Sam Admin Guide

SolarWinds
Server & Application Monitor Administrator Guide
Copyright 1995-2012 SolarWinds Worldwide, LLC. All rights reserved worldwide. No part of this document may be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the written consent of SolarWinds. All right, title, and interest in and to the software and documentation are and shall remain the exclusive property of SolarWinds and its respective licensors. SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND DOCUMENTATION FURNISHED HEREUNDER INCLUDING WITHOUT LIMITATION THE WARRANTIES OF DESIGN, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL SOLARWINDS, ITS SUPPLIERS, NOR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. The SolarWinds, the SolarWinds & Design, ipMonitor, LANsurveyor, Orion, and other SolarWinds marks, identified on the SolarWinds website, as updated from SolarWinds from time to time and incorporated herein, are registered with the U.S. Patent and Trademark Office and may be registered or pending registration in other countries. All other SolarWinds trademarks may be common law marks or registered or pending registration in the United States or in other countries. All other trademarks or registered trademarks contained and/or mentioned herein are used for identification purposes only and may be trademarks or registered trademarks of their respective companies. Microsoft, Windows, and SQL Server are registered trademarks of Microsoft Corporation in the United States and/or other countries. Portions Copyright ComponentOne, LLC 1991-2002. All Rights Reserved. Portions of the following SolarWinds SAM Documentation is excerpted from: IBM DeveloperWorks, Copyright IBM Corporation 1994, 2012. Available at http://www.ibm.com/developerworks/ Microsoft TechNet, TechNet Library, 2010 Microsoft Corporation. All rights reserved. Available at technet.microsoft.com. Oracle Corporation, 2012 2010 Oracle Corporation. All rights reserved. . Available at www.oracle.com SolarWinds Server & Application Monitor Administrator Guide, 4/27/2012, version 5.0.1 - DJR
SolarWinds Server & Application Monitor Administrator Guide
About SolarWinds
SolarWinds (NYSE: SWI) provides powerful and affordable IT management software to customers worldwide from Fortune 500 enterprises to small businesses. We work to put our users first and remove the obstacles that have become status quo in traditional enterprise software. SolarWinds products are downloadable, easy to use and maintain, and provide the power, scale, and flexibility needed to address users management priorities. Our online user community, thwack, is a gathering-place where tens of thousands of IT pros solve problems, share technology, and participate in product development for all of SolarWinds products. Learn more today at http://www.solarwinds.com. SolarWinds, SolarWinds.com, and Orion are registered trademarks of SolarWinds. All other company and product names mentioned are used only for identification purposes and may be trademarks or registered trademarks of their respective companies.
Contacting SolarWinds
You can contact SolarWinds in a number of ways, including the following: Team Sales Technical Support User Forums Contact Information 1.866.530.8100 http://www.solarwinds.com http://www.solarwinds.com/support, you need a customer account to access the Customer Support area of the website. http://www.thwack.com contains the community oriented user forums
Conventions
The documentation uses consistent conventions to help you identify items throughout the printed and online library. Convention Bold Italics Specifying Window items, including buttons and fields. Book and CD titles, variable names, new terms File and directory names, commands and code examples, text typed by you Optional command parameters Required command parameters Exclusive command parameters where only one of the options can be specified
Fixed font
Straight brackets, as in [value] Curly braces, as in {value} Logical OR, as in value1|value2
About SolarWinds iii
Administrator Guide SolarWinds Server & Application Monitor
SolarWinds Server & Application Monitor Documentation Library

The following documents are included in the Server & Application Monitor (SolarWinds SAM) documentation library: Document Administrator Guide Evaluation Guide Page Help Quick Start Guide Purpose Provides detailed setup, configuration, and conceptual information for SolarWinds SAM. Provides an introduction to SolarWinds Server & Application Monitor features and instructions for installation and initial configuration. Provides help for every window in the SolarWinds Server & Application Monitor user interface Provides installation, setup, and common scenarios for which SolarWinds Server & Application Monitor provides a simple, yet powerful, solution. Provides late-breaking information, known issues, and updates. The latest Release Notes can be found at www.solarwinds.com.
Release Notes
The following documents supplement the Server & Application Monitor documentation library with information about SolarWinds Common Components: Document Orion Common Components Administrator Guide Orion Common Components Page Help Release Notes Purpose Provides detailed setup, configuration, and conceptual information for the common components. Provides help for every window in the Orion Common Components user interface. Provides late breaking information, known issues, and updates. The latest Release Notes can be found at www.solarwinds.com.
Note: With this release, Orion products are based on a set of common features that are shared by all of the Orion products. Therefore you need to consult the documentation listed above for the Orion Common Components in order to find information about all of the common features.
iv SolarWinds Orion Server & Application Monitor Documentation Library
Contents
About SolarWinds ......................................................................................... iii Contacting SolarWinds ................................................................................ iii Conventions .................................................................................................. iii SolarWinds Server & Application Monitor Documentation Library ........ iv
Chapter 1
Introduction ...................................................................................................... 1 SolarWinds SAM vs. Orion APM .................................................................. 1 Applications Defined ..................................................................................... 2 SAM Glossary of Terms ................................................................................ 3 How Does SolarWinds Server & Application Monitor Work? ................... 5
Chapter 2
Requirements and Installation ......................................................................... 7 Requirements for SolarWinds SAM ............................................................. 7 FIPS Support ................................................................................................ 11 Server Sizing ................................................................................................ 13 SNMP Requirements for Monitored Devices ............................................ 13 Enabling Microsoft Internet Information Services (IIS) ........................... 14 Enabling IIS on Windows Server 2003...................................................... 14 Enabling IIS on Windows Server 2008...................................................... 18 Upgrading SolarWinds Server & Application Monitor ............................. 21 Upgrading NPM and SolarWinds SAM on Your Current Server ............... 22 Upgrading APM to a New Server While Keeping NPM on Your Current Server ........................................................................................................ 22 Moving SolarWinds SAM to a different server ......................................... 23 General Requirements .............................................................................. 23 Database Requirements ........................................................................... 24 Stopping SAM Services ............................................................................ 24 Creating a Database Backup File with Database Manager ...................... 25 Creating a Database Backup File with SQL Server Management Studio Express ..................................................................................................... 26 Creating a Database Backup File with SQL Server Management Studio. 27
Contents v
Restoring a Database Backup File for SQL Express Server .................... 28 Restoring a Database Backup File for SQL Server 2005 ......................... 29 Restoring a Database Backup File for SQL Server 2008 ......................... 30 Updating SolarWinds SAM to Use the New Database Server ................. 32 Reassigning Nodes ................................................................................... 33 Copying Custom Reports .......................................................................... 35 Updating Report Schemas........................................................................ 35 Moving SolarWinds SAM Security Certificates to a New Server .............. 35 Migrating Licenses with License Manager ................................................ 37 Installing License Manager ....................................................................... 38 Upgrading SolarWinds APM when SolarWinds Failover Engine is Installed .................................................................................................................. 38 Installing SolarWinds Server & Application Monitor ............................... 41 Activating Your License ............................................................................ 46 Finishing SolarWinds SAM Installation ..................................................... 47 Excluding SolarWinds Data Directories from Anti-Virus Scanning ....... 50 Running SolarWinds SAM .......................................................................... 50 Internet Explorer Security Settings ........................................................... 51 Licensing ...................................................................................................... 51
Chapter 3
Common Tasks with SolarWinds SAM ......................................................... 53 Monitoring Internal and External Web Site Performance ....................... 54 Monitoring Microsoft Windows Performance .......................................... 57 Monitoring IIS Application Pools ............................................................... 60 Scanning for Applications Worth Monitoring .......................................... 63 Monitoring VMware Performance Counters ............................................. 65 Monitoring and Restarting Stopped Windows Services ......................... 68 Creating a Custom Component Availability Report ................................ 70 Monitoring Large Directories ..................................................................... 72
Chapter 4
Managing the Web Console .......................................................................... 75 Getting Started with SolarWinds ............................................................... 78 Discovery Central ..................................................................................... 78 Network Sonar Discovery ......................................................................... 78
vi Contents
Add a Node ............................................................................................... 78 Node & Group Management ....................................................................... 78 Manage Nodes .......................................................................................... 79 VMware Settings ....................................................................................... 79 Manage Dependencies ............................................................................. 79 Manage Groups......................................................................................... 79 Accounts ...................................................................................................... 79 Manage Accounts...................................................................................... 80 Account List ............................................................................................... 80 Customize ..................................................................................................... 80 Customize Menu Bars ............................................................................... 80 Color Scheme............................................................................................ 80 External Websites ..................................................................................... 81 Manage Alerts .............................................................................................. 81 Manage Advanced Alerts .......................................................................... 81 Product Updates .......................................................................................... 82 Available Product Updates ........................................................................ 82 SolarWinds Product Team Blog ................................................................ 82 Views ............................................................................................................. 82 Manage Views ........................................................................................... 83 Add New View ........................................................................................... 83 Views by Device Type ............................................................................... 83 Views by Application Type ........................................................................ 83 Settings ......................................................................................................... 83 Web Console Settings ............................................................................... 84 Polling Settings.......................................................................................... 84 SAM Settings ............................................................................................. 84 SolarWinds Thresholds ............................................................................. 84 Virtualization Thresholds ........................................................................... 84 Details ........................................................................................................... 84 Database Details ....................................................................................... 85 Polling Engines.......................................................................................... 85 Orion Core Details ..................................................................................... 85 License Details .......................................................................................... 85 Navigating the SolarWinds Web Console ................................................. 85 Using Web Console Tabs ......................................................................... 86 Using and Disabling Web Console Breadcrumbs ..................................... 86
Contents vii
Managing Nodes from the Web Console .................................................. 87 Adding Nodes for Monitoring .................................................................... 88 Deleting Nodes from Monitoring ............................................................... 91 Deleting Applications or Volumes from Monitoring ................................... 92 Viewing Node Data in Tooltips ................................................................. 92 Editing Node Properties ............................................................................ 93 Promoting a Node from ICMP to SNMP Monitoring ................................. 94 Promoting a Node from ICMP to WMI Monitoring .................................... 96 Viewing Node Resources ......................................................................... 97 Setting Node Management States ............................................................ 97 Unscheduled Node Polling and Rediscovery ........................................... 98 Monitoring Windows Server Memory ...................................................... 100 Scheduling a Node Maintenance Mode Time Period ............................. 100 Administrative Functions of the SolarWinds Web Console ................. 100 Changing an Account Password ............................................................ 100 Viewing Secure Data on the Web ........................................................... 101 Handling Counter Rollovers .................................................................... 101 SolarWinds General Thresholds ............................................................. 102 SolarWinds General Threshold Types .................................................... 102 Setting SolarWinds General Thresholds ................................................ 104 Customizing Views ................................................................................... 104 Creating New Views ............................................................................... 105 Editing Views .......................................................................................... 105 Configuring View Limitations .................................................................. 107 Copying Views ........................................................................................ 108 Deleting Views ........................................................................................ 108 Views by Device Type ............................................................................ 108 Resource Configuration Examples ......................................................... 109 Customizing Web Console Menu Bars ................................................... 118 Changing the Web Console Color Scheme ............................................ 119 Changing the Web Console Site Logo ................................................... 119 Configuring the Available Product Updates View ................................... 120 Updating your SolarWinds Installation .................................................... 121 Customizing Charts in the SolarWinds Web Console ............................ 121 Custom Node Charts .............................................................................. 122 Custom Volume Charts ........................................................................... 124 Custom Chart View ................................................................................. 124 Multiple Object Chart .............................................................................. 126 Exporting Views to PDF .......................................................................... 127 Creating a Custom Summary View ........................................................ 128 Creating and Editing External Website Views ........................................ 129 Custom Object Resources in the SolarWinds Web Console ................ 130
viii Contents
Editing a Custom Object Resource ......................................................... 130 Selecting Custom Objects and Resources ............................................. 130 Available Custom Resources .................................................................. 131 Integrating SolarWinds Engineers Toolset ............................................ 131 Configuring a Toolset Integration ............................................................ 131 Adding Programs to a Toolset Integration Menu .................................... 132 Web Console Configuration ..................................................................... 133 Creating a Web Console Configuration Backup ..................................... 133 Restoring a Web Console Configuration Backup .................................... 134 Clearing a Web Console Configuration ................................................... 134 Logging in for the First Time as an Administrator ................................. 135 Windows Authentication with Active Directory ...................................... 135 Using the Web Console Notification Bar................................................. 136 Using the SolarWinds Web Console Message Center ........................... 137 Using Node Filters ..................................................................................... 137 Accessing Nodes Using HTTP, SSH, and Telnet .................................... 138 Using Integrated Remote Desktop ........................................................... 139
Chapter 5
SolarWinds SAM Settings ........................................................................... 141 Getting Started with SAM ......................................................................... 142 Scan Nodes for Applications ................................................................... 143 Manually Assign Application Monitors..................................................... 143 Find Processes, Services, and Performance Counters .......................... 143 Application Monitors ................................................................................. 143 Manage Application Monitors .................................................................. 143 Application Monitor Templates ................................................................ 144 Manage Templates.................................................................................. 144 Create a New Template .......................................................................... 144 Component Monitors................................................................................. 144 Component Monitor Library ..................................................................... 144 Manage Assigned Component Monitors ................................................. 144 Manage Component Monitors within Templates ..................................... 145 Application Detail Views ........................................................................... 145
Contents ix
Views by Application Type ...................................................................... 145 Global SAM Settings ................................................................................. 145 Credentials Library .................................................................................. 145 Data and Database Settings ................................................................... 145 License Summary ..................................................................................... 147 SAM License Summary .......................................................................... 147 thwack Community ................................................................................... 147 Shared thwack Templates ...................................................................... 147 SAM thwack Forum ................................................................................ 148
Chapter 6
Discovering and Adding Nodes on a Network ............................................ 149 Discovery Central ...................................................................................... 149 Virtualization Discovery .......................................................................... 150 Application Discovery ............................................................................. 150 Network Sonar Discovery ......................................................................... 150 Using the Network Sonar Results Wizard .............................................. 157 Managing Scheduled Discovery Results ................................................ 158 Using the Discovery Ignore List .............................................................. 159
Chapter 7
Application Discovery .................................................................................. 161 Add Application Monitors ........................................................................ 162 Reading the Application Summary ......................................................... 163 Active Application Alerts ......................................................................... 164 Application Health Overview ................................................................... 164 Applications with Problems ..................................................................... 165 Last 25 Application Events ..................................................................... 165 Thwack Latest Application Templates .................................................... 165 Top 10 Components Monitored by Response Time ............................... 166 Top 10 Processes Monitored by CPU Load ........................................... 166 Top 10 Processes Monitored by Physical Memory ................................ 167 Top 10 Processes Monitored by Virtual Memory.................................... 167
x Contents

Chapter 8
Managing Groups and Dependencies ......................................................... 169 Creating Groups ...................................................................................... 169 Editing Groups......................................................................................... 171 Managing Group Members ..................................................................... 171 Deleting Groups ...................................................................................... 172 Managing the Display of Group Status ................................................... 172 Managing Dependencies .......................................................................... 174 Creating a Dependency .......................................................................... 174 Editing a Dependency ............................................................................. 176 Deleting a Dependency ........................................................................... 177 Viewing Alerts on Child Objects .............................................................. 177
Chapter 9
Managing Accounts ..................................................................................... 179 Creating Accounts ..................................................................................... 179 Editing User Accounts .............................................................................. 180 User Account Access Settings ................................................................ 182 Configuring Audible Web Alerts .............................................................. 183 Setting Account Limitations ..................................................................... 184 Defining Pattern Limitations .................................................................... 186 Setting Default Account Menu Bars and Views ...................................... 187 Configuring an Account Report Folder .................................................... 189 Server & Application Monitor Settings..................................................... 190 Orion General Settings ............................................................................ 190 Integrated Virtual Infrastructure Monitor Settings ................................... 191
Chapter 10
Managing SolarWinds SAM Polling Engines ............................................... 193 Viewing Polling Engine Status ................................................................. 193 Configuring Polling Engine Settings ....................................................... 193 SolarWinds Polling Settings ..................................................................... 194 Polling Intervals ....................................................................................... 194 Polling Statistics Intervals ....................................................................... 194 Network ................................................................................................... 195 Calculations & Thresholds ...................................................................... 195 Calculating Node Availability ................................................................... 196 Calculating a Baseline .............................................................................. 197
Contents xi
Using the Polling Engine Load Balancer ................................................ 197 Setting the Node Warning Level .............................................................. 198 Managing Packet Loss Reporting ........................................................... 199
Chapter 11
Virtualization ................................................................................................ 201 Requirements for Monitoring ESXi and ESX Servers ........................... 202 Enabling SNMP on VMware ESXi and ESX Servers ............................. 203 Enabling SNMP on VMware ESXi .......................................................... 203 Enabling SNMP on ESX Server version 3.5 ........................................... 204 Enabling SNMP on ESX Server Version 4.0 .......................................... 205 Creating ESX Server Credentials for SolarWinds SAM ......................... 207 Managing VMware Credentials in the Web Console.............................. 208 Adding VMware Servers for Monitoring ................................................. 208 Virtualization Summary ............................................................................ 209 Viewing ESX Host Details ......................................................................... 210 Changing Polling Orders for ESX Servers ............................................. 210 Troubleshooting ESX Hardware Monitoring .......................................... 211
Chapter 12
Building Component Monitors and Templates ............................................ 213 Understanding Component Monitors and Application Monitor Templates................................................................................................... 216 Choosing Component Monitors and Templates Based on Protocol ... 218 Requirements for Component Monitors and Templates that use WMI 218 Monitoring External Nodes ...................................................................... 220 Understanding the Credentials Library .................................................. 220 Adding Credentials to the Credentials Library ........................................ 221 Editing Credentials in the Credentials Library ........................................ 221 Deleting Credentials from the Credentials Library .................................. 221 Using Quick Credentials ......................................................................... 222 Using Application Monitor Templates .................................................... 223 Scanning Nodes for Applications ............................................................ 223 Manually Assign Application Monitors .................................................... 225 Creating New Templates ........................................................................ 226
xii Contents
Managing Templates ............................................................................... 228 Managing Assigned Application Monitors .............................................. 234 Editing an Assigned Application Monitor ................................................. 234 Unmanaging Assigned Application Monitors .......................................... 235 Remanaging Assigned Application Monitors .......................................... 236 Deleting Assigned Application Monitors .................................................. 237 Working with Component Monitors ......................................................... 237 Viewing the Component Monitor Library ................................................. 237 Managing Assigned Component Monitors .............................................. 238 Managing Component Monitors within Templates .................................. 241 Scripting Custom Component Monitors ................................................. 244 Creating a Linux/Unix Script Monitor....................................................... 246 Creating a Windows Script Monitor ......................................................... 250 Creating a Nagios Script Monitor ............................................................ 258 Creating a Windows PowerShell Monitor ................................................ 261 JMX Component Monitor Wizard ............................................................. 264 Custom Application Monitor Template Example: Creating a SolarWinds SAM Template ............................................................................................ 266 Conversion Value ...................................................................................... 268 Available Data Transformations ............................................................... 269 Multiple Statistic Chart .............................................................................. 270
Chapter 13
Viewing Application and Component Performance and Status ................... 275 Understanding the SAM Application Summary ...................................... 275 Understanding SAM Application Details ................................................. 277 Understanding SolarWinds SAM Component Details ........................... 278 Showing SolarWinds SAM Data in Node Details .................................... 279 Customizing SAM Application Summary Views ..................................... 280 Customizing Application Details Views .................................................. 283 Viewing Node and Application Data in Tooltips ..................................... 285 Monitoring Network Events in the Web Console ................................... 286 Viewing Event Details in the Web Console ............................................. 286 Acknowledging Events in the Web Console ........................................... 287
Contents xiii

Chapter 14
Creating Account Limitations ...................................................................... 289 Using the Account Limitation Builder ..................................................... 289 Creating an Account Limitation ............................................................... 289 Deleting an Account Limitation ............................................................... 290
Chapter 15
Alerting and Reporting ................................................................................ 291 Creating Alerts........................................................................................... 291 Configuring SolarWinds SAM Alerts ....................................................... 292 SolarWinds SAM Alerts .......................................................................... 295 Testing Alert Actions ............................................................................... 301 Viewing Alerts in the SolarWinds Web Console ..................................... 302 Acknowledging Advanced Alerts in the Web Console ............................ 302 Viewing Alerts from Mobile Devices ....................................................... 303 Restarting Windows Services with an Alert Action ................................. 304 Creating a New Advanced Alert.............................................................. 305 Naming, Describing, and Enabling an Advanced Alert ........................... 306 Setting a Trigger Condition for an Advanced Alert ................................. 308 Setting a Reset Condition for an Advanced Alert ................................... 311 Setting a Suppression for an Advanced Alert ......................................... 313 Setting the Monitoring Period for an Advanced Alert ............................. 314 Setting a Trigger Action for an Advanced Alert ...................................... 314 Setting a Reset Action for an Advanced Alert ........................................ 315 Alert Escalation ....................................................................................... 316 Understanding Condition Groups ........................................................... 316 Using the Advanced Alert Manager ........................................................ 318 Adding Alert Actions ................................................................................ 321 Sending an E-mail / Page ....................................................................... 322 Playing a Sound ...................................................................................... 323 Logging an Advanced Alert to a File ....................................................... 324 Logging an Advanced Alert to the Windows Event Log ......................... 325 Logging an Advanced Alert to the NetPerfMon Event Log ..................... 326 Sending a Syslog Message .................................................................... 327 Executing an External Program .............................................................. 329 Executing a Visual Basic Script .............................................................. 329 Emailing a Web Page ............................................................................. 330 Using Text to Speech Output ................................................................. 332 Sending a Windows Net Message .......................................................... 332 Sending an SNMP Trap .......................................................................... 333 Using Get or Post URL Functions .......................................................... 334 Dial Paging or SMS Service ................................................................... 335
xiv Contents
Escalated Advanced Alerts ...................................................................... 335 Escalated Alert Example ......................................................................... 335 Creating a Series of Escalated Alerts ..................................................... 336 Creating and Viewing Reports ................................................................. 339 Creating SolarWinds SAM-Specific Reports ........................................... 339 Using Predefined SolarWinds SAM Reports ........................................... 340 Viewing SolarWinds Server & Application Monitor Reports .................... 342 Filtering and Grouping Data in Resources .............................................. 344 SQL Syntax ............................................................................................. 345 SWQL Syntax (Semantic Web Query Language) ................................... 346 Predefined SolarWinds Reports .............................................................. 348 Availability ............................................................................................... 349 Current Node Status ............................................................................... 350 Current Volume Status ............................................................................ 350 Daily Node Availability ............................................................................. 350 Events ..................................................................................................... 351 Historical CPU and Memory Reports ...................................................... 352 Historical Response Time Reports.......................................................... 352 Historical VMware ESX Server Reports .................................................. 352 Groups: Current Groups and Groups Members Status .......................... 353 Groups: Daily Group Availability ............................................................. 353 Groups: Group Availability (with members) ............................................ 354 Groups: Historical Groups Status ............................................................ 354 Historical Volume Usage Reports ........................................................... 354 Inventory .................................................................................................. 354 Viewing Reports ...................................................................................... 355 Using Report Writer ................................................................................. 356 Creating and Modifying Reports .............................................................. 357 Using SolarWinds Report Scheduler....................................................... 362 Customizing the Report Header and Footer Image ................................ 365 Exporting Reports.................................................................................... 365 Example Device Availability Report ........................................................ 366 Reports and Account Limitations ............................................................ 373
Chapter 16
Monitoring Hardware Health ........................................................................ 375 Hardware Items Monitored by SAM ......................................................... 376 Hardware Monitoring and VMware ........................................................... 376 Accessing Hardware Monitoring Agent Software .................................. 377 Adding Server Hardware Monitoring ....................................................... 378 Hardware Details........................................................................................ 380
Contents xv
Current Hardware Health Status ............................................................ 381 Changing Threshold Values ................................................................... 382 Hardware Health Chart ............................................................................. 383 Customizing the Hardware Health Chart ................................................ 384 Alerting on Hardware Health .................................................................... 386 Manually Changing Alert Thresholds ...................................................... 387
Chapter 17
Monitoring Processes in Real Time ............................................................ 389 Accessing the Real Time Process Explorer ........................................... 390 Using the Real Time Process Explorer ................................................... 392 Monitoring Unmonitored Processes ....................................................... 393 Real Time Process Explorer Alerts ......................................................... 394
Chapter 18
Monitoring Syslog Messages ...................................................................... 395 Configuring the SolarWinds Syslog Port ............................................... 395 Syslog Messages in the Web Console .................................................... 396 Syslog Resources ................................................................................... 396 Viewing Syslog Messages in the Web Console ..................................... 397 Acknowledging Syslog Messages in the Web Console .......................... 398 Using the Syslog Viewer .......................................................................... 399 Viewing and Acknowledging Current Messages .................................... 399 Searching for Syslog Messages ............................................................. 399 Syslog Server Settings ........................................................................... 400 Configuring Syslog Viewer Filters and Alerts ......................................... 401 Available Syslog Alert Actions ................................................................ 403 Forwarding Syslog Messages................................................................. 405 Syslog Alert Variables .............................................................................. 406 Syslog Date/Time Variables ................................................................... 406 Other Syslog Variables ........................................................................... 407 Syslog Message Priorities........................................................................ 407 Syslog Facilities ...................................................................................... 407 Syslog Severities .................................................................................... 408
xvi Contents

