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=[Link]"

:doDebug
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=1161"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=[Link]"
shift

:doRun
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=1161"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=[Link]"
shift

:doStart
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=1161"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=[Link]"
shift

2. Run %TOMCAT_HOME%\bin\[Link] to start Tomcat.

Linux
1. Open $TOMCAT_HOME/bin/[Link] and then add the following lines
into Debug, Run and Start sections (where %TOMCAT_HOME% is the path
to your Tomcat installation):

1161

Configuring and Integrating

JAVA_OPTS="$JAVA_OPTS -[Link]=1161"
JAVA_OPTS="$JAVA_OPTS -[Link]=[Link]"

if [ "$1" = "debug" ] ; then

JAVA_OPTS="$JAVA_OPTS -[Link]=1161"
JAVA_OPTS="$JAVA_OPTS -[Link]=[Link]"
if $os400; then

elif [ "$1" = "run" ]; then

JAVA_OPTS="$JAVA_OPTS -[Link]=1161"
JAVA_OPTS="$JAVA_OPTS -[Link]=[Link]"
shift

elif [ "$1" = "start" ] ; then

JAVA_OPTS="$JAVA_OPTS -[Link]=1161"
JAVA_OPTS="$JAVA_OPTS -[Link]=[Link]"
if [ ! -z "$CATALINA_PID" ]; then

2. Run $TOMCAT_HOME/bin/[Link] command to start Tomcat.

For more information, see "JMX" on page 1143.
Configuring JBoss (tested on versions 5.0.1, 5.1, and 6.0)
Windows Service
1. Edit %JBOSS_HOME%\bin\[Link] by adding the following lines (where
%JBOSS_HOME% is the path to your JBoss installation):
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=1161"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=[Link]"

rem Setup JBoss specific properties

set JAVA_OPTS=-[Link]=%PROGNAME% %JAVA_OPTS%
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=1161"
set "JAVA_OPTS=%JAVA_OPTS% -

1162

Configuring JBoss (tested on versions 5.0.1, 5.1, and 6.0)

[Link]=[Link]"

2. Register JBoss as a service by running: %JBOSS_HOME%\bin\[Link]

install

3.
4.
5.
6.
7.

Go to the Windows Services console

Right-click JBoss Application Server service.
Click Properties.
Click the Log On tab and then select Log on as this account.
Click Browse, find the user Administrator, and then type the Administrator
password twice.
8. Click OK.
9. Start the JBoss service.
Windows Command Line
1. Edit %JBOSS_HOME%\bin\[Link] by adding the following lines (where
%JBOSS_HOME% is the path to your JBoss installation):
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=1161"set
"JAVA_OPTS=%JAVA_OPTS% -[Link]=[Link]"
rem Setup JBoss specific properties
set JAVA_OPTS=-[Link]=%PROGNAME% %JAVA_OPTS%set "JAVA_
OPTS=%JAVA_OPTS% -[Link]=1161"
set "JAVA_OPTS=%JAVA_OPTS% -[Link]=[Link]"

2. Start JBoss by running %JBOSS_HOME%\bin\[Link].

Linux
1. Edit $JBOSS_HOME/bin/[Link] by adding the following lines (where $JBOSS_
HOME$ is the path to your JBoss installation):
JAVA_OPTS="$JAVA_OPTS -[Link]=1161"JAVA_OPTSS="$JAVA_OPTS -[Link]=[Link]"# Setup JBoss
specific propertiesJAVA_OPTS="${JAVA_OPTS:+$JAVA_OPTS -[Link]=$PROGNAME}"JAVA_OPTS="${JAVA_OPTS:--[Link]=$PROGNAME}"JAVA_OPTS="$JAVA_OPTS [Link]=1161"JAVA_OPTS="$JAVA_OPTS -[Link]=[Link]"

2. Run JBoss by running $JBOSS_HOME/bin/[Link].

For more information, see "JMX" on page 1143.

1163

Configuring and Integrating

Configuring GlassFish (tested on version 3.1):
1. Run the GlassFish Application Server.
2. Open a web browser and then navigate to: [Link] where
hostname is the name of your GlassFish server.
3. In the left panel, click Configurations: server-config.
4. In the main window, click JVM settings.
5. Click the JVM Options tab.
6. Click Add JVM Option and then type -[Link]=1161 in the blank field.
7. Click Add JVM Option and then type -[Link]=[Link] in the blank field.
8. Click Save.
9. Restart the GlassFish server.
For more information, see "JMX" on page 1143.
Configuring IBM WebSphere (tested on version 7.0):
IBM WebSphere uses its own JDK, installed at %WEBSHERE_HOME%\java
(where %WEBSHERE_HOME% is the path to your WebSphere
installation).Configure the IBM JDK in the following manner:
1. Go to the $JAVA_HOME/jre/lib/management folder.
2. Rename the [Link] file to [Link].
3. Edit [Link] by replacing its content with the following:
acl = { { communities = public, private access = read-only managers = localhost,
SAM-server }}Where SAM-server is the hostname of your SAM server.

4. Grant access to the [Link] file only for the root user. Run the following
commands as the root user in your shell:
# chown [Link] $JAVA_HOME/jre/lib/management/[Link]
# chmod 600 $JAVA_HOME/jre/lib/management/[Link]

5. Run the IBM WebSphere Application Server.

6. Open a web browser and then navigate to: [Link] where
hostname is the name of the IBM WebSphere server.
7. In the left panel, click Expand Servers and Server types.
8. Click WebSphere Application Servers.
9. In the main window, click your server.
10. In the Server Infrastructure section, expand Java and Process Management.
11. Click Process Definition.
12. In the Additional Properties section, click Java Virtual Machine.

1164

Configuring Oracle WebLogic (tested on version [Link])

13. In Generic JVM Arguments, add the following:
-[Link]=1161 -[Link]=[Link]

14.
15.
16.
17.
18.
19.
20.
21.

Click OK.
Click, Save and then click OK.
Click Save.
Go to the Windows Services console.
Right click the IBM Websphere service.
Click Properties.
Click the Log On tab and then select Log on as this account.
Click Browse, find the user Administrator, and then type the Administrator password twice.
22. Click OK.
23. Restart the IBM WebSphere Application Server.
For more information, see "JMX" on page 1143.
Configuring Oracle WebLogic (tested on version [Link])
Windows
Oracle WebLogic uses its own JDK installed in %MIDDLEWARE_HOME%\jdk*
(where %MIDDLEWARE_HOME% is the path to your WebLogic installation).
1. Go to the $JAVA_HOME/jre/lib/management folder
2. Rename the [Link] file to [Link].
3. Edit [Link] by replacing its content with the following:
acl = {
{
communities = public, private
access = read-only
managers = localhost, SAM-server
}
}

Where SAM-server is the hostname of your SAM server.

4. Grant access to the [Link] file only for the Administrator. To grant
access only for the Administrator,see: [Link]
5. Edit the following file:
%MIDDLEWARE_HOME%\C:\Oracle\Middleware\user_projects\domains\<your_domain>\bin\[Link]

1165

Configuring and Integrating

by adding the lines:
set "JAVA_OPTIONS=%JAVA_OPTIONS% -[Link]=1161"
set "JAVA_OPTIONS=%JAVA_OPTIONS% -[Link]=[Link]"

The result should resemble:

call "%DOMAIN_HOME%\bin\[Link]" %*
set "JAVA_OPTIONS=%JAVA_OPTIONS% -[Link]=1161"
set "JAVA_OPTIONS=%JAVA_OPTIONS% -[Link]=[Link]"
set SAVE_JAVA_OPTIONS=%JAVA_OPTIONS%

Warning: This file is created by the Configuration Wizard. Your changes to

this script will be lost the next time you use the configuration wizard.
6. Restart WebLogic Server.
Linux
Oracle WebLogic uses its own JDK which in $MIDDLEWARE_HOME/jdk*
(where $MIDDLEWARE_HOME is the path to your WebLogic installation).
1. Go to the $JAVA_HOME/jre/lib/management folder.
2. Rename the [Link] file to [Link].
3. Edit [Link] by replacing its content with the following:
acl = {
{
communities = public, private
access = read-only
managers = localhost, SAM-server
}
}

Where SAM-server is the hostname of your SAM server.

4. Grant access to the [Link] file only for the root user. Run the following
commands as the root user in your shell:
# chown [Link] $JAVA_HOME/jre/lib/management/[Link]
# chmod 600 $JAVA_HOME/jre/lib/management/[Link]

1166

MAPI
5. Edit the following file:
$MIDDLEWARE_HOME/user_projects/domains/<your_domain>/bin/[Link]

by adding the lines:

JAVA_OPTIONS="$JAVA_OPTIONS -[Link]=1161"
JAVA_OPTIONS="$JAVA_OPTIONS -[Link]=[Link]"

The result should resemble:

. ${DOMAIN_HOME}/bin/[Link] $*JAVA_OPTIONS="$JAVA_OPTIONS
-[Link]=1161"JAVA_OPTIONS="$JAVA_OPTIONS [Link]=[Link]"SAVE_JAVA_OPTIONS="${JAVA_
OPTIONS}"

Warning: This file is created by the Configuration Wizard. Your changes to

this script will be lost the next time you use the configuration wizard.
6. Restart the WebLogic Server.

MAPI
Messaging Application Programming Interface (MAPI) is a Microsoft Windows
program that enables you to send email from within a program. Programs that use
MAPI include word processors, spreadsheets, and graphics applications.
Programmers who are using Microsoft's Active Server Page (ASP) technology
access MAPI by using Microsoft's Collaboration Data Objects (CDO). The CDO
library comes with Microsoft's Internet Information Server (IIS). MAPI functions can
be accessed by Visual Basic programmers.
CDO - [Link]
A "session" is a specific connection between the client and the MAPI program.
MAPI defines the following three services:
l
l
l

Address book: A database that contains addressing information.

Transport: Supports communication between different devices.
Message store: Stores messages that consists folders and subfolders.

Simple MAPI is a subset of 12 functions which enable developers to add basic

messaging functionality.

1167

Configuring and Integrating

Extended MAPI allows complete control over the email system.
Note: With regard to the SAM monitor, this document will concentrate only on the
mail function.

The MAPI User Experience Monitor in SAM

This component monitor sends an email from your SMTP mail server to your
Microsoft Exchange Server Mailbox and measures the time it takes to complete
the trip. You can use this component monitor to measure the performance of
Outlook. This response time is measured in milliseconds.
The Exchange Server computer uses port 135 for client connections to the RPC
endpoint mapper service. After a client connects to a socket, the Exchange Server
allocates the client two random TCP ports above 1024 used to communicate with
the directory and the information store.
For a complete list of network ports used by Microsoft Server Products, refer to the
following article: [Link]
What credentials should a user use?
User credentials must be valid for both the Exchange server mailbox and the
SAM server. This means that the SAM server and Exchange server must be in the
same domain and the probe must use domain credentials.
Why does the profile have to be able to log in to the SAM server?
Because the probe uses an external .exe module [Link].
Meaning, user impersonation on the SAM server is needed to have ability to run
external process.

Install the MAPI Client on the SolarWinds SAM Server

This component monitor requires you to install the Microsoft Exchange Server
MAPI Client and Collaboration Data Objects on your SolarWinds SAM server.
You can download the MAPI Client from:
l

The Microsoft Download Center. [Link]

This component monitor does not compute a statistic. The response time is the
difference between the time SolarWinds SAM sends the email and the time that it
is received by the recipient. Following is an illustration of the MAPI monitor. To

1168

Install the MAPI Client on the SolarWinds SAM Server

expose the fields, as illustrated below, click [+] to the left of the component
monitor name.

1. This component monitor waits for the email to arrive based on the default
job timeout of 20 minutes. If the email does not arrive within this period,
SolarWinds SAM marks the monitor as Down.
2. The monitor goes through the following steps with respect to the mail flow:
a. Sends an email to the user mailbox via SMTP. The email has a
unique temporary subject name that starts with APM_prefix.
b. Connects to the user mailbox through MAPI, then searches the
emails by Subject.
c. If it does not find the email it is looking for, it waits and then
searches again. It will stop when:
1. It finds the email;

1169

Configuring and Integrating

2. The timeout is reached;
3. The maximum number of attempts is reached.
d. Once it finds the email, the monitor deletes it from the user inbox.
e. The monitor collects the total round trip time for the email and compares
it with the thresholds set.
f. Once it knows the round trip time, status is given according to where it
falls with regard to the thresholds set.
If the email is not found within the timeout or the maximum number of attempts, or
SMTP or MAPI reported an error, SolarWinds SAM will mark the monitor as down.
3. Emails are posted using SMTP. If the MAPI probe works, emails will be
deleted successfully, if not, emails will accumulate.
4. It is not currently possible to use the monitor without SMTP and send the
email from the same server the monitor is running on via MAPI.
Field Descriptions of the MAPI Monitor:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}.

Enable Component
Determines whether the component is enabled.
Credential for Monitoring
Select a credential that is both a user who can log on to the SolarWinds
SAM server, and that has an Exchange account on the MAPI server. If the
credential you need is not already present in the credentials list, use the
Quick Credentials section to add a new credential.
Send Email From
This field allows you to specify the From address of the test email message.
Send Email To
This field allows you to specify the recipient of the test email message. The
recipient should have a mailbox on the MAPI server you are monitoring.
MAPI Profile Name
Allows you to specify the name of the MAPI profile

1170

Troubleshooting MAPI
SMTP Server
This field allows you to specify the SMTP server that sends the test email
message.
SMTP Port
This field is the port number used for SMTP sessions. The default value is
25.
Use Credentials for SMTP
This check box allows you to use the user name and password from
Credentials for Monitoring to connect to SMTP servers that support or
require authentication.
SMTP Encryption
This list allows you to select an encryption protocol to connect to SMTP
servers that support SSL or TLS encryption.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}.

Troubleshooting MAPI
The following procedures will help you troubleshoot MAPI issues relating to SAM:
Note: Do not use the same mailbox for multiple MAPI UX monitors. Doing so can
cause the MAPI monitor to intermittently fail.

1171

Configuring and Integrating

MAPI Probe Diagnostic Checklist
Install CDO or Outlook
l

CDO can be found here: [Link] If you would like to

install CDO, uninstall your entire MS Office installation. Uninstalling
Outlook only is not sufficient.
The MAPI probe may be unstable when running with Outlook installed. If
this is the case, uninstall Office then download and install CDO.

Check the MAPI profile

l

l
l

The Orion Server is in the same domain as the Exchange server being
monitored
The user account used to monitor the mailbox with SAM has permission to
login to the server console and has done so at least once.
The user account to monitor the mailbox with SAM is in the local administrator user group of the server where SAM is installed
MAPI component is using the FQDN for the domain account.
The MAPI profile does not need to exist. The probe should create it and
also update the existing profile with the required settings. However, there
may be issues with an existing or created profile. The default Outlook profile is called Outlook.
If this profile does not work, create a profile with the MFCMapi free tool,
availabe at: [Link]
1. In the MFCMapi tool, navigate to Profile > Advanced Profile >
Launch Profile Wizard, keeping the defaults on the first dialog.
2. Set the profile as default.
3. Update the profile name of the newly created profile in the MAPI
probe.
Use MFCMapi to find the profile name: Navigate to Profile > Show Profiles for verification.

Check probe settings

l
l

Check that Send Email To: is correctly filled out in the component settings.
The Mapi Profile Name must match the actual profile name. Use the
MFCMapi tool if you are not sure about the name.
Credentials used for the probe must be eligible to open the mailbox. It is
required to add the user to the local Administrators group, otherwise the
probe can fail with insufficient privileges.

1172

Mailbox recommendations
Mailbox recommendations
l

Use a clean mailbox created for monitoring purposes. A mailbox full of

email is problematic as it takes a lot more time for the probe to search
through all of the emails. The MAPI probe deletes obsolete, undeleted messages sent by the probe in the past to keep the mailbox clean.

Advanced Troubleshooting
[Link] Command Line Arguments
To analyze issues with the MAPI probe more closely, run the MAPI executable
from the command line. The following arguments can be used:
Command

Explanation

-s <subject>

The subject text of searched in an email. Use quotes for a subject

containing spaces.