Chapter 19
Monitoring SNMP Traps .............................................................................. 409 The SNMP Trap Protocol .......................................................................... 409 Viewing SNMP Traps in the Web Console .............................................. 409 Using the Trap Viewer ............................................................................... 410 Viewing Current Traps ............................................................................ 410 Searching for Traps ................................................................................. 411 Trap Viewer Settings ............................................................................... 411 Configuring Trap Viewer Filters and Alerts ............................................. 412 Available Trap Alert Actions ..................................................................... 414 Trap Alert Variables................................................................................. 415 Trap Date/Time Variables ....................................................................... 416 Other Trap Variables ............................................................................... 416
Chapter 20
Network Atlas ............................................................................................... 419 What is in a Map? ...................................................................................... 419 Example Maps ............................................................................................ 419 Installing Network Atlas ............................................................................ 421 Network Atlas Requirements .................................................................... 421 Installing Network Atlas on a Remote Computer ................................... 421 Creating a Basic Map ................................................................................ 423 Starting Network Atlas .............................................................................. 423 Adding Map Objects .................................................................................. 424 Connecting Map Objects Manually .......................................................... 425 Using Object Links to Represent Interface Status ................................. 425 Interpreting Map Links .............................................................................. 425 Using Anchor Points to Reshape Map Links .......................................... 425 Adding a Background ............................................................................... 426 Saving Maps ............................................................................................... 428 Opening Maps ............................................................................................ 428 Displaying Maps in the Web Console ...................................................... 429 Map Resources in the Network Atlas Web Console .............................. 429
Contents xvii
Displaying Maps in the SolarWinds Web Console ................................ 430 Displaying Maps in the SolarWinds EOC Web Console ....................... 430 Advanced Mapping Techniques .............................................................. 430 Zooming In and Out of a Map ................................................................... 431 Creating Nested Maps .............................................................................. 431 Displaying Map Object Metrics ................................................................ 432 Adding Independent Map Objects and Floating Labels ........................ 433 Changing the Appearance of Map Objects ............................................. 433 Pasting Custom Icons from the Windows Clipboard ............................ 434 Adding Custom Icons from Graphics Files ............................................ 435 Changing the Appearance of Links ......................................................... 436 Changing the Appearance of Labels ....................................................... 437 Linking Map Objects to URLs .................................................................. 438 Linking or Embedding Maps in Web Pages ........................................... 438 Customizing SolarWinds Web Console Tooltips ................................... 438 Advanced Map Layouts ............................................................................ 439 Displaying Grid Guides ............................................................................ 440 Aligning Map Objects ............................................................................... 440 Distributing Map Objects .......................................................................... 441 Selecting Automatic Layout Styles ......................................................... 441 Map Properties .......................................................................................... 442 Network Atlas Settings ............................................................................. 443 Network Atlas Tooltip Variables .............................................................. 445 Application Variables ................................................................................ 445 Application Component Monitor Variables ............................................ 445 Date and Time Variables ........................................................................... 446 General Variables ...................................................................................... 447 Node Variables .......................................................................................... 447 Volume Variables ...................................................................................... 449 Wireless Variables .................................................................................... 449
xviii Contents
Group Variables ......................................................................................... 450

Chapter 21
Managing the SolarWinds SAM Database .................................................. 451 Using Database Manager .......................................................................... 451 Adding a Server....................................................................................... 451 Creating Database Backups ................................................................... 452 Restoring a Database ............................................................................. 453 Compacting your Database ..................................................................... 453 Compacting Individual Tables ................................................................. 454 Viewing Database Details ....................................................................... 454 Viewing Table Details .............................................................................. 455 Editing Database Fields .......................................................................... 456 Detaching a Database ............................................................................. 457 Creating a Database Maintenance Plan ................................................. 457 Using SQL Server Management Studio ................................................... 458 Database Maintenance .............................................................................. 461 Running Database Maintenance ............................................................. 461 Migrating your Database ......................................................................... 462
Chapter 22
Creating Custom Properties ........................................................................ 465 Creating a Custom Property ..................................................................... 465 Removing a Custom Property .................................................................. 466 Importing Custom Property Data ............................................................. 467 Custom Property Editor Settings ............................................................. 468 Editing Custom Properties ....................................................................... 468 Using Filters in Edit View .......................................................................... 469 Creating Custom Properties Filters ......................................................... 469 Removing Custom Properties Filters ...................................................... 470
Appendix A
Additional Polling Engine and Web Console ............................................... 471 Understanding How Polling Engines Work ............................................ 471 SolarWinds SAM is Poller-Unaware By Default ...................................... 472 SolarWinds SAM Additional Polling Engines are Poller-Aware .............. 473
Contents xix
Requirements for Installing an Additional Polling Engine ................... 474 Installing an Additional Polling Engine .................................................. 474 Installing an Additional Web Console ..................................................... 476
Appendix B
Status Icons and Identifiers ......................................................................... 479

Appendix C
SolarWinds Variables and Examples .......................................................... 481 Variable Modifiers ..................................................................................... 481 95 Percentile Calculations ..................................................................... 481 Regular Expression Pattern Matching .................................................... 483 Advanced Alert Engine Variables ............................................................ 487 General ................................................................................................... 487 Date/Time ............................................................................................... 488 Group Variables ...................................................................................... 488 SQL Query .............................................................................................. 489 Status Variables ...................................................................................... 490 Node Variables ....................................................................................... 490 Volume Variables .................................................................................... 493 Hardware Specific Variables................................................................... 494 Example Messages Using Variables ...................................................... 497 Syslog Alert Variables .............................................................................. 498 Syslog Date/Time Variables ................................................................... 498 Other Syslog Variables ........................................................................... 499 Trap Alert Variables .................................................................................. 499 General Trap Variables ........................................................................... 499 Trap Date/Time Variables ....................................................................... 500
Appendix D
th
Configuring Automatic Login ....................................................................... 501 Using Windows Pass-through Security .................................................. 501 Passing Login Information Using URL Parameters............................... 504 Using the DirectLink Account .................................................................. 504
xx Contents

Appendix E
Troubleshooting ........................................................................................... 505 Why do my SAM WMI Monitors Show Status Unknown?...................... 507 WMI Troubleshooting Flowchart for SolarWinds SAM ............................ 509 Testing Local WMI Services .................................................................... 510 Test WMI on the Target Server ............................................................... 510 Reset the WMI Counters ......................................................................... 513 Testing Remote WMI Connectivity .......................................................... 514 Remotely Test WMI on the Target Server .............................................. 514 Verify Administrator Credentials .............................................................. 517 Enable Remote Procedure Call (RPC).................................................... 517 Configure Distributed Component Object Model (DCOM) and User Account Control (UAC) ............................................................................ 518 Enabling DCOM ...................................................................................... 519 Enabling Account Privileges in WMI ....................................................... 519 Disabling Remote User Account Control for Workgroups ....................... 520 Add a Windows Firewall Exception for Remote WMI Connections ........ 521 Do You Need an Additional Polling Engine? ........................................... 521 Verify SAM Component Configuration .................................................... 521 Service reporting, "Invalid Class." ........................................................... 522 WMI is Still Not Working, Now What? ..................................................... 524 Working with Temporary Directories ....................................................... 524 Moving the SQL Server Temporary Directory ......................................... 524 Redefining Windows System Temporary Directories .............................. 524 Slow Performance on Windows Server 2008 .......................................... 525
Appendix F
Component Monitor Types .......................................................................... 527 DHCP User Experience Monitor ............................................................... 529 Directory Size Monitor............................................................................... 532 DNS Monitor - TCP..................................................................................... 534 DNS Monitor - UDP .................................................................................... 535 DNS User Experience Monitor .................................................................. 536 Download Speed Monitor ......................................................................... 538 File Age Monitor ......................................................................................... 540 File Change Monitor .................................................................................. 542 File Count Monitor ..................................................................................... 544
Contents xxi
File Existence Monitor .............................................................................. 546 File Size Monitor ........................................................................................ 547 FTP Monitor ............................................................................................... 549 FTP User Experience Monitor .................................................................. 550 HTTP Form Login Monitor ........................................................................ 553 HTTP Monitor ............................................................................................. 557 HTTPS Monitor .......................................................................................... 560 IMAP4 Monitor ........................................................................................... 563 IMAP4 User Experience Monitor .............................................................. 564 JMX Monitor ............................................................................................... 567 LDAP User Experience Monitor ............................................................... 569 Linux/Unix Script Monitor ........................................................................ 571 MAPI User Experience Monitor ................................................................ 573 Nagios Script Monitor ............................................................................... 576 NNTP Monitor ............................................................................................ 578 ODBC User Experience Monitor .............................................................. 579 Oracle User Experience Monitor.............................................................. 582 Performance Counter Monitor ................................................................. 587 POP3 Monitor............................................................................................. 590 POP3 User Experience Monitor ............................................................... 592 Process Monitor - SNMP .......................................................................... 594 Process Monitor - WMI ............................................................................. 596 RADIUS User Experience Monitor ........................................................... 598 Service Status SNMP ............................................................................. 600 SMTP Monitor ............................................................................................ 602 SNMP Monitor ............................................................................................ 603 SQL Server User Experience Monitor ..................................................... 605 SSL Certificate Expiration Monitor .......................................................... 608 TACACS+ User Experience Monitor ........................................................ 610 TCP Port Monitor ....................................................................................... 612
xxii Contents
Tomcat Server Monitor ............................................................................. 614 VMware Performance Counter Monitor ................................................... 617 Web Link Monitor ....................................................................................... 621 Windows Event Log Monitor .................................................................... 624 Windows PowerShell Monitor .................................................................. 628 Windows Script Monitor ........................................................................... 631 Windows Service Monitor ......................................................................... 633 WMI Monitor ............................................................................................... 635
Appendix G
Filter Syntax Reference ............................................................................... 639 Filter Syntax ............................................................................................... 639 SWQL Filter Syntax Examples ................................................................ 640 SQL Filter Syntax Examples ................................................................... 641 SWQL Resource Matrix ............................................................................. 642 EOC Filters .............................................................................................. 642 IVIM Filters .............................................................................................. 648 SolarWinds SAM Filters .......................................................................... 649
Appendix H
Configuring and Integrating ......................................................................... 651 JMX.............................................................................................................. 651 JConsole ................................................................................................. 652 Adding a JMX Component Monitor to SAM ............................................ 653 Configuring Java Applications Servers for JMX ...................................... 657 Configuring Java Virtual Machines for SNMP ......................................... 668 MAPI ............................................................................................................ 678 The MAPI User Experience Monitor in SAM ........................................... 679 Install the MAPI Client on the SolarWinds SAM Server .......................... 679 Troubleshooting MAPI ............................................................................. 684 Advanced Troubleshooting ..................................................................... 686 Oracle .......................................................................................................... 689 Physical and Logical Structures .............................................................. 689 Storage .................................................................................................... 689 Disk files .................................................................................................. 689
Contents xxiii
Configuring SAM to Monitor an Oracle Database Server ....................... 690 Prerequisites for Oracle Server Monitoring ............................................ 690 Installing ODP.Net .................................................................................. 690 Installing the Basic Lite Oracle Client ..................................................... 697 Adding an Oracle Database Server to SAM ........................................... 700 Monitoring an Oracle Database on an Existing Node ............................ 706 Getting the Required Settings................................................................. 712 Troubleshooting ...................................................................................... 715 PowerShell ................................................................................................. 732 PowerShell and SAM: Configuration and Usage .................................... 733 PowerShell Templates and Monitors ...................................................... 741 PowerShell Code with SAM .................................................................... 746 Execute Scripts Remotely via Secure WinRM........................................ 750 PowerShell 2.0 Remoting Requirements ................................................ 750 PowerShell 2.0 Remoting Configuration ................................................. 751 Remoting Client/SAM Computer Configuration ...................................... 762 Communicate with Remoting Host ......................................................... 770 Setup Windows PowerShell Monitor in SAM .......................................... 771
Appendix I
Templates Reference .................................................................................. 776 Active Directory 2003-2008 Services and Counters .............................. 782 Active Directory 2008 R2 Services and Counters .................................. 788 AIX LPD ...................................................................................................... 794 Apache ....................................................................................................... 795 Bind (Linux) ............................................................................................... 797 BizTalk Server 2010 Adapters Performance Counters .......................... 799 BizTalk Server 2010 Host Throttling Performance Counters ............... 803 BizTalk Server 2010 Message Box and Orchestrations Performance Counters ..................................................................................................... 811 Blackberry Delivery Confirmation ........................................................... 817 Blackberry Enterprise Server................................................................... 819 Cisco CallManager .................................................................................... 821 CiscoSecure ACS (via SNMP) .................................................................. 823 Citrix XenApp 5.0 Core Counters ............................................................ 824 Citrix XenApp 5.0 ICA Session Counters ............................................... 828
xxiv Contents
Citrix XenApp 5.0 Presentation Server Counters ................................... 834 Citrix XenApp 5.0 Services ....................................................................... 839 Citrix XenApp 6.0 Core Counters ............................................................. 842 Citrix XenApp 6.0 ICA Session ................................................................. 845 Citrix XenApp 6.0 Presentation Server .................................................... 850 Citrix XenApp 6.0 Services ....................................................................... 855 CUPS ........................................................................................................... 858 DHCP User Experience Monitor ............................................................... 860 Distributed File System (DFS) .................................................................. 861 DNS User Experience ................................................................................ 868 Download Speed Monitor ......................................................................... 869 Errors in Application Event Log ............................................................... 871 Exchange 2007 and 2010 .......................................................................... 872 Basic versus Advanced Templates ......................................................... 872 Typical Usage Scenario .......................................................................... 872 Exchange 2007-2010 Client Access Role Services and Counters (Basic) ................................................................................................................. 874 Exchange 2007-2010 Mailbox Role Services and Counters (Basic) ...... 876 Exchange 2007-2010 Hub Transport Role Services and Counters (Basic) ................................................................................................................. 880 Exchange 2007-2010 Edge Transport Role Services and Counters (Basic) ................................................................................................................. 883 Exchange 2007-2010 Unified Messaging Role Services and Counters (Basic) ..................................................................................................... 886 Exchange 2007-2010 Common Performance Counters ......................... 888 Exchange 2007-2010 Statistics with PowerShell .................................... 891 Exchange 2007-2010 PowerShell Scripts Statistics Counters ............... 896 Exchange 2010 Client Access Role Counters (Advanced) ..................... 901 Exchange 2010 Mailbox Role Counters (Advanced) .............................. 903 Exchange 2010 Hub Transport Role Counters (Advanced) ................... 908 Exchange 2010 Edge Transport Role Counters (Advanced) .................. 912 Exchange 2010 Unified Messaging Role Counters (Advanced) ............. 916 Exchange 2010 OWA Form Login (PowerShell) ..................................... 918 Exchange 2007 Client Access Role Counters (Advanced) ..................... 919 Exchange 2007 Mailbox Role Counters (Advanced) .............................. 921 Exchange 2007 Hub Transport Role Counters (Advanced) ................... 926 Exchange 2007 Edge Transport Role Counters (Advanced) .................. 930 Exchange 2007 Unified Messaging Role Counters (Advanced) ............. 934 Exchange 2007 Outlook Web Access (OWA) Form Login ..................... 936
Contents xxv
Exchange Server (via SNMP) ................................................................. 937 File Age Monitor ........................................................................................ 938 File Change Monitor .................................................................................. 939 File Count Script ....................................................................................... 940 File Existence Monitor .............................................................................. 941 File Size Monitor ........................................................................................ 942 File Modified (Vbscript) ............................................................................ 943 Finger Port Monitor ................................................................................... 944 FTP User Experience ................................................................................ 945 Generic DNS .............................................................................................. 946 Generic Mail Server ................................................................................... 947 Generic Web Server .................................................................................. 948 Gopher Port Monitor ................................................................................. 949 Group Policy Object (System and Application Logs) ........................... 950 Helix Universal Media Server (Linux/Unix) ............................................. 955 Helix Universal Media Server (Windows) ................................................ 965 HTTP ........................................................................................................... 975 HTTP Form Login ...................................................................................... 976 IBM DB2...................................................................................................... 977 IBM Informix............................................................................................... 981 IMAP4 Round Trip Email .......................................................................... 990 Internet Information Services and Counters (IIS) .................................. 991 IRC Port Monitor ........................................................................................ 993 ISC DHCP Server (Linux) .......................................................................... 994 Java Application Server (SNMP) ............................................................. 996 LDAP Connection Monitor ..................................................................... 1003 LDAP User Experience Monitor ............................................................. 1004 Linux CPU Monitoring Perl ..................................................................... 1005 Linux Disk Monitoring Perl ..................................................................... 1008 Linux Memory Monitoring Perl .............................................................. 1011
xxvi Contents
Linux Sendmail Monitoring Perl ............................................................. 1015 Log Parser (Perl) ...................................................................................... 1017 Log Parser (PowerShell) ......................................................................... 1019 Lotus Domino Server .............................................................................. 1022 Lotus Domino Server Statistics ............................................................. 1024 MAPI Round Trip Email ........................................................................... 1028 Microsoft Forefront Threat Management Gateway 2010 ..................... 1029 Microsoft Lync Server (Edge Role) ........................................................ 1035 Microsoft Lync Server (Front-End Role) ............................................... 1040 Microsoft Lync Server (Mediation Role) ................................................ 1045 Microsoft Network Policy Server Events .............................................. 1047 Microsoft Network Policy Server RADIUS Proxy ................................. 1053 Microsoft Network Policy Server RADIUS Server ................................ 1056 Microsoft Windows Server 2003 Failover Cluster ................................ 1059 Microsoft Windows Server 2008 Failover Cluster ................................ 1070 MySQL ...................................................................................................... 1082 Nagios Linux File & Directory Count Script .......................................... 1089 OpenLDAP ................................................................................................ 1093 Oracle Database....................................................................................... 1096 POP3 Round Trip Email .......................................................................... 1100 Postfix ....................................................................................................... 1101 PostgreSQL .............................................................................................. 1105 RADIUS User Experience ........................................................................ 1108 Run 3rd Party Application ...................................................................... 1109 RWHOIS Port Monitor.............................................................................. 1111 SharePoint Server 2007 .......................................................................... 1112 SharePoint Server 2010 .......................................................................... 1115 SharePoint Services (WSS) 3.0 .............................................................. 1118 SNPP Port Monitor ................................................................................... 1120 Solaris LPD ............................................................................................... 1121
Contents xxvii
SolarWinds (Orion) Server ..................................................................... 1123 SolarWinds NetFlow Traffic Analyzer Database .................................. 1124 SolarWinds NetFlow Traffic Analyzer ................................................... 1128 SQL Server (via SNMP) ........................................................................... 1134 SQL Server 2005 2008 Performance (WMI) ........................................ 1135 SQL Server 2005-2008 Performance (SQL) .......................................... 1141 SQL Server Query ................................................................................... 1147 Streaming Media Services 2008 ............................................................ 1148 Sybase ASE ............................................................................................. 1153 TACACS+ User Experience .................................................................... 1157 Thwack.com - User Experience Monitor ............................................... 1158 Tomcat Server ......................................................................................... 1159 Unix CPU Monitoring Perl ...................................................................... 1161 Unix Disk Monitoring Perl ...................................................................... 1164 Unix Memory Monitoring Perl ................................................................ 1166 VMware ESX Host ................................................................................... 1169 Web Link .................................................................................................. 1171 Windows 2003-2008 FTP Service .......................................................... 1172 Windows 2008 R2 FTP Service .............................................................. 1174 Windows DHCP Server ........................................................................... 1176 Windows DNS Server .............................................................................. 1181 Windows DNS Server (via SNMP) .......................................................... 1185 Windows Event Log Count ..................................................................... 1186 Windows FTP Server (via WMI).............................................................. 1188 Windows Network Load Balancing ....................................................... 1189 Windows Print Services ......................................................................... 1198 Windows Remote Desktop Services (Session Host Role) .................. 1199 Windows Server 2003 Domain Controller Security ............................. 1208 Windows Server 2003-2008 .................................................................... 1213 Windows Server 2008 Domain Controller Security ............................. 1216
xxviii Contents
Windows Update Monitoring .................................................................. 1222

Index
Index .......................................................................................................... 1225
Contents xxix
Chapter 1
Introduction
SolarWinds Server & Application Monitor (SolarWinds SAM) allows you to create and monitor your own custom collection of monitored components, providing an open field of opportunity to the network engineer. It also allows you to create flexible Application Monitor templates to combine process monitors, port availability, and performance counters, allowing you to assess the status of every aspect of your application and the health of the application as a whole.
SolarWinds SAM vs. Orion APM

The SolarWinds family of products (NPM, SAM, and so on) share many common components, including the engine these products use to function. These common components are referred to as the Orion Platform. In an effort to distinguish SAM as a powerful and unique product, we changed the name of the product from Orion APM to SolarWinds SAM beginning with version 5.0. This name change should not have a large impact on the user's experience; however, it is worth noting that there may be instances of the words and acronyms, SolarWinds, Orion, APM, and SAM, where they appear to be interchangeable.
Introduction 1
Be aware of these name changes as you explore the software and this manual: The acronym APM has been replaced with, SAM, when referring to this software product. There are instances throughout this guide, as well as various places within the software itself, and on the SolarWinds website, that the acronym, APM, may still exist. This is intentional and will be found in paths, variables, and previous versions of the software. While this may be a slight inconvenience, it is essential to ensure the integrity of an already active implementation of previous versions of the software. The word Orion has been removed when referring to specific SolarWinds software. For example: Orion APM, Orion NPM, and so on. The word Orion refers to shared platform items such as alerts, shared components, variables, and so on.
Applications Defined
An application in SolarWinds SAM is considered a collection of component monitors housed in a template. A component monitor is defined as a value returned by a specific process, counter, status, or a value returned by a script. With this received data, SolarWinds SAM can easily show you a myriad of vital statistics concerning the health of your system. Templates provide blueprints for the applications to be monitored. You can quickly and easily customize numerous templates, using only the component monitors you need for a specific environment. SolarWinds SAM recognizes and answers the complexity of todays business applications with scalability, flexibility, and reliability. Refer to the following sections for more information: SAM Glossary of Terms How Does SolarWinds Server & Application Monitor Work?
2 Introduction
SAM Glossary of Terms

Here is a list of fundamental terms with which you should be familiar. A treelike map is also provided to visualize how SAM operates.
Component Monitor A component monitor is the fundamental element of an application. Component monitors return the current status or value of a monitored service or process. All component monitors return at least one value or one status condition. Node - A node is considered to be any endpoint of a given network. For example, any server or computer on a network is considered a node. Sometimes a node is referred to as a device. Application - An application in SolarWinds SAM is a collection of component monitors. Template - A template is the blueprint for an application. It is a collection of component monitors designed to monitor a server or application. You can customize numerous templates using only the component monitors you need for a specific environment.
Introduction 3
The type of information returned by the component monitor is based upon the type of monitor being utilized. For example, one type of monitor can report the up or down status of a service or process, another monitor can return the percentage of free space of a volume. Another type of component monitor can return up to ten values. Each monitor type, along with its parameters and returned values and/or states, is unique. Each node, along with its applications and component monitors, can be viewed from the SolarWinds SAM web console as shown in the diagram below. The view can be customized to suit your needs.
4 Introduction
How Does SolarWinds Server & Application Monitor Work?