-server
<server_
name>

Server hostname / IP address.

-t
<timeout>

Timeout in ms for watchdog.

-p <profile_
name>

Exchange profile name.

-u <user_
name>

Exchange user name

-attempts
<count>

Maximum number of search attempts.

-debug

Turns on debug logging.

-removeall

Remove all historical messages from the MAPI probe. Messages

from the MAPI probe get stuck in the mailbox if the probe fails to
delete them.

-w

Wait time between search attempts.

1173

Configuring and Integrating

In SAM v5.0+:
-subjectmatchsubstring: This

enables a substring subject match. The target mail

subject is expected to match the substring of the subject setting. An exact match
is expected by default. This is useful for matching emails returned by bouncers,
which can add Re: to the mail subject.
Note: This command is not listed in the configuration file.
For example:
[Link] -debug -s "test subject" -u domain\[Link] -server exchange p Outlook -t 10000

Important: Run the executable as the user owning the mailbox. To do this, start a
new [Link] and run the following command.
runas /user:domain\[Link] [Link]

This will ask for a password and start a new [Link] with that user account. Test
the MAPI executable from this console.
The MAPI probe is also configurable via the [Link] file.
Settings in this file take precedence over any command line arguments. See the
following:
<settings> <!-- c:\logs will not be made by this program, it must exist to enable logging -->
<logdirectory>c:\logs</logdirectory> <logenable>false</logenable> <logkeepall>true</logkeepall> <enablewatchdog>true</enablewatchdog> <mapimaxwaitlogoff>2500</mapimaxwaitlogoff> <dologoff>true</dologoff> <!-<debug>false</debug> <removeall>true</removeall> <subjectpattern>^APM_MAPITestEmail__GUID:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$</subjectpattern> <delaybetweenattempts>500</delaybetweenattempts> --></settings>

Command

Explanation

Logdirectory

Path to the directory where logs from the MAPI

executable will be written. This directory must exist
otherwise no logs will be written.

Logenable

Enable log file logging.

Logkeepall

Set false for deleting the log file after a successful

run, (i.e. email was found and deleted; all log files

1174

New in SAM 5.0+ (not listed in the configuration file):

are preserved by default (true).)
Enablewatchdog

Enable or disable watchdog which kills the MAPI

processing thread if it does not finish in a given
time. Prevents processing for a long time.

Mapimaxwaitlogoff

Number of milliseconds to wait for logoff before the

MAPI process ends. This setting is used after an
error during MAPI processing and between
attempts to retrieve probe mail.

Dologoff

Set to false to skip logoff and closing the MAPI

session.

Debug

True for debugging information and detailed

logging to the log file or console.

Removeall

Remove all obsolete messages from the mailbox

matching the subjectpattern regular expression. The
SAM probe always tries to enable this setting from
the command line.

Subjectpattern

Regular expression pattern for deleting obsolete

probe messages. Use together with removeall =true

Delaybetweenattempts Delay in milliseconds.

New in SAM 5.0+ (not listed in the configuration file):

true/false setting (false by default) to match just the
substring of the subject. This is useful for matching emails returned by bouncers,
which can add Re: to the mail subject.
subjectmatchsubstring

During initial analysis, it is typically required to update logdirectory (or create

C:\logs) and set logenable to true. Other arguments are passed from the
command line.

Oracle
This section is designed to give you a basic introduction to the Oracle database
model and its use with SolarWinds SAM. For more detailed information on
Oracle, seek resources outside of this guide.

1175

Configuring and Integrating

Physical and Logical Structures

An Oracle database system is made up of at least one instance of the application,
along with data storage. An instance, identified by an instantiation number (or
activation id: SYS.V_$[Link]#), is made up of a set of operating
system processes and memory-structures that work with the storage.
If an Oracle database administrator has employed Oracle RAC (Real Application
Clusters), then multiple instances attach to a storage array. This implementation
offers advantages such as better performance, scalability, and redundancy.
The Oracle DBMS can store and execute procedures and functions within itself.
PL/SQL or the object-oriented language, Java, can use such code objects and/or
provide the programming structures for writing them.

Storage
The Oracle RDBMS stores data in the form of tablespaces and physically in the
form of ("datafiles"). Tablespaces can contain various types of memory segments,
such as Data Segments, Index Segments, etc. Segments are made up of one or
more extents. Extents make up groups of continuous data blocks. Data blocks are
the basic units of data storage.
Newer versions of the database include a partitioning feature, which allows tables
to be partitioned based on different sets of keys.
Oracle tracks its data storage using the information stored in the System
tablespace. The System tablespace contains the data dictionary, indexes and
clusters. A data dictionary consists of a collection of tables that has information
about all user objects. Beginning with version 8i, the Oracle RDBMS also
supports locally managed tablespaces which can store space management
information in their own headers rather than in the System tablespace.

Disk files
Disk files primarily consist of the following types:
l

Data and index files: These files are necessary for the physical storage,
which can be made up of the data dictionary, user data, or index data.
These files may be managed manually or by Oracle itself,
Note: A datafile has to belong to exactly one tablespace, whereas a
tablespace can consist of multiple datafiles.
Redo log files: These consist of all changes to the database used to
recover from an instance failure. Note: These files are stored multiple times

1176

Configuring SAM to Monitor an Oracle Database Server

for security in case of a catastrophic failure. The identical redo log files are
part of the same group.
Undo files: These are datafiles which contain undo information and are
used for recovery.
Archive log files: These files are copies of the redo log files and stored at
different locations. These files are necessary.
Tempfiles: These datafiles are used for temporary storage data.
Control file: This file is necessary for database startup. This file records the
physical structure of a database and holds the names and locations of redo
log files, the time stamp of the database creation, the current log sequence
number, checkpoint information, and so forth.

l
l

Configuring SAM to Monitor an Oracle Database Server

SAM provides an application template for monitoring Oracle databases. This is
called the Oracle Database Template. However, unlike most applications, this
requires additional drivers to be downloaded and installed on the computers
where SAM and any additional pollers are running.

Prerequisites for Oracle Server Monitoring

There are two Oracle data providers which can be used with SAM:
l
l

Oracle Data Provider for .NET ([Link]) Installer package

Basic Lite Oracle Client

Credentials: An Oracle user name and password with read access to the Oracle
views: dba_free_space, v$sysstat, v$rowcache, v$librarycache, v$sgastat, and v$session.
Note: Some required settings information will be needed. See Getting the
Required Settings, on page 22.

Installing [Link]
The following instructions describe the recommended method for monitoring
Oracle databases using ODP. Net.
Uninstall any other version of the Oracle Client before proceeding. Ensure that
SolarWinds Basic Lite Oracle Client is not installed. Verify that the following
directory does not exisit or is empty: C:\Program Files (x86)
\Solarwinds\Orion\APM\OracleClient\. If it is not empty, stop all Orion services and
remove this directory before you continue with your installation.

1177

Configuring and Integrating

Note: ODP. Net is not part of SolarWinds SAM and may need to be downloaded
from the Oracle website, which requires free registration. Download the 32-bit
version of [Link], even if SAM is installed on a 64-bit version of Windows.
1. You can use the following link to download [Link]:
l [Link]
If you do not want to register with Oracle, you can use the Basic Lite Client
which can be downloaded by logging in to your SolarWinds customer
portal. Location and installation instructions can be found at, "Installing the
Basic Lite Oracle Client" on page 1183. Following is a screenshot of
Oracle's website with the both the 32 and 64-bit versions highlighted.
Download the 32-bit version.
Note: You can download the 64-bit version. Installing this version will
require you to poll jobs using the 64-bit option within SAM.

1178

Installing [Link]

2. Next, download ODAC with Oracle Developer Tools for Visual Studio, as
shown below. This installation package comes with its own installer:

1179

Configuring and Integrating

3. Accept the License Agreement and then select the latest version when
prompted. You will be asked for your Oracle Username and Password. If
you have not already done so, register for free with Oracle to obtain these
needed credentials.

4. Login to SAM using an administrator account.

5. Copy the downloaded file to the SAM computer then extract the contents
and run [Link].
6. When [Link] runs, go to the next step and select the first option as
shown below. (This option contains what is necessary for SAM to be able
to monitor an Oracle database server.)
Note: If the Oracle server is being polled from an additional poller, then

1180

Installing [Link]
this software needs to be installed on that additional poller as well.

7. Enter the path where the files should be installed.

8. Either install everything or select the following two components:

1181

Configuring and Integrating

l
l

Oracle Data Provider for .Net

Oracle Instant Client

9. Start the installation.

10. When the installation finishes successfully, click Exit. Restart all Orion services by navigating to: Start > SolarWinds Orion > Orion Service Manager.
Note: Restarting of the services is necessary because the Oracle
1182

Installing the Basic Lite Oracle Client

installer added its installation directory (c:\app\Administrator\... by
default) to the Path variable.
11. From the Service Manager, click Shutdown Everything.
12. When all services have stopped, click Start Everything and wait for the
services to begin.

Installing the Basic Lite Oracle Client

Follow these steps only if you cannot use the full Oracle Data Provider.
Note: The Basic Lite Oracle Client may not support the latest versions of Oracle
database servers. Therefore, this version may not support all data types used in
monitoring your queries.
1. Ensure that the SolarWinds Basic Lite Oracle Client is not currently
installed. If it is installed, the following is the default path and must be

1183

Configuring and Integrating

deleted before proceeding: c:\Program Files (x86)\Solarwinds\Orion\APM\OracleClient\. If this folder is not empty, stop all Orion services and remove this directory before continuing with the Oracle Client
installation.
2. Log in to your customer portal. Once logged in, navigate to SolarWinds
customer portal > Additional Components > Oracle Client. From here
you can download the needed files.

3. Use the Oracle Client link to download the installation package.

4. Copy the downloaded file to the SAM computer and extract [Link] from the zip archive.

1184

Installing the Basic Lite Oracle Client

5. Run the installer under an administrator account.

6. After the installer window closes, navigate to the SAM installation directory, typically: C:\Program Files\SolarWinds\Orion, and ensure that the subfolder, APM\OracleClient was created successfully and contains the five files
as shown below:

7. Check the file properties of each .dll file to ensure that the account under
which the SolarWinds JobEngine v2 service runs has high enough privileges to load these libraries.

1185

Configuring and Integrating

8. Restart all Orion services by navigating to Start > SolarWinds Orion >
Orion Service Manager.
Note: Restarting of the services is necessary because the Oracle installer
added its installation directory (c:\app\Administrator\... by default) to the Path
variable.
9. From the Service Manager, click Shutdown Everything.
10. When all services are stopped, click Start Everything and wait for the services to begin.

Adding an Oracle Database Server to SAM

1. Navigate to Start > SolarWinds Orion > Orion Web Console to open the
SAM website.
2. Log in to the SAM web console.
3. If the node you want to monitor is not currently monitored by SAM, navigate
to Settings > Add Node and follow the wizard to start monitoring the
Oracle computer as a node in SAM.
Note: The Oracle server can be added as any type of node (ICMP, SNMP,
WMI).

4. At the Add Application Monitors step, select the Oracle Database Template. Do not test it. At this stage the application template requires further
configuration which cannot be done from this page. Testing at this point

1186

Adding an Oracle Database Server to SAM

will result in a failure.

5. Go to the last step of the wizard and click OK, ADD NODE.

6. You will be redirected to the Manage Nodes page. Search for the newly
added Oracle server and click on it to go to its Node Details view.

7. Search for the Applications resource on this view and click on the Oracle
Application to go to its Application Details View.

1187

Configuring and Integrating

8. On the Application Details view, notice the Oracle Database is in an

Unknown state. This is because it is not properly configured. Click Edit
Application Monitor to begin configuring these settings.

9. Expand each monitor by clicking [+] to the left of each component monitor
in the list.

1188

Adding an Oracle Database Server to SAM

1189

Configuring and Integrating

10. The correct settings for the fields, Destination Point Type and Destionation Point Name (highlighted above) should be provided by the
administrator of the Oracle server. This example is testing against the
Oracle 10g Express Edition, which is configured to have the name "XE."

11. Repeat steps 9-10 for each monitor in this template.

12. The Oracle driver type must correspond with the installed Oracle Client software (as described earlier in the Prerequisites for Oracle Server Monitoring
section on page 4). The following table shows which combinations work
together.
Oracle Driver Type setting in Web UI
Oracle Client package

Microsoft .NET
Oracle Data Provider
Data Provider
for .NET ([Link])
(MS_
ORACLECLIENT)

Full Oracle Data Provider for

.NET ([Link])

Works

Works

Basic Lite Oracle Client (from

SolarWinds Customer Portal)

Works

Does not work

1190

Monitoring an Oracle Database on an Existing Node

Monitoring an Oracle Database on an Existing Node

If an Oracle database server is already being monitored by SAM as a node,
perform the following steps to configure the node:
1. In the SAM web console, navigate to Settings > SAM Settings > Manage
Templates

2. Search for the Oracle Database Template, select it by checking the box
next to the name.
3. Click Assign to Node.

1191

Configuring and Integrating

4. Next, search for Oracle.
5. Once found, check the nodes you want to add.
6. Click the green arrow to add it to the Selected Nodes column.

7. The Oracle node will be moved to the Selected Nodes column.

1192

Monitoring an Oracle Database on an Existing Node

8. Click Next.
9. Select the credentials to be used and then click Assign Application Monitors.
Note: Do not test the application now. This application is not properly configured. There are settings specific to the Oracle server which will be set
later.

10. Click Edit to go to the Edit Application page.

11. Expand each monitor by clicking [+]to the left of each component monitor
in the list.

1193

Configuring and Integrating

12. The correct settings for the fields Destination Point Type and Destination
Point Name (highlighted above) should be provided by the administrator

1194

Getting the Required Settings

of the Oracle server. This example is testing against the Oracle 10g
Express Edition, which is configured to have the name "XE."

13. Repeat steps 11-12 for each monitor in this template. Use the following
table for reference:
Oracle Driver Type setting in Web UI
Oracle Client package

Microsoft .NET
Oracle Data Provider for
Data Provider
.NET ([Link])
(MS_
ORACLECLIENT)

Full Oracle Data Provider for .NET Works

([Link]

Works

Basic Lite Oracle Client (from

SolarWinds Customer Portal)

Does not work

Works

Getting the Required Settings

The Oracle User Experience Monitors settings must match the settings on the
Oracle Server. Database Administrators usually provide a file with connection
details ([Link]) to database users and users add this file to their Oracle

1195

Configuring and Integrating

Client directory. SAM does not use the [Link] file directly. The user needs to
input all of the settings to the Oracle User Experience Monitor in the SAM web
interface.
If you were not given [Link] file by your database administrator, but have
access to Oracle Server system, follow these steps to locate the [Link] file:
1. Log in to the Oracle Server using an administrator account.
2. The [Link] file should be located at $ORACLE_HOME/network/admin/[Link], where $ORACLE_HOME is the directory where the
Oracle Server was installed.

3. Once you have located this file, open the file and follow these steps to
extract the required information.
a. Locate the section in the file that describes the options for the database
instance you want to monitor. For the most part, this section will contain
the settings for Protocol, Host, and Port as shown in the examples bulleted below.
b. Once you locate this section, extract the following settings and use
them in the Oracle User Experience Monitor:
l Protocol Must be TCP. This how SAM connects to the remote
Oracle Server.
l Host Must match the IP address (or hostname, which resolves
to that IP) of the Oracle server node in SAM.
l Port Use this setting for the Port Number field of Oracle User
Experience Monitor.
l Service_Name If this is present in the [Link] configuration section, then select the value for the Service_Name for
the Destination Point Type field of the Oracle User Experience
Monitor.
l SID If this is present in the [Link] configuration section,
then select the SID value for for the the Destination Point Type
field of the Oracle User Experience Monitor.
l Service_Name or SID settings in [Link] also defines a connection point name (after the "=" character), which needs to be

1196

Getting the Required Settings

used for the Destination Point Name field of the Oracle User
Experience Monitor.
Example 1: Following is a sample [Link] file from the Oracle Server 10g
Express Edition. Highlighted are the settings mentioned previously.