Using UDP, TCP, SNMP, and WMI calls to your network framework and application servers, SolarWinds Server & Application Monitor provides real time feedback on your applications and trending through statistics stored in the SolarWinds database. Keeping with the SolarWinds common components infrastructure, there are no agents installed on your servers and no remote software to maintain. All calls are made in real time and displayed on a Web Console accessible from any supported browser. As a standalone product, SAM's operations can be visualized with the following flowchart:
Installed as a module in your family of SolarWinds products, SAM can be visualized with the following flowchart:
Introduction 5
6 Introduction
Chapter 2
Requirements and Installation

Installing SolarWinds Server & Application Monitor (SolarWinds SAM) is a wizard driven process. Resource and space requirements are reasonable, and most deployments do not require hardware updates to your SolarWinds Server. This chapter discusses: Requirements for SolarWinds FIPS Support Server Sizing SNMP Requirements for Monitored Devices If SNMPv2c is enabled on a device you want to monitor, by default, SolarWinds SAM will attempt to use SNMPv2c to poll the device for performance information. If you only want SolarWinds SAM to poll using SNMPv1, you must disable SNMPv2c on the device to be polled. Enabling Microsoft Internet Information Services (IIS) Upgrading SolarWinds Server & Application Monitor Installing SolarWinds Server & Application Monitor Activating Your License Finishing SolarWinds SAM Installation Excluding SolarWinds Data Directories from Anti-Virus Scanning Running SolarWinds SAM Internet Explorer Security Settings Licensing
Requirements for SolarWinds SAM

SolarWinds recommends installing your SolarWinds product on one server, and installing the SolarWinds database on its own SQL Server. Installations of multiple SolarWinds SAM servers using the same database are not supported.
Requirements and Installation 7
SolarWinds Server Software Requirements The following table lists minimum software requirements and recommendations for your SolarWinds server.
Software Requirements Windows Server 2003 or Windows Server 2008 R2, with IIS in 32-bit mode. IIS must be installed. SolarWinds recommends that SolarWinds administrators have local administrator privileges to ensure full functionality of local SolarWinds tools. Accounts limited to use of the SolarWinds Web Console do not require administrator privileges. Notes: SolarWinds does not support production installations of SolarWinds products on Windows XP, Windows Vista, or Windows 7 systems. If you are installing SolarWinds SAM on Windows Server 2003, confirm that your full computer name is no longer than 15 characters in length. Windows Server 2003 trims any characters beyond the fifteenth, and this may prevent SolarWinds services from properly identifying your SolarWinds server. For more information, see Additional SolarWinds SAM Requirements on page 10. Microsoft IIS, version 6.0 and higher, in 32-bit mode. DNS specifications require that hostnames be composed of alphanumeric characters (A-Z, 0-9), the minus sign (-), and periods (.). Underscore characters (_) are not allowed. For more information, see RFC 952. Warning: The following Windows accounts, as configured by IIS 6.0 on Windows Server 2003 with their default security settings, are required: IUSR_<hostname>, as a member of the Guests group ONLY. IWAM_<hostname>, as a member of the IIS_WPG group ONLY. Disabling these accounts or changing any default settings of these accounts may negatively affect the operation of your SolarWinds installation. SolarWinds strongly recommends against altering these accounts or their settings. Note: SolarWinds neither recommends nor supports the installation of any SolarWinds SAM product on the same server or using the same database server as a Research in Motion (RIM) Blackberry server. Version 3.5 .NET Framework 3.5 SP1 is recommended. Windows operating system management and monitoring tools component Microsoft Internet Explorer version 6 or higher with Active scripting Firefox 3.0 or higher (Toolset Integration is not supported on Firefox)
Operating System
Web Server
.NET Framework SNMP Trap Services Web Console Browser
SolarWinds Server Hardware Requirements The following table lists minimum hardware requirements and recommendations for your SolarWinds server. Note: Hardware requirements are listed by SolarWinds license level.
Hardware CPU Speed AL50, AL100, AL250, or AL500 2.0 GHz AL1000 2.4 GHz ALX 3.0 GHz
Note: Dual processor, dual core is recommended.
8 Requirements and Installation

2 GB Hard Drive Space 5 GB 20 GB
Note: A RAID 1 drive for server operating system, SolarWinds installation, and tempdb files is recommended. The SolarWinds installer needs 1GB on the drive where temporary Windows system or user variables are stored. Per Windows standards, some common files may need to be installed on the same drive as your server operating system. 3 GB 4 GB 4 GB 161/SNMP and 443/SNMP. VMware ESX/ESXi Servers are polled on 443. 17777/TCP open for SolarWinds module traffic 17778/ HTTPS open to access the SolarWinds Information Service API
Memory Application Ports
Requirements for Virtual Machines and Servers SolarWinds installations on VMware Virtual Machines and Microsoft Virtual Servers are fully supported if the following minimum configuration requirements are met for each virtual machine. Note: SolarWinds strongly recommends that you maintain your SQL Server database on a separate physical server.
Virtual Machine Configuration CPU Speed Allocated Hard Drive Space Memory SolarWinds Requirements by License Level AL50, AL100, AL250, or AL500 2.0 GHz 2GB AL1000 2.4 GHz 5GB ALX 3.0 GHz 20GB
Note: Due to intense I/O requirements, SQL Server should be hosted on a separate physical server configured as RAID 1+0. RAID 5 is not recommended for the SQL Server hard drive. 3 GB 4 GB 4 GB Each virtual machine on which SolarWinds is installed should have its own, dedicated network interface card. Note: Since SolarWinds uses SNMP to monitor your network, if you are unable to dedicate a network interface card to your SolarWinds server, you may experience gaps in monitoring data due to the low priority generally assigned to SNMP traffic.
Network Interface
Requirements for the SolarWinds Database Server (SQL Server) The following table lists software and hardware requirements for your SolarWinds database server. SolarWinds license levels are provided as a reference.
Requirements AL50, AL100, AL250, or AL500 AL1000 ALX
SQL Server
SQL Server 2005 SP1 Express, Standard, or Enterprise SQL Server 2008 Express, Standard, or Enterprise Notes: Due to latency effects, SolarWinds does not recommend installing your SQL Server and your SolarWinds server or additional polling engine in different locations across a WAN. For more information, see SolarWinds Knowledge Base article, Can I install my SolarWinds server or Additional Polling Engine and my SolarWinds database (SQL Server) in different locations across a WAN? Either mixed-mode or SQL authentication must be supported. If you are managing your SolarWinds database, SolarWinds recommends you install the SQL Server Management Studio component. Use the following database SQL statement to check your SQL Server version, service pack or release level, and edition: select SERVERPROPERTY ('productversion'), SERVERPROPERTY ('productlevel'), SERVERPROPERTY ('edition') 2.0 GHz 2 GB 2.4 GHz 5 GB 3.0 GHz 20 GB
CPU Speed
Hard Drive Space
Note: Due to intense I/O requirements, a RAID 1+0 drive is strongly recommended the SQL Server database and SolarWinds data and log files. RAID 5 is not recommended for the SQL Server hard drive. The SolarWinds installer needs at least 1GB on the drive where temporary Windows system or user variables are stored. Per Windows standards, some common files may need to be installed on drive as your server operating system. 2 GB 3 GB 4 GB Note: SolarWinds recommends additional RAM for SolarWinds SAM installations utilizing more than 1,000 monitors. For optimal performance in larger ALX environments, we recommend 8GB of RAM or greater. Additional memory will improve both performance and reliability.
Memory
The Configuration Wizard installs the following required x86 components if they are not found on your SolarWinds database server: Microsoft SQL Server Native Client Microsoft SQL Server Management Objects
Additional SolarWinds SAM Requirements Enterprise-level SolarWinds SAM deployments with the potential for more than 1,000 monitors may need additional computing resources above the standards required for SolarWinds common components:

Component Monitors Up to 1,000 More than 1,000 Additional Requirements No additional requirements 8+ GB RAM
Note: If you are running Windows Server 2008, you must upgrade to Windows Server 2008 R2 because SolarWinds SAM does not support Windows Server 2008 due to known WMI issues.
FIPS Support
FIPS (Federal Information Processing Standard) defines security and interoperability standards for computers used by the U.S. federal government. To enable FIPS in the Local Security Policy on Windows: 1. Click Start > Control Panel > System and Security > Administrative Tools, and then double-click Local Security Policy. 2. Expand the Local Policies category in the left pane, and then click Security Options. 3. Right-click System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing. 4. In the context menu that is displayed, click Properties. 5. In the Local Security Setting tab, click Enabled and then click Ok. Note: FIPS can also be enabled as part of Group Policy. SolarWinds SAM installations on Windows Server 2008 R2 require a Microsoft hotfix to realize the FIPS-compatibility features of this release. For more information about this required Microsoft hotfix, see the article http://support.microsoft.com/kb/981119. As noted in the KB article, you need to enable FIPS first before applying the Microsoft hotfix. If you use component monitors that have not passed FIPS testing, they may not work properly when FIPS is enabled. The following SolarWinds SAM component monitors have passed FIPS testing: DHCP User Experience Monitor Directory Size Monitor DNS Monitor - TCP DNS Monitor - UDP DNS User Experience Monitor
Download Speed Monitor File Age Monitor File Count Monitor File Existence Monitor File Size Monitor FTP Monitor HTTP Form Login Monitor HTTP Monitor HTTPS Monitor IMAP4 Monitor IMAP4 User Experience Monitor LDAP User Experience Monitor Linux/Unix Script Monitor MAPI User Experience Monitor NNTP Monitor ODBC User Experience Monitor Oracle User Experience Monitor Performance Counter Monitor POP3 Monitor POP3 User Experience Monitor Process Monitor - SNMP FIPS not supported when SNMP is SNMPv3 and using MD5. Process Monitor - WMI SMTP Monitor SNMP Monitor FIPS not supported when SNMP is SNMPv3 and using MD5. SQL Server User Experience Monitor TCP Port Monitor Tomcat Server Monitor Web Link Monitor
Windows Event Log Monitor Windows Script Monitor
Server Sizing
SolarWinds SAM is capable of monitoring networks of any size, ranging from small corporate LANs to large enterprise and service provider networks. Most SolarWinds SAM systems perform well on 3.0 GHz systems with 4 GB of RAM using default polling engine settings. However, when monitoring larger networks, you should give additional consideration to the hardware used and the system configuration. There are three primary variables that affect scalability. The most important consideration is the number of monitored components. Monitoring more than 1,000 components may require fine tuning for optimal performance. The second variable to consider is polling frequency. For instance, if you are collecting statistics more frequently than the default, the system will have to work harder and system requirements will increase. Finally, the number of simultaneous users accessing SolarWinds SAM directly impacts system performance. When planning a SolarWinds SAM installation, there are four main factors to keep in mind with respect to polling capacity: CPU, memory, number of polling engines, and polling engine settings. For minimum hardware recommendations, see Requirements for SolarWinds on page 7. For more information about polling engines, see Additional Polling Engine and Web Console on page 471. Installing SolarWinds SAM and SQL Server on different servers is highly recommended, particularly if you are planning on having more that 1,000 component monitors. This scenario offers several performance advantages as the SolarWinds SAM server does not perform any database processing and it does not have to share resources with SQL Server. If you plan to monitor 10,000 or more components, SolarWinds recommends that you install additional polling engines on separate servers to help distribute the work load. For more information about sizing SolarWinds SAM to your network, contact the SolarWinds sales team or visit www.solarwinds.com. For more information about configuring additional pollers, see Additional Polling Engine and Web Console on page 471.
SNMP Requirements for Monitored Devices

SolarWinds SAM can monitor the performance of any SNMPv1-, SNMPv2c-, or SNMPv3-enabled device on your network. Consult your device documentation or a technical representative of your device manufacturer to acquire specific instructions for configuring SNMP on your device. Notes:
To properly monitor devices on your network, you must enable SNMP on all devices that are capable of SNMP communications. Unix based devices should use the configuration of Net-SNMP version 5.5 or higher that is specific to the type of Unix-based operating system in use. SolarWinds SAM is capable of monitoring VMware ESX and ESXi Servers versions 3.5 and higher with VMware Tools installed. For more information about enabling SNMP and VMware Tools on your VMware device, consult your VMware documentation or technical representative. If SNMPv2c is enabled on a device you want to monitor, by default, SolarWinds SAM will attempt to use SNMPv2c to poll the device for performance information. If you only want SolarWinds SAM to poll using SNMPv1, you must disable SNMPv2c on the device to be polled.
Enabling Microsoft Internet Information Services (IIS)

To host the SolarWinds Web Console, Microsoft Internet Information Services (IIS) must be installed and enabled on your SolarWinds SAM server. Windows Server 2003 requires IIS version 6 while Windows Server 2008 requires IIS version 7, as detailed in the following sections: Enabling IIS on Windows Server 2003 Enabling IIS on Windows Server 2008
Enabling IIS on Windows Server 2003

The following procedure enables IIS on Windows Server 2003. To enable IIS on Windows Server 2003: 1. Click Start > Control Panel > Add or Remove Programs. 2. Click Add/Remove Windows Components. 3. Confirm that Application Server is checked, and then click Details.
4. Confirm that Internet Information Services (IIS) is checked, and then click Details.
5. Confirm that World Wide Web Service is checked, and then click Details.
6. Confirm that World Wide Web Service is checked, and then click OK.
7. Click OK on the Internet Information Services (IIS) window, and then click OK on the Application Server window.
8. Confirm Management and Monitoring Tools is checked and click Details.
9. Confirm that both Simple Network Management Protocol and WMI SNMP Provider are checked, and then click OK.
10. Click Next, and then click Finish when the wizard completes. Note: You may be prompted to install additional components, to provide your Windows Operating System media, or to restart your computer.
Enabling IIS on Windows Server 2008

IIS is enabled automatically after the SAM installation and prior to the start of the Configuration Wizard. If the Configuration Wizard detects that IIS is not installed on Windows 2008, it installs IIS. The following manual procedure is provided for Windows Server 2008 in case problems occur with the automatic IIS installation. To enable IIS on Windows Server 2008: 1. Click Start > All Programs > Administrative Tools > Server Manager. 2. Click Roles.
3. Click Add Roles.
4. Click Next to start the Add Roles Wizard, and then check Web Server (IIS).
5. If you are prompted to add features required for Web Server (IIS), click Add Required Features.
6. Click Next on the Select Server Roles window, and then click Next on the Web Server (IIS) window.
7. Confirm that Common HTTP Features > Static Content is installed. 8. Check Application Development > ASP.NET.
9. Click Add Required Role Services.
10. Check both Security > Windows Authentication and Security > Basic Authentication.
11. Check Management Tools > IIS 6 Management Compatibility.
12. Click Next on the Select Role Services window. 13. Click Install on the Confirm Installation Selections window. 14. Click Close on the Installation Results window. 15. If you are currently enabling IIS as part of a SolarWinds SAM installation, restart the SolarWinds SAM installer.
Upgrading SolarWinds Server & Application Monitor

If you have version 3.1 or lower of SolarWinds APM installed, you must first upgrade to NPM 10 and then upgrade to APM 3.5 before you can upgrade to SAM 5.X. For more information, click Upgrade Instructions in any SolarWinds NPM group on the License Management page of the Customer Portal. Note: SolarWinds recommends creating a backup of your database before starting any SolarWinds upgrade or installation. If you have version 3.5 or later of APM installed, you have an option for upgrading to APM 4.X, or SAM 5.X: Upgrading NPM and SolarWinds SAM on Your Current Server
Notes: Always upgrade NPM first, then you can upgrade to SAM If installed together on the same server, SAM and SolarWinds NPM share the same database.
If installed on different servers, SAM and SolarWinds NPM each require their own database. You cannot share one database between separate SAM and SolarWinds NPM servers.
Upgrading NPM and SolarWinds SAM on Your Current Server

To upgrade both SolarWinds NPM and SolarWinds SAM on your current SolarWinds server: 1. Upgrade SolarWinds NPM to version 10.1. For more information, see Installing SolarWinds Network Performance Monitor in the SolarWinds Network Performance Monitor Administrator Guide. 2. Install SAM 5.X as described in the section Installing SolarWinds Server & Application Monitor on page 41. Important: Always upgrade NPM on all SolarWinds servers first. After that is complete, you can successfully upgrade. Failure to upgrade in the correct order will result in the Configuration Wizard generating a Database Configuration Failure error.
Upgrading APM to a New Server While Keeping NPM on Your Current Server
To upgrade APM to a new server: 1. Back up your current SolarWinds Server. 2. Shutdown SolarWinds NPM and APM on your current SolarWinds Server. 3. Have your Database Administrator clone your SolarWinds database to a different name. Note: To clone your SolarWinds database, use the appropriate version of Microsoft SQL Server Management Studio for your database. You can download this from the Microsoft website if it is not already installed. 4. Uninstall APM from your original Orion Server. a. Use Add or Remove Programs in Control Panel to remove SolarWinds Server & Application Monitor. b. The Configuration Wizard should be run automatically as part of the uninstallation. If it is not, execute it manually by clicking Start > All Programs > SolarWinds Orion > Configuration and AutoDiscovery > Configuration Wizard.
c. In the Configuration Wizard, select all components to be modified: Database, Website, and Services, and then configure them appropriately for your original SolarWinds Server. Ensure that you specify the original database. d. Delete the APM folder in the <drive>:\INETPUB\SOLARWINDS\ORION directory, where <drive> is the drive letter for the APM Website Root Directory, for example: C. 5. Copy the security certificate from the original server to the new server. 6. Install SAM on its new server as described in the section Installing SolarWinds Server & Application Monitor on page 41, and in the Configuration Wizard specify the new cloned database. For more information, see Installing SolarWinds Server & Application Monitor on page 41.
Moving SolarWinds SAM to a different server

Migrating SolarWinds SAM to a different server is a process that can take as little as 30 minutes or as long as several hours, depending on the size of your SolarWinds database. Consider scheduling an appropriate maintenance window in which to perform your migration. The process involves deactivating the licenses of your products, stopping the services, migrating the products, and then uninstalling your previous installation.
General Requirements
Moving your SolarWinds SAM implementation to a new server requires the following: Server hardware meeting minimum requirements for the new SolarWinds SAM implementation. Windows user account credentials that have been granted administrative rights on both servers. A license reset to register SolarWinds SAM on your new server. You will need to install SolarWinds License Manager to manage the required license migration.
Note: Maps and map objects created or edited in SolarWinds Network Atlas are stored in the SolarWinds database. If the database is successfully migrated, there is no need to migrate any additional Network Atlas map files.
Database Requirements
Ensure that you comply with the following requirements before you attempt to modify or back up your existing database: SolarWinds APM version 4.0 and higher requires SQL Server 2005 SP1 or later, including SQL Server 2008. Install your new database server. The following procedures assume you are moving your database from one physical server to another and that the management tool (Enterprise Manager, SQL Server Management Studio Express, or SQL Server Management Studio) is installed on the new database server. If you want to use a Microsoft SQL Server Express database, recognize that the database store is limited to 4GB. Know the sa password to both your existing SolarWinds database server and your new database server. Know the credentials to an account with administrator rights on both your existing SolarWinds database server and your new database server. Have a maintenance window during which you can safely shutdown your SolarWinds SAM services. You need to stop data collection to ensure that your backup file matches your last active database state.
Stopping SAM Services

It is important to stop the SolarWinds SAM services that are currently writing to the database. This ensures that you do not have data inconsistencies when you bring your new database server online. To stop SolarWinds SAM services: 1. Click Start > All Programs > SolarWinds Orion > Advanced Features > Orion Service Manager. 2. Expand Services. 3. Click each service, except the SQL Server service, and then click Stop. Notes: If you have more than one Polling Engine, you will need to stop each additional Polling Engine before continuing. Do not stop the SQL Service. The SQL Service needs to be running in order to make the necessary changes to the database.
4. Click File > Exit.
Creating a Database Backup File with Database Manager

Complete the following procedure if you want to use Database Manager. To backup your SolarWinds database using Database Manager: 1. Log on to the computer that hosts your current SolarWinds SAM server. 2. Click Start > All Programs > SolarWinds Orion > Advanced Features > Database Manager. 3. If your SQL Server is not listed in the left pane, add your server, as shown in the following steps: a. Click Add Server. b. Select the name of the SQL instance from the SQL Server list. If your server is not listed, type the name or IP address. c. Select the appropriate authentication type, and then click Connect to Database Server. 4. Locate and right-click your database in the Database Manager tree in the left pane, and then click Backup Database. 5. Type a Description of the database backup, and then specify a Backup Filename, including the path. Note: Click the ellipsis to directly select the Backup Filename. 6. Select either of the following options: If you want to attach your new database backup to the end of the selected backup file, select Append to the end of the Backup File. If you want to overwrite the selected backup file, select Overwrite Backup File.
7. Click OK. 8. If you are moving the SQL database to the new SolarWinds SAM server, copy the new backup file to a folder on the new server. 9. Install SolarWinds SAM on the new server, but DO NOT run the Configuration Wizard yet. Reboot the server if prompted, and then register the software. Note: A new license key is required, and you will need to install SolarWinds License Manager to manage the required license migration. 10. On the new server, click Start > SolarWinds Orion > Advanced Features > Database Manager.
11. If your SQL Server is not listed in the left pane, add your server, as shown in the following steps: a. Click Add Server. b. Select the name of the SQL instance from the SQL Server list. If your server is not listed, type the name or IP address. c. Select the appropriate authentication type, and then click Connect to Database Server. 12. Locate and right-click on your server in the Database Manager tree in the left pane, and then click Connect to Server. 13. If you moved the SQL database to the new server, perform the following steps: Note: Database Manager cannot create new folders. Therefore, specify a path that already exists. a. Click Database > Restore Database. b. Click the ellipsis to Select the Database file to Restore. c. If you want to verify the validity of the selected database, click Verify. d. Confirm or edit the name of the restored database in the Restore Database as the following Database name field. e. If you want to restore the database as .MDF or .LOG files, provide appropriate filenames in the Restore Database in the following MDF and LOG files fields. f. Click OK.
14. Run the Configuration Wizard and specify the existing (or newly restored) database on the Database setup section of the wizard. When prompted, click Yes to use the existing database. Note: Do not skip tabs or deviate from the tab order. Click Start, and then click Continue to complete the wizard in order. Completing tabs out of order may adversely affect the install process.
Creating a Database Backup File with SQL Server Management Studio Express
Complete the following procedure if your new database server uses SQL Server 2005 Express edition. To backup your SolarWinds database using SQL Server Management Studio Express:
1. Log on to the new database server using an administrator account. 2. Click Start > All Programs > Microsoft SQL Server 2005 > SQL Server Management Studio Express. 3. Specify the name of the current SolarWinds database server on the Connect to Server window. 4. If you are using SQL Server Authentication, click SQL Server Authentication in the Authentication field, and then specify your credentials in the User name and Password fields. 5. Click Connect. 6. Expand the name of your SolarWinds server, and then expand Databases in the left pane. 7. Right-click the name of your SolarWinds database, and then click Tasks > Backup. 8. Click Add, and then specify and remember the Destination you provide. This is the directory and name of your backup. Note: Remember, this file is created on the remote database server. It is not created locally. 9. Click Options in the Select a page pane on the left. 10. Check Verify backup when finished. 11. Click OK. 12. Copy the .bak file from your current SolarWinds database server to your new database server.
Creating a Database Backup File with SQL Server Management Studio