Example 2:

1197

Configuring and Integrating

Here is what the configuration of the Oracle User Experience Monitor should look
like when completed correctly using Example 1:

Troubleshooting
If the Oracle User Experience Monitor does not work properly, explore the
following troubleshooting sections.
l
l
l

l
l

Oracle Client Driver and Server Compatibility

SAM is Unable to Load the Oracle Client Driver
Using Process Explorer to Determine if SAM is Loading the Correct Oracle
Client Library
Using Process Monitor to Determine Why the Oracle Client fails
Oracle User Experience Monitor is Unable to Connect to the Oracle Server

1198

Oracle Client Driver and Server Compatibility

l

Using the Oracle SQL*Plus Tool to Troubleshoot Connectivity Issues:

Note: Many of these troubleshooting procedures are used by SolarWinds
support technicians.

Oracle Client Driver and Server Compatibility

Notes:
l

Oracle Client drivers are not forward and backwards compatible with all
Oracle database servers.
Oracle Data Provider for .NET ([Link]) [Link].0 is compatible only
with Oracle Server 9.2 and higher.

Monitoring two different versions of Oracle Server might not be possible if there is
no appropriate driver which would be able to connect to both server versions. If
this is the case, have the second version of the Oracle Client on an additional
poller and assign the nodes there.
SAM is Unable to Load the Oracle Client Driver
Following is a screenshot of this error:

1199

Configuring and Integrating

Troubleshooting Steps:
l

Make sure that the Oracle Client was installed on the SAM computer or on
the appropriate additional poller.
Do not deploy two different Oracle Client Driver versions on the SAM computer.
If the above was unsuccessful, follow these troubleshooting steps:

[Link] Process Explorer and install it on the SAM computer.

[Link] Process Explorer and look for the [Link] processes, (which
belongs to SAM). This can be identified by the command line argument,
"[Link]."

3. Display the [Link] properties to ensure that the environment

variable ORACLE_HOME exists and points to the correct location where the Oracle
Client is installed.
l

The example below shows ORACLE_HOME set to the APM\OracleClient directory. This computer has the Basic Light Oracle Client installed (not
the full [Link] version).

1200

Using Process Explorer to Determine if SAM is Loading the Correct Oracle Client

Using Process Explorer to Determine if SAM is Loading the Correct Oracle

Client Library
To determine if SAM is loading the correct Oracle Client Library, follow these
steps:
1. In Process Explorer, navigate to View > Show Lower Pane. Then, navigate to View > Lower Pane View > DLLs.

1201

Configuring and Integrating

2. Locate the [Link] (which belongs to SAM) and see if the

[Link] file is displayed in the DLL list in the lower pane.
3. Verify that the path is set to the correct directory.
l This step needs to be done for each [Link] instance
that belongs to SAM. This can be identified by the command line

1202

Using Process Monitor to Determine Why the Oracle Client Fails

argument, "[Link]."

Using Process Monitor to Determine Why the Oracle Client Fails

If the Oracle Client is not visible in Process Explorer, perform the following
steps to determine from which directory SAM is trying to load the Oracle
Client:
1. Download Process Monitor from the following link: [Link]
2. Start Process Monitor and define Filter.

1203

Configuring and Integrating

3. Add the following conditions:
l Process Name equals [Link].
l Path contains [Link] .

4.
5.
6.
7.

Click OK.
Restart the JobEngine v2 service and wait for it to fully restart.
Go to the Oracle Database Edit page and test one of the components.
Wait until the test is finished and then stop the trace (File > Capture
Events).
8. Analyze the results. There will be information about [Link] trying to find the [Link] file, (which is part of the Oracle Client),
revealing a list of directories it was searching for and whether or not it was
successful. The Load Image event indicates whether or not SAM was able
to load that library successfully. This may fail if the architecture of this library does not match the architecture of the polling job (as defined on the
Application Edit page in SAM).

1204

Using Process Monitor to Determine Why the Oracle Client Fails

9. See the following illustration:

Below is sample output when the Oracle Client is not installed and therefore not
found:

Here you can see which directories are being searched to locate the file. Below
you can see that the full Oracle Client was installed:

1205

Configuring and Integrating

Here you can see SAM was not able to load the Oracle Client because it does not
match the platform of the polling job. In this case, the Oracle Database application
is set to run as 64-bit, but the 32-bit version of the Oracle Client was installed. You
can also see that SAM finds the [Link] and opens it to read from it, but it detects
that this is the wrong platform. Consequently, there is no Image Load operation:

Oracle User Experience Monitor is Unable to Connect to the Oracle Server

Following is a screenshot of this error:

1206

Troubleshooting steps:

Troubleshooting steps:
1. Make sure a firewall is not blocking communication between SAM and
Oracle computers.
2. Verify the configuration of the Oracle User Experience Monitor.

1207

Configuring and Integrating

Use a third party tool, SQL*Plus, to try and connect to the Oracle Server using the
same settings that SAM is using. Refer to the section, "Using the Oracle
SQL*Plus Tool to Troubleshoot Connectivity Issues."
Using the Oracle SQL*Plus Tool to Troubleshoot Connectivity Issues:
The following steps demonstrate how to use SQL*Plus to check the
following:
l
l

l
l

Connectivity issues to the Oracle Server from the SAM computer.

You are using the correct and valid Oracle endpoint, (i.e. Service_Name
or SID).
You are using correct and valid Oracle credentials.
You have credentials with enough permission to query Oracle system
views.
Note: This is required for troubleshooting the Oracle Database default template.

The Oracle SQL*Plus tool is included in the Oracle Data Provider for .NET
([Link]) package. This package should be installed first as described in the,
Installing [Link], section. Once installed, navigate to the installation directory
and ensure that the [Link] file exists.

Connecting to an Oracle Server Using Simple Syntax

1. Run [Link] and navigate to the directory where [Link] is located.
2. Run the following command to test simple syntax:
sqlplus<UserName>/<Password>@<OracleServerNameOrIP>/<ServiceNameOrSid>

where

1208

Connecting to the Oracle Server Using Full Oracle Connection Syntax

l

l
l

is the username of the account used by the Oracle User Experience Monitor in SAM.
<Password> is the valid password for this account as defined in the SAM
Credential Library.
<OracleServerNameOrIP> is the Oracle Server hostname or IP address.
<ServiceNameOrSid> is the Oracle endpoint Service_Name or SID value as
defined in the Oracle User Experience Monitor settings.
<UserName>

For example:
sqlplus SYSTEM/Password1@[Link]/XE

This is used to connect to the XE instance on the Oracle Server running on

[Link] under the System account using Password1 as the password.
l

SqlPlus will show information on whether or not the connection was successful. If the connection was unsuccessful, the error message should contain the reason why it failed.
If the connection was successfully established, then the prompt, SQL>, is
shown.

Connecting to the Oracle Server Using Full Oracle Connection Syntax

To more accurately simulate how SAM is connecting to the Oracle Server, run
SQL*Plus using the full Oracle connection syntax , which is the equivalent of
using the [Link] syntax:
sqlplus <UserName>/<Password>@(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=
(PROTOCOL=TCP)(HOST=< OracleServerNameOrIP>)(PORT=<PortNumber>)))(CONNECT_
DATA=(<EndPointType>=<ServiceNameOrSid>)))

where
l

is the username of the account used by the Oracle User Experience Monitor in SAM.
<Password> is the valid password for this account as defined in the SAM
Credential Library.
<OracleServerNameOrIP> is the Oracle Server hostname or IP address.
<UserName>

1209

Configuring and Integrating

l
l

<PortNumber> is the specified TCP port where the Oracle endpoint listens.
<EndPointType> specifies the type of Oracle endpoint. This value must be

either Service_Name or SID. This should match the Oracle User Experience Monitor settings in SAM.
<ServiceNameOrSid> is the Oracle endpoint Service_Name or SID value as
defined in the Oracle User Experience Monitor settings.

For Example:
sqlplus SYSTEM/Password1@(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=
(PROTOCOL=TCP)(HOST=[Link])(PORT=1521)))(CONNECT_DATA=
(SERVICE_NAME=XE)))

Note: This example is used without specifying the password on the command line (Sqlplus will prompt for a password.)sqlplus SYSTEM @
(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOSTT=[Link])(PORT=1521)))(CONNECT_DATA=(SERVICE_NAME=XE)))

See the following illustration:

1210

Executing queries using SQL*Plus

Using SQL*Plus to connect using this method must be tried if SAM is unable to
connect to the Oracle Server. If the connection does not work from SQL*Plus, then
it will not work from SAM.
Executing queries using SQL*Plus
1. Connect to the Oracle Server as described in previous sections. Ensure
SQL*Plus shows the SQL> prompt.

2. Verify that it is possible to execute simple queries by typing, Select 1 from

dual;Note the semicolon at the end.

If this query is successful, the next step is to try the same query as used in the
Oracle User Experience Monitor in SAM.
3. Type the SQL query used by the Oracle User Experience Monitor and put
a semicolon at the end. Note: Semicolons are required in SQL*Plus.

1211

Configuring and Integrating

4. Press Enter to run the query.

This query may fail if you do not have privileges to access these SQL tables or
views. If this is the case, you should connect to the Oracle Server using the
Oracle administrator account (System) and execute the query under this account.
If this works, then the issue is permissions related and needs to be changed or a
different account should be used in SAM for monitoring.

PowerShell
The ability to employ PowerShell scripts within SAM is a powerful advantage for
system administrators. This document merely provides an introduction to
PowerShell, as well as its role with SAM.
Windows PowerShell is a command-line shell created for system administrators.
PowerShell includes an interactive prompt and a scripting environment that can
be used independently or in combination.
PowerShell is built on top of the .NET Framework Common Language Runtime
(CLR) and the .NET Framework, and accepts and returns .NET Framework
objects.

1212

PowerShell and SAM: Configuration and Usage

PowerShell also introduces the cmdlet. A cmdlet is a simple command that can
manipulate objects in PowerShell. Cmdlets have a unique format -- a verb and
noun separated by a dash (-), such as Get-Help. You can use each cmdlet
separately or in combination to perform complex tasks. PowerShell includes more
than one hundred cmdlets, and you can write your own.
PowerShell gives you access to the file system on the computer. In addition,
PowerShell providers enable you to access other data stores, such as the
registry, for example.
Things you should know about PowerShell:
l

PowerShell does not process text. Instead, it processes objects based on

the .NET Framework.
PowerShell comes with a set of built-in commands with a consistent interface.

PowerShell and SAM: Configuration and Usage

In order to use PowerShell with SAM you must have PowerShell 2.0 installed on
the SAM and target servers. PowerShell 2.0 can be found here:
[Link]
Once PowerShell is installed on the SAM and target servers, ensure that
Windows Remote Management (WinRM) is properly configured and enabled on
the SAM and target servers. To do this, follow these steps:
1. On the SAM server, open a command prompt as an Administrator. To do
this, go to the Start menu and right-click the [Link] and then select Run
as Administrator.
2. Enter the following in the command prompt:
winrm quickconfig qwinrm set winrm/config/client @{TrustedHosts="*"}

1213

Configuring and Integrating

3. On the target server, open a command prompt as an Administrator and
enter the following:
winrm quickconfigwinrm set winrm/config/client @{TrustedHosts="IP_ADDRESS"}

where IP address is the IP address of your SAM server. Once you have
successfully completed these steps, PowerShell will be able to properly
communicate with SAM.
Exchange 2010 Management Tools
Many SAM PowerShell components rely on Exchange Management Tools. Both
the 2007 and 2010 editions are acceptable.
If you plan to monitor Exchange 2007 then you must use the Exchange 2007
Management Tools. If you plan to monitor Exchange 2010 then you will need to
install the Exchange 2010 Management Tools.
Exchange Management Tools must be installed on the SAM server and any
additional poller that will poll using PowerShell scripts. Any snap-ins that
PowerShell may require must also be installed in the same location.
To ease PowerShell plug-in management in a multi-poller environment, you may
prefer to assign nodes with PowerShell templates to a single polling engine.
Exchange 2010 Management Tools will be used for the following instructions:
Installation of Exchange Management Tools:
To install Exchange Management Tools on your Windows computer, you first
need to configure the pre-requisite components.
1. Open the Control Panel, click on Programs and then click Turn Windows
Features On or Off.

1214

Installation of Exchange Management Tools:

2. Enable the features shown below:

3. Download the Exchange Server 2010 SP1 installation files and extract
them to a temporary folder on your computer.
4. From that folder launch [Link]. (If your computer is missing the .NET
Framework, visit [Link] to download and install it. Additionally,
Steps 1 and 2 of the Exchange Server 2010 SP1 installation will prompt
you to install pre-requisites if they are missing, as shown in the following

1215

Configuring and Integrating

illustration.)

5. If needed, install the pre-requisites for Exchange Server 2010 SP1. If not,
click on Step 3 from the install screen and choose Install only languages
from the DVD.

6. Choose language options for installing Exchange Server 2010 SP1 on

Windows.
7. Next, click on Step 4 from the install screen to begin the installation.

1216

Installation of Exchange Management Tools:

8.
9.
10.
11.
12.

Begin the installation of Exchange Server 2010 SP1 on Windows.

Click Next at the introduction page, then Accept the license agreement.
Click Next, then choose your preference for Error Reporting.
Click Next.
At the Installation Type page, select Custom Exchange Server Installation, and also check the box to Automatically install Windows Server
roles and features required for Exchange Server.
13. Click Next.

1217

Configuring and Integrating

14. Select the Management Tools role and then click Next.

64-bit vs. 32-bit

Using the 64-bit (x64) or 32-bit (x86) version of PowerShell depends on how your
target server and applications are configured. Ideally, both machines should be
running on the same platform to get the most out of PowerShell.
Platform Scenarios
For the most part, you will not encounter any differences between the 64-bit and
32-bit versions of PowerShell; however, each version of the shell, in some cases,
can only load matching snap-ins. This means you should use the correct 64-bit or
32-bit version of any snap-ins you plan to use. Below are some guidelines to help
you determine which version of PowerShell you should use for your particular
monitoring environment:
l

If SAM is installed on a 64-bit sever and polling a 64-bit machine, you

should poll using the 64-bit version of PowerShell.
If SAM is installed on a 64-bit sever and polling a 32-bit machine, you
should poll using the 32-bit version of PowerShell.
If SAM is installed on a 32-bit sever and polling a 32-bit machine, you
should poll using the 32-bit version of PowerShell.

1218

Troubleshooting PowerShell Snap-In Compatibility

l

If SAM is installed on a 32-bit server and polling a 64-bit machine, you may
encounter some errors. You should install SAM on a 64-bit server if you
need to poll 64-bit machines.

Note: There may be instances where installed software on a 64-bit machine may
have added its own cmdlets into the 32-bit version of PowerShell. If this is the
case, you should use 32-bit polling.
On Windows machines, you can determine the platform you are using by rightclicking My Computer and clicking Properties.
Troubleshooting PowerShell Snap-In Compatibility
The most common issue with PowerShell is the incompatibility of the snap-ins
with the platform of PowerShell being used; meaning both PowerShell and its
snap-ins should both be either 64-bit or 32-bit. When running your script in SAM,
typical errors of this type resemble the following:

However, no evidence of a snap in problem exists in PowerShell itself.

In order to diagnose and correct this problem, verify that the snap-ins are properly
registered by doing the following.
1. Find the following registry path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellSnapIns

Notice the ApplicationBase path is C:\Program Files\Microsoft\Exchange

1219

Configuring and Integrating

Server\bin not C:\Program Files (x86). The C:\Program Files (x86) path

would suggest 32-bit PowerShell extensions are registered.