Complete the following procedure if your new database server uses SQL Server 2005 or 2008. To backup your SolarWinds database using SQL Server Management Studio: 1. Log on to the new database server using an administrator account. 2. Click Start > All Programs > Microsoft SQL Server 200X > SQL Server Management Studio. 3. Specify the server name of the current SolarWinds database server on the Connect to Server window.
4. If you are using SQL Server Authentication, click SQL Server Authentication in the Authentication field, and then specify your credentials in the User name and Password fields. 5. Click Connect. 6. In the pane on the left, expand the name of the server hosting the SQL instance you are using for SolarWinds SAM, and then expand Databases. 7. Right-click the name of your SolarWinds database, and then click Tasks > Back Up. 8. In the Source area, select Full as the Backup type. 9. In the Backup set area, provide an appropriate Name and Description for your database backup. 10. If there is not already an appropriate backup location listed in the Destination area, click Add, and then specify and remember the destination path and file name you provide. This is the location where your backup is stored. Note: Remember, if your database is on a remote server, as recommended, this backup file is also created on the remote database server. It is not created locally. 11. Click Options in Select a page pane on the left. 12. In the Reliability area, check Verify backup when finished. 13. Click OK. 14. Copy the .bak file from your current SolarWinds database server to your new database server.
Restoring a Database Backup File for SQL Express Server

Complete the following procedure if you are restoring your SolarWinds database backup file to a database server running SQL Express Server. Note: Remember that SQL Express has a 4GB data store limitation. If at all possible, consider using a production version of SQL Server. To restore your database backup file on a server running SQL Express Server: 1. Log on to the new database server using an administrator account. 2. Click Start > All Programs > Microsoft SQL Server 2005 > SQL Server Management Studio Express. 3. Click File > Connect Object Explorer.
4. Specify the name of the new SolarWinds database server on the Connect to Server window. 5. If you are using SQL Server Authentication, click SQL Server Authentication in the Authentication field, and then specify your credentials in the User name and Password fields. 6. Click Connect. 7. Click the name of your server to view an expanded list of objects associated with your server. 8. Click Databases, and then click Restore Database. 9. Leave To database blank. 10. Click From device, and then browse () to the location of your .bak file. 11. Click Add, and then navigate to the .bak file and click OK. 12. Click OK on the Specify Backup window. 13. Check Restore. 14. Select the name of your database from the To database field. It will now be populated with the correct name. 15. Click Options in the left Select a page pane, and then check Overwrite the existing database. 16. Ensure you select a directory that already exists for the files listed in the Restore As column. 17. Click OK. 18. Open and run the configuration wizard to update your SolarWinds SAM installation.
Restoring a Database Backup File for SQL Server 2005

Complete the following procedure if you are restoring your SolarWinds database backup file to a database server running SQL Server 2005. To restore your database backup file on a server running SQL Server 2005: 1. Log on to the new database server using an administrator account. 2. Click Start > All Programs > Microsoft SQL Server 2005 > SQL Server Management Studio. 3. Click File > Connect Object Explorer. 4. Specify the name of the new SolarWinds database server on the Connect to Server window.
5. If you are using SQL Server Authentication, click SQL Server Authentication in the Authentication field, and then specify your credentials in the User name and Password fields. 6. Click Connect. 7. Click the name of your server to view an expanded list of objects associated with your server, and then right-click Databases. 8. Click Restore Database. 9. Leave To database blank. 10. Click From device, and then browse () to the location of your .bak file. 11. Click Add, and then navigate to the .bak file and click OK. 12. Click OK on the Specify Backup window. 13. Check Restore. 14. Select the name of your database from the To database field. It will now be populated with the correct name. 15. Click Options in the left Select a page pane. 16. Check Overwrite the existing database. 17. For each Original File Name listed, complete the following steps to ensure a successful restoration: a. Click Browse (). b. Select a directory that already exists. c. Provide a name for the Restore As file that matches the Original File Name, and then click OK. 18. Select Leave the database ready to use by rolling uncommitted transactions(RESTORE WITH RECOVERY). 19. Click OK. 20. Open and run the configuration wizard to update your SolarWinds SAM installation. Note: Due to the nature of security identifiers (SIDs) assigned to SQL Server 2005 database accounts, SolarWinds recommends that you create and use a new account for accessing your restored SolarWinds database on the Database Account window of the SolarWinds Configuration Wizard.
Restoring a Database Backup File for SQL Server 2008

Complete the following procedure if you are restoring your SolarWinds database backup file to a database server running SQL Server 2008.
To restore your database backup file on a server running SQL Server 2008: 1. Log on to the new database server using an administrator account. 2. Click Start > All Programs > Microsoft SQL Server 2008 > SQL Server Management Studio. 3. Click File > Connect Object Explorer. 4. Specify the name of the new SolarWinds database server on the Connect to Server window. 5. If you are using SQL Server Authentication, click SQL Server Authentication in the Authentication field, and then specify your credentials in the User name and Password fields. 6. Click Connect. 7. Click the name of your server to view an expanded list of objects associated with your server, and then right-click Databases. 8. Click Restore Database. 9. Leave To database blank. 10. Select From device, and then click Browse (). 11. Confirm that File is selected as the Backup media. 12. Click Add. 13. Navigate to the .bak file, select it, and then click OK. 14. Click OK on the Specify Backup window. 15. In the Destination for restore area, select the name of your database from the To database field. Note: The To database is now populated with the correct name. 16. Check Restore next to the database backup you are restoring. 17. Click Options in the left Select a page pane. 18. Check Overwrite the existing database (WITH REPLACE). 19. For each Original File Name listed, complete the following steps to ensure a successful restoration:
a. Click Browse (). b. Select a directory that already exists. c. Provide a name for the Restore As file that matches the Original File Name, and then click OK. 20. Select Leave the database ready to use by rolling uncommitted transactions(RESTORE WITH RECOVERY), and then click OK. 21. Open and run the configuration wizard to update your SolarWinds SAM installation. Note: Due to the nature of security identifiers (SIDs) assigned to SQL Server 2008 database accounts, SolarWinds recommends that you create and use a new account for accessing your restored SolarWinds database on the Database Account window of the SolarWinds Configuration Wizard.
Updating SolarWinds SAM to Use the New Database Server

In general, SolarWinds recommends that you use SQL Server Authentication with the sa login and password to ensure that SolarWinds SAM can always access your SQL Server database, even when it is hosted remotely on a separate server. To update SolarWinds SAM to use a new database: 1. Log on to your SolarWinds SAM server. 2. Click Start > All Programs > SolarWinds Orion > Configuration and Auto-Discovery > Configuration Wizard. 3. Check Database, and then click Next. 4. Specify your new database server in the SQL Server field. 5. If you want to use SQL authentication, check Use SQL Server Authentication, and then provide the appropriate credentials. Note: SolarWinds recommends that you use the sa login and password for your database server to ensure that you are able to properly configure the SolarWinds database user account. 6. Click Next. 7. Select Use an existing database, select or type the Existing Database name, and then click Next. 8. If you are prompted to use the existing database, click Yes. 9. Select Create a new account, and then provide a New Account name.
Notes: Creating a new account ensures that SolarWinds SAM has required access to your migrated database. The New Account must be a member of the securityadmin server role. The sysadmin role and the sa user account are always members of securityadmin. 10. Provide and confirm an account Password. 11. Click Next to start database configuration, and then click Finish to exit the Configuration Wizard
Reassigning Nodes
If a new name is used for the new SolarWinds SAM server, it is added to the database as a new polling engine. All current nodes remain assigned to the old polling engine name and must be reassigned to the new polling engine, as shown in the following procedure. To reassign items to the new polling engine: 1. Click Start > All Programs > SolarWinds Orion > Advanced Features > Orion Service Manager. 2. Stop all SolarWinds services. Notes: If you have more than one Polling Engine, you will need to stop each additional Polling Engine before continuing. Do not stop the SQL Service. The SQL Service needs to be running in order to make the necessary changes to the database. 3. Click File > Exit 4. Click Start > SolarWinds Orion > Database Utilities > Database Manager. 5. Expand your SQL Server in the tree. 6. Expand the SolarWinds database. Note: By default, this database is named NetPerfMon. 7. Right-click on the Engines table, and then click Query Table. 8. Click Refresh to display the table entries.
9. Select Read-Write (Results can be edited).
10. Replace the value in the ServerName field for the old polling engine with the server name of the new polling engine. In the previous graphic, the OLDSERVER is renamed NEW-SERVER. Note: It is not necessary to update the IP field. The next time the service is started, SolarWinds SAM discovers the new IP address, and the IP field is updated automatically. 11. Delete the newly added engine from the table (EngineID: 2 in this example) by clicking on the blank area to the left of the row to select it. Right-click anywhere in the selected row, and then click Delete Selected Rows.
12. Click Yes when prompted to confirm deleting the row. Note: The final result will display the new server name with the IP address of the old server. The next time the service starts, the IP field will be updated with the IP address of the new server.
13. Close Database Manager.
Copying Custom Reports

Complete the following task to copy your custom reports to the new SolarWinds SAM server. To copy your reports: 1. On the old server, copy your custom reports located in the \Orion\Reports folder. 2. Paste these reports into the Orion\Reports folder on the new server.
Updating Report Schemas

If you have added custom properties to the database, you will need to upgrade the report schemas on the new server. Updating the report schemas allows Report Writer to display and use custom property data. To update report schemas for custom properties: 1. Ensure that Report Writer is closed, and then click Start > All Programs > SolarWinds Orion > Advanced Features > Custom Property Editor. 2. Right-click on the toolbar, and then click Customize 3. Click the Commands tab, and then click Properties in the category list. 4. Drag Update Report Schemas to the toolbar to add a new button to the toolbar. 5. Close the Customize window. 6. Click Update Report Schemas on the toolbar. 7. Click OK after the custom properties have been added to the report schemas. 8. Close Custom Property Editor.
Moving SolarWinds SAM Security Certificates to a New Server

SolarWinds SAM encrypts your sensitive data with a security certificate stored on the original SolarWinds SAM server. To grant a new server access to this encrypted data, you must copy the original security certificate to the new server. Warning: If you do not replicate the original certificate, SolarWinds SAM on the new server cannot access any credentials used by your component monitors, and all of those component monitors will fail.
To replicate the original certificate: 1. Export the credential from the original server. a. On the Start Menu, click Run, type MMC, and then click OK. b. On the File menu, click Add/Remove Snapin, and then click Add. c. Select Certificates and then click Add. d. Select Computer account and then click Next. e. Select Local computer and then click Finish. f. Click Close.
g. Click OK. h. Expand the Certificates (Local Computer) > Personal > Certificates group. i. Right-click SolarWinds APM Engine (if present), and SolarWindsOrion, point to All Tasks on the shortcut menu, and then click Export. Note: Exporting SolarWinds APM Engine is only required if you are upgrading from APM 4.0.1 or earlier. If you have APM 4.0.2 or later, you do not need to do anything with this certificate. Just migrate the SolarWinds-Orion certificate. j. Click Next in the Certificate Export Wizard.
k. Select Yes, export the private key, click Next, and then click Next again. l. Type and confirm a password for this private key, and then click Next.
m. Specify the file name to which you want to save the certificate, click Next, and then click Finishthe certificate is saved with a .pfx file name extension. 2. Copy the .pfx certificate file to the new server. 3. Import the certificate to the new server. a. On the Start Menu, click Run, type MMC, and then click OK. b. On the File menu, click Add/Remove Snapin, and then click Add. c. Select Certificates, and then click Add. d. Select Computer account, and then click Next. e. Select Local computer, and then click Finish. f. Click Close.
g. Click OK.
h. Expand the Certificates (Local Computer) group. i. j. Expand the Personal group. Expand the Certificates group.
k. If there is a SolarWinds SAM Engine item in the list, right-click SolarWinds APM Engine and SolarWinds-Orion and select Delete from the shortcut menu. l. Right-click the CertificatesPersonalCertificates node, point to All Tasks in the shortcut menu, and then click Import.
m. Click Next in the Certificate Import Wizard. n. Specify the .pfx certificate file you copied to the server and then click Next. o. Enter the password for the private key, check Mark this key as exportable, and then click Next. p. Select Place all certificates in the following store, and then select Personal as the Certificate Store. q. Click Next and then click Finish.
Migrating Licenses with License Manager

You must run License Manager on the computer where the currently licensed SolarWinds products are installed before you can migrate licenses to a new installation. The following procedure deactivates currently installed licenses that can then be transferred to a new installation. To deactivate currently installed licenses: 1. Click Start > All Programs > SolarWinds > SolarWinds License Manager. 2. Check the products you want to deactivate on this computer. 3. Click Deactivate. 4. Specify your SolarWinds Customer ID and password when prompted, and then click Deactivate. Note: Deactivated licenses are now available to activate on a new computer. When you have successfully deactivated your products, log on to the computer on which you want to install your products, and then begin installation. When asked to specify your licenses, provide the appropriate information. The license you deactivated earlier is then assigned to the new installation.
Installing License Manager

You will need to install License Manager on the computer from which you are migrating currently licensed products. Note: You must install License Manager on a computer with the correct time. If the time on the computer is even slightly off, in either direction, from Greenwich Mean Time (GMT), you cannot reset licenses without contacting SolarWinds Customer Service. Time zone settings neither affect nor cause this issue. To install License Manager: 1. Click Start > All Programs > SolarWinds > SolarWinds License Manager Setup. 2. Click I Accept to accept the SolarWinds EULA. 3. If you are prompted to install the SolarWinds License Manager application, click Install. Using License Manager You must run License Manager on the computer where the currently licensed SolarWinds product is installed before you can migrate licenses to a new installation. The following procedure deactivates currently installed licenses that can then be transferred to a new installation. To deactivate currently installed licenses: 1. Click Start > All Programs > SolarWinds > SolarWinds License Manager. 2. Check the products you want to deactivate on this computer. 3. Click Deactivate. 4. Specify your SolarWinds Customer ID and password when prompted, and then click Deactivate. Note: Deactivated licenses are now available to activate on a new computer. When you have successfully deactivated your products, log on to the computer on which you want to install your products, and then begin installation. When asked to specify your licenses, provide the appropriate information. The license you deactivated earlier is then assigned to the new installation.
Upgrading SolarWinds APM when SolarWinds Failover Engine is Installed

Prior to attempting this upgrade you should read the entire procedure.
On the primary/active server: Note: If the secondary server is the active server, omit step 1 below. 1. Switch active server to secondary, shutdown Failover Engine on primary server Using the SolarWinds Orion Failover Manager, select the secondary (passive) server and click Make Active. Wait for the secondary server to become active. After that stop Stop Orion Failover Engine from context menu of tray icon 2. Shutdown Orion Failover Engine on the secondary (active) server Stop Orion Failover Engine on the secondary (active) server leaving the protected applications running from context menu of tray icon. On the secondary server: 3. Upgrade desired SolarWinds product : a. Install the SolarWinds Orion Update by running the setup program. b. If asked, reboot server now. After reboot, shutdown Failover Engine and proceed with Configuration Wizard. c. Verify that SolarWinds Orion is operational. 4. If the upgrade procedure was successful, proceed to step 6. 5. If Upgrade on secondary server fails: a. Research the cause of the upgrade failure. b. If the issue can be resolved then it is safe to proceed with upgrade procedure. Otherwise you can revert to previous version. c. To revert to a previous version: i. Uninstall the upgraded components. ii. On the secondary server, launch the SolarWinds Orion Failover Engine Configure Server wizard and click on the Machine tab. Change the Current role to Secondary/passive. iii. Reboot the server. iv. SolarWinds Orion Failover Engine will start and SolarWinds Orion will be stopped. v. On the primary server, launch the SolarWinds Orion Failover Engine Configure Server wizard and click on the Machine tab. Change the Current role to Primary/active. vi. Restart SolarWinds Orion Failover Engine on the primary server and allow system to synchronize. vii. Start SolarWinds Orion Failover Manager and check that the system completes the full system check. Needs to be updated:
SQL is already updated, needs revert Orion is not able to uninstall upgrade, needs repair of previous release 6. Change the server role to Secondary/passive: a. Start failover engine in context menu of tray icon - to update service default start up mode b. Stop failover engine including stopping all protected applications in context menu of tray icon c. Wait until all protected services are stopped d. Launch the Configure Server wizard and click on the Machine tab. Change the Current role to Secondary/passive e. Start Failover Engine - to enable packet filter f. Shutdown Failover Engine
On the primary Server (assuming a successful upgrade of secondary completed): 7. Perform upgrade on primary: a. Disable Neverfail Packet Filter Driver on Public NIC 1. Open Properties of the Public Network Adapter. (e.g. in Network Connections window, accessible via Control Panel, right click the Public Network Adapter and select Properties) 2. Uncheck the Neverfail Packet Filter Driver item on the list and close the window by OK. b. Install the SolarWinds Orion Update by running the setup program. c. If asked, reboot server now. After reboot, shutdown Failover Engine and proceed with Configuration Wizard. d. Verify that SolarWinds Orion is operational. e. Enable the Neverfail Packet Filter Driver on Public NIC 1. Open Properties of the Public Network Adapter. (e.g. in Network Connections window, accessible via Control Panel, right click the Public Network Adapter and select Properties) 2. Check the Neverfail Packet Filter Driver item on the list and cl ose the window by OK. 8. Resume the Failover Engine a. Start Failover engine on the Primary Server. b. Launch Failover Manager on the Primary Server and make the Primary Server Active using the Make Active button. c. Start Failover Engine on the Secondary server.
d. Start Replication using Start Replication button in the Failover Manager. 9. License the SolarWinds a. If applicable, license the application(s) on the Active (Primary) server. If SolarWinds fails to start on the secondary server, follow the steps below : 1. Shutdown Orion Failover Engine. 2. Launch the Configure Server wizard and set the secondary server role to passive. 3. Start Orion Failover Engine on the secondary server. 4. Start the Configure Server wizard on the primary server and set the server role to active. 5. Start Orion Failover Engine on the primary server. 6. Launch the SolarWinds Orion Failover Manager and verify that the system completes the Full System Check. 7. Investigate the cause of the SolarWinds Orion failure on the secondary server.
Installing SolarWinds Server & Application Monitor

SolarWinds Server & Application Monitor offers an intuitive wizard to guide you through installing and configuring the product. If you are performing a clean install of SolarWinds SAM and also want to install SolarWinds NPM, you should install SolarWinds NPM version 10.2.2 or higher. For more information, see Installing SolarWinds Network Performance Monitor in the SolarWinds Network Performance Monitor Administrator Guide. To install or upgrade SolarWinds Server & Application Monitor: 1. Using an account with local administrative privileges, log on to the SolarWinds server on which you want to install SolarWinds SAM. To avoid permissions issues, this account should not be a domain account, and it should not be subject to any local or group policy restrictions. 2. If you downloaded the product from the SolarWinds website, complete the following steps: a. Navigate to the location of your downloaded .zip file, and then extract the evaluation package to an appropriate location. b. Launch the SolarWinds SAM evaluation executable.
3. If you are prompted to install any required components, such as Microsoft .NET Framework 3.5 or Microsoft ASP.NET 2.0 AJAX Extensions, click Install and then complete the component installation. Note: Downloading and installing Microsoft .NET Framework 3.5 may take a long time, depending on your existing system configuration. 4. Review the Welcome text, and then click Next.
5. If the InstallShield Wizard detects that Microsoft Internet Information Services (IIS) is not installed, suspend installation, quit setup, and then install Internet Information Services (IIS). 6. If you had to install Internet Information Services (IIS), launch the SolarWinds evaluation executable again.
7. Accept the terms of the license agreement, and then click Next.
8. Accept the default install location, or navigate to a different location, and then click Next.
9. Accept the Express Install Recommended option, and then click Next.
10. Click Next to start copying files. Installation begins.
11. After files are copied and installed, configuring begins automatically.
12. Click Finish to exit the Configuration Wizard.
13. Type Admin in the User Name field, and then click LOGIN.
14. The Network Sonar Wizard is displayed. Click Cancel and then confirm that you want to cancel the network discovery by clicking Ok. Note: The wizard can be used to discover a set of nodes in your network. You will use it later in this guide.
Activating Your License

After installing the software through the setup wizard, you are prompted to enter the license activation key for your product. If you do not have an activation key, the product runs in a time-limited evaluation mode. To evaluate the software without a license: Click Continue Evaluation. To license the software on a server with Internet access: 1. Click Enter Licensing Information. 2. Select I have internet access and an activation key. 3. Click the http://www.solarwinds.com/customerportal link to access the customer portal on the SolarWinds web site. 4. Log on to the portal using your SolarWinds customer ID and password. 5. Click License Management on the left navigation bar. 6. Navigate to your product, choose an activation key from the Unregistered Licenses section, and then copy the activation key.
7. If you cannot find an activation key in the Unregistered Licenses section, contact SolarWinds customer support. 8. Return to the Activate SAM window, and then enter the activation key in the Activation Key field. 9. If you access Internet web sites through a proxy server, click I access the internet through a proxy server, and enter the proxy address and port. 10. Click Next. 11. Enter your email address and other registration information, and then click Next. To license the software on a server without Internet access: 1. Click Enter Licensing Information 2. Select This server does not have internet access, and then click Next. 3. Click Copy Unique Machine ID. 4. Paste the copied data into a text editor document. 5. Transfer the document to a computer with Internet access. 6. On the computer with Internet access, complete the following steps: 7. Browse to http://www.solarwinds.com/customerportal/licensemanagement.aspx and then log on to the portal with your SolarWinds customer ID and password. 8. Navigate to your product, and then click Manually Register License. 9. If the Manually Register License option is not available for your product, contact SolarWinds customer support. 10. Provide the Machine ID from Step 5, and then download your license key file. 11. Transfer the license key file to the server. 12. Return to the Activate SAM window, browse to the license key file, and then click Next.
Finishing SolarWinds SAM Installation