2. Open PowerShell though the GUI and check to see if the process is running in 32-bit mode. This is denoted by the *32 next to the process name.
Since this is a 64-bit server with the 64-bit Exchange Management
installed, PowerShell should not have a "*32" next to the process name. It
should look similar to the image below:

3. Open your 64-bit PowerShell session and run the following:

add-pssnapin [Link].E2010
4. Run get-PSSnapin registered. You should see the snap-in listed as
shown below:

5. Now you should be able to execute a PowerShell command such as GetMailboxDatabase -Server {exchange server hostname} and have it return

1220

PowerShell Templates and Monitors

results similar to the following:

6. Your snap-in module has properly been registered. SAM templates that
use PowerShell will now work properly.

PowerShell Templates and Monitors

Many SAM templates contain component monitors that allow for the use of
PowerShell scripts. An easy way to find a list of these templates is to navigate to
the Manage Application Monitor Templates page and search for the word,
"PowerShell." This can be done from the SAM web console by navigating to
Settings > SAM Settings > Manage Templates. The search text box is at the topright of the screen.
Below is a sample list of the templates found when "PowerShell" is searched. To
examine and edit a template, check the box next to the template name. Once a
template is checked, the Edit button will become enabled. Click Edit at the top of
the list to open the selected template.

In this example, the Exchange 2007-2010 Mailbox Send and Receive Statistics
with PowerShelltemplate is used. This template tracks Exchange Mailbox
Send/Receive statistics of Exchange 2007-2010 servers with the Mailbox role
using PowerShell scripts.
The following screen appears once you have selected a template to edit,
revealing the individual component monitors as well as details about the
template:

1221

Configuring and Integrating

The following documentation accompanies this template:

Prerequisites:
l

l
l

PowerShell 2.0 and Exchange Management Tools 2007 or 2010 installed

on the SAM server.
The Exchange server must have an Exchange Mailbox role.
The SAM server and the Exchange server must be in the same domain.

Credentials:
The credentials must be an Exchange Administrator (Organization Manager)
account with at least view-only permissions.
Note: Before using this template, under the Advanced tree collapse [+], you
should set the correct platform; either 32-bit or 64-bit, from the dropdown menu.
The default it set to 32-bit.

1222

PowerShell Templates and Monitors

For all PowerShell component monitors: You must specify the correct name of
your Exchange user and server in the Script Arguments field of the corresponding
PowerShell Monitor. If you fail to do this, the counter will return with an error of
"Undefined" status.
For example: If the name of your Exchange server is [Link],
and the user you want to monitor is [Link]@[Link], the value in the
Script Arguments field should be the following:
[Link]@[Link],[Link].
To see the names of your Exchange servers, run the following PowerShell
command in the Exchange Management Shell: Get-ExchangeServer
To see the names of the users, run the following PowerShell command in
Exchange Management Shell: Get-Mailbox
To examine and edit an individual PowerShell component monitor within the
template, click [+] to the left of the monitor. For example: Number of items
received by specific user during last month.

The following details about the selected component monitor are revealed:

1223

Configuring and Integrating

Using a PowerShell script, the monitor in this example is designed to return the
number of items received by a specific user during the last month.
In order to use this monitor, you will need to change the Script Arguments field
from the default example of, user@[Link],[Link] to something
that will suit your needs for your particular environment. You can do this by
clicking the Edit button (highlighted above).You also have the ability to alter the
pre-defined script that comes with PowerShell component monitors.
Note: Unless otherwise directed by the documentation, you should not need to
edit pre-defined scripts.
Once you have changed the Script Arguments field, click Submit to begin using
the component monitor within the template. The output for this script using the

1224

PowerShell Code with SAM

SAM monitor, Number of items received by specific user during last month,
should be similar to the following illustration:

The output for the script using only PowerShell should be similar to the following
illustration:

PowerShell Code with SAM

SolarWinds does not provide customer support for any scripting language. For
scripting support with SAM, the SolarWinds public community on [Link]
may be of assistance.
Note: Unless otherwise directed by the documentation, you should not need to
edit pre-defined scripts.
To edit the default script for the Number of items received by specific user during
last month monitor, click the Edit button for that monitor. Below is the default
PowerShell script for this component monitor:
Note: Each statistic and message output pair of your script requires a unique
identifier. A maximum of 10 output pairs can be monitored per script.
$ErrorActionPreference = "silentlycontinue";
add-pssnapin [Link].E2010;
add-pssnapin [Link];
$address = $[Link](0);
$server = $[Link](1);
$[Link]();
if ( !$address )
{
Write-Host "Message: Can't find "user_mailbox" argument.

1225

Configuring and Integrating

Check documentation.";
exit 1;
}
if ( !$server )
{
Write-Host "Message: Can't find "server" argument. Check
documentation.";
exit 1;
}
$t1 = Get-Date;
$t2 = $[Link](-1);
$stat = (Get-MessageTrackingLog -Server $server -Recipients
$address -EventID "Receive" -ResultSize "Unlimited" -Start $t2
-End $t1 | Measure-Object).Count;
if ($[Link] -eq 0) {
Write-Host "Message: User $address received: $stat items
during last month";
Write-Host "Statistic: $stat";
Exit 0;
}
Write-Host "Message: $($Error[0])";
Exit 1;

Variables are used for storing information. In SAM, variables are prefixed with "$",
as highlighted below. The following code snippet from the above code calculates
a numerical value and then stores it in the variable $stat. In the illustration below,
the variable's value is reported as 9356, as highlighted in the Statistic column's
output.

Text and variables within quotes indicate information that may be visible to the
user. When made visible, the variables in the message will be replaced with the

1226

Scripts Must Report Status Through Exit Codes

values the variables store. The variables are highlighted below in both the code
and the output:

With these same lines of code, Message: and Statistic: refer to the columns where
the information will be placed:

Scripts Must Report Status Through Exit Codes

Scripts must report their status by exiting with the appropriate exit code. The exit
code is used to report the status of the monitor, which is seen by the user through
the interface. The following table explains the exit codes and their values:
Exit Code

Meaning

Up

Down

Warning

Critical

Any other value Unknown

1227

Configuring and Integrating

The following code snippet shows proper usage of exit codes.

The two exit codes in this example are conditional, meaning either one or the
other will be triggered based on a certain outcome. When Exit 0; (status of Up) is
reported, the message and statistic are displayed and the monitor shows a status
of Up. When Exit 1; (status of Down) is reported, the message and statistic are not
displayed and a status of Down is reported.
If you want to inform SolarWinds SAM that a PowerShell script reports an Up
status, you would exit the script using Exit 0;
Scripts with Text Output
Scripts report additional details by sending text to the scripts standard output.
SAM supports multiple values returned by a script using the following format.
There is a limit of 10 Statistic and Message pairs for the script. These can be
placed anywhere in the script output. The Statistic and Message names you
give must contain valid letters and/or numbers.
Detail Type

Required Meaning

Statistic

Yes

A numeric value used to

determine how the monitor
compares to its set thresholds.
This must be an integer value,
(negative numbers are
supported).
Statistic.Name1: 123Statistic.Name2:
456

Message

No

An error or information message

to be displayed in the monitor

1228

Remote Execution vs. Local Execution

status details. Note: Multi-line

messages are supported. To use
this functionality, print each line
using a separate command. For
example:
Message.Name1: abc
Message.Name2: def

For more information, refer to the following sections:

l
l

"Creating a Windows PowerShell Monitor" on page 389.

For more information about Windows PowerShell, visit: [Link]
For a complete list of available PowerShell cmdlets, visit: [Link]

Remote Execution vs. Local Execution

When you select remote execution, SAM creates a remote session via WinRM on
the target server. The script is then copied to the target server and run there.
When you select local execution, a local version of the PowerShell console will
open. If you need to run specific non-default cmdlets for the target server, you
should have the needed cmdlets installed on the SAM machine.
The following script can be used inside of SAM (local/remote execution modes)
and outside of SAM in the PowerShell console. The script returns 0 and the
Hostname of the SAM machine (SAM local execution) or the Hostname of the
target machine (SAM remote execution). In the Windows PowerShell console, the
script returns the local machine Hostname. If for some reason the script cannot
get the hostname, it returns 1 and a message of Host not found.
Script:
$stat = $env:computername;
if ($stat -ne $null)
{
Write-Host "Statistic: 0";
Write-Host "Message: $stat";
}

1229

Configuring and Integrating

else
{
Write-Host "Statistic: 1";
Write-Host "Message: Host not found";
}

To save this script as a PowerShell (ps1) file:

In Notepad, save the script as Get-Date.ps1 (You can rename an existing file from
*.txt to *.ps1.)
To open the PowerShell console:
For Windows x64:
l

For x64, navigate to Start > Accessories > Windows PowerShell > Windows PowerShell
For x86, navigate to: Start > Accessories > Windows PowerShell > Windows PowerShell (x86)

For Windows x86:

l

Navigate to Start > Accessories > Windows PowerShell > Windows

PowerShell

To run this command via remote execution:

invoke-command ComputerName SOME_PC -Credential SOME_PC\SOME_
USER -ScriptBlock { Get-Date }

To run this command via local execution:

Name the file Get-Date.ps1 and run it by double-clicking it.

1230

Execute Scripts Remotely via Secure WinRM

Execute Scripts Remotely via Secure WinRM

Note: The steps outlined below are only for advanced users. Following the steps
outlined in the section, " PowerShell 2.0 Remoting Configuration" on page 1233
should be sufficient for most users and environments.
Aside from new remoting specific cmdlets with enhanced capabilities,
PowerShell 2.0 also ships with full remoting functionality. It is possible to connect
your local PowerShell session to a remote computer and execute commands just
as if you were sitting in front of the server console. The technology to make this
happen relies on WinRM 2.0, which is Microsofts latest implementation of the
WS-Management Protocol, a SOAP-based protocol used to manage a variety of
hardware devices. The theory behind this is that it will provide a shared way for
differing systems to communicate with each other.
WinRM 2.0 communicates via HTTP, and so is likely to be firewall-friendly; it also
listens on ports 5985 (default) and 5986 (encrypted), avoiding issues with locally
installed IIS. Even though it uses HTTP for communication, security has still been
considered; either NTLM or Kerberos are used for authentication, and if you wish
to configure WinRM 2.0 to use SSL, that is possible too. A lot of the configuration
can be carried out via new PowerShell cmdlets shipped with version 2.0.

1231

Configuring and Integrating

Since PowerShell 2.0 and WinRM 2.0 go hand in hand, Microsoft has bundled
them up together along with a new version of BITS (Background Intelligent
Transfer Service) 4.0, making a single package known as the Windows
Management Framework. Although this collection makes some sense if you know
the background, there can be some confusion if an administrator is searching for
the download of PowerShell 2.0, ends up at the homepage for the Windows
Management Framework ([Link] and wonders
what the heck that is. Well, now you know!
The components of the Windows Management Framework are already installed
with both Windows Server 2008 R2 and Windows 7, although WinRM 2.0 is not
enabled by default on Windows 7. The components have also been made
available for older OS versions, and you can download all of those from the
homepage of the Windows Management Framework. Essentially, it is available
for the various flavors of Windows Server 2008 and 2003, as well as the Windows
Vista and XP client operating systems although BITS 4.0 is not available for
Windows Server 2003 or XP. This might sound like a muddle, but in short, it is
possible to run remote PowerShell 2.0 sessions both to and from all these
different operating systems.

PowerShell 2.0 Remoting Requirements

To enable PowerShell remoting, all computers participating in remote
management should have the following software:
l
l
l

Windows PowerShell 2.0

NET framework 2.0 SP1 or later
Windows Remote Management (WinRM) 2.0

All of the above are installed by default on Windows 7 and Windows Server 2008
R2. However, earlier versions of Windows will require you to download the
updates from Microsoft website and install them yourself.
PowerShell 2.0 and WinRM 2.0 are included as a part of Windows Management
Framework download and are available for Windows XP, Windows Server 2003,
Windows Vista and Windows Server 2008.
To be able run scripts and commands on remote computers, the user performing
remote script execution must be:
l
l

A member of the administrators group on the remote machine or

Should be able to provide administrator credentials at the time of remote
execution or
Should have access the PS session configuration on the remote system

1232

PowerShell 2.0 Remoting Configuration

Also, on client OS versions of Windows such as Windows Vista and Windows 7,
network location must be set either to Home or Work. WS-Management may not
function properly if the network location for any of the network adapters is set to
public.

PowerShell 2.0 Remoting Configuration

To get PowerShell remoting working we need to configure Remoting Client and
Remoting Server. In this document Remoting Client is a SAM box (including
additional pollers if there are any); The Remoting Server is any target node, which
we are going to monitor with the use of the PowerShell monitor configured to
execute scripts remotely via WinRM. As an example, we will discuss the remoting
configuration procedure against Windows Server 2008 R2.
Note: Some commands (or steps) may be different if Windows Server 2003 is
used.
Configuration of the Remoting Server
To turn your computer in to a Remoting Server that is accessible from other
machines, the prerequisites for Remoting Server need to be in place:
l

SSL Certificate: This is required if we are going to secure our WinRM connection.
Listener: Inside WinRM, a listener needs to be set up that listens on the network port Windows PowerShell the Remoting Server uses to communicate.
Firewall Exception: A firewall exception is needed that allows outside
requests to reach the WinRM service;
WinRM Service: This service receives requests from other computers and
needs to be running.

Create a Self-signed Certificate

You will need an SSL certificate to use a secure WinRM connection. WinRM
HTTPS requires a local computer Server Authentication Certificate with a CN
matching the IP address that is not expired or revoked to be installed.
There are two well-known tools available to create self-signed certificates;
[Link] and [Link]. [Link] is for testing purposes only and
comes with Visual Studio. [Link] is a part of the Internet Information
Services (IIS) 6.0 Resource Kit Tools. [Link] will be used in this example.

1233

Configuring and Integrating

The following commands should be executed on the Remoting Server computer.
This is the target node to be used with the SAM PowerShell monitor.
1. Download Internet Information Services (IIS) 6.0 Resource Kit and start
setup:

1234

Create a Self-signed Certificate

2. Choose the Custom Setup option:

3. Select only the [Link] tool (if you have no need for the additional
components):

1235

Configuring and Integrating

4. Open a Command Prompt as an administrator from the Start menu, (rightclick):

5. Change the current location on SelfSSL install path. Typically the path is
C:\Program Files (x86)\IIS Resources\SelfSSL:

1236

Create a Self-signed Certificate

6. Enter the following command to create a self-signed certificate. Replace

the parameters with actual values, as explained below. Note: Ignore the following possible error message: Error opening metabase: 0x80040154.
This indicates that IIS 6.0 compatibility mode may not be installed.
[Link] /N:CN=<Local Server IP Address> /V:<Certificate time
to live in days> /P:<WinRM listener port> /T /Q
l

This is the IP address of the Remoting Server

node. Use the IP address and not the computer name. SAM uses this IP
address when the probes are run;
<Certificate time to live in days> This is the time interval, in days, for which
the certificate remains valid;
<WinRM listener port> This is the port on which the HTTPS listener will be
created. The default value for the WinRM HTTPS listener port is 5986;
/T This option adds the self-signed certificate to the Trusted Root Certificates list;
/Q Quiet mode. This will prevent you from be prompted when SSL settings are overwritten.
<Local Server IP Address>

For example: [Link] /N:CN=[Link] /V:3600 /P:5986 /T /Q

1237

Configuring and Integrating

7. Verify that certificate was created properly. Start the Management Console
([Link]):

8. Add the Certificates snap-in and verify that the recently created self-signed
certificate is listed in both the Personal and Trusted Root Certificate

1238

Create a Self-signed Certificate

Authorities storages.

9. Follow the red steps in the graphic, 1 through 4, to select the Certificates:
snap-in

1239

Configuring and Integrating

10. Once complete, you should have the following:

11. Verify that the certificate is in Personal storage:

12. Verify that the certificate is in Trusted Root Certificate Authorities storage:

1240

Create a WinRM HTTPS Listener

13. Open the created certificate by double-clicking it.
14. On the Details page, select and copy the Thumbprint field value:

15. Copy the values highlighted above to the clipboard. These copied values
will be used in creating a Listener in the following section.
Create a WinRM HTTPS Listener
Create the Windows Remote Management Listener and bind it to the certificate
using the following steps:
1. Open a Command Prompt as an administrator from the Start menu, (rightclick):

2. The following command should be executed on the Remoting Server computer. This is the target node which will be used with the SAM PowerShell
monitor. It is also the computer where the self-signed certificate was created in the previous section.