After activating your license, you are prompted to configure SolarWinds SAM. Doing so configures the SolarWinds database, web site, and services to work in your specific environment. Follow the directions in the SolarWinds Configuration Wizard: Notes:
Confirm that you have designated a SQL Server database instance for SolarWinds SAM. Confirm that the Internet Information Services (IIS) Manager is not open while the Configuration Wizard is running. During configuration, the SolarWinds polling engine will shut down temporarily with the result that, if you are actively polling, you may lose some polling data. SolarWinds recommends that you perform upgrades during offpeak hours of network usage to minimize the impact of this temporary polling stoppage.
To configure Server & Application Monitor: 1. If the Configuration Wizard has not loaded automatically, click Start > All Programs > SolarWinds Orion > Configuration and Auto-Discovery > Configuration Wizard. 2. Click Next on the Welcome window of the Configuration Wizard. 3. If you are prompted to stop services, click Yes. Note: To ensure that all updates and changes are installed correctly, it is imperative that you stop all services. 4. Specify the SQL Server instance you want to use to store network data. 5. Provide the credentials, if necessary, that are required to log into the selected instance. Notes: If you are using an existing database, the user account needs only to be in the db_owner database role for the existing database. If you are using an existing SQL account, the user account needs only to be in the db_owner database role for the SolarWinds SAM database.
The selected instance must support mixed mode or SQL authentication with strong passwords. A strong password must meet at least three of the following four criteria: o o o o Contains at least one uppercase letter. Contains at least one lowercase letter. Contains at least one number. Contains at least one non-alphanumeric character, e.g., #, %, or ^.
For more information about authentication with strong passwords, see http://msdn.microsoft.com/ms143705.aspx.
If you are using SQL Express, specify your instance as (local) and use a strong password. For more information about authentication with strong passwords, see http://msdn.microsoft.com/ms143705.aspx. Due to its inherent limitations, SolarWinds recommends against the use of SQL Express in production environments. If you are creating a new database, the user account must be a member of the dbcreator server role. The sysadmin role and the sa user account are always members of dbcreator. If you are creating a new SQL account for use with SolarWinds SAM, the user account must be a member of the securityadmin server role. Note: The sysadmin role and the sa user account are always members of securityadmin. 6. Click Next. 7. If you are creating a new database, select Create a new database, provide a name for the new database, and then click Next. Note: SolarWinds recommends against using non-alphanumeric characters in database names. 8. If you are using an existing database, select Use an existing database, type the database name or select it from the list, and then click Next. 9. If you want to create a new SQL account for the SolarWinds SAM polling engine and web console to use for accessing the database, select Create a new account, provide an account name and password, confirm the account password, and then click Next. 10. If you want to use an existing SQL account for the SolarWinds SAM polling engine and web console to use for accessing the database, select the existing account, provide the appropriate password, and then click Next. 11. If you need to specify a particular IP Address for the SolarWinds SAM Web Console, provide the IP address of the host web server. Note: SolarWinds recommends the default All Unassigned unless your environment requires a specific IP address for your SolarWinds Web Console. 12. Specify both the port through which you want to access the web console and the volume and folder in which you want to install the web console files. Note: If you specify any port other than 80, you must include that port in the URL used to access the web console. For example, if you specify an IP address of 192.168.0.3 and port 8080, the URL used to access the web console is http://192.168.0.3:8080. 13. Click Next.
14. If you are prompted to create a new directory, click Yes. 15. If you are prompted to create a new website, click Yes. Note: Choosing to overwrite the existing website will not result in the deletion of any custom SolarWinds SAM website settings you may have previously applied. 16. Confirm that all services you want to install are checked, and then click Next. 17. Review the final configuration items, and then click Next. 18. Click Next on the Completing the SolarWinds Configuration Wizard dialog. 19. Click Finish when the SolarWinds Configuration Wizard completes. 20. Log in to the SolarWinds Web Console as an administrator. Note: By default, you can log in with User Name Admin and no password. 21. If you have not discovered your network devices and added them to the SolarWinds database, the Network Discovery Wizard starts.
Excluding SolarWinds Data Directories from AntiVirus Scanning

Anti-virus programs may lock files used by the SolarWinds Job Engine v2 during scanning. This can cause the SolarWinds Job Engine v2 services to stop and restart, causing delayed polling and gaps in data for a poll cycle. SolarWinds recommends that you exclude certain SolarWinds data directories (depending on your Windows platform) from your anti-virus scanning to improve performance and stability: Exclude for Windows Server 2003
C:\Documents and Settings\All Users\Application Data\SolarWinds
Exclude for Windows Server 2008

C:\ProgramData\SolarWinds
Running SolarWinds SAM

To run SolarWinds SAM: Click Start > All Programs > SolarWinds Orion > Orion Web Console. The SolarWinds Web Console is displayed. You can login by default by entering the User name Admin and no password. Then click Login.
Internet Explorer Security Settings

If you are using Internet Explorer, SolarWinds recommends that you add the URL of your SolarWinds website (http://FullSolarWindsServerName/), the URL of SolarWinds support (http://support.solarwinds.com), and about:blank to the list of trusted sites. If you do not add these URLs to the list of trusted sites, you may see Internet Explorer dialogs that contain messages similar to the following regarding blocking website content:
Content from the website listed below is being blocked by the Internet Explorer Enhanced Security Configuration. <website>
To add the specified URLs to your trusted sites list, click the Add button in the Internet Explorer dialog. For more information about adding sites to your trusted sites list, see the Microsoft article, Working with Internet Explorer Security Settings.
Licensing
The SolarWinds SAM license you purchase is based on the number of allowed assigned component monitors. A component monitor provides a statistic that you want to monitor in SolarWinds SAM. You can have as many application templates and assigned monitors as you need, as long as the number of assigned component monitors does not exceed the license count. If you have more assigned component monitors than allowed by your license, the monitors that exceed your license limit are not activated, and their component statuses are changed to "Not Licensed." You can either disable some assigned component monitors to reduce your total assigned monitor count, or contact SolarWinds about upgrading your SolarWinds SAM license. Note: SolarWinds SAM licenses do not have to mirror the license count of any other installed SolarWinds product. For example, you can install SolarWinds SAM with a 50 component license on a SolarWinds NPM server with an unlimited node license. To see the available component monitors remaining in your license: 1. Log on to the SolarWinds Web Console with an administrator account. 2. Click Applications. 3. Click SAM Settings. 4. Click SAM License Summary.
Note: As an alternative to the previous procedure, you can also click License Details in the Settings page to view the used and available component monitors.
Chapter 3
Common Tasks with SolarWinds SAM

The features and flexibility provided by Server & Application Monitor give highly detailed insight into the performance quality of applications on your network. The tasks presented in this chapter illustrate the value of Server & Application Monitor, and how it can immediately offer you a significant return on your investment: Monitoring Internal and External Web Site Performance Monitoring Microsoft Windows Performance Monitoring IIS Application Pools Scanning for Applications Worth Monitoring Monitoring VMware Performance Counters Monitoring and Restarting Stopped Windows Services Creating a Custom Component Availability Report Creating a Windows PowerShell Monitor Monitoring Large Directories
Common Tasks with SolarWinds SAM 53
Monitoring Internal and External Web Site Performance

You are the website administrator for your company. You are responsible for the Intranet web site accessed by the employees and the corporate web site accessed by the customers. You want to make sure both your employees and customers are able to access your web sites and that you are alerted to any problems that would prevent them from doing so.
Deciding What to Monitor The Intranet server is in your server room. To make sure only employees can access the Intranet web site, the web site is secured using basic HTTP authentication (htpasswd) that requires them to log on using a user name and password. You decide to monitor this server using the HTTP template and the valid credentials: user name "admin" and password "password. The corporate web server is hosted and managed by a web hosting company. You can monitor the web site with the HTTP Template, but because you do not have direct control over the server hardware, you will add the server to the SolarWinds database as an external node. Monitoring the Intranet Home Page We need to add the Intranet web server to the SolarWinds database, and then assign the SolarWinds SAM HTTP template to the web server. 1. Log on to the SolarWinds Web Console. 2. Click Applications if not already selected.
54 Common Tasks with SolarWinds SAM
3. Add the Intranet web server to the SolarWinds database. a. Click Add a Node. b. Type the Hostname or IP Address of the Intranet web server. c. Check the ICMP (Ping only) check box, select the appropriate Polling Engine (if applicable), and then click Next. d. In the Add Application Monitors page, click Next. Note: If you wish to add an Application Monitor to the node, you may do so either here or from the Application Settings as described elsewhere in this guide. e. In the Change Properties page, click Ok, Add Node. 4. Assign the HTTP template to the Intranet web server node. a. Click Applications if not already selected. b. Click SAM Settings. c. Click Manually Assign Application Monitors. d. Select Web Server in the Show only list. e. Select HTTP, and then click Next. f. Expand the categories and locate your Intranet web server node, select it, and then click Next.
g. Select <New Credential> in the Choose Credential list. h. Type Intranet Admin in the Credential Name field. i. j. Type admin in the User Name field. Type password in the Password and Confirm Password fields. If the test fails, see Troubleshooting the HTTP Template.
k. Click Test. l.
m. Click Assign Application Monitors. n. Click Done. Monitoring the Corporate Home Page We need to add the corporate web server to the SolarWinds database as an external node, and then assign the HTTP template to the web server. 1. Log on to the SolarWinds Web Console. 2. Click Applications if not already selected.
3. Add the corporate web server to the SolarWinds database as an external node. a. Click Add a Node. b. Type the Hostname or IP Address of the corporate web server. c. Check the External check box, select the appropriate Polling Engine (if applicable), and then click Next. 4. Assign the HTTP template to the corporate web server node. a. Select Web Server in the Show only list. b. Select HTTP. c. Select Inherit credentials from template and then click Test. d. If the test fails, see Troubleshooting the HTTP Template. e. Click Next. f. Enter the Name for your corporate web server.
g. Click Ok, Add Node. Troubleshooting the HTTP Template If the web site requires a user name and password, verify that you are entering a working user name and password. If the SolarWinds SAM server must connect to the Internet through a web proxy: 1. Click Assign Application Monitors even though the test failed. 2. Click Edit. 3. Click [+] to expand the HTTP Monitor component. 4. Click Override Template next to Use Proxy. 5. Check the Use Proxy check box. 6. Click Override Template next to Proxy Address. 7. Type the proxy address in the Proxy Address field using the syntax
http://proxyaddress
8. Click Test All. 9. Click Submit. 10. Click Done.
Monitoring Microsoft Windows Performance

You are a systems administrator who maintains several Microsoft Windows Server 2003 servers in your server room that host databases. Several database users have complained recently that their databases are "running slow" during certain times of the day. You want to monitor the performance of these database servers to see what you can do to remedy the situation.
Deciding What to Monitor You suspect that the disk systems on a few of these servers need to be upgraded to RAID or something similar to increase the speed. You know that monitoring the disk queue length for each system would tell you whether there is an I/O bottleneck. You decide to apply the Windows Server 2003-2008 template to these servers because it includes a built-in Disk Queue Length monitor. Monitoring the Windows 2003 Servers We need to add the server nodes to the SolarWinds database, assign the Windows Server 2003-2008 template to the server nodes, and then adjust the warning threshold of the template's Disk Queue Length component to >2. This will make SolarWinds SAM send us a warning if the Disk Queue Length of any server is greater than 2. The Windows 2003 servers occupy the IP address range 192.168.1.120 to 192.168.1.127. We could add each server to the SolarWinds database one at a time, but it is easier to add the entire IP range using SolarWinds Network Discovery.
1. Log on to the SolarWinds Web Console. 2. Add the Windows 2003 servers to the SolarWinds database. a. Click Settings. b. Click Network Sonar Discovery. c. Click Add New Discovery. d. Click Next. e. Click Next. f. Enter 192.168.1.120 as the Start address, 192.168.1.127 as the End address, and then click Next.
g. Click Next to save the discovery settings. h. Click Discover to begin the discovery process. The Discovering Network dialog is displayed. i. j. Click Next on each page until you reach the IMPORT PREVIEW page. When you reach the IMPORT PREVIEW page, click Import.
k. When you reach the RESULTS page, click Finish. 3. Assign the Windows 2003-2008 template to your Windows 2003 server nodes. a. Click Applications if not already selected. b. Click SAM Settings. c. Click Manually Assign Application Monitors. d. Select Windows in the Show only list. e. Select Windows Server 2003-2008, and then click Next. f. Browse to your Windows 2003 nodes, select all of them, and then click Next.
g. Enter sysadmin in the Credential Name field. h. Enter your administrator user name in the User Name field. i. j. Enter your password in the Password and Confirm Password fields. Click Test.
k. If the test fails, see Troubleshooting the Windows 2003-2008 Template. l. Click Assign Application Monitors, and then click Done.
4. Change the Disk Queue Length warning threshold of the Windows 20032008 template to >2. a. Click SAM Settings. b. Click Manage Templates. c. Select Windows in the tag group column. d. Check the Windows Server 2003-2008 check box. e. Click Edit. f. Click + to expand the Disk Queue Length group.
g. Enter greater than 2 for the Statistic Warning Threshold, and then click Submit. Troubleshooting the Windows 2003-2008 Template. Verify that you are entering the user name and password of an administratorlevel account. If you think you have entered an incorrect credential, correct the mistake and then retest. Verify that the monitored server allows remote WMI connections. Consult the WMI Troubleshooting Guide if you are unsure whether the monitored server allows remote WMI connections. The guide is available from: http://www.solarwinds.com/support/apm/docs/APMWMITroubleshooting.pdf For information about troubleshooting the Windows performance counters, refer to the KB article How can I troubleshoot SolarWinds SAM performance monitoring and Windows performance counters?: http://knowledgebase.solarwinds.com/kb/questions/2139
Monitoring IIS Application Pools

You maintain a web server that hosts five different web sites through Internet Information Services (IIS) 6.0 using application pools to separate each web site. Everything was fine at first, but the average load time for the web pages has doubled as business has grown, and you suspect it may be time to move at least one of the web sites to a new server.
Deciding What to Monitor Internet Information Services 6.0 runs each application pool in a new instance of wp3w.exe. Monitoring the five w3wp.exe instances individually will let you see which web site is using the most system resources. You can then make a more informed decision as to which web site you should move to the new server. Note: w3wp.exe is running only if there are HTTP requests made to a server. To keep w3wp.exe running if no HTTP requests are made to that server, add an HTTP Monitor to the same application. The HTTP Monitor will then check the same website and generate HTTP requests, thereby keeping w3wp.exe running.
What needs to be monitored: Five instances of w3wp.exe, differentiated by application pool. SolarWinds SAM can monitor them separately if you specify the application pool names in the component monitors. 1. Log on to the SolarWinds Web Console. 2. Click Applications if not already selected. 3. Add the web server to the SolarWinds database. a. Click Add a Node. b. Type the hostname or IP address of the Intranet web server. c. Check the ICMP (Ping only) check box and then click Next. d. In the Add Application Monitors page, click Next. e. In the Change Properties page, Click Ok, Add Node. 4. Find the wp3w.exe process on the web server. a. Click Applications if not already selected. b. Click SAM Settings. c. Click Find Processes, Services, and Performance Counters. d. Select Process Monitor WMI as the monitor type, and then click Next. e. Click Browse, select the web server, and then click Select. f. Enter WebServerAdmin in the Credential Name field.
g. Enter your administrator user name in the User Name field. h. Enter your password in the Password and Confirm Password fields. i. j. Click Next. Wait for the process list to load.
k. Click the last page button to view the last page. l. Check the check box next to w3wp.exe, and then click Next.
m. Change Monitor Name to Webpool1. n. Enter webpool1 in the Command Line Filter field. o. Change the CPU Warning Threshold to greater than 40. p. Change the CPU Critical Threshold to greater than 50.
q. Click Add Another Component. r. Repeat steps d through q, changing the Monitor Name and Command Line Filter fields appropriately for the four remaining webpool filters.
s. After creating the monitors for all five w3wp.exe instances, click Next. t. Select New Application Monitor.
u. Type Web Server Application Pools as the Application Monitor Name, and then click Next. v. Select the web server node, and then click Next. w. Review the list of component monitors to create, and then click Ok, Create.
Scanning for Applications Worth Monitoring

You already use SolarWinds SAM for monitoring applications critical to your own job functions. Now, you want to discover and monitor other applications that are hosted in your organization's network.
What needs to be monitored: You decide to scan for Windows and IIS because you have the Windows administrator password to access many computers on the network and you have a hunch at least a few of them are running IIS. All the computers in your network are already in the SolarWinds database, so there is no need to add them. The administrator user name and passwords are:
User Name: WAREHOUSE\Administrator Password: H0merSamps0n User Name: IT\Administrator Password: FourLights
1. Log on to the SolarWinds Web Console. 2. Click Applications if not already selected. 3. Click SAM Settings.
4. Click Scan Nodes for Applications. 5. Select nodes: a. Click [+] to expand the node groups. b. Select the nodes you want to scan, and then click Next. 6. Select applications to find. a. Uncheck all applications except: Internet Information Services Windows Server 2003-2008. b. Click Next. 7. Enter the credentials for the servers you are scanning: a. Click Add Credential. b. Type Warehouse Admin in the Credential Name field. c. Type WAREHOUSE\Administrator in the User Name field. d. Type H0merSamps0n in both the Password and Confirm Password fields. e. Click Submit. f. Click Add Credential.
g. Type IT Admin in the Credential Name field. h. Type IT\Administrator in the User Name field. i. j. Type FourLights in the both the Password and Confirm Password fields. Click Submit.
k. Click Next. 8. Click Start Scan. 9. Click View SAM Summary Page. 10. Click View results (near the top of the page) after the SAM scan is complete. 11. Review the results of the scan.
Monitoring VMware Performance Counters

You want to ensure the health of your VMware environment. What needs to be monitored: You want to create an Application Monitor that uses VMware performance counters provided by the VMware wizard to monitor the health of various aspects of your VMware environment. To create a new Application Monitor using the browsing method to select the desired VMware performance counters: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Find Processes, Services, and Performance Counters underneath Getting Started with SAM. 5. Select one of the following component monitor types, depending on whether you want to browse for ESX or vCenter performance counters: VMware ESX Performance Counter Monitor VMware vCenter Performance Counter Monitor 6. Click Next. 7. Type the IP address of the VMware node you want to browse, or click Browse, select the node from the list, and click SELECT. 8. If suitable credentials already exist, choose the credential from the Choose Credential list. 9. If suitable credentials do not exist, choose <New Credential> from the Choose Credential list, and then add the new credential by filling out the credential details. 10. Click Next. 11. Select whether you want to monitor A single system or Multiple systems. Choosing A single system will provide specific counters that apply to the target system only. Note: This option provides all available performance counters with instances for the specified Entity Type. Since the performance counters selected may contain instances, the Application Monitor or template created based on them cannot be considered as generic, and may only be assigned to the specific target node you specified in step 7 above.
Choosing Multiple systems will provide more generic counters that can be applied to multiple systems. Note: This option provides only aggregate performance counters (without instances). Therefore the Application Monitor or template created based on them can be considered as generic and assigned to different ESX/vCenter target hosts. In this case, monitors in the application or template created will contain the special ${VMWARE_ENTITY_NAME} variable in the Entity Name field of the monitor. When the monitor runs, this variable will be resolved to the first available Entity on a target host with the desired Entity Type (for example, the first Host System). 12. Select the desired VMware Entity Type to monitor: Cluster Compute Resource (only available if the VMware vCenter Performance Counter Monitor type is selected in step 5) Data object that aggregates the computation resources of its associated Host System objects into one single computation resource for use by virtual machines. The cluster services such as HA (High Availability), DRS (Distributed Resource Scheduling), and EVC (Enhanced vMotion Compatibility), enhance the usefulness of this single computation resource. This Entity Type is specific to vCenter systems. Host System Managed object type that provides access to a virtualization host platform. Resource Pool Represents a set of physical resources which may be a single host, a subset of a host's resources, or resources spanning multiple hosts. You can subdivide Resource pools by creating child resource pools. In order to run, a virtual machine must be associated as a child of a resource pool. In a parent/child hierarchy of resource pools and virtual machines, the root resource pool is the single resource pool that has no parent pool. Virtual Machine Managed object type for manipulating virtual machines, including templates that can be repeatedly deployed as new virtual machines. This object type provides methods for configuring and controlling a virtual machine.
13. If you selected the A single system option in step 11, select the desired VMware Entity to monitor. 14. Select the desired Performance Object (group) to monitor. For example, if you want to monitor CPU counters, select CPU. 15. Select the check boxes next to the counters to monitor for the selected Performance Object. Note: To select all the counters listed, select the check box next to Counter. The selected counters are listed in the Selected items list with a red X next
to each one. To delete an item, click the red X next to the item and it will be removed from the list. 16. If you want to select counters from an additional Performance Object, select the next Performance object and then add the desired counters for it. 17. When you are finished selecting counters, click Next. 18. If you selected the A single system option in step 11, select the desired counter instances to monitor: a. Use the Group By dropdown to display the counters for a particular Performance Object, or select All Counters. b. Click the name of the desired counter to choose its instances. c. Select the check box(es) next to the desired instance(s) to monitor. Note: To select all the instances listed, select the check box next to Instance Name. The selected instances are then displayed in the Selected items list with a red X next to each one. To delete an item, click the red X next to the item and it will be removed from the list. d. When you are finished selecting counter instances, click Next. 19. The Edit Properties page is displayed with the component monitors that have been created for each of your selected counters or counters/instances. Here you can modify settings such as the Monitor Name, which defaults to the counter name that was selected. This is only a descriptive label, and can be modified as desired. If you chose the Multiple systems option in step 11 , you can see the special ${VMWARE_ENTITY_NAME} variable in the Entity Name field of the monitor. When the monitor runs, this variable will be resolved to the first available Entity on a target host with the desired Entity Type (for example, the first Host System). You also need to configure your warning and critical thresholds for response time and statistic. 20. When you are finished editing monitor properties, click Next. 21. The Add to Application Monitor or Template page is displayed with the Component list collapsed. Click + next to Component list to expand the list of counters or counters/instances to be added. 22. Select New Application Monitor. Then enter a name for the new Application Monitor, for example: VMware Disk and CPU Monitor. You can change the name of the Application Monitor up to and including step 25.
23. If you selected the Multiple systems option in step 11, expand the list of nodes and select the nodes to monitor. Only VMware ESX and vCenter nodes are displayed. 24. Click Next. 25. Click Ok, Create. 26. Click View SAM Summary Page. 27. Your new VMware monitor appears in the tree view for the All Applications resource. The polling results for the new monitor are updated after a few minutes.
Monitoring and Restarting Stopped Windows Services

You want to ensure the health of your Windows server by monitoring the services that are running. If any services are stopped, they should be restarted. What needs to be monitored: You want to create an Application Monitor that monitors Windows services. You also want to create an alert that attempts to restart any services that are stopped and sends an email. To create a new Application Monitor template using the browsing method to select the desired Windows services and then assign it to the desired nodes: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Find Processes, Services, and Performance Counters underneath Getting Started with SAM. 5. Select the following component monitor type: Windows Service Monitor 6. Click Next. 7. Type the IP address of the Windows node you want to browse, or click Browse, select the node from the list, and click SELECT. 8. If suitable credentials already exist, choose the credential from the Choose Credential list.
9. If suitable credentials do not exist, choose <New Credential> from the Choose Credential list, and then add the new credential by filling out the credential details. 10. Click Next. 11. Browse the list of services and check the boxes for the services to monitor. 12. Adjust thresholds as desired. 13. Click Next. 14. Ensure that New Application Monitor Template Name is selected and then enter a name for your new template, for example CustomWindowsServices. 15. Click Next. 16. Select the boxes for the desired nodes to monitor and click Next. 17. Click Ok, Create to create the assigned Application Monitor. To create an alert that restarts any stopped Windows services and sends an email: 1. Click Start > All Programs > SolarWinds Orion > Alerting, Reporting, and Mapping > Advanced Alert Manager. 2. Click Configure Alerts. 3. Scroll to the bottom of the list in the Manage Alerts dialog, and check the box for Restart a service. 4. If you would also like to send an e-mail notification for the service restart: a. Highlight Restart a service and click Edit. b. Select the Trigger Actions tab and then click Add New Action. c. Select Send an E-Mail / Page and click Ok. d. Complete the e-mail info and click Ok. e. Click Ok. 5. Click Done. For more information about restarting Windows services with an alert action, see Restarting Windows Services with an Alert Action on page 304.
Creating a Custom Component Availability Report