1241

Configuring and Integrating

3. Enter the following command with the parameters replaced with actual values, as explained below:
winrm create winrm/config/Listener?Address=<IP Address used to bind listener>+Transport=HTTPS @{Hostname=<The name or IP of your remoting server>;CertificateThumbprint=<Paste from the previous step and remove the
spaces>;Port=<Port number>}
l

- To bind the certificate to the Listener, specify the Remoting Server's local IP address. You can use the wildcard, (*),
symbol to allow listening on all available local addresses;
<The name or IP of your remoting server> - The Remoting Server's node name
or IP address;
<Paste from the previous step and remove the spaces> - Paste the self-signed
certificate thumbprint created in steps 13-14 of the previous section;
<Port number> - This is the port number for the Listener. You can specify the
default WinRM HTTPS port of 5986.
<IP Address used to bind listener>

For example:
winrm create winrm/config/Listener?Address=IP:[Link]+Transport=HTTPS @
{Hostname="[Link]";CertificateThumbprint="6aa47ed7356fb0f1e3b434850a7bb51ed40
b0d3a";Port="5986"}

Once the command has been successfully executed, the output will look similar to
the following illustration:

1242

Adding a Firewall Exception

Adding a Firewall Exception
The following steps will create a in-bound exception for the Windows firewall
using WinRM HTTPS port 5986.
1. Open a Command Prompt as an administrator from the Start menu, (rightclick):

2. Enter the following command with the parameters replaced with actual values, as explained below:
netsh advfirewall firewall add rule name="<Rule name>" protocol=TCP dir=in localport=<Port number> action=allow

- This is the name of the rule shown in the Windows Firewall under Advanced Security > Inbound Rules;
<Port number> - This is the port number in use for the Listener
that was created in the previous section.
<Rule name>

For example:
netsh advfirewall firewall add rule name="WinRM via HTTPS - Open Port 5986"
protocol=TCP dir=in localport=5986 action=allow

Remoting Client/SAM Computer Configuration

Import the self-signed certificate from the Remoting Server with the
following steps:

1243

Configuring and Integrating

1. On the Remoting Server, open the management console;

2. Add the Certificates snap-in;

3. Locate the created certificate and right-click on it then selet All Tasks >
Export

1244

Remoting Client/SAM Computer Configuration

4. The Certificate Export Wizard will be launched:
5. Select, No, do not export the private key, then click Next.

6. Select, DER binary X.509 (.CER), and then click Next.

1245

Configuring and Integrating

7. Specify the file, and then click Next.

8. Click Finish.

1246

Transferring the Certificate:

Transferring the Certificate:
1. Now you need to transfer the certificate. On the Remoting Client, open the
Management Console.

2. Add the Certificates snap-in.

3. Follow the red steps in the graphic, 1 through 4, to select the Certificates
snap-in:

1247

Configuring and Integrating

4. Click OK when done.

5. Locate Trusted Root Certification Authorities, right click on it, then navigate
to All Tasks > Import.

1248

Transferring the Certificate:

6. The Certificate Import Wizard will be launched. Find the file to import and
then click Next.

7. Select, Place all Certificates in the following Store. The store is "Trusted
Root Certification Authorities."

1249

Configuring and Integrating

8. Complete the wizard by clicking Finish.

1250

Communicate with Remoting Host

9. Verify that certificate was imported successfully:

Communicate with Remoting Host

If your machine is only acting as a client in a domain environment, meaning it is
accessing other systems but not being accessed itself, you do not need to
configure anything out of the ordinary.
The following minimum setup will only allow access to other systems that have
enabled remoting. You will not be able to test remoting on your own computer.
To set up TrustedHosts without calling Enable-PSRemoting, you need to add a
registry key and then temporarily run the WinRM service.
The following steps will set up TrustedHosts:

1251

Configuring and Integrating

1. Run a Windows PowerShell console as an administrator (right-click):

2. Execute the following commands:

l

PS> Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemLocalAccountTokenFilterPolicy 1 -Type DWord

PS> Start-Service WinRM

3. Add the TrustedHosts entry:

l

PS> Set-Item WSMan:\localhost\Client\TrustedHosts

Value * -Force

4. Turn off the WinRM service and revert the value of the LocalAccountTokenFilterPolicy registry entry:
l

PS> Stop-Service WinRM PS> Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

LocalAccountTokenFilterPolicy 0 -Type DWord

Your client is now able to access other systems remotely using Windows
PowerShell remoting and is no longer limited to Kerberos and machines inside a
domain.

Setup Windows PowerShell Monitor in SAM

Create and test the SAM PowerShell monitor using the following steps:

1252

Setup Windows PowerShell Monitor in SAM

1. From the SAM web console, navigate to: Settings > SAM Settings > Manage Templates.
2. Search for "PowerShell."
3. Select a template by checking the box next to the template name, an then
clicking Edit.
4. Click [+] to the left of a monitor name to reveal its details:
5. You must choose Remote Host as the execution mode.
6. Check the Use HTTPS Protocol setting.
7. The Port Number value, (the default value is 5986 for WinRM secure connection), should correlate with the port on which the Listener was created on
the Remoting Server.

8. Enter a simple script in the monitor for testing by clicking Edit, for example:
write "[Link]: 0";
write "[Link]: $env:computername";
exit 0;

Note: This script is printing the computer name (the machine on which this
is executed).

1253

Configuring and Integrating

9. Define the output columns for the script:

1254

Setup Windows PowerShell Monitor in SAM

10. View the script output:

11. Create an application based on our template and assign it to the Remoting
Server target node:

12. Examine the script output. Done correctly, you should see the name of the
Remote Server node in the output, not the SAM server, (i.e. the script was
executed remotely).

1255

Configuring and Integrating

You now have a PowerShell monitor configured to execute scripts remotely via
secure WinRM connection.

LDAP
Lightweight Directory Access Protocol (LDAP) is a protocol for accessing
directory servers. In other words, LDAP is a directory, not a database. There are
no rows or tables in LDAPs directory and there are no relational links. The result
is a simple yet structured directory design that is easy to navigate.
Every object in LDAP can contain one or more sub-objects, much like the folder
and sub-folder relationship used in Windows operating systems. LDAP runs
directly over TCP port 389 by default. It is used to store information about users,
including the network privileges assigned to each user. Revoking or changing
privileges can be done from one entry in the LDAP directory, rather than at many
machines across the network. LDAP also supports SSL and TLS for security.

LDAP Key Terms and Components

Following is a list of key terms and components along with their respective
definitions.
Distinguished Names
Distinguished Names (DNs) are a fundamental part of LDAP. LDAP uses path
syntax to identify objects in the store.
Typical Windows path syntax:
C:\Files\Pictures\[Link]

DNs work in reverse order, meaning the most specific node is on the left of the
path syntax. Typical example of a DN:
CN=SomeUser,OU=SomeContainer,DC=SomeDomain,DC=com

This DN is composed of four Relative Distinguished Name (RDN) parts:

CN=SomeUserOU=SomeContainerDC=SomeDomainDC=com

Each RDN is a child of the object whose RDN is to its right. The object deepest in
the tree in this DN example is the object, CN=SomeUser.
Each RDN is composed of two parts: the name of the attribute that provides the
primary name of the object, and the value of that attribute. In this example, CN,
which stands for Common Name, is the name of the attribute that provides the
primary name for objects of its class. SomeUser is the value of this attribute.

1256

Search Root
There are also RDN attributes for OU (Organizational Unit) and DC (Domain
Component).
Like any file system, the name for an object in an LDAP container must be
unique. Thus, CN=Kate uniquely identifies this object within its container,
OU=CustomerSupport. As a result, the entire DN uniquely identifies this particular
object in the entire directory tree.
Search Operation
The most important operation in LDAP is the ability to search. This is how objects
are found in the directory tree and how values are read. The syntax is somewhat
different from more familiar query syntaxes such as SQL. However, LDAP is also
much simpler than SQL with SQL's joins, sub-queries, ordering, and grouping.
An LDAP query is composed of four basic parts: a search root, a search scope, a
filter, and a list of attributes to return. There are more parameters and options, but
these basic four are enough for most cases.
Search Root
The search root determines the place in the tree from which the search will start.
This value is passed as a DN in string format. To search the entire directory, pass
the DN of the object that is the root of the tree. To search lower in the hierarchy,
specify a lower-level DN.
Search Filter
The search filter determines which objects will be returned in the query. It is
analogous to the Where clause in a SQL statement. Each object in the scope of
the query will be evaluated against the filter to determine whether or not it
matches. Objects that do not meet the filter criteria are eliminated from the search.

Basic LDAP Syntax

The following table outlines basic operators for use with LDAP:
Operator Operator Definition
Definition
=

Equal to

Example

This argument means an attribute

must be equal to a certain value to
be true.

1257

(givenName=Kate)

This will return

all objects that

Configuring and Integrating

have the first

name of "Kate."
Note: Because
there is only one
argument in this
example, it is
surrounded with
parentheses for
illustration.
&

And

Use & when you have more than

one condition and you want all
conditions to be true. For example,
if you want to find all of the people
that have the first name of Kate and
live in Austin, you would use the
example in the right-hand column.

(&(givenNamee=Kate)(l=Austin))

Not

The ! operator is used to exclude

objects that have a certain attribute.
If you need to find all objects except
those that have the first name of
Kate, you would use the example in
the right-hand column. This would
find all objects that do not have the
first name of Kate.

(!givenName=Kate)

Note: Because
there is only one
argument in this
example, it is
surrounded with
parentheses for
illustration.

Note: The ! operator goes directly in

front of the argument and inside the
argument's set of parentheses.
*

Wildcard

Use the * operator to represent a

value that could be equal to
anything. If you wanted to find all
objects that have a value for title,
you would then use the example in
the right-hand column. This would

1258

(title=*)

The LDAP User Experience Monitor

return all objects that have the title

attribute populated with any value.
*

Wildcard

This would apply to all objects

whose first name starts with "Ka."

(givenName=Ka*)

Advanced Examples of LDAP Syntax:

l

You need a filter to find all objects that are in NYC or Austin, and that have
the first name of "Kate." This would be:
(&(givenName=Kate)(|(l=NYC)(l=Austin)))

You have received 9,360 events in the Application log and you need to
find all of the objects that are causing this logging event. In this case, you
need to find all of the disabled users (msExchUserAccountControl=2) that do
not have a value for msExchMasterAccountSID. This would be:
(&(msExchUserAccountControl=2)(!msExchMasterAccountSID=*))

Note: Using the ! operator with the * operator will look for objects where that
attribute is not set to anything.

The LDAP User Experience Monitor

Use the LDAP Monitor to test that:
l
l
l

An LDAP client can open a connection with an LDAP server.

Specified objects exist and can be located in the LDAP catalogue.
The server responds within a required time frame.

The LDAP Monitor supports LDAP version 2, which is the most commonly
supported version. Most LDAP version 3 servers will support LDAP version 2
client requests.
How this Monitor Works:
1. It creates an instance of the LDAP Connection class using the specified directory identifier.
2. It configures the connection which can be encrypted.

1259

Configuring and Integrating

3. It establishes an LDAP connection and passes user authentication with the
bind operation.
4. It prepares and sends an LDAP search request. LDAP Search Root and
LDAP Filter monitor settings are used.
5. It reads and proceeds with an LDAP response. The monitor returns the
number of found entries as statistic data. It also calculates and shows the
server response time.

Integrating the LDAP User Experience Monitor

Prerequisites
The target LDAP server IP address and name must be successfully DNS
resolved from the SolarWinds server.
Fields Defined
The fields highlighted below are unique to this monitor, therefore, only they are
defined immediately following this illustration:
l

l
l

Port Number: Port 389 is the default port for a non-encrypted connection.
Use port 636 if you use encryption.
Encryption Method: Choose either SSL or StartTLS to encrypt your data.
Authentication Method: Below are the five available options:
o Anonymous: Indicates that the connection should be made without
passing credentials.
o Simple: Indicates that basic authentication should be used with the
connection. This only requires a valid username and password.
o NTLM: Indicates that Windows NT Challenge/Response (NTLM)
authentication should be used on the connection. This requires user
name, password, and domain (Realm).
o Kerberos: Indicates that Kerberos authentication should be used on
the connection. This requires a user name, password and domain
(Realm).
o Negotiate: Indicates that Microsoft's Negotiate authentication should
be used with the connection. This only requires a valid username
and password.
Realm (User Domain): This is the user's domain (e.g. for DC=soolarwinds,DC=com the realm would be solarwinds).
LDAP Search Root: This is the place in the LDAP tree that you want to
start your search. (e.g. The Users folder, as illustrated below):

1260

Credentials

This example is based on the Active Directory Domain Controller [Link]. The
LDAP search root would be CN=Users,DC=lab,DC=rio because the context name
Folder is Users, and the domain DC is [Link].
In general, you may specify just the domain root (DC=lab,DC=rio) to begin a search
because the monitor always applies the [Link] request option.
The query will search the entire domain tree for the requested object from the
specified root.
l

LDAP Filter: This describes the search condition for an LDAP query and
matching attributes.

Credentials
Credentials should be used without the domain because the Realm field is
defined with this information.
LDAP Monitor Statistics.
The following illustrates typical field entries for a working LDAP User
Experience monitor within SAM:

1261

Configuring and Integrating

In the illustration below, the Statistic and the Response Time values are
highlighted. A statistic of 1 is returned indicating that 1 user was found that
matched the filter criteria. This query took 259 milliseconds, as indicated by the
Response Time value of 259.

1262

SAM Page Help

SAM Page Help

This section is designed to provide context sensitive help from with the user
interface.

Application Custom Properties

This resource displays custom properties you have created for Applications. To
edit property values, click Edit Custom Property Values. From here, you will be
able to edit your custom property from within the assigned Application.

Find Processes, Services and Performance Counters

This page, accessible by clicking Find Processes, Services and Performance
Counters on the SAM Settings page, allows you to find the processes, services,
or performance counters on a server that SolarWinds SAM can monitor, and then
create an assigned application monitor or an application template from your
selections.
For more information, see To create a new template using the browsing method
in the SolarWinds SAM Administrator Guide.

SolarWinds SAM Application Detail Reports

Click Customize Page to add or remove resources on this page.
The following resources are available in the SolarWinds SAM Application Detail
Reports category for inclusion on the SolarWinds SAM Application Details page:

1263

How To...
This section provides simple examples of how to use the tools and resources that
SAM provides. If you would like to know How To do something or you have an
example of How To accomplish something, please post your idea at: Thwack
Suggestions. If selected, your idea will be listed in this chapter when a new
version of this guide is available.
Following are the examples included:
l
l
l

l
l
l
l
l
l

How to Monitor an Application Process Launched from a Specific Path.

How to Stop the Polling of all Applications Monitored by SAM.
How to Control Whether Alerts are Repeated or Suppressed if a Condition
Still Exists
How to Wrap a VBScript Around an Executable File
How to Monitor Multiple Instances of [Link]
How to Remove an Application Template from Multiple Nodes
How To Change the Width and Number of Columns in a Page View
How To Add and Manage Resources in a Page View
How to Restart a Windows Service with an Alert Action

How To Add and Manage Resources in a Page

View
1. Click Customize Page in the top right corner of the web console.
2. The following screen appears showing the current resources implemented
for both columns in the current view. With the icons to the right of each
column, you can add, delete, and move resources about the page by selecting that item and then clicking an action icon. Hovering the mouse over an
icon reveals the action that icon will take when clicked.

1309

How To...

For example, clicking the green [+] icon will allow you to add a resource to
that column, which brings up the following screen:

3. From here, you can select a category to group resource items by from the
Group by dropdown menu:
Note: The Classic category reflects the tree views found in previous
versions of SAM for this resource.
4. Select the resources you want, and then click Add Selected Resources.
5. Click Done.
Notes:
l
l

Some resources will not be available for certain views.

The Last 25 Application Events resource is used across all
applications.
The Last XX Application Events resource is used for a single
application.

1310

How To Change the Width and Number of Columns in a Page View

How To Change the Width and Number of

Columns in a Page View
1. Click Customize Page in the top right corner of the web console.
2. Click Edit.

3. The following screen appears, allowing you to select one, two, or three
columns. From here you can also select the width of each column in pixels.

4. When done, click Submit.

How To Disable Asset Inventory Data Collection

l

For existing nodes, you can disable Asset Inventory data collection by
executing the following SQL command:
UPDATE [SolarWindsOrion].[dbo].[AssetInventory_Polling] set Enabled
= 0;

To disable this for future nodes added, rename the following file:
C:\Program Files (x86)
\SolarWinds\Orion\Discovery\Plugins\[Link]
[Link]

For example: [Link]-Disabled

How to Handle Microsoft Server Clusters in

AppInsight for SQL
Question: Should you monitor a cluster virtual node or the real server?
Answer:It is recommended that AppInsight for SQL be applied to the cluster VIP.
You should also have each cluster member node managed/monitored in SAM.
For more information, see Monitoring Clusters with AppInsight for SQL

1311

How To...

How to Remove an Application Template from Multiple Nodes

1. Navigate to Settings > SAM Settings > Manage Application Monitors.
2. From here, you can change the Group By dropdown menu to Application
Monitor Template.
3. Find the template in the list on the left and click that template.
4. Multi-select the nodes you want to delete the Application Monitor from.

How to Monitor Multiple Instances of [Link]

Let us assume you are using SAM to monitor your SQL servers and that you have
multiple instances of [Link] running. You want to monitor each instance of
[Link] individually so you can determine which instances (databases) are
causing excessive CPU usage.
In this example there are four instances of [Link] you want to monitor:
DB1, DB2, DB3, and DB4. By using command-line filtering when setting up an
application monitor, you can instruct SAM to monitor specific instances.
When viewing Task Manager on the SQL server, you can see that each of the
separate instances use a switch to specify the particular instance. For example, sDB1 is found at the end of that invoked instance.
Using the command-line filter of your SAM template, you can enter that switch to
get a list of the specific instances and their respective memory and CPU usage.

You also may be interested in: How to Monitor an Application Process Launched
from a Specific Path.

How to Restart a Windows Service with an Alert

Action
Example Alert Manager Trigger Action to Restart a Windows Service

1312

How to Wrap a VBScript Around an Executable File

Execute program: [Link] ${ComponentId}

Using the Preconfigured Restart a Service Alert

The SolarWinds Alert Manager includes a pre-configured alert called Restart a
Service that has a recovery action to restart a service if a Windows service
component monitor is down. You must enable this alert manually because it is
disabled by default.
To enable the Restart a Service alert:
1. Click Start > All Programs > SolarWinds > Alerting, Reporting, and Mapping > Advanced Alert Manager.
2. Click Configure Alerts.
3. Check Restart a Service.
4. Click Done.
For more information, see Restarting Windows Services with an Alert Action.

How to Wrap a VBScript Around an Executable

File
The following example demonstrates how to write a simple vbscript to open
[Link]:

1. Open Notepad and paste the following code into a new document:
Set WshShell = [Link]("[Link]")
Dim exeName
Dim statusCode
exeName = "%windir%\notepad"
statusCode = [Link] (exeName, 1, true)
MsgBox("End of Program")

2. Save the file as [Link] (manually change the extension to .vbs)

3. Double-click [Link] to run the program which launches [Link]
Note: Change the highlighted section to the path and .exe you want to
execute, for example, C:\Program Files\Mozilla Firefox\[Link]

1313

How To...

How to Control Whether Alerts are Repeated or

Suppressed if a Condition Still Exists
By default, alert actions happen once after a trigger. They will only trigger again
after the existing trigger condition clears. To have them trigger continuously
during each event, employ Alert Escalation on the Trigger Action. Following is the
flow of an alert:
1.
2.
3.
4.

Event happens
Check alerts that match Trigger Condition
Matching alert found, perform Trigger Actions
Perform all applicable Trigger Actions based on action configuration (Escalation falls here)

5. Reset Condition matched

6. Perform all applicable Reset Conditions

How to Stop the Polling of all Applications Monitored by SAM.

l
l
l

To do this permanently: Delete all SAM applications.

To do this temporarily: Unmanage all applications.
To disable polling quickly and temporarily, without changing application parameters:
1. locate the following file: C:\Program Files (x86)\Common
2.

Files\SolarWinds\JobEngine.v2\plugins\[Link]
Next, move it to a different location and restart the Job Engine v2

service.
Note: This will result in an invalid configuration which may generate
errors.

1314

How To Use VB Script to Monitor Your SSL Expiration Date

3. Return the file to its original place and restart the Job Engine v2 service to return this to a working state.

How To Use VB Script to Monitor Your SSL Expiration Date

Important: SAM has an SSL Expiration Date Monitor which can be found
atSSL Certificate Expiration Date Monitor." The following example demonstrates
a typical use case scenario using a Windows Script Monitor utilizing VB script.
In order to calculate the number of days until an SSL certificate expires, a vbscript
can be implemented with the Windows Script Monitor. This script relies on
OpenSSL being installed on your SolarWinds server to check for the expiration
date. The script below accepts one argument in the form of a URL, with the socket
number, and returns the statistic in the number of days remaining until expiration.
Before using this script you need to install OpenSSL, which is freely available on
the internet. Ensure the path given below has the OpenSSL plug-in installed or
change the path as per your OpenSSL plug-in.
For each instance of the monitor, change the text file that the monitor writes to,
(e.g.: [Link], [Link]), otherwise the monitors may return a value of, Unknown.
Warning: The code below is user-submitted. Use at your own risk. SolarWinds is
not responsible for the impact this code may have on your system. Exercise
caution when executing any code with which you are not familiar.
Installation: You will need to pass the argument site name plus the port number.
Example:
[Link]
Code:
Option Explicit
Dim
Dim
Dim
Dim
Dim
Dim
Dim
Dim
Dim

oShell
ArgObj
Fh
FSO
Line
Expiry
DaysLeft
ExpDate
oExec

1315

How To...
Dim
Dim
Dim
Dim
Dim
Dim
Dim
Dim

cert
tstream
i
str
PluginPath
CertFilePath
char
XString

Const ForReading = 1
CertFilePath = "C:\TMP\[Link]"
PluginPath = "C:\Program Files\Solarwinds\Common\OpenSSL\bin\"
Set FSO = CreateObject("[Link]")
Set tstream = [Link](CertFilePath, True)
ArgObj = [Link](0)
Set oShell = [Link]("[Link]")
'Calling funtion to retieve the host
Set oExec = [Link](PluginPath & "[Link] s_client -connect " & ArgObj)
'Write the certificate into a text file
Do Until [Link]
char = [Link](1)
[Link] (char)
If Len(XString) < 20 Then
XString = XString & char
ElseIf XString = "END CERTIFICATE-----" Then
Exit Do
Else
XString = Mid(XString, 2, 19)
XString = XString & char
End If
Loop
[Link]
[Link]
'Read SSL certificate for start date and end date
Set oExec = [Link](PluginPath & "[Link] x509 -noout in " & CertFilePath & " -dates")

1316

How To Use VB Script to Monitor Your SSL Expiration Date

'Return start date and end date of the certificate
Line = [Link]
'Get the expiration date of the certificate
Expiry = (Mid(Line, Len(Line) - 24, 24))
ExpDate = ConvertDate(Expiry)
'Calculating number of days
DaysLeft = DateDiff("d", Now(), ExpDate)
'Display the number of days remaining until expiration
[Link] "Statistic: " & DaysLeft
[Link] "Message: Number of days remaning of expiry for
SSL certificate are " & DaysLeft
'Object Closing code
[Link]
Set oShell = Nothing
Set oExec = Nothing
'This function converts the date into the required format
Function ConvertDate(DateStr)
Dim Components
Dim Month
Dim Day
Dim Year
Components = Split(DateStr)
Select Case Components(0)
Case "Jan", "January"
Month = 1
Case "Feb", "February"
Month = 2
Case "Mar", "March"
Month = 3
Case "Apr", "April"
Month = 4
Case "May"
Month = 5
Case "Jun", "June"
Month = 6
Case "Jul", "July"
Month = 7
Case "Aug", "August"
Month = 8

1317

How To...
Case "Sep",
Month = 9
Case "Oct",
Month = 10
Case "Nov",
Month = 11
Case "Dec",
Month = 12
Case Else
Month = 1
End Select

"Sept", "September"
"October"
"November"
"December"

Day = Components(1)
Year = Components(3)
If UBound(Components) = 5 Then
Day = Components(2)
Year = Components(4)
Else
Day = Components(1)
Year = Components(3)
End If
ConvertDate = CDate(Day & "/" & Month & "/" & Year)
End Function

How to Monitor an Application Process Launched

from a Specific Path.
You want to monitor an application process launched from a specific path.
For example:
Imagine your organization uses an application that runs multiple instances of the
same executable file for specific data needs. Each executable process is
launched from a different folder, and the catch is that these applications are
running on the same server.
l
l
l

Data application 1 is located in C:\DataApp1\[Link]

Data application 2 is located in C:\DataApp2\[Link]
Data application 3 is located in C:\DataApp3\[Link]

You can set up a Process Monitor (WMI) and SolarWinds SAM will display each
process ID (PID) in the dashboard. However, you need to monitor and report each

1318

How to Monitor an Application Process Launched from a Specific Path.

separate application that has been launched from each folder. What you want to
be able to do is set up an application template to monitor Data Application 1 that
resides in C:\DataApp1\[Link], then set up another template for data application
2, and so on.
How can you monitor an application that has been launched from each
specific folder/path?
You can use the Command Line filter to get information about concrete instance
(s). Check the command line using Task Manager (it is hidden by default) and if
the command line contains the full path. You can use this as a filter.

You also may be interested in: How to Monitor Multiple Instances of [Link]

1319

Troubleshooting
If you have problems with a SolarWinds product, the causes are usually related to
an incorrect configuration or corrupted files. The suggestions listed in this section
can often clear up these problems.
Additionally, you can visit our knowledge base repository for articles to help
remedy specific issues. The address is: [Link]
You can also talk to other users as well as the SolarWinds staff by logging on to
[Link]
Back Up Your Data
As a first step in any troubleshooting procedure, you should back up your
SolarWinds database. For more information, see Creating Database Backups
on page904.
Verify Program Operation
SolarWinds runs many components at the same time to deliver a view of your
network status. Confirm that the following components are running on your
SolarWinds server:
Services:
l
l
l
l
l

l
l
l
l

l
l
l
l

Message Queuing
[Link] Port Sharing Service
SNMP Trap Service
SolarWinds Alerting Engine service
SolarWinds Collector Data Processor, Management Agent, and Polling Controller services
SolarWinds Information Service
SolarWinds Job Engine and Job Engine v2
SolarWinds Job Scheduler
SolarWinds Network Performance Monitor Service. All SolarWinds products
use this service. It is not exclusive to SolarWinds SAM.
SolarWinds Product services
SolarWinds Information Service
SolarWinds Module Engine
SolarWinds Syslog and Trap Services

1320

Troubleshooting

l
l

SQL Server
Internet Information Service (IIS)

Stop and Restart

Many problems disappear when programs are restarted. Stopping and restarting
Internet Information Service (IIS) may eliminate web page problems. Problems
with polling or data gathering may be eliminated by stopping and restarting the
SolarWinds Network Performance Monitor Service using the available shutdown
tool that you can locate as follows:
1. Click Start> All Programs> SolarWinds> Advanced Features> Orion
Service Manager.
For a complete refresh of the system, reboot the computer.
Run the Configuration Wizard
Running the Configuration Wizard, which refreshes files on the web server and
performs checks on the structure of your database, may solve many problems.
Note: Before you run the Configuration Wizard, you should close all open
applications and stop the SolarWinds Network Performance Monitor Service in
the Windows Services Control Panel. It will be restarted by the Wizard at the end
of its process.
Using Full Variable Names
If you are having difficulty acquiring expected values from a selected variable,
using the ${VariableName}format, it may be helpful to include the database table
name within the variable name, as in ${Nodes.IP_Address}.

Why do my SAM WMI Monitors Show Status

Unknown?
To monitor SAM applications containing WMI component monitors, the
following conditions must be true:
l
l

WMI on the remote server is enabled and functioning properly.

The remote server is accessible through a RPC connection in order to run
the WMI queries.

If these conditions cannot be met, the WMI component monitors in SAM show an
Unknown status. Examples of some issues that can prevent these conditions from
being met include, but are not limited to:

1321

Working with Temporary Directories

l

l
l
l

Trying to connect to a remote computer where you do not have local Administrator rights.
A firewall blocking the WMI traffic.
An operating system that is not configured for WMI.
Mistyping the credential password in the SAM component monitor.

To help diagnose and fix these issues and others, we can test the WMI services,
the remote WMI connections, and the SolarWinds SAM component configuration
to discover and correct the issues that can prevent your WMI component monitors
from functioning correctly.
The topics in this guide are as follows:
l

WMI Troubleshooting Flowchart for SolarWinds SAM. Provides a flowchart

of the troubleshooting decisions described in this guide.
Testing Local WMI Services. Ensures WMI is running correctly on the target
computer.
Testing Remote WMI Connections. Ensures the WMI connection to the target computer is not being blocked, ignored, or rejected.
Testing SolarWinds SAM Component Configuration. Ensures you are properly configuring the WMI component credentials in SolarWinds SAM.

Working with Temporary Directories

The following sections provide procedures for moving Windows and SQL Server
temporary directories to optimize SolarWinds server performance and resources.

Moving the SQL Server Temporary Directory

The SQL Server temporary directory, tempdb, where temporary database objects
generated during table creation and sorting are stored, is typically created in the
same location on your SolarWinds database server as the master, model, and msdb
databases. Moving the tempdb database to a physical drive separate from your
SolarWinds database can significantly improve overall system performance.
l

For more information about moving the SQL Server 2005 temporary directory, tempdb, for see Moving System Databases Example A: Moving the
tempdb Database.
For more information about moving the SQL Server 2008 temporary directory, tempdb, for see Moving System Databases Example A: Moving the
tempdb Database.

1322

Troubleshooting

Redefining Windows System Temporary Directories

Following established Windows standards, the SolarWinds installer may use
Windows User and System TEMP and TMP variable directories as temporary
scratch spaces for file expansion and execution. If you do not have the required
scratch space available in the default User or System TEMP and TMP directories,
use the following procedure to redefine your default locations.
Note: Regardless of where you actually install SolarWinds, some common files
may be installed where the operating system of your SolarWinds server are
located.
To Redefine Default System Temporary Directories:
1.
2.
3.
4.

Log on to your SolarWinds server as a user with administrative rights.

Right-click My Computer, and then click Properties.
Click Advanced, and then click Environment Variables.
Select the variable name representing the directory you want to redefine,
click Edit, and then provide a new path as the Variable value for the selected temporary directory variable.

Slow Performance on Windows Server 2008

If SolarWinds is installed on Windows Server 2008 or Windows Vista and there
are any devices on your network, between your SolarWinds server and your
database server, that do not support RFC 1323, TCP Extensions for High
Performance, the TCP window size auto-tuning feature of Windows Server 2008
and Windows Vista may prevent your SolarWinds server from successfully
connecting with your SolarWinds database. This TCP auto-tuning feature is
intended as a network-sensitive restriction, applied by the receiveryour
SolarWinds serveron the amount of data it is allowed or able to receive. If any
devices along the network path between your SolarWinds server and your
SolarWinds database do not support the TCP window scaling detailed in RFC
1323, the allowed size of the TCP window in packets sent to your SolarWinds
server may not match the TCP window size reported by packets sent from your
SolarWinds server. This mismatch may lead to failed connections between your
SolarWinds server and your SolarWinds database. The following procedure
disables this TCP auto-tuning feature, resetting the TCP receive window to 64kB.

1323

To Disable TCP Auto-tuning:

To Disable TCP Auto-tuning:
1. Click Start > All Programs > Accessories.
2. Right-click Command Prompt, and then click Run as administrator.
3. If you are prompted by User Account Control, click Continue to open
the elevated command prompt.
Note: In some cases, having User Account Control (UAC) enabled on Windows Server 2008 and Windows Vista (evaluation-only) can lead to installation errors. For more information about disabling UAC, see the article,
Disabling User Account Control (UAC) in the SolarWinds Knowledge
Base.
4. At the prompt, enter the following: netsh interface tcp set global autotuninglevel=disabled

5. Close the command prompt window, and then restart your SolarWinds
server.

1324

Troubleshooting

WMI Troubleshooting Flowchart for SolarWinds

SAM

1325

Testing Local WMI Services

Note: The following Microsoft article describes how to set permissions in a
workgroup after an upgrade from Microsoft Windows 2000 Professional to
Microsoft Windows XP Professional. [Link]

Testing Local WMI Services

Testing the local WMI services helps us isolate any faults on the target server we
are trying to monitor. The testing program is a Microsoft program named
WBEMTest that comes already installed on Microsoft Windows operating
systems.