The following procedure generates an example report of component average availability information over the previous week. The final report is sorted so that the worst items are viewed last. Components are listed in order of decreasing availability. Open Report Writer by clicking Start > All Programs > SolarWinds Orion > Alerting, Reporting, and Mapping > Report Writer. Note: At any point during the creation of a report (or perhaps at many points), you may save what you have done by clicking File > Save. The first time you save you must give your report a filename or accept the default, which will be the report title that you assign in the following procedure. To generate an example report of component availability information: 1. Click File > New Report. 2. The example calls for a report on component availability over the past week, so select APM: Historical Daily Component Availability, and then click Ok. 3. Type My Reports in the Report Group field. 4. Enter Last Weeks Component Availability as the Report Title. 5. Select Portrait for the paper orientation. 6. Click the Select Fields tab. 7. Click Browse (...), and then select Add a new field. 8. Click the Field asterisk, and then select Date/Time (Daily Component Availability Filtering Only) > DateTime. 9. Click Browse (...), and then select Add a new field. 10. Click the Field asterisk, and then select Network Nodes > Node Details >Node Name. 11. Click Browse (...), and then select Add a new field. 12. Click the Field asterisk, and then select Historical Daily Component Availability > Application > Application Name. 13. Click Browse (...), and then select Add a new field. 14. Click the Field asterisk, and then select Historical Daily Component Availability > Component > Component Name. 15. Click Browse (...), and then select Add a new field.
16. Click the Field asterisk, and then select Historical Daily Component Availability > Component > ComponentAvailability. 17. On the line for Component Availability, click the function asterisk and then select Average. 18. Click Preview to run the SQL query and view the report data in the Preview window. 19. Click Design in the toolbar to return to design mode. 20. Click the Field Formatting tab. 21. Select DateTime from the field list. 22. Change the Column Header entry to Date/Time. 23. Select Application_Name from the field list. 24. Change the Column Header entry to Application Name. 25. Select Component_Name from the field list. 26. Change the Column Header entry to Component Name. 27. Select Average_of_ComponentAvailability from the field list. 28. Change the Column Header entry to Average Component Availability. Note: Column widths are adjustable. To change a column width, place your cursor on the column divider and drag it to a different position. 29. Click Preview to run the SQL query and view the report data in the Preview window. 30. Click Design in the toolbar to return to design mode. 31. Click the Select Fields tab. 32. Click the sort asterisk on the Component Availability field line, and then select descending. 33. Click Preview to run the SQL query and view the report data in the Preview window. 34. Click Design in the toolbar to return to design mode. 35. Click the Time Frame tab. 36. Select Relative Time Frame, type 7 in the text field, and then select Days from the list. 37. If you want to break down the report day-by-day, click the Summarization tab and specify your choices. 38. If you want to filter your report, click the Filter Results tab and specify filter rules.
39. Click File > Save to save your work.
Monitoring Large Directories

You already use the Directory Size monitor in SolarWinds SAM for monitoring small and medium-sized directories. Now you need to monitor a very large directory. You discover the Directory Size monitor has problems monitoring the very large directory, which contains hundreds or even thousands of files, because the monitor timeout may lapse before the target computer can finish computing the file sizes and sending the response. In order to work around this issue, you decide to use the Windows Script monitor instead to execute a Visual Basic script that uses the Scripting.FileSystemObject to calculate the directory size. What needs to be monitored: You decide to monitor the very large directory using the Windows Script monitor, because this method should be as fast as if you view the folder properties in Windows Explorer to get the size and avoid the timeout issues. 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Create a New Template underneath Application Monitor Templates. 5. Type a name for your template in the Template Name field, for example Large Directory Monitor. 6. If you want to turn on extended debug information to assist Customer Support, expand Advanced and then set Debug logging On and specify the Number of log files to keep. Here you can also select either 32bit or 64bit from the dropdown list entitled, Platform to run polling job on. Note: Do not turn on Debug logging unless directed by Customer Support. 7. Click Add Component Monitor. 8. Expand the Custom Component Monitors group, and then check Windows Script Monitor. 9. Click Submit.
10. Select credentials with appropriate permissions to run the script on the SolarWinds SAM server, and that also has appropriate permissions to do whatever else the script requires. 11. Copy the following Visual Basic script to get the directory size into the Script Body field:
Dim folderPath
folderPath = WScript.Arguments(0)
Set fs = WScript.CreateObject ("Scripting.FileSystemObject") Set folder = fs.GetFolder(folderPath)
WScript.Echo "Message: Folder " & folderPath & " is " & folder.Size & " bytes large" WScript.Echo "Statistic: " & folder.Size
The VB code does the following: a. Reads the first argument passed to the script (the UNC pathname for the directory to monitor) and stores it in folderPath. b. Creates the Scripting.FileSystemObject and stores it in fs. c. Gets the folder name from the saved command line argument and stores it in folder. d. Displays the message with the folder name and the folder size. e. Displays the statistic (folder size in bytes). Note: The script does no error checking, such as handling the case if the folder does not exist. 12. Type the UNC pathname for the directory name to monitor into the Script Arguments field. You can use the token ${IP} and the IP address will be filled in with the IP address of the target node to which the monitor is assigned when the Windows Script monitor runs. For example, if you type the following UNC pathname for the directory name in the Script Arguments:
\\${IP}\c$\my_large_directory
the VBscript will get the size of the directory c:\my_large_directory on the
node to which the Windows Script monitor is assigned. 13. Specify the critical and warning thresholds appropriately based on the desired directory size. 14. Click Submit. 15. Create an assigned Application Monitor by assigning the Large Directory Monitor template to the desired node to monitor. a. Click the Applications tab. b. Click SAM Settings. c. Click Manually Assign Application Monitors underneath Getting Started with SAM. d. Select All in the Show only list. e. Click Large Directory Monitor and then Next. f. Click Manually Assign Application Monitors underneath Getting Started with SAM.
g. Select All in the Show only list. h. Click Large Directory Monitor and then click Next. i. j. Browse to the desired node to monitor, select it, and then click Next. Enter itadmin in the Credential Name field.
k. Enter your administrator user name in the User Name field. l. Enter your password in the Password and Confirm Password fields.
m. Click Test. n. If the test fails, see Troubleshooting the Large Directory Monitor. o. Click Assign Application Monitors, and then click Done. Troubleshooting the Large Directory Monitor Verify that you are entering the user name and password of an administratorlevel account. If you think you have entered an incorrect credential, correct the mistake and then retest. If you made a mistake with the spelling of the directory name, correct it and then retest.
Chapter 4
Managing the Web Console

The SAM Web Console is an integral part of the SolarWinds family of products that can be configured for viewing from virtually any computer connected to the Internet. You can also customize the web console for multiple users and store individually customized views as user profiles. Administrator functions are accessed by clicking Settings in the top right of all SolarWinds Web Console views. The SolarWinds Web Console administrator manages the SolarWinds Website using the commands listed in the various categories on the Settings page. You can manage SolarWinds SAM nodes, groups, accounts, alerts, views, and settings. You can also manage the navigation and look of SolarWinds SAM and view information about available product updates. This guide is designed to mirror the SAM interface, as shown below. Note: If links appear not to work or misdirect you, clear your web cache which can be done by clicking the Clear Web Cache button at the top right of the Settings page, or by going through your browser's Options menu.
Managing the Web Console 75
To manage the SolarWinds Web Console, navigate to the Settings page: 1. Log on to your SolarWinds Web Console with an Administrator account. Note: Initially, Admin is the default administrator user ID with a blank password. You can change the password later using the Account Manager. For more information, see "Managing Accounts" on page 179. 2. Click Settings near the top right of the SolarWinds Web Console to display the Settings page. Refer to the sections that follow for details about the administrative commands available in each category: Getting Started with SolarWinds
Discovery Central Network Sonar Discovery

76 Managing the Web Console
Add a Node Node & Group Management
Manage Nodes VMware Settings Manage Dependencies Manage Groups Accounts
Manage Accounts Account List Customize
Customize Menu Bars Color Scheme External Websites Manage Alerts
Manage Advanced Alerts Product Updates
Available Product Updates Orion Product Team Blog Views
Manage Views Add New View Views by Device Type Views by Application Type Settings
Web Console Settings Polling Settings SAM Settings Orion Thresholds Virtualization Thresholds Details
Database Details Polling Engines Orion Core Details License Details
Getting Started with SolarWinds

This section describes how to get nodes recognized by SAM. For specific information on the discovery options, refer to the following sections: Discovery Central Network Sonar Discovery Add a Node
Discovery Central
Click Discovery Central on the Settings page to view a centralized overview of the types and number of network objects you are monitoring with your currently installed SolarWinds products. Refer to Discovering and Adding Nodes on a Network on page 149.
Network Sonar Discovery

Click Network Sonar Discovery on the Settings page to discover a range of nodes in your SolarWinds SAM. For more information, refer to Network Sonar Discovery on page 150.
Add a Node
Click Add a Node on the Settings page to add a single device to your SolarWinds SAM. For more information, see "Adding Nodes for Monitoring" on page 88.
Node & Group Management

The Node & Group Management category gives you access to the commands for managing nodes, groups, and dependencies. Refer to the following sections for more information: Manage Nodes
VMware Settings Manage Dependencies Manage Groups
Manage Nodes
Click Manage Nodes on the Settings page to add, view, and manage all nodes and resources managed or monitored by your SolarWinds SAM installation. For more information, see "Managing Nodes from the Web Console" on page 87.
VMware Settings
Click VMware Settings on the Settings page to open the VMware Settings view, where you can view both a list of currently monitored VMware ESX Servers and a library of the VMware credentials SolarWinds SAM uses to monitor your ESX Servers. For more information, refer to Virtualization on page 201.
Manage Dependencies
Click Manage Dependencies on the Settings page to manage dependencies for your SolarWinds SAM. For more information, see "Managing Groups and Dependencies" on page 169.
Manage Groups
Click Manage Groups on the Settings page to manage groups for your SolarWinds SAM. For more information, see "Managing Groups and Dependencies" on page 169.
Accounts
The Accounts category gives you access to the commands for managing accounts, permissions, and views. Refer to the following sections for more information: Manage Accounts Account List
Manage Accounts
Click Manage Accounts on the Settings page to manage user accounts, permissions, and views. For more information, see "Managing Accounts" on page 179.
Account List
Click Account List on the Settings page to open the SolarWinds Website Accounts view, providing an immediate overview of web console user account settings. You may use this view to make changes to multiple accounts simultaneously and immediately by clicking to check or clear options. Clicking an Account user name opens the Account Manager for the selected account. For more information, see "Managing Accounts" on page 179.
Customize
The Customize category provides commands to customize the navigation and appearance of your SolarWinds Web Console. Refer to the following sections for more information: Customize Menu Bars Color Scheme External Websites
Customize Menu Bars

Click Customize Menu Bars on the Settings page to configure the menu bars seen by individual users.
Color Scheme
Click Color Scheme on the Settings page to select a default color scheme for resource title bars. For more information, see "Changing the Web Console Color Scheme" on page 119.
External Websites
Click External Websites on the Settings page to designate any external website as a SolarWinds Web Console view, appearing in the Views toolbar. For more information, see "Creating and Editing External Website Views" on page 129.
Manage Alerts
The Manage Alerts category gives you access to the commands that allow you to edit, disable, enable, or delete currently configured advanced alerts. Refer to the following section for more information: Manage Advanced Alerts
Manage Advanced Alerts

Click Manage Advanced Alerts on the Settings page to view, edit, enable, disable, and delete advanced alerts. Editing Alerts To edit an alert: 1. Select the check box for the alert you want to edit. 2. Click Edit. 3. Modify the settings for the alert and then click Ok. Enabling Alerts To enable an alert: 1. Select the check box(es) for the alert(s) you want to enable. 2. Click Enable. Disabling Alerts To disable an alert: 1. Select the check box(es) for the alert(s) you want to disable. 2. Click Disable. Deleting Alerts To delete an alert:
1. Select the check box(es) for the alert(s) you want to delete. 2. Click Delete. 3. Click Yes to confirm the alert deletion. Creating New Alerts and Configuring Advanced Alerting Options To create new alerts or configure advanced alerting options: Click Start > All Programs > SolarWinds Orion > Alerting, Reporting and Mapping > Advanced Alert Manager. For information about creating and configuring alerts using the Advanced Alert Manager, see Creating Alerts on page 291.
Product Updates
The Product Updates category provides commands to get up-to-date information about using and upgrading SolarWinds SAM. Refer to the following sections for more information: Available Product Updates SolarWinds Product Team Blog
Available Product Updates

Click Available Product Updates on the Settings page to configure regular checks for SolarWinds SAM updates that can include version upgrades and service packs.
SolarWinds Product Team Blog

Click SolarWinds Product Team Blog on the Settings page to view regular posts from members of the SolarWinds product team to help you take full advantage of features provided by SolarWinds SAM and its modules.
Views
The Views category gives you access to the commands that allow you to manage individual web console views as well as views for device and application types. Refer to the following section for more information: Manage Views
Add New View Views by Device Type Views by Application Type Customizing Views
Manage Views
Click Manage Views on the Settings page to add, edit, copy, or remove individual web console views. For more information see Customizing Views" on page 104.
Add New View

Click Add New View on the Settings page to add a custom view with the information you want to view. For more information see Customizing Views" on page 104.
Views by Device Type

Click Views by Device Type on the Settings page to designate default views for network nodes. For more information, see "Views by Device Type" on page 108.
Views by Application Type

Click Views by Application Type on the Settings page to specify a custom or a default application details view for each application type. For information, see Views by Application Type on page 145.
Settings
The Settings category gives you access to the commands that allow you to manage configuration settings for the Web Console, polling, SAM, and thresholds. Refer to the following sections for more information: Web Console Settings SAM Settings SolarWinds Thresholds
Virtualization Thresholds
Web Console Settings

Click Web Console Settings on the Settings page to customize the function and appearance of both the SolarWinds Web Console and the charts that are displayed as resources in SolarWinds Web Console views. For more information, see "Customizing Charts in the SolarWinds Web Console" on page 121.
Polling Settings
Click Polling Settings on the Settings page to define the configuration of polling intervals, timeouts, statistics calculations, and database retention settings for your SolarWinds SAM polling engine. For more information, see "SolarWinds Polling Settings" on page 194.
SAM Settings
Click SAM Settings on the Settings page to configure SolarWinds SAM and its templates and component monitors. For more information refer to Configuring SolarWinds SAM on page 141.
SolarWinds Thresholds
Click SolarWinds Thresholds on the Settings page to configure SolarWinds SAM threshold settings. For more information, see "SolarWinds General Thresholds" on page 102.
Virtualization Thresholds
Click Virtualization Thresholds on the Settings page to configure SolarWinds SAM virtual threshold settings for VMware objects. For more information, see "SolarWinds General Thresholds" on page 102.
Details
The Details category gives you access to the commands that allow you to view configuration details for the database, polling engines, licenses, and modules. Refer to the following sections for more information: Database Details
Polling Engines Orion Core Details License Details
Database Details
Click Database Details on the Settings page to display details about the SQL Server database currently used. For more information, see "Data and Database Settings" on page 145.
Polling Engines
Click Polling Engines on the Settings page to show the status and selected configuration information for each currently operational polling engine. For more information, see "Managing SolarWinds SAM Polling Engines" on page 193.
Orion Core Details

Click Orion Core Details on the Settings page to display an information-only page that displays details about your installation of the common components and resources that all SolarWinds products share, including information about your SolarWinds server, monitored object counts, and the version numbers of the executables and DLLs required by any and all installed SolarWinds products.
License Details
Click License Details on the Settings page to display details about both your SolarWinds SAM license and your monitored network. This page also shows the version of the applications that you are running and the versions of associated DLLs.
Navigating the SolarWinds Web Console

The SolarWinds Web Console offers two primary methods of navigation: top-level web console tabs and view-level breadcrumbs. The following sections describe how these navigation methods are used: Using Web Console Tabs Using and Disabling Web Console Breadcrumbs Managing Nodes from the Web Console
Using Web Console Tabs

In the case of a basic SolarWinds SAM installation, the SolarWinds Web Console displays the following tabs: Home The Home tab provides a menu bar of links to views aiding you in general network management and monitoring. Information, like events and Top 10 lists, and technologies, like alerts, used to generate the views linked from the Home menu are generally available to all SolarWinds modules. By default, the SolarWinds Summary Home view displays when you click Home from any view in the web console. Applications If you are viewing the SolarWinds Web Console on a server on which SolarWinds SAM is installed, the Applications tab opens a menu of default views for some of the many different types of applications SolarWinds SAM can monitor. The SAM Summary Home view displays by default when you click Home from any web console view. Virtualization The Virtualization tab provides access to specific views and resources that are tailored for monitoring virtual devices.
Using and Disabling Web Console Breadcrumbs

As you navigate web console views, your location is recorded as a series of links, or breadcrumbs, to the views you have opened. Each breadcrumb offers the following navigation options: Clicking a breadcrumb opens the corresponding view directly. Clicking > next to a breadcrumb opens a clickable list of all other views at the same navigation level in the web console. For example, if you are on a Node Details view, clicking > displays a list of other monitored nodes. Note: Only the first 50 monitored nodes, listed in alphanumeric order by IP address, are displayed. Customizing Web Console Breadcrumbs Dropdown breadcrumb lists are customizable, as shown in the following steps. To customize the items in a breadcrumb dropdown: 1. Click > at an appropriate level in a breadcrumb to open the dropdown. 2. Click Customize this list.
3. Select a criterion from the menu, and then click Submit. Note: All items in the customized list will be identical for the selected criterion. Disabling Web Console Breadcrumbs To ensure access is appropriately restricted for account-limited users, you may want to disable breadcrumbs, as indicated in the following procedure. To disable web console breadcrumb navigation: 1. Log on to your SolarWinds server using an account with administrative access. 2. Open web.config (default location C:\Inetpub\SolarWinds\) for editing. 3. In the <appsettings> section, locate the following setting:
<add key=DisableBreadCrumbs value=false/>
4. Change false to true, as follows:

<add key=DisableBreadCrumbs value=true/>
5. Save web.config. Note: If you run the Configuration Wizard after editing this setting, your changes may be overwritten.
Managing Nodes from the Web Console

The SolarWinds Web Console administrator manages the SolarWinds Website using the commands listed in the various categories on the Settings page. From the Web Console, the administrator can manage nodes, groups, accounts, alerts, views, and settings. The administrator can also manage the look and feel of SolarWinds SAM and view information about available product updates. To manage the SolarWinds Web Console, navigate to the Settings page: 1. Log on to your SolarWinds Web Console with an Administrator account. Note: Initially, Admin is the default administrator user ID with a blank password. You can change the password later using the Account Manager. For more information, refer to Managing Accounts" on page 179. 2. Click Settings at the top right of the SolarWinds Web Console to display the Settings page.
Note: The Node Management feature is accessible by clicking Manage Nodes either in the header of any All Nodes resource or in the Node & Group Management grouping of the Website Administration page. The All Nodes resource is included on the SolarWinds Summary Home view by default, but you can include it on any other web console view as well. Confirm that the All Nodes resource is available on an appropriate Web Console view before continuing. For more information about adding resources to SolarWinds Web Console views, see Editing Views on page 105. Refer to the following sections for more information: Adding Nodes for Monitoring Deleting Nodes from Monitoring Viewing Node Data in Tooltips Editing Node Properties Promoting a Node from ICMP to SNMP Monitoring Viewing Node Resources Setting Node Management States Unscheduled Node Polling and Rediscovery Monitoring Windows Server Memory Scheduling a Node Maintenance Mode Time Period
Adding Nodes for Monitoring

The following procedure details the steps required to add a device for monitoring in the SolarWinds Web Console. To add a device for monitoring in the SolarWinds Web Console: 1. Log in to the SolarWinds Web Console as an administrator. 2. Click Settings in the top right of the web console. 3. Click Manage Nodes in the Node & Group Management grouping of the SolarWinds Website Administration page. 4. Click Add Node on the Node Management toolbar. 5. Provide the hostname or IP Address of the node you want to add in the Hostname or IP Address field. 6. If the IP address of the node you are adding is dynamically assigned, check Dynamic IP Address.
7. If you only want to use ICMP to monitor node status, response time, or packet loss for the added node, check ICMP (Ping only). 8. If you want to add an External node to monitor a hosted application with SolarWinds Server & Application Monitor, select No Status: External Node. Note: The External status is reserved for nodes hosting applications that are to be monitored with SolarWinds Server & Application Monitor. SolarWinds SAM will not collect or monitor any data about a node itself, if it is marked as External. 9. If you want to monitor Windows Servers using WMI and ICMP, select Windows Servers: WMI and ICMP. 10. If you are adding a VMware device, check Poll for VMware to ensure that SolarWinds SAM acquires any data the VMware device provides to SNMP polling requests, and then complete the following steps to provide required vCenter or ESX Server credentials. For more information, see Virtualization" on page 201. a. Select an appropriate vCenter or ESX credential. Notes: If you are creating a new credential, select <New Credential>. If you are editing an existing credential, select the credential you want to edit. SolarWinds recommends against using non-alphanumeric characters in VMware credential names.
b. If you are creating a new credential, provide a Credential name. c. Provide an appropriate User name and a Password, and then provide the password again in the Confirm password field. d. Click Test to confirm the VMware credentials you have provided. 11. If you want to use SNMP and ICMP to monitor the added node, complete the following steps: a. Select the Most Devices and the SNMP Version for the added node. Notes: SolarWinds uses SNMPv2c by default. If the device you are adding supports or requires the enhanced security features of SNMPv3, select SNMPv3. If SNMPv2c is enabled on a device you want SolarWinds SAM to monitor, by default, SolarWinds SAM will attempt to use SNMPv2c to poll for performance information. If you only want SolarWinds SAM to
poll using SNMPv1, you must disable SNMPv2c on the device to be polled. b. If you have installed multiple polling engines, select the Polling Engine you want to use to collect statistics from the added node. Note: This option may not be available if you are only using one polling engine to collect information from your network. c. If the SNMP port on the added node is not the SolarWinds default of 161, provide the actual port number in the SNMP Port field. d. If the added node supports 64-bit counters and you want to use them , check Allow 64-bit counters. Note: SolarWinds fully supports the use of 64-bit counters; however, these high capacity counters can exhibit erratic behavior depending on manufacturer implementation. If you notice peculiar results when using these counters, use the Node Details view to disable the use of 64-bit counters for the device and contact the hardware manufacturer. 12. If you want SolarWinds to use SNMPv2c to monitor the added node, provide valid community strings for the added node. Note: The Read/Write Community String is optional, but SolarWinds does require the public Community String at a minimum, for node monitoring. If you want to use read/write SNMPv3 credentials, complete the following steps in the Read / Write SNMPv3 Credentials area. 13. If you want SolarWinds to use SNMPv3 to monitor the added node, provide the following SNMP Credentials, Authentication, and Privacy/Encryption settings: SNMPv3 Username, Context, Authentication Method, and Password. Note: If this password is a key, check Password is a key. SNMPv3 Privacy/Encryption Method and Password. Note: If this password is a key, check Password is a key. 14. If you want to save the provided credentials as a Credential Set in the Credential Set Library, provide a Name, and then click Save. 15. If you want to delete a currently saved credential set, select the set to delete, and then click Save. 16. If you are using SNMP to communicate with your added node, click Validate SNMP after entering all credentials to confirm your SNMP settings. 17. Click Next.
18. Check the objects for the added node that you want SolarWinds to monitor or manage. The following options are available in the Selection toolbar: Clicking All selects all listed devices for monitoring. Clicking None clears any checked devices. Clicking All Volumes selects all listed volumes for monitoring. 19. After you have selected objects for monitoring, click Next. 20. If you want to edit the SNMP settings you provided earlier, change the appropriate values in the SNMP area of the Change Properties page, and then click Validate SNMP to confirm your new settings. 21. If you want to edit the default polling settings for your added node, change the Node Status Polling or Collect Statistics Every values in the Polling area of the Change Properties page, as appropriate. Note: The Node Status Polling value refers to the number of seconds, between the node status checks that SolarWinds performs on the added node. The Collect Statistics Every value refers to the period of time between updates SolarWinds makes to display statistics for the added node. 22. If you have defined any custom properties for a monitored node, provide appropriate values for the added node in the Custom Properties area of the Change Properties page. Note: The Custom Properties area is empty if you have not defined any custom properties for monitored network objects. 23. Click Ok, Add Node when you have completed properties configuration. 24. If you have successfully added the node, click Ok on the dialog.
Deleting Nodes from Monitoring