Test WMI on the Target Server

Complete the following procedure to check whether WMI on the target
server is functioning correctly:
1. Log on to the target server with an administrator account.
2. Click Start > Run, enter [Link] and then click OK.

3. Click Connect on the Windows Management Instrumentation Tester window.

1326

Troubleshooting
4. Enter root\cimv2 in the field at the top of the dialog box next to the Connect
button.

5. Click Connect.
6. Click Enum Classes.

1327

Test WMI on the Target Server

7. Select the Recursive radio button without entering a superclass name, and
then click OK.

8. If the WMI class you are querying appears in this list, local WMI services are functioning correctly. Skip to the next topic and test remote WMI.

9. If the list does not appear or does not contain the desired WMI class,
WMI is not functioning correctly. Continue reading this section for guidance
on repairing WMI services on the target server.
10. Click Close, and then click Exit.

1328

Troubleshooting

Reset the WMI Counters

At times, the WMI performance counters may not get transferred to WMI because
services were delayed or started out of order
([Link]
To manually reset the WMI counters:
1.
2.
3.
4.
5.
6.

Stop the Windows Management Instrumentation service.

Click Start, click Run, type cmd, and then click OK.
At the command prompt, type winmgmt /resyncperf, and then press Enter.
At the command prompt, type [Link] /f, and then press Enter.
Type exit, and then press Enter to close the command prompt.
Start the Windows Management Instrumentation service.

After resetting the WMI counters, retest WMI. If resetting the WMI counters did not
solve your problem, see WMI is Still Not Working. Now What?

Testing Remote WMI Connectivity

Testing the remote WMI connectivity of the target server helps us isolate faults
that could prevent the target server from receiving or responding to our remote
WMI requests. The testing program is a Microsoft program named WBEMTest that
comes already installed on Microsoft Windows operating systems.

Remotely Test WMI on the Target Server

Complete the following procedure to check whether the target server is
responding appropriately to remote WMI requests that originate from the
SolarWinds SAM server:
1. Log on to the SolarWinds SAM server with an administrator account.
2. Click Start > Run, enter [Link] and then click OK.

3. Click Connect on the Windows Management Instrumentation Tester window.

1329

Remotely Test WMI on the Target Server

4. Enter \\Target_Primary_IP_Address\root\cimv2 in the field at the top of the
dialog box. Replace Target_Primary_IP_Address in the above example
with the actual Hostname or Primary IP Address of the target server.

5. Enter the user name in the User field, the password in the Password field,
and NTLMDOMAIN:NameOfDomain in the Authority field. Replace
NameOfDomain with the domain of the user account specified in the User
field.
6. Click Connect.
7. Click Enum Classes.

1330

Troubleshooting
8. Select the Recursive radio button without entering a superclass name,
and then click OK.

9. If the WMI class list appears, remote WMI is functioning correctly. Skip to
the next topic and test your SAM credentials.

10. If the list does not appear, remote WMI is not functioning correctly.
Continue reading this topic for guidance on restoring remote WMI connections on the target server, and retest remote WMI after completing each
troubleshooting step.
11. Click Close, and then click Exit.

1331

Verify Administrator Credentials

Verify Administrator Credentials

Only a credential that has administrator rights on the target server has the
necessary permissions to access the target servers WMI services. Make sure that
the username and password you are using belongs to an administrator on the
target server.
If the administrator credential is a domain member, be sure to specify both the
user name and the domain in the standard Microsoft syntax. For example:
DOMAIN\Administrator.

Enable Remote Procedure Call (RPC)

Remote WMI connections use RPC as a communications interface. If the RPC
service is disabled on the target server, remote WMI connections cannot be
established.
To enable the RPC service:
1.
2.
3.
4.

Log on to the target server with an administrator account.

Click Start, click Run, type [Link], and then press Enter.
Scroll the list to Remote Procedure Call (RPC)
Right-click Remote Procedure Call (RPC), and then click Start on the
shortcut menu.

Configure Distributed Component Object Model (DCOM) and User

Account Control (UAC)
If the target computer is running Windows Vista or Windows Server 2008, you
may be required to make settings changes to allow remote WMI requests
([Link]
Item

Need
l

DCOM
l
l
l
l
l

Default and Limits permissions edited to allow the following actions:

Local launch (default permission)
Remote launch (default permission)
Local activation (limits permission)
Remote activation (limits permission)
For more information, see Enabling DCOM

1332

Troubleshooting

WMI
Namespaces

User
Account
Control

Modify the CIMV2 security to enable and remote enable

the account used to access the server or workstation
through WMI. You must ensure the security change
applies to the current namespace and sub-namespaces.
For more information, see Enabling Account Privileges in
WMI
Remote UAC access token filtering must be disabled
when monitoring within a workgroup environment. For
more information, see Disabling Remote User Account
Control for Workgroups

Enabling DCOM
WMI uses DCOM to communicate with monitored target computers. Therefore, for
Server & Application Monitor to use WMI, DCOM must be enabled and properly
configured.
To enable DCOM permissions for your Server & Application Monitor credentials:
1. Log on to the target server with an administrator account.
2. Navigate to Start> Control Panel> Administrative Tools>Component
Services. You need to switch to the Classic View of the Control Panel to
use this navigation path. You can also launch this console by
double-clicking [Link] in the /windows/system32 directory.
3. Expand Component Services> Computers.
4. Right-click My Computer, and then select Properties.
5. Select the COM Security tab, and then click Edit Limits in the Access Permissions grouping.
6. Ensure the user account you want to use to collect WMI statistics has Local
Access and Remote Access, and then click OK.
7. Click Edit Default, and then ensure the user account you want to use to
collect WMI statistics has Local Access and Remote Access,
8. Click OK.
9. Click Edit Limits in the Launch and Activation Permissions grouping.
10. Ensure the user account you want to use to collect WMI statistics has Local
Launch, Remote Launch, Local Activation, and Remote Activation, and then click
OK.

1333

Enabling Account Privileges in WMI

11. Click Edit Default, and then ensure the user account you want to use to
collect WMI statistics Local Launch, Remote Launch, Local Activation, and
Remote Activation.
12. Click OK.

Enabling Account Privileges in WMI

The account you specify in the Credentials Library must possess security access
to the namespace and sub-namespaces of the monitored target computer. To
enable these privileges, complete the following procedure.
To enable namespace and sub-namespaces privileges:
1. Log on to the computer you want to monitor with an administrator account.
2. Navigate to Start> Control Panel> Administrative Tools>Computer
Management> Services and Applications. You need to switch to the
Classic View of the Control Panel to use this navigation path.
3. Click WMI Control, and then right-click and select Properties.
4. Select the Security tab, and then expand Rootand click CIMV2.
5. Click Security and then select the user account used to access this computer and ensure you grant the following permissions:
Enable Account
Remote Enable

6. Click Advanced, and then select the user account used to access this computer.
7. Click Edit, select This namespace and subnamespaces in the Apply to field,
and then click OK.
8. Click OK on the Advanced Security Settings for CIMV2 window.
9. Click OK on the Security for Root\CIMV2 window.
10. Click Services in the left navigation pane of Computer Management.
11. Select Windows Management Instrumentation in the Services result pane, and
then click Restart.

Disabling Remote User Account Control for Workgroups

If you are monitoring a target in a workgroup, you need to disable remote User
Account Control (UAC). This is not recommended but it is necessary when
monitoring a workgroup computer. Disabling remote user account control does
not disable local user account control functionality.
Warning: The following procedure requires the modification or creation of a
registry key. Changing the registry can have adverse effects on your computer

1334

Troubleshooting
and may result in an unbootable system. Consider backing up your registry before
making these changes.
To disable remote UAC for a workgroup computer:
1.
2.
3.
4.

Log on to the computer you want to monitor with an administrator account.

Click Start> Accessories> Command Prompt.
Enter regedit.
Expand HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.
5. Locate or create a DWORD entry named LocalAccountTokenFilterPolicy and
provide a DWORD value of 1.
Note: To re-enable remote UAC, change this value to 0.

Add a Windows Firewall Exception for Remote WMI Connections

If the target computer has Windows Firewall enabled, it must have a Remote WMI
exception to allow remote WMI traffic through ([Link]
To add this exception:
1. Click Start, click Run, type cmd and then press Enter.
2. At the command prompt, type netsh firewall set service RemoteAdmin enable,
and then press Enter.
3. At the command prompt, type exit, and then press Enter.
If adding the firewall exception did not solve your problem, see WMI is Still Not
Working. Now What?

Do You Need an Additional Polling Engine?

Symptoms that may indicate you need an additional polling engine include, but
are not limited to, the following:
l

Polling completion rates are lower than expected which leads to gaps in
data.
Sporadic component monitor timeouts usually resulting in component monitors showing an "Unknown" status, reporting the error, "Connection
timeout. Job cancelled by scheduler."
Resourceexhaustionon the SQL server.

For more information, see "Additional Polling Engine and Web Console" on page
931.

1335

Verify SAM Component Configuration

Verify SAM Component Configuration

Make sure that the credential you are using for remote WMI is the same credential
that you are using in the SAM component.
After you click Set Component Credentials to set the component credentials,
you must also click Submit at the bottom of the page.

Service reporting, "Invalid Class"

There are various possibilities for this to occur. Read the following section to help
troubleshoot this issue. In APM v4 and higher, services can be polled via RPC or
WMI. Ensure the correct service is running by navigating to Edit Application >
RPC or WMI.
Repair the WMI Repository according to this KB article:
[Link]
lid+Class%22+when+using+WMI+monitors

1336

Troubleshooting
Note: Vista and Windows 2008 have a built-in method for repairing the WMI
repository. Open an Administrator command prompt and run: winmgmt
/salvagerepository
If you are using APM prior to version 4 and using WMI, try the following:
There are three required WMI queries for service monitoring to work:
SELECT * FROM Win32_Service
SELECT * FROM Win32_Process
SELECT * FROM Win32_PerfRawData_PerfProc_Process
You can test these by going to Start > Run > WBEMTEST on the SolarWinds
server.
1.
2.
3.
4.
5.
6.
7.

Click on Connect.
In the whitespace at the top, you should have \\ipaddress\root\CIMV2
For user and password, fill in the credentials used in APM.
For Authority, type in NTLMDOMAIN: and enter your domain.
Click Connect.
Click Query
Enter the above three queries, one at a time.

More often than not, the culprit is the last query. If your problem still exists,
try the following:
1. Re-sync the counters by opening a command prompt and typing: winmgmt
/resyncperf
2. Check to make sure performance counters are not disabled: [Link]
Note: WMI is an operating system component. If the previous steps do no
work, you may need to contact Microsoft for further information.

WMI is Still Not Working. Now What?

This guide depicts only the most common scenarios that can cause WMI services
to fail. If you are unable to get WMI services to work at this point, it is time to
consult Microsoft on this topic.
l

WMI Troubleshooting. Microsoft Developer Network. [Link]

1337

Troubleshooting Hardware Health

Troubleshooting Hardware Health

This section describes possible causes and solutions concerning hardware
resources either not being reported or being reported incorrectly.

Hardware Prerequisite Checklist

If the following conditions cannot be met, the Hardware Health resources will not
be displayed. To monitor hardware in SAM, the following must be true:
l

The monitored node must be HP Proliant, Dell PoweEdge, IBM X-Series,

HP C7000, HP C3000, or Dell M1000e.
The node must be monitored using one of the following protocols:
o SNMP
o WMI
o ICMP nodes are allowed for VMWare when the Poll for VMware
option is selected.
The Hardware Monitoring Agent software, (provided by the vendor), is
installed on the remote server. This applies for both SNMP and WMI.
Required software can be found at "Monitoring Hardware Health" on page
835.
For VMware, the minimum requirements are as follows: ESX server version 3.5, 4.0, 4.1, ESXi version 5.0, vCenter version 4.0, 4.1, 5.0.

The following systems have been verified to work properly with SAM's hardware
monitoring features. Note: Other systems may work as well.
l

l
l

Dell PowerEdge M610, R210, R610, R710, R900, 1950, 2850, 2950,
2970, 6850
HP ProLiant DL320 G4, DL360 G3, DL360 G4, DL380 G4, DL380 G6,
ML570 G3
IBM IBM System x3550, System x3550 M2, System x3550 M3, System
x3650, System x3650 M2, System x3650 M3, x3850, eServer 306m
HP C7000, HP C3000
Dell M1000e.

Note: IBM's ServeRAID Manager software must be installed on IBM X-Series

servers for storage hardware health information to be displayed in SolarWinds
SAM. HPs WBEM providers are required for HP servers polled via WMI.
Installation instructions can be at "Monitoring Hardware Health" on page 835.

1338

Troubleshooting

Hardware Troubleshooting Flowchart

1339

Troubleshooting an SNMP Node

Note: Dell does not make array and hard disk health information visible from WMI
managed nodes. To monitor storage health on Dell servers, use SNMP.

Troubleshooting an SNMP Node

The most common issue customers face is that hardware information is not
available via SNMP because the Hardware Monitoring Agent software was
installed before SNMP was installed. This means MIBs were never installed
and/or configured correctly. The easiest solution is to uninstall and then re-install
the Hardware Monitoring Agent software after installing SNMP on the server. If
this is not the case, follow the troubleshooting steps as outlined below:
Verify the node was successfully added using SNMP:
1. Verify the polling method on the Node Details page as shown below:

2. Verify the Hardware Monitoring Agent software is installed on the remote

server and running. For verification instructions, see "Accessing Hardware
Monitoring Agent Software" on page 837.
3. Determine if SNMP responds for the proper OID. Below are the correct
OIDS for each vendor:
For HP:[Link].[Link].[Link]
For Dell:[Link].4.1.674.10892.[Link].8.1
For IBM:[Link].[Link].[Link].3.1
l

To determine if the remote server responds to the correct OID, you can use
the MIB browser from SolarWinds Engineers Toolset, which can be downloaded from [Link] Additionally, you can
use other applications capable of making SNMP requests.

If you do not have a tool for checking OIDs on the remote server, you can create
an SNMP walk by using the [Link] installed with SAM, normally located at

1340

Troubleshooting
C:\Program Files (x86)\SolarWinds\Orion\[Link]. [Link] will

be used in

this demonstration.
Using [Link]:

1. Start [Link] and type in the IP address of the remote server and the
community string for SNMP.
2. Click Scan.
3. After completing the scan, save the SNMP walk in a text file.
4. Open the text file and manually search for the OIDs.
If the Remote Server does not respond on this OID, the Hardware Monitoring
Agent software may not be properly configured. Check to see if the Hardware
Monitoring Agent software has imported the correct MIBs as outlined in the
following table.
For information on verifying Hardware Monitoring Agent software, see "Accessing
Hardware Monitoring Agent Software" on page 837.
HP

Dell

IBM

CPQSTDEQMIB

MIB-Dell-10892

IBM-SYSTEM-HEALTH-MIB

CPQSINFOMIB

StorageManagementMIB

IBM-SYSTEM-ASSETID-MIB

1341

Troubleshooting a WMI Node

CPQIDA-MIB

IBM-SYSTEM-LMSENSOR-MIB

CPQHLTHMIB

IBM-SYSTEM-MEMORY-MIB

CPQSTSYSMIB

IBM-SYSTEM-POWER-MIB

CPQIDE-MIB

IBM-SYSTEM-PROCESSOR-MIB
IBM-SYSTEM-RAID-MIB
ADAPTEC-UNIVERSALSTORAGE-MIB

Troubleshooting a WMI Node

The following conditions must be met before you can proceed troubleshooting
WMI nodes:
l
l
l

The node has successfully been added via WMI.