The following procedure allows you to delete nodes from monitoring. Warning: Deleting nodes from monitoring in the web console automatically stops monitoring of all applications and volumes on the deleted nodes. To delete a node from monitoring in the SolarWinds Web Console: 1. Log in to the SolarWinds Web Console as an administrator. 2. Click Settings in the top right of the web console. 3. Click Manage Nodes in the Node & Group Management area of the SolarWinds Website Administration page.
4. Locate the node to delete using either of the following methods: Use the search tool above the node list to search your SolarWinds database for the node you want to delete. Select an appropriate Group by: criterion, and then click the appropriate group including the node to delete. 5. Check the node to delete in the list, and then click Delete on the toolbar.
Deleting Applications or Volumes from Monitoring

You can select multiple applications on different nodes for simultaneous deletion. The search tool above the node list can aid you in finding the proper device to delete. 1. If you want to delete a monitored application or volume, use the following steps: a. Locate the application to delete using either of the following methods: Use the search above the node list to search your SolarWinds database either for the object to delete or for its parent object to delete. Select a Group by: criteria, and then click the appropriate group including the parent node of the object to delete. b. If you have a list of node results, click [+] to expand the parent node of the object you want to delete. c. Check the object to delete, and then click Delete on the toolbar. 2. Click Ok to confirm deletion.
Viewing Node Data in Tooltips

Node tooltips in SolarWinds SAM provide immediate status overviews of monitored nodes. To get a quick overview of any monitored node in the web console, hover over the device name. The information in the following tables displays immediately.
Node Data Node Status IP Address Machine Type Average Response Time Current status of the node. (up, down, warning, unmanaged, or unreachable) The IP address currently assigned to the selected node The vendor icon and vendor description of the selected node The measured average response time of the selected node as of the last node poll

Packet Loss CPU Load Memory Used The percent of all transmitted packets that are lost by the selected node as of the last node poll The percent of available processing capacity on the selected node that is currently used as of the last node poll The percent of available memory on the selected node that is currently used as of the last node poll
Editing Node Properties

The following procedure provides the steps required to edit monitored object properties using the Node Management utility of the SolarWinds Web Console. To edit object properties in the SolarWinds Web Console: 1. Log in to the SolarWinds Web Console as an administrator. 2. Click Settings at the top right of the web console, and then click Manage Nodes in the Node & Group Management grouping. 3. Locate the object to edit using either of the following methods: Use the search tool above the node list to search your SolarWinds database for either the object you want to edit or the parent node of the volume you want to edit. Select an appropriate Group by criteria, and then click the appropriate group including either the node to edit or the parent of the object to edit. 4. If you want to edit the properties of a monitored node, check the node you want to edit, and then click Edit Properties. 5. If you want to edit the properties of a monitored object, click [+] next to the parent node of the object you want to edit, check the object you want to edit, and then click Edit Properties. 6. If you are editing the SNMP properties of a node, click Test after providing new settings to confirm they are valid for the edited node. 7. If the selected node is a VMware ESX Server and you want to poll it for data using the VMware API, confirm that Poll for VMware is checked. 8. If you want to poll for ESX data using an existing ESX credential, select the appropriate credential from the VMware credentials dropdown menu.
9. If you want to poll for ESX data using a new ESX credential, complete the following steps: a. Select <New Credential> in the Choose Credential dropdown menu, and then provide a new credential name in the Credential Name field. Note: SolarWinds recommends against using non-alphanumeric characters in VMware credential names. b. Add the credential User name and Password, as necessary. c. Confirm the password and then click Validate VMware to confirm the credentials you have provided are valid for the edited node. 10. Edit additional device properties as needed, and then click Submit.
Promoting a Node from ICMP to SNMP Monitoring

After adding a node to the SolarWinds database as an ICMP only node, you may need to promote the node to SNMP to start collecting additional statistics. The Node Management utility of the SolarWinds Web Console can easily promote your node to SNMP without any loss of historical data. Note: Once you promote a node from SNMP to WMI, you cannot go back to polling via ICMP. To promote an ICMP only node to SNMP: 1. Log in to the SolarWinds Web Console as an administrator. 2. Click Settings in the top right of the web console and then click Manage Nodes in the Node & Group Management grouping of the SolarWinds Website Administration page. 3. Locate the device to promote using either of the following methods: Use the search tool above the node list to search your SolarWinds database for the node you want to promote. Select an appropriate Group by criteria, and then click the appropriate group including the node to promote. 4. Click Edit Properties, and then select Most Devices: SNMP and ICMP. 5. In the SNMP area, select the SNMP Version for the promoted node. Note: SolarWinds uses SNMPv2c by default. If the promoted device supports or requires the enhanced security features of SNMPv3, select SNMPv3. 6. If you have installed multiple polling engines, select the Polling Engine you want to use to collect statistics from the added node.
Note: This option may not be available if you are only using one polling engine to collect information from your network. 7. If the SNMP port on the added node is not the SolarWinds default of 161, provide the actual port number in the SNMP Port field. 8. If the added node supports 64 bit counters and you want to use them, check Allow 64 bit counters. Note: SolarWinds fully supports the use of 64-bit counters; however, these high capacity counters can exhibit erratic behavior depending how they are used. If you notice peculiar results when using these counters, use the Edit Properties view to disable the use of 64-bit counters on the device in question, and then contact the hardware manufacturer. 9. If you want to use SNMPv2c to monitor the promoted node, provide valid community strings for the added node. Note: The Read/Write Community String is optional, but SolarWinds does require the public Community String, at minimum, for node monitoring. 10. If you want to use SNMPv3 to monitor the promoted node, provide the following SNMPv3 credential settings: SNMPv3 User name and Context SNMPv3 Authentication Method and Password/Key SNMPv3 Privacy/Encryption Method and Password/Key Note: Read/Write SNMPv3 Credentials are optional, but the public Community String is required, at a minimum, for node monitoring. 11. If you want to edit an existing SNMPv3 credential set, select the name of your set from the Saved Credential Sets list, and then edit the stored settings. 12. If you want save the provided SNMPv3 credentials as a credential set, provide a Name for your new credential set, and then click Save. 13. Click Validate SNMP after entering all required credentials to confirm your SNMP settings. 14. If you want to change the default polling settings for your promoted node, edit the Node Status Polling or Collect Statistics Every values in the Polling area, as appropriate.
Note: The Node Status Polling value refers to the period of time, in seconds, between the node status checks SolarWinds performs on the promoted node. The Collect Statistics Every value refers to the period of time between updates SolarWinds makes to displayed statistics for the promoted node. 15. If you have defined any custom properties for monitored nodes, provide appropriate values for the promoted node in the Custom Properties. 16. Click Submit when you have completed properties configuration for your promoted node. 17. If you have successfully added the node, click Ok on the dialog.
Promoting a Node from ICMP to WMI Monitoring

After adding a node to the SolarWinds database as an ICMP only node, you may need to promote the node to WMI to start collecting additional statistics. The Node Management utility of the SolarWinds Web Console can easily promote your node to WMI without any loss of historical data. Note: Once you promote a node from ICMP to WMI, you cannot go back to polling via ICMP. Also, this option is only available in SAM 5.0 and above. To promote an ICMP only node to WMI: 1. Log in to the SolarWinds Web Console as an administrator. 2. Click Settings in the top right of the web console and then click Manage Nodes in the Node & Group Management grouping of the SolarWinds Website Administration page. 3. Locate the device to promote using either of the following methods: Use the search tool above the node list to search your SolarWinds database for the node you want to promote. Select an appropriate Group by criteria, and then click the appropriate group including the node to promote. 4. Click Edit Properties, and then select, Windows Servers: WMI and ICMP. 5. Select existing WMI credentials, or create new credentials. 6. Optionally, you can click the Test button for verification. 7. If you want to change the default polling settings for your promoted node, edit the Node Status Polling or Collect Statistics Every values in the Polling area, as appropriate. Note: The Node Status Polling value refers to the period of time, in seconds, between the node status checks SolarWinds performs on the
promoted node. The Collect Statistics Every value refers to the period of time between updates SolarWinds makes to displayed statistics for the promoted node. 8. If you have defined any custom properties for monitored nodes, provide appropriate values for the promoted node in the Custom Properties. 9. Click Submit when you have completed properties configuration for your promoted node. 10. If you have successfully added the node, click Ok on the dialog.
Viewing Node Resources

The List Resources feature of the SolarWinds Web Console Node Management utility allows you to immediately see all monitored volumes and charts on a selected node, as shown in the following procedure. To view a list of all resources present on a node: 1. Log in to the SolarWinds Web Console as an administrator. 2. Click Settings in the top right of the web console. 3. Click Manage Nodes in the Node & Group Management grouping of the SolarWinds Website Administration page. 4. Locate the node to view using either of the following methods: Use the search tool above the node list to search your SolarWinds database for the node you want to view. Select an appropriate Group by criteria, and then click the appropriate group including the node to view. 5. Check the node you want to view from the list, and then click List Resources on the Node Management toolbar.
Setting Node Management States

Monitored devices are regularly polled for operational status. Collected statistics are displayed in the SolarWinds Web Console. Using the Node Management feature of the SolarWinds Web Console, the management status of monitored nodes, is easily set or changed, allowing you to either temporarily suspend data collection or resume polling and statistics collection, as necessary. The following procedure sets or changes management states for monitored nodes in the SolarWinds Web Console. Note: Setting a node to an unmanaged state automatically suspends the management on the selected node.
To set or change the management state of a node: 1. Log in to the SolarWinds Web Console as an administrator. 2. Click Settings in the top right of the web console. 3. Click Manage Nodes in the Node & Group Management grouping of the SolarWinds Website Administration page. 4. Locate the node to manage using either of the following methods: Use the search tool above the node list to search your SolarWinds database for the device you want to manage. Select an appropriate Group by criteria, and then click the appropriate group including the node to manage. 5. Check the node to change, and then click Unmanage or Remanage, as appropriate, for the selected node. 6. If you have selected Unmanage, provide start and end times and dates for your management suspension, and then click Ok.
Unscheduled Node Polling and Rediscovery

SolarWinds SAM polls devices for statistics and status regularly, according to the polling settings available for configuration on the Polling Settings view in the SolarWinds Web Console. For more information, see Orion Polling Settings on page 194. Sometimes, however, it may be necessary to conduct an unscheduled poll or rediscovery of a monitored device. The Node Management utility gives you this ability, as shown in the following procedure. To perform an unscheduled poll or rediscovery: 1. Log in to the SolarWinds Web Console as an administrator. 2. Click Settings in the top right of the web console. 3. Click Manage Nodes in the Node & Group Management grouping of the SolarWinds Website Administration page. 4. Locate and check the node you want to poll or locate and check the node to rediscover, using either of the following methods: Use the search tool above the node list to search your SolarWinds database. Select an appropriate Group by criteria, and then click the appropriate group including the node you want to poll or the node you want to rediscover. 5. If you want to poll the selected node, click More Actions > Poll Now. 6. If you want to rediscover the selected node, click More Actions > Rediscover.
Note: When you click Poll Now, this reschedules a job to run "now" in the job scheduler, meaning, if the job scheduler is already full, the job may not execute immediately, but it will execute sooner than the next scheduled poll cycle. Depending upon how many components are in a given template, and the type of component monitors that make up a template, it is not unusual for polling to take several minutes for the process to fully complete. To see this behavior, click Edit Application Monitor on the Application Details page and then click Test All.
Monitoring Windows Server Memory

When SolarWinds SAM polls a Windows server for CPU load and memory utilization, it pulls the amount of physical memory to define the 100% level, and then it totals the amount of memory in use by each allocation to compute what percentage of the physical memory is in use. This can result in memory utilization readings over 100%, as many applications pre-allocate memory and swap before it is actually needed. To work around this, you can also add physical memory as a volume for these servers within SolarWinds. When monitored as a volume, the values will be more in line with your expectations.
Scheduling a Node Maintenance Mode Time Period

When you need to perform maintenance on a node or its components, such as upgrading firmware, installing new software, or updating security, you may want to discontinue polling while the device is down for maintenance. Disabling polling, or setting a node status as Unmanaged, while performing node maintenance, maintains the accuracy of your data and prevents unnecessary alert messages. For more information about disabling node polling to perform node maintenance, see Setting Device Management States on page 97.
Administrative Functions of the SolarWinds Web Console

The following sections describe the primary administrative functions performed by a SolarWinds Web Console administrator. Changing an Account Password Viewing Secure Data on the Web Handling Counter Rollovers
Changing an Account Password

SolarWinds Web Console administrators may change user account passwords at any time, as shown in the following procedure. Note: In environments where security is a priority, SolarWinds recommends against providing a view where users may change their own web console account passwords. To change an account password: 1. Log in to the web console as an administrator. 2. Click Settings in the top right corner of the web console.
3. Click Manage Accounts in the Accounts grouping of the SolarWinds Website Administration page. 4. Select the user account with the password you want to change, and then click Change Password. 5. Complete the New Password and Confirm Password fields, and then click Change Password. 6. Click Continue when the password is successfully changed.3
Viewing Secure Data on the Web

In the interest of security, sensitive network information, such as community strings, logins, and passwords, is not viewable in the web console. However, if you have secured your network, you may check Allow Secure Data On Web (advanced) in the Calculations & Thresholds area of the SolarWinds Polling Settings page to allow the passage of community strings through the web console. Note: This setting does not affect the display of custom reports that you export to the web. For more information see Creating and Viewing Reports on page 339.
Handling Counter Rollovers

The Counter Rollover setting configures SolarWinds SAM to properly handle counter rollovers. SolarWinds SAM is capable of handling either 32-bit or 64-bit counters, but, by default, SolarWinds SAM assumes counters are 32-bit. 32-bit 32 counters have a maximum value of 2 , or 4,294,967,296, and 64-bit counters, if 64 they are supported by your network devices, have a maximum value of 2 , or 18,446,744,073,709,551,616. Note: The 32-bit counters option is designated as Method 1 in the Counter Rollover field on the SolarWinds Polling Settings page. The following procedure designates the type of counter used by SolarWinds SAM. To designate the type of counter used by SolarWinds SAM: 1. Log in to the web console as an administrator. 2. Click Settings in the top right of the web console, and then click Polling Settings in the Settings grouping of the SolarWinds Website Administration page. 3. If you are using 64-bit counters, select Method 2 in the Counter Rollover field in the Calculations & Thresholds area. Notes:
If Method 2 is selected, SolarWinds SAM will intentionally skip a poll if a polled 64 value is less than the previous polled value to permit counting to 2 . SolarWinds fully supports the use of 64-bit counters; however, these 64-bit counters can exhibit erratic behavior in some implementations. If you notice peculiar results when using these counters, disable the use of 64-bit counters for the problem device and contact the device manufacturer. 4. If you are using of 32-bit counters, select Method 1 in the Counter Rollover field in the Calculations & Thresholds area. Note: If Method 1 is selected, when a rollover is detected, the time between 32 polls is calculated as (2 Last Polled Value) + Current Polled Value.
SolarWinds General Thresholds

Many of the resources available in the SolarWinds Web Console are capable of displaying error and warning conditions for the devices on your network. Errors and warnings display in the SolarWinds Web Console. SolarWinds SAM uses the values provided on the thresholds pages to determine when and how to display errors and warnings in the SolarWinds Web Console. The following sections provide more information about threshold types and configuration: Orion General Threshold Types Setting Orion General Thresholds
SolarWinds General Threshold Types

The following device conditions may be configured as SolarWinds General Thresholds: CPU Load Monitored network devices experiencing CPU loads higher than the value set for the High Level display in High CPU Load reports and resources. Gauges for these devices also display as bold red. Monitored network devices experiencing a CPU load higher than the value set for the Warning Level, but lower than the value set for the High Level, display as red in High CPU Load reports and resources. Gauges for these devices also display as red. Disk Usage Monitored network devices experiencing a disk usage higher than the value set for the High Level display as bold red in Disk Usage reports and resources. Monitored network devices experiencing a disk usage higher than the value set for the Warning Level, but lower than the value set for the High Level, display as red in High Disk Usage reports and resources.
Percent Memory Used Monitored network devices experiencing a percent memory usage higher than the value set for the Error Level display in High Percent Utilization reports and resources. Gauges for these devices also display as bold red. Monitored network devices experiencing a percent memory usage higher than the value set for the Warning Level, but lower than the value set for the Error Level, display in High Percent Utilization reports and resources. Gauges for these devices also display as red. Percent Packet Loss Monitored network devices experiencing a percent packet loss higher than the value set for the Error Level display in High Percent Loss reports and resources. Gauges for these devices also display as bold red. Monitored network devices experiencing a percent packet loss higher than the value set for the Warning Level, but lower than the value set for the Error Level, display in High Percent Loss reports and resources. Gauges for these devices also display as red. SolarWinds SAM calculates percent packet loss using ICMP ping requests made on the Default Poll Interval. SolarWinds pings monitored devices and records the results of the ten most recent ping attempts. Percent packet loss is expressed as the number of failed ping requests, X, divided by the number of ping requests, 10. For more information about the Default Poll Interval, see Orion Polling Settings on page 194. For example, if, at a given point in time, the last ten ping requests made of a selected device resulted in 2 failures and 8 successes, the percent packet loss for the selected device at the given time is reported as 2/10, or 20%. Response Time Monitored devices experiencing response times longer than the value set for the Error Level display in High Response Time reports and resources. Gauges for these devices also display as bold red. Devices experiencing response times longer than the value set for the Warning Level, but shorter than the value set for the Error Level, also display in High Response Time reports and resources. Gauges for these devices also display as red. SolarWinds SAM calculates response time using ICMP ping requests made on the Default Node Poll Interval. SolarWinds pings monitored devices and records the results of the ten most recent ping attempts. Average Response Time is expressed as the average response time of these last 10 ping requests. If SolarWinds SAM does not receive a ping response within the Default Poll Interval, SolarWinds SAM will attempt to ping the nonresponsive device once every 10 seconds for the period designated as the Warning Interval. For more information, see Orion Polling Settings on page 194.
Setting SolarWinds General Thresholds

The following procedure configures SolarWinds General Thresholds. To set SolarWinds SAM thresholds: 1. Log in to the SolarWinds Web Console as an administrator. 2. Click Settings in the top right of the web console. 3. Click SolarWinds Thresholds in the Settings group of the SolarWinds Website Administration page. Note: For more information about SolarWinds General Thresholds, see Orion General Threshold Types on page 102. 4. Provide appropriate values for Error Level, High Level, or Warning Level for selected thresholds.
Customizing Views
SolarWinds Web Console views are configurable presentations of network information that can include maps, charts, summary lists, reports, events, and links to other resources. Customized views can then be assigned to menu bars. Note: In environments where security is a priority, SolarWinds recommends against providing a view where users may change their own web console account passwords. Refer to the following sections for more information: Creating New Views Editing Views Configuring View Limitations Copying Views Deleting Views Views by Device Type Resource Configuration Examples Customizing Web Console Menu Bars Changing the Web Console Color Scheme Changing the Web Console Site Logo Configuring the Available Product Updates View Updating your SolarWinds Installation
Customizing Charts in the SolarWinds Web Console Custom Node Charts Custom Volume Charts Custom Chart View Custom Volume Charts
Creating New Views

You can customize the SolarWinds Web Console for individual users by logging in as an administrator and creating new views as shown in the following procedure. Note: In environments where security is a priority, SolarWinds recommends against providing a view where users may change their own web console account passwords. To create a new view: 1. Click Settings in the top right of the web console. 2. Click Manage Views in the Views group of the SolarWinds Website Administration page. 3. Click Add. 4. Enter the Name of New View. 5. Select the Type of View. Note: The Type of View selection affects how the view is made accessible to users, and your choice may not be changed later. For more information, see Views by Device Type on page 108. 6. Click Submit. After you have created a new view, the Customize YourView page opens. For more information, see Editing Views on page 105.
Editing Views
The SolarWinds Web Console allows administrators to configure views for individual users. The following steps are required to configure an existing view. To edit an existing view: 1. Click Settings in the top right of the web console. 2. Click Manage Views in the Views group of the SolarWinds Website Administration page.
3. Select the view you want to customize from the list, and then click Edit. 4. If you want to change the column layout of your view, complete the following steps. a. Click Edit to the right of the column widths. b. Select the number of columns under Layout. c. Provide the width, in pixels, of each column in the appropriate fields, and then click Submit. 5. If you want to add a resource, repeat the following steps for each resource: Notes: Resources already in your view will not be checked on this page listing all web console resources. It is, therefore, possible to pick duplicates of resources you are already viewing. Some resources may require additional configuration. For more information, see Resource Configuration Examples on page 109. Several options on the Add Resources page are added to the list of resources for a page, but the actual configuration of a given map, link, or code is not added until the page is previewed. a. Click + next to the column in which you want to add a resource. b. Click + next to a resource group on the Add Resources page to expand the resource group, displaying available resources. c. Check all resources you want to add. d. If you have completed the addition of resources to the selected view, click Submit. 6. If you want to delete a resource from a column, select the resource, and then click X next to the resource column to delete the selected resource. 7. If you want to copy a resource in a column, select the resource, and then click next to the resource column to delete the selected resource. 8. If you want to rearrange the order in which resources appear in your view, select resources, and then use the arrow keys to rearrange them. 9. If you have finished configuring your view, click Preview. Note: A preview of your custom web console displays in a new window. A message may display in the place of some resources if information for the resource has not been polled yet. For more information, see Resource Configuration Examples on page 109. 10. Close the preview window.
11. When done, click Done. Notes: For more information about adding a customized view to menu bars as a custom item, see Customizing Web Console Menu Bars on page 118. For more information about assigning your customized view as the default view for a user, see Editing User Accounts on page 180.
Configuring View Limitations

As a security feature, the web console gives administrators the ability to apply device-based view limitations. The following views and limitations are available:
Managed Views that Support Limitations SAM Application Details SAM Component Details SAM Summary Cluster Details Current Top 10 Lists Custom Summary Datacenter Details ESX Host Details Group Details Group Summary Node Details SolarWinds Summary Home Customize Problem Areas Virtual Center Details Virtualization summary Volume Details Available Limitations Single Network Node Group of Nodes Node Name Pattern System Name Pattern Group of Machine Types Machine Type Pattern Hardware Manufacturer Device Status System Location System Location Pattern System Contact System Contact Pattern Single Machine Type Single Hardware Manufacturer IP Address Pattern Group of Volumes Single Group Group of Groups Group Name Pattern Application Name Pattern Group of Application Names Specific Applications
The following procedure configures a view limitation.