WMI is working properly on the remote server.
The Hardware Monitoring Agent software is installed on the remote server
and running.

Using [Link] to troubleshoot WMI:

1. Open [Link], usually located at C:\Windows\System32\wbem\[Link].

2. Connect from the problematic node (either the SAM server or the additional
poller server) to the remote server using [Link].
3. Click Connect.
4. In the Namespace field enter:
For IBM and HP enter: \\RemoteServerIpAddress\root
For Dell enter: \\RemoteServerIpAddress\root\cimv2

1342

Troubleshooting

5. Enter administrator credentials.

6. Click Connect.
7. Once connected, click Query from the main screen. The Query dialog
appears.

1343

Troubleshooting a VMWare Node

8. Enter: select * from __Namespace

9. Replace Namespace with the following:

l For HP nodes, replace Namespace with HPQ
l For Dell nodes, replace Namespace with Dell
l For IBM nodes, replace Namespace with IBMSD
10. If the proper Namespace is found, connect to this Namespace.
l \\RemoteServerIpAddress\root\IBMSD for IBM.
l \\RemoteServerIpAddress\root\HPQ for HP.
l \\RemoteServerIpAddress\root\cimv2\Dell for Dell.

11. Run a Query for specific information:

Select Manufacturer, Model, SerialNumber from CIM_Chassis
12. If the test was not successful, re-install the platform or Hardware Monitoring
Agent software on the remote server with the latest release.

Troubleshooting a VMWare Node

VMWare nodes can be polled for Hardware information either through the
vCenter or directly by using the CIM protocol. Polling through the vCenter uses

1344

Troubleshooting
VMWare's native API interface. Polling the ESX server directly uses the CIM
protocol to get Hardware information.
To determine if a node is polled through the vCenter or directly:
1. From the web console, navigate to Settings > Virtualization Settings
2. Listed will be table of all the currently polled VMWare nodes. This table
contains the Polling Through column. Note: This column may be hidden. If
the column is hidden, unhide it by clicking the dropdown menu of an adjacent column and check the Polling Through option:

3. Use the illustration below to determine how your VMWare is being polled.

1345

Troubleshooting AppInsight for Exchagne

Troubleshooting AppInsight for Exchagne

The following sections will help you identify and correct AppInsight for Exchange
errors concerning configuration and performance counters:
l
l
l

Troubleshooting Error Codes in AppInsight for Exchange

Troubleshooting Exchange Performance Counters
Troubleshooting Permissions

Troubleshooting Permissions
The following information will help you troubleshoot issues with the following:
l
l
l
l

Non-Domain Accounts
Adding Local Administrative privileges to Active Directory Account
Exchange Access
Mailbox Exchange Access

Non-Domain Account
Local accounts (Non-Domain) cannot access Exchange Management interfaces
and therefore are not supported by AppInsight for Exchange. Please select an
Active Directory account or create a new one to use with AppInsight for
Exchange.
Add Local Administrative privileges to Active Directory Account
1. On the server where you want to grant local administrative privileges, open
a Computer Management console.
2. Navigate to System Tools >Local Users and Groups > Groups and then
double click the Administrators group.
3. Click Add and type in the Active Directory username of the account you
want to grant administrative privileges to, and then press Enter. (Ensure the
location is set to either the domain where the account is located or Entire
Directory.)
4. Click Apply and then click OK.
5. Alternatively, you can add an Active Directory group to the Local Administrators group and then add the AD user accounts to that group.
6. To verify the account and local group membership has been configured
properly, run the following in a PowerShell session:
$Recurse = $true
$GroupName = 'Administrators'
Add-Type -AssemblyName [Link]
$ct =

1346

Troubleshooting

[[Link]]::Machine
$group = [[Link]]::FindByIdentity
($ct,$GroupName)
$LocalAdmin = $[Link]($Recurse) | select @{N='Domain'; E=
{$_.[Link]}}, samaccountName, @{N='ObjectType'; E={$_.StructuralObjectClass}} -Unique
$LocalAdmin = $LocalAdmin | Where-Object {$_.ObjectType -eq "user"}

Exchange Access
Granting Least Privilege access to the Exchange Organization can be
accomplished using Active Directory Users and Computers (ADUC)
1. From the Start Menu open ADUC and navigate to the Microsoft Exchange
Security Groups OU.
2. Double click on the View-Only Organization Management group.
3. After the window opens, click the Members tab and then click Add.

1347

Troubleshooting Permissions
4. Type the username of the account you want to grant access to the
Exchange organization, and then click OK.
5. Click Apply and then click OK .
6. Close the ADUC window.
Access can also be granted using the Exchange Management
Shell with the following command:
${USER} = Username of service account
Add-RoleGroupMember -Identity "View-Only Organization
Management" -Member "$USER"

To verify the management role is properly assigned, use the

following commands:
Get-RoleGroupMember -Identity "View-Only Organization
Management" | Where-Object {$_.SamAccountName -eq
"$USER"}
Get-RoleGroupMember -Identity "Organization Management"
| Where-Object {$_.SamAccountName -eq "$USER"}

or
Get-ManagementRoleAssignment -RoleAssignee ${USER} |
Where-Object {$_.RoleAssigneeName -eq "View-Only
Organization Management" -or $_.RoleAssigneeName -eq
"Organization Management"}

Mailbox Search Access

Mailbox Search access is required to determine attachment counts and sizes. It
can be granted using the Exchange Management Shell (EMS).
1. From the Start Menu, open the EMS.
2. Type: New-ManagementRoleAssignment -Role "Mailbox Search" -User
"${USER}" and press Enter.
To verify the management role has been properly assigned, use
the following command:
Get-ManagementRoleAssignment -RoleAssignee ${USER} Role "Mailbox Search" | Where-Object {$_.RoleAssignmentDelegationType -eq "Regular"}

Note: Exchange Management Roles can be assigned to role

assignees using either regular or delegating role assignments.

1348

Troubleshooting

Regular role assignments enable the role assignee to access

the permissions provided by the management role entries on this
role.
Delegating role assignments give the role assignee the ability to
assign this role to Role Groups, Users, or Universal Security
Groups.

For more information, see:

l
l

[Link]
[Link]

Troubleshooting Exchange Performance Counters

Occasionally, you may encounter an Exchange server which is missing some of
the expected performance counters. If this happens, you need to verify whether
the counters are simply disabled or if they are completely missing. The simplest
way to do this is through the registry.
1. Navigate to the service with the missing performance counters.
Note: Individual services are listed under HKLM\SYSTEM\CurrentControlSet\Services.
2. Expand the service and click on the Performance key. The important values we want to ensure exist are listed below and displayed in Figure 1.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<ServiceName>\Performance]

Example: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ESE\Performance]
"Close"="ClosePerformanceData"
"Collect"="CollectPerformanceData"
"Library"="<Path to performance counter DLL file>"

Example: "Library"="C:\\Program Files\\Microsoft\\Exchange

Server\\V15\bin\\perf\\%PROCESSOR_ARCHITECTURE%\\[Link]"

"Open"="OpenPerformanceData"
"PerfIniFile"="<Name of performance counter INI file>"

Example: "PerfIniFile"="[Link]"

1349

Troubleshooting Exchange Performance Counters

The "Library" file path is typically "C:\Program
Files\Microsoft\Exchange
Server\%ExchangeVersion%\Bin\perf\%Processor_
Architecture%\%DLLFileName%"

Figure 1.

3. Verify the counters have not been disabled by expand the service and then
clicking on the "Performance" key.
4. Check for the value Disable Performance Counters (See Figure 2.) If this
value exists, ensure the data value is 0. Any other value will disable the
counters.
5. Once the value is confirmed to be set to 0, close all PerfMon windows and
then reopen them.
Note: The performance counters should be visible at this time. If the performance counters are not visible, proceed to the next step.
Figure 2.

1350

Troubleshooting

6. If the values First Counter, First Help, Last Counter, and Last Help are listed (See Figure 3), it is highly recommended to unload the performance
counters prior to reloading them.
Figure 3.

To Unload Performance Counters: (See Figure 4)

1. Close all PerfMon windows and stop any services which may be using
these counters.
2. Open the Exchange Management Shell (EMS) in the Run as Administrator
context.
3. Type: Add-PSSnapin [Link]
and then press Enter.
4. Type: Remove-PerfCounters -DefinitionFileName "<Path to counter
definition XML file> and then press Enter.

1351

Troubleshooting Error Codes in AppInsight for Exchange

a. The default location for Exchange counter definition files is: C:\Program Files\Microsoft\Exchange Server\%ExchangeVersion%\Setup\perf\%XMLFileName%

To Reload Performance Counters: (See Figure 4)

1. Close all PerfMon windows and stop any services which may be using
these counters.
2. Open the Exchange Management Shell (EMS) in the Run As Administrator
context.
3. Type: Add-PSSnapin [Link]
and then press Enter.
4. Type: New-PerfCounters -DefinitionFileName "<Path to counter definition XML file> and then press Enter.
a. The default location for Exchange counter definition files is: C:\Program Files\Microsoft\Exchange Server\%ExchangeVersion%\Setup\perf\%XMLFileName%

5. Check the application log to verify the counters were properly loaded and
no PerfLib errors exist. Reopen PerfMon to ensure the counters are available.
Figure 4.

Troubleshooting Error Codes in AppInsight for Exchange

Following are the possible error messages associated with AppInsight for
Exchange. Included are possible causes and solutions.
Configuration Errors
Error Message, Information, and Remediation
Error message: Remote configuration was unsuccessful due to the following:
"The deployment service executable was not found on the Orion server." For
details, see the log on the Orion server: ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\[Link]).
Description: Internal error. The Remote Installation [Link] file was not
found. (Default file location: C:\Program Files (x86)\SolarWinds\Orion\APM).

1352

Troubleshooting

This can be caused by an incorrect SAM installation or Remote Installation

[Link] was deleted or modified.
Remediation: Add the Remote Installation [Link] file to the following
folder: C:\Program Files (x86)\SolarWinds\Orion\APM.

Error message: Remote configuration was unsuccessful due to the following:

"The configurator executable was not found on the Orion server." For details,
see the log on the Orion server: ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\[Link]).
Description: Internal error. [Link]
file was not found (Default file location: C:\Program Files (x86)
\SolarWinds\Orion\APM).This can be caused by an incorrect SAM installation or
[Link] was deleted or modified..
Remediation: Add [Link] to the
following folder: C:\Program Files (x86)\SolarWinds\Orion\APM.

1353

Troubleshooting Error Codes in AppInsight for Exchange

Error message: Remote configuration was unsuccessful due to the following:

"Access denied." For details, see the log on the Orion server:
([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\[Link]).
Description: The provided user account does not have access to the
Administrator share on the remote Exchange server.
Remediation: Connect to the Administrator share with
\\ExchangeComputerName\<drive letter>$\ from the Orion server.

1354

Troubleshooting

Error message: Remote configuration was unsuccessful due to the following:

"The configurator executable has an invalid signature." For details, see the log
on the Orion server: ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\[Link]).
Description: The configuration executable cannot be started on the remote
Exchange server due to any of the following:
n
n

The high level of User Account Control settings

The provided user account does not have privileges high
enough to run *.exe files
[Link] is not
signed with a Solarwinds certificate.

Remediation:
n

Reduce User Account Control settings on the remote

Exchange server;

1355

Troubleshooting Error Codes in AppInsight for Exchange

Ensure the user's account has privileges to run *.exe files

Error message: Remote configuration was unsuccessful due to the following:

"The network path was not found." For details, see the log on the Orion server:
([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\[Link]).
Description: This is a Windows error indicating that a networking component is
malfunctioning.
Remediation:
l

Ensure you have access to the Shared Storage drive.

1. In Windows Explorer, navigate to My Network Places > Entire
Network > Microsoft Windows Network > (workgroup name) >
(Shared Storage drive name).
Firewalls can block traffic to the network which could generate this message. Try temporarily disabling any software or hardware firewalls to isolate the problem.

1356

Troubleshooting

Anti-spyware tools can block network traffic. Try temporarily disabling any
anti-spyware programs and restart the computer to isolate the problem.

Error message: Remote configuration was unsuccessful due to the following:

"Executable configuration file was not found on the Orion server." For details,
see the log on the Orion server: ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\[Link]).
Description: Internal error.
was not found
(Default file location: C:\Program Files (x86)\SolarWinds\Orion\APM.) This
can be caused by an incorrect SAM installation or
[Link] was deleted or
modified.
[Link]

Remediation:Add [Link]
to the following location: C:\Program Files (x86)\SolarWinds\Orion\APM.

1357

Troubleshooting Error Codes in AppInsight for Exchange

For information about Microsoft error codes, see: [Link]

1358

Troubleshooting

Error message: Remote configuration was unsuccessful due to the following:

"PowerShell 2.0 was not detected on the Exchange server." Learn how to
correct this. For details, see the log on the remote computer. ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\[Link]).
Description: PowerShell 2.0 is not installed on the remote Exchange server.
Remediation: PowerShell 2.0 should be installed on Exchange server.
Installing PowerShell 2.0 on Server 2008:
For Server 2008, download the installation file for PowerShell 2.0 at
[Link] and install it on the
server.
Note: PowerShell 2.0 is automatically installed on Server 2008 R2
and therefore no additional installation is required.
Installing PowerShell 2.0 on Server 2012:
1. Open Server Manager.

1359

Troubleshooting Error Codes in AppInsight for Exchange

2. Click on the Manage menu, and the select Add Roles and
Features.
3. After the wizard opens, click Next until you get to the Installation Type page.
4. Select Role-based or feature-based installation.
5. Click Next until you reach the Features page.
6. Scroll down to Windows PowerShell. It will likely show itself
as partially installed (square inside box).
7. Check the box next to Windows PowerShell 2.0 Engine.
8. Click Next and then Install.
9. When the installation finishes, click Close.

Error message: Remote configuration was unsuccessful due to the following:

"This account must be an Active Directory account with local administrative

1360

Troubleshooting

privileges." Learn how to correct this. For details, see the log on the remote
computer. ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\[Link]).
Description: The provided user account does not have Local Administrative
privileges.
Remediation:
Add Local Administrative privileges to Active Directory Account:
1. On the server where you wish to grant local administrative privileges,
open a Computer Management console.
Note: On Windows 2012, add this privilege using the Active Directory
console.
2. Navigate to System Tools >Local Users and Groups > Groups and
double click the Administrators group.
3. Click Add and type in the Active Directory username of the account you
want to grant administrative privileges, and then press Enter. (Ensure the
location is set to either the domain where the account is located or Entire
Directory.)
4. Click Apply and then click OK.
Note: Alternatively, you can add an Active Directory group to the local
administrators group and add the Active Directory user accounts to that
group.
Error message: Remote configuration was unsuccessful due to the following:
"This account must be an Active Directory account with organization wide
Exchange access (View-Only-Organization Management and Mailbox Search
Management Role)." Learn how to correct this. For details, see the log on the
remote computer. ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\[Link]).
Description: The provided user account does not have View-Only-Organization
Management or Mailbox Search Management privileges.
Remediation:
Grant View-Only-Organization Management privileges:
Granting Least Privilege access to the Exchange Organization can be
accomplished using Active Directory Users and Computers (ADUC). To
accomplish this, take the following steps:

1361

Troubleshooting Error Codes in AppInsight for Exchange

1. From the Start Menu, open ADUC and navigate to the Microsoft
Exchange Security Groups OU.
2. Double click on the View-Only Organization Management group.
3. After the window opens, click the Members tab and then click Add.
4. Type the username of the account you want to grant access to the
Exchange organization, and then click OK.
5. Click Apply, and then click OK.
6. Close the ADUC window.
Grant Mailbox Search Access:
Mailbox Search access is required to determine attachment counts and sizes.
This can be granted using the Exchange Management Shell (EMS).
1. From the Start Menu, open the EMS.
2. Type: New-ManagementRoleAssignment -Role "Mailbox Search" User <Username of account being granted access> and then press
Enter.
3. To verify the management role has been properly assigned, enter the
following command:
Get-ManagementRoleAssignment -RoleAssignee <Username of
account>

1362

Troubleshooting

1363