To enable a view limitation: 1. Click Settings in the top right of the web console, and then click Manage Views in the Views group of the SolarWinds Website Administration page. 2. Select the view to which you want to add a limitation, and the click Edit. 3. In the View Limitation area of the Customize View page, click Edit. 4. Select the type of view limitation you want to apply, and then click Continue. 5. Provide or check appropriate strings or options to define the device types to include or exclude from the selected view, and then click Submit. Note: The asterisk (*) is a valid wildcard. Pattern limitations restrict views to devices for which the corresponding fields include the provided string.
Copying Views
When you want to create multiple views based on the same device type, copying views allows you to create one view, and then use that view as a template to create other new views. The following steps copy an existing view. To copy a view: 1. Click Settings in the top right of the web console. 2. Click Manage Views in the Views group. 3. Select the view you want to copy, and then click Copy. 4. If you want to edit a copied view, follow the procedure in the Editing Views section on page 105.
Deleting Views
The following steps delete an existing view. To delete an existing view: 1. Click Settings in the top right of the web console. 2. Click Manage Views in the Views grouping of the SolarWinds Website Administration page. 3. Select the view you want to delete, and then click Delete.
Views by Device Type

There are vast differences among network objects and the statistics they report, but the SolarWinds Web Console can make it easier to view network data by displaying object details by device type, giving you the ability to have a different
view for each unique type of device you have on your network, including routers, firewalls, and servers. The following steps assign a view by any available device type. To assign a view by device type: 1. Click Settings in the top right of the web console, and then click Views by Device Type in the Views group of the SolarWinds Website Administration page. 2. Select available Web Views for the different types of devices that SolarWinds is currently monitoring or managing on your network. 3. Click Submit.
Resource Configuration Examples

Several resources that may be selected from the Add Resources page require additional configuration. Included in this section are examples of these resources and the steps that are required for their proper configuration. Selecting a Network Map Network maps created with SolarWinds Network Atlas can give a quick overview of your network, right from the main web console view. Note: Clicking the resource title in the title bar menu displays the resource by itself in a browser window. The following procedure adds a network map to the SolarWinds Web Console. To add a network map to the web console: 1. Create a new view or edit an existing view. Note: For more information, see Customizing Views on page 104. 2. Select the view to which you want to add the map, and then click Edit. 3. Click + next to the view column in which you want to display the new map. 4. Click + next to Network Maps, check Network Map, and then click Submit. 5. Click Preview on the Customize YourView page. 6. Click Edit in the Network Map resource title bar. 7. If you do not want to use the default title provided, enter a new Title for the title bar of the added map. 8. If you want a subtitle, enter a new Subtitle for the added map.
Note: Titles and subtitles may be entered as either text or HTML. 9. Select from the list of available maps. 10. Select the Scale at which you want to display the map. Note: If you leave the Scale field blank, the map will display at full scale, based on the size of the column in which the map displays. 11. Click Submit. Displaying a List of Objects on a Network Map When your web console view includes a network map, it can be helpful to maintain a list of network objects that appear on the map. The following procedure enables a resource listing network map objects. Note: Clicking the resource title displays the resource in a new browser window. To display a list of network map objects: 1. Create a new view or edit an existing view. Note: For more information, see Customizing Views on page 104. 2. Select the view to display the list of network map objects, and then click Edit. 3. Click + next to the view column in which you want to display the new list of network map objects. 4. Click + next to Network Maps, check List of Objects on Network Map, and then click Submit. 5. Click Preview on the Customize YourView page. 6. Click Edit in the title bar of the List of Objects on Network Map resource. 7. If you do not want to use the default title provided, enter a new Title for the header of the objects list. 8. If you want a subtitle, enter a new Subtitle for the added objects list. Note: Titles and subtitles may be entered as either text or HTML. 9. Select from the list of available maps for the objects that you want to populate your list, and then click Submit. Displaying a Custom List of Maps The web console allows you to populate a custom view with a list of available network maps. Each map in your custom list, when clicked, opens in a new window. The following procedure enables a custom network maps list resource. Note: Clicking the resource title displays the resource in its own browser window.
To display a custom list of maps: 1. Create a new view or edit an existing view. Note: For more information, see Customizing Views on page 104. 2. Select the view to which you want to add the custom list of network maps, and then click Edit. 3. Click + next to the view column in which you want to display the custom list of network maps. 4. Click + next to Network Maps. 5. Check Custom List of Maps, and then click Submit. 6. Click Preview on the Customize YourView page, and then click Edit in the title bar of the Custom List of Maps resource. 7. If you do not want to use the default title provided, enter a new Title for the header of the maps list. 8. If you want a subtitle, enter a new Subtitle for the custom list of maps. Note: Titles and subtitles may be entered as either text or HTML. 9. Check the maps you want to include in your maps list. 10. Click Submit. Displaying an Event Summary - Custom Period of Time You may want your web console view to display an event summary for a specified period of time. The following procedure details the steps to include an event summary in your web console. Note: Clicking the resource title in the title bar menu displays the resource by itself in a browser window. To display an event summary: 1. Create a new view or edit an existing view. Note: For more information about creating a new view or editing an existing view, see Customizing Views on page 104. 2. Select the view to include the event summary, and then click Edit. 3. Click + next to the view column that will display the event summary. 4. Click + next to Events. 5. Check Event Summary Custom Time Period, and then click Submit. 6. Click Preview on the Customize YourView page.
7. Click Edit in the title bar of the Event Summary resource. 8. If you do not want to use the default title provided, enter a new Title for the header of the event summary. Note: Titles may be entered as either text or HTML. 9. Select the time period for displaying events from Display Events for the following Time Period. 10. Click Submit. Specifying User-Defined Links The User-Defined Links option may be used to create quick access to external websites or customized views. URLs of your customized views can be copied from their preview pages and pasted in a User-Defined Links field. The following steps enable user-defined links from within your web console. Note: Clicking the resource title in the title bar menu displays the resource by itself in a browser window. To enable a user-defined links resource: 1. Create a new view or edit an existing view. Note: For more information, see Customizing Views on page 104. 2. Select the view to which you want to add the user-defined links resource. 3. Click Edit. 4. Click + next to the view column to display the user-defined links resource. 5. Click + next to Miscellaneous 6. Check User Defined Links. 7. Click Submit. 8. Click Preview on the Customize YourView page. 9. Click Edit in the title bar of the User Defined Links resource. 10. If you do not want to use the default title provided, enter a new Title for the links list.
11. If you want a subtitle, enter a new Subtitle for the links list. Note: Titles and subtitles may be entered as either text or HTML. 12. Enter the following information for each link you want to define: a. A link Name and the URL of your link. b. If you want your links to open in a new browser window, check Open in New Window. 13. Click Submit. Specifying Custom HTML or Text In situations where you have static information that you want to provide in the web console, use the Custom HTML or Text option. The Custom HTML or Text option may also be used to create quick access to your customized views. The following procedure will create a static content area within your web console for displaying text or HTML content. Note: Clicking the resource title displays the resource in a new browser window. To specify custom HTML or text: 1. Create a new view or edit an existing view. Note: For more information, see Customizing Views on page 104. 2. Select the view to include the custom HTML or text. 3. Click Edit. 4. Click + next to the column to display the custom HTML or text. 5. Click + next to Miscellaneous, and then check Custom HTML or Text. 6. Click Submit. 7. Click Preview on the Customize YourView page. 8. Click Edit in the title bar of the Custom HTML or Text resource. 9. If you do not want to use the default title provided, enter a new Title for the specified content area. 10. If you want a subtitle, enter a new Subtitle for the specified content area. Note: Titles and subtitles may be entered as either text or HTML. 11. Enter content as either text or HTML into the Raw HTML field. 12. Click Submit.
Specifying a SolarWinds Report The web console is able to incorporate reports that you have created in SolarWinds Report Writer into any view. The following procedure will take a report that you have created with Report Writer and include it within a web console view. Note: Clicking the resource title in the title bar menu displays the resource by itself in a browser window. To include a SolarWinds report: 1. Create a new view or edit an existing view. Note: For more information, see Customizing Views on page 104. 2. Select the view to which you want to add the report. 3. Click Edit. 4. Click + next to the view column in which you want to display the report. 5. Click + next to Report Writer. 6. Check Report from SolarWinds Report Writer. 7. Click Submit. 8. Click Preview on the Customize YourView page. 9. Click Edit in the title bar of the Report from SolarWinds Report Writer resource. 10. If you do not want to use the default title provided, enter a new Title for the included report. 11. If you want a subtitle, enter a new Subtitle for the included report. Note: Titles and subtitles may be entered as either text or HTML. 12. Select a Report to include. 13. If you want to add a filter to the included report, enter an appropriate query in the Filter Nodes field. Note: Filter Nodes is an optional, advanced, web console feature that requires some knowledge of SQL queries. Click + next to Show Filter Examples to view a few example filters. 14. Click Submit. Displaying a Custom List of Reports The web console allows you to populate a custom view with a custom reports list. When clicked from the list, each report opens in a new window. The following procedure details the steps required to enable a custom list of network reports.
Note: Clicking the resource title displays the resource in a new browser window. To display a custom list of reports: 1. Create a new view or edit an existing view. For more information, see Customizing Views on page 104. 2. Select the view to which you want to add the custom list of reports, and then click Edit. 3. Click + next to the column to display the custom list of reports. 4. Click + next to Report Writer. 5. Check Custom List of Reports, and then click Submit. 6. Click Preview on the Customize YourView page, and then click Edit in the title bar of the Report from SolarWinds Report Writer resource. 7. If you do not want to use the default title provided, enter a new Title for the header of the reports list. 8. If you want a subtitle, enter a new Subtitle for the custom list of reports. Note: Titles and subtitles may be entered as either text or HTML. 9. Check the reports that you want to include in your custom list of reports. Note: To allow a user to view a report included in the custom list, you must set the report access for the account. For more information, see Configuring an Account Report Folder on page 189. 10. Click Submit. Filtering Nodes Your SolarWinds Web Console can maintain a customizable node list for your network. Node lists may be configured for specific views using SQL query filters. The following steps set up node filtering for node lists included in web console views. Note: Clicking the resource title displays the resource in a new browser window. To enable filtering on a node list: 1. Create a new view or edit an existing view. Note: For more information, see Customizing Views on page 104. 2. Select the view to which you want to add the node list 3. Click Edit. 4. Click + next to the view column in which you want to display the node list.
5. Click + next to Node Lists. 6. Check All Nodes Table, and then click Submit. 7. Click Preview on the Customize YourView page, and then 8. Click Edit in the title bar of the All Nodes Table resource. 9. If you do not want to use the default title provided, enter a new Title for the node list. 10. If you want a subtitle, enter a new Subtitle for the node list. Note: Titles and subtitles may be entered as either text or HTML. 11. If you want to filter your node list by text or IP address range, provide the text or IP address range by which you want to filter your node list in the Filter Text field, as shown in the following examples: Type Home in the Filter Text field to list all nodes with Home in the node name or as a location. Type 192.168.1.* in the Filter Text field to list all nodes in the 192.168.1.0-255 IP address range. 12. Select the property that is appropriate to the filter text provided above, as shown in the following examples: If you typed Home in the Filter Text area, select Node Name or Location to list nodes with Home in the node name or as a location. If you typed 192.168.1.* in the Filter Text area, select IP Address to list only nodes in the 192.168.1.0-255 IP address range. 13. If you want to apply a SQL filter to the node list, enter an appropriate query in the Filter Nodes (SQL) field. Notes: Filter Nodes (SQL) is an optional, advanced, web console feature that requires some knowledge of SQL queries. Click + next to Show Filter Examples to view a few example filters. By default, node list resources are designed to sort nodes alphabetically by node caption. This configuration cannot be overwritten using a SQL filter, so order by clauses included in SQL filters are redundant and will result in Custom SQL filter formatting errors. 14. Click Submit.
Grouping Nodes Your SolarWinds Web Console can maintain a customizable node list for your network. Node lists may be configured for specific views with node grouping. The following steps set up node grouping for node lists included in web console views. Note: Clicking the resource title in the title bar menu displays the resource by itself in a browser window. To enable grouping on a node list: 1. Create a new view or edit an existing view. Note: For more information, see Customizing Views on page 104. 2. Select the view to which you want to add the node list, and then click Edit. 3. Click + next to the view column in which you want to display the node list. 4. Click + next to Node Lists. 5. Check an appropriate node list, and then click Submit. 6. Click Preview on the Customize YourView page. 7. Click Edit in the title bar of the All Nodes Tree (AJAX) resource. 8. If you do not want to use the default title provided, enter a new Title for the node list. 9. If you want a subtitle, enter a new Subtitle for the node list. Note: Titles and subtitles may be entered as either text or HTML. 10. Select up to three criteria, in specified levels, for Grouping Nodes within your web console view. 11. If you want to apply a SQL filter to the node list, enter an appropriate query in the Filter Nodes field. Notes: Filter Nodes (SQL) is an optional, advanced, web console feature that requires some knowledge of SQL queries. Click + next to Show Filter Examples to view a few example filters. By default, node list resources are designed to sort nodes alphabetically by node caption. This configuration cannot be overwritten using a SQL filter, so order by clauses included in SQL filters are redundant and will result in Custom SQL filter formatting errors. 12. Click Submit.
Customizing Web Console Menu Bars

The menu bars displayed at the top of every page may be configured to display various menu items. You can also define menu items and add them to custom menu bars. For more information about customizing menu bars for individual accounts, see Editing User Accounts on page 180. The following procedure customizes a web console menu bar. To customize web console menu bars: 1. Click Settings in the top right of the web console. 2. Click Customize Menu Bars in the Customize grouping of the SolarWinds Website Administration page. 3. If you want to modify an existing menu, click Edit beneath the menu bar you want to modify, and then click and drag items between the Available items list on the left and the Selected items list on the right until the Selected items list includes all the items you want to include in your edited menu. Note: Hover over any view title to read a description. Selected items display from left to right in the edited menu bar as they are listed from top to bottom. 4. If you want to create a new menu bar, complete the following steps: a. Click New Menu Bar, and then provide a Name for the New Menu Bar. b. Click and drag the buttons you want to include in your new menu bar from the Available items list on the left to their correct relative locations in the Selected items list on the right. Note: Hover over any view title to read a view description. Selected items display from left to right in the new menu bar as they are listed from top to bottom. 5. If you want to add menu items, complete the following steps: a. Click Edit under the menu bar to which you are adding the new item. b. Click and drag the items you want to include in your new menu from the Available items list on the left to their correct relative locations in the Selected items list on the right. Notes:
Hover over any view title to read a view description. Selected items display from left to right in the new menu bar as they are listed from top to bottom. If you check Reports from the Select Menu Items page, you must also enable reports for the accounts that use the menu bar. For more information, see Configuring an Account Report Folder on page 189. 6. If you want to add a custom menu item, complete the following steps: a. Click Edit under the menu bar to which you are adding the custom item. b. Click Add. c. Provide the Name, URL, and Description of your custom menu item. d. If you want the menu option to open in a new window, check Open in a New Window. e. Click Ok. 7. If you want to delete a menu item, click and drag the item to delete from the Selected items list on the right to the Available items list on the left. Warning: Do not delete the Admin option from the Admin menu bar. 8. If you want to change the location of an item in your menu, click and drag items to move them up and down in the Selected items list. 9. If you have finished editing your menu bar, click Submit.
Changing the Web Console Color Scheme

The overall color scheme of the SolarWinds Web Console may be changed to any of several color schemes that are viewable by all users, as shown in the following procedure. To change the web console color scheme: 1. Click Settings in the top right of the web console. 2. Click Color Scheme in the Customize grouping. 3. Select the desired color scheme, and then click Submit.
Changing the Web Console Site Logo

The SolarWinds Web Console can be configured to display your logo instead of the default SolarWinds banner across the top of every web console page. The following steps change the default SolarWinds web console banner. To change the web console banner:
1. Create an appropriately sized graphic to replace the SolarWinds logo. Notes: The SolarWinds banner file is 271x48 pixels at 200 pixels/inch. The SolarWinds.com End User License Agreement prohibits the modification, elimination, or replacement of either the SolarWinds.com logo and link on the menu bar or the SolarWinds copyright line at the bottom of the page. 2. Place your graphic in the images directory. Note: By default, it is in C:\Inetpub\SolarWinds\NetPerfMon\. 3. Log in to the web console as an administrator. 4. Click Settings in the top right of the web console. 5. Click Web Console Settings in the Settings grouping of the SolarWinds Website Administration page. 6. Type the new logo image name as a replacement for SolarWinds.Logo.jpg in the Site Logo URL field.
Configuring the Available Product Updates View

The SolarWinds Web Console can automatically check for the availability of any updates to your currently installed SolarWinds products. By default, the web console regularly checks for product updates automatically, as indicated by the dates and times reported as Last Check and Next Check, but you can click Check Now at any time to see an up-to-the-minute update. If updates are available, a note is posted in the web console notification bar and updates are listed in this view, where you can then select and download them as needed. Note: For more information about downloading listed product updates, see Updating your Orion Installation on page 121. To configure product updates: 1. Log in to the web console as an administrator, and then click Settings in the top right corner of the web console. 2. Click Available Product Updates in the Product Updates grouping. 3. If you want to disable the automatic check for product updates, clear Check for product updates, and then click Save Settings. 4. If you want to ensure that updates are listed for all currently installed SolarWinds products, including SolarWinds NPM, SolarWinds SAM, and all SolarWinds modules, check Show all updates. 5. Click Save Settings.
Updating your SolarWinds Installation

If your Product Updates view is configured to list SolarWinds updates, you can download them directly from the Product Updates view. To update your SolarWinds installation: 1. Log in to the web console as an administrator, and then click Settings in the top right corner of the web console. 2. Click Available Product Updates in the Product Updates grouping. 3. Click Check Now to refresh the updates list. 4. If there are any updates you want to ignore, check the updates to ignore, and then click Ignore Selected. 5. Check the updates you want to apply, and then click Download Selected. 6. Save and then execute downloaded installers. For more information, see either the readme.txt file packaged with the downloaded update or review related documentation available at www.solarwinds.com.
Customizing Charts in the SolarWinds Web Console

Clicking any chart opens the Custom Chart view in a new window, displaying the selected chart with additional chart customization options. For more information about the Custom Chart view, see Custom Chart View on page 124. You can also configure any custom chart resource in the SolarWinds Web Console directly from the resource title bar either by selecting from the dropdown menu of options or by clicking Edit to display the Edit Chart Title view, as described in the following sections. Custom Chart Resource Title Bar Options The title bar menu of the custom chart resource provides the following options for viewing chart data: View chart data over the Last 7 Days or over the Last 30 Days Select Edit Chart to view and modify chart settings. Note: This is the same as clicking Edit in the title bar. View Chart Data as an HTML format document View Chart Data in Excel to see chart data in an Excel-compatible format
Edit Chart Title View Click Edit in the title bar of a custom chart resource to display the Edit Chart Title view. This view provides the following options to configure your chart resource:
Select a Chart allows you to change the chart type displayed in the current resource. Chart options are determined in accordance with the type of view displaying the resource you are currently editing. For more information about available node charts, see Custom Node Charts on page 122. For more information about available volume charts, see Custom Volume Charts on page 124. The Time Period for the selected chart may be any of the following:
Last Hour Yesterday Last 30 Days Last 2 Hours Last 7 Days Last 3 Months Last 24 Hours This Month This Year Today Last Month Last 12 Months
The Sample Interval for the selected chart may be any of the following:
Every Minute Every 30 Minutes Every 12 Hours Every 5 Minutes Every Hour One a Day Every 10 Minutes Every 2 Hours Every 7 Days Every 15 Minutes Every 6 Hours
Notes: Each sample interval is represented on a chart by a single point or bar. Data within a selected sample interval is summarized automatically. Due to limits of memory allocation, some combinations of time periods and sample intervals require too many system resources to display, due to the large number of polled data points. As a result, charts may not display if the time period is too long or if the sample interval is too small. The Trend Line option allows you to enable the trend line feature of SolarWinds SAM charts. By enabling trend lines on SolarWinds SAM charts, you can see potential future results as they are extrapolated from collected historical data. Note: Due to the broad array of factors that can affect the performance of devices on your network, trend lines provided on SolarWinds SAM charts are intended as approximate predictions of future data only. For more th information, see "95 Percentile Calculations" on page 481.
Custom Node Charts

The following node-related charts, grouped by type, are available as resources within the SolarWinds Web Console. To add any of these charts to a web console view dealing with monitored nodes, add the Custom Node Chart resource to the Node Details view. For more information about adding resources to SolarWinds Web Console views, see Customizing Views on page 104.
Availability The following charts are available to display node availability information over custom time periods for nodes monitored by SolarWinds. Availability Availability Autoscale Availability and Response Time
CPU Load The following charts display CPU loading information over specified periods of time for nodes monitored by SolarWinds. Average CPU Load Min/Max/Average CPU Load
Memory Usage The following charts present memory usage information over custom time periods for nodes monitored by SolarWinds. Average Memory Usage Memory/Buffer Failures Min/Max/Average Memory Usage Percent Memory Used
Packet Loss and Response Time The following charts are available to display historical statistics about packet loss and response time for nodes monitored by SolarWinds. Availability and Response Time Average Response Time Average Response Time and Packet Loss
Min/Max/Average Response Time Min/Max/Average Response Time and Packet Loss Percent Loss Bar Chart Percent Loss Line Chart
Custom Volume Charts

The following volume-related charts, grouped by type, are available as resources within the SolarWinds Web Console. To add any of these charts to a web console view dealing with monitored volumes, add the Custom Volume Chart resource to the Volume Details view. For more information about adding resources to SolarWinds Web Console views, see Customizing Views on page 104. Allocation Failures Shows the number of disk allocation failures that have occurred on the selected volume. Min/Max/Average Disk Usage Shows both the total disk space available and the average amount of disk space used on the selected volume. Bars are also included to show minimum and maximum levels of disk usage. Percent Disk Usage Shows the total available disk space and the average amount of disk space used, as a percentage of the total available, on the selected volume. Volume Size Shows the total disk space available on the selected volume.
Custom Chart View

Charts in the SolarWinds Web Console are easily customizable. Clicking a chart opens the Custom Chart view in a new window. The following sections describe options that are available on the Custom Chart page to modify the presentation of a selected chart. Note: Click Refresh at any time to review changes you have made. Printing Options To print your customized chart, click Printable Version and a printable version of your customized chart displays in the browser.
Chart Titles Chart Titles are displayed at the top center of a generated chart. The Chart Titles area allows you to modify the Title and Subtitles of your generated chart. Note: SolarWinds may provide default chart titles and subtitles. If you edit any of the Chart Titles fields on the Custom Chart page, you can restore the default titles and subtitles by clearing the respective fields, and then clicking Submit. Time Period Predefined and custom time periods are available for generated charts. You may designate the time period for a chart by either of the following methods: Select a predefined period from the Select a Time Period: menu. Provide custom Beginning and Ending Dates/Times in the appropriate fields in the Time Period area.
Sample Interval The sample interval dictates the precision of a given chart. A single point or bar is plotted for each sample interval. If a sample interval spans multiple polls, data is automatically summarized and plotted as a single point or bar on the chart. Note: Due to limits of memory allocation and the large number of polled data points, some combinations of time periods and sample intervals may require too many system resources to display. As a result, charts may not display if the time period is too long or if the sample interval is too small. Chart Size Chart Size options configure the width and height, in pixels, of the chart. You can maintain the same width/height aspect ratio, or scale the chart in size, by entering a width in the Width field and then entering 0 for the Height. Font Size Font sizes for generated charts are variable. The Font Size option allows you to select a Small, Medium, or Large size font for your chart labels and text. Note: Font Size selections are maintained in the printable version of your chart. Data Export Options The Display Data from Chart area provides the following options to export chart data as either Excel-compatible Raw Data or as HTML-formatted Chart Data: To view chart data in an Excel-compatible format, click Raw Data, and then follow the prompts, if provided, to open or save the resulting raw data file. To view HTML-formatted chart data in a new browser, click Chart Data.
Multiple Object Chart

The Multiple Object Chart resource allows you to simultaneously view data for multiple objects on the same chart. Objects may be on the same node or on different nodes. Clicking Edit allows you to configure the following characteristics of a selected multiple objects chart:
To add the Multiple Object Chart to your home page, take the following steps: 1. Click the Home tab to get to the Summary view. 2. Click Customize Page on the far top right of the page. 3. Click the green [+] to the right of where you want to add this chart. 4. From the Add Resources to SolarWinds Home Summary page, select and expand Multiple Series Charts. 5. Check Multiple Object Chart, and then click Submit, and then click Done.
To configure the Multiple Object Chart, take the following steps: 1. Once the chart is on your Home Summary page, click Edit at the top right of the chart. 2. From this page, you can have multiple options to choose from, including: i) ii) Title: This allows you to change the title of your chart. Subtitle: This allows you to add a subtitle to your chart.
iii) Choose Objects: This allows you to choose the type of objects to display from the dropdown menu provided. You can remove an object from the list by clicking the red X to its right. iv) Select a Chart: This allows you to chart various aspects of what you intend to monitor. v) Choose Objects: Click the Select SolarWinds Object button to choose which objects you want charted based on your selection in step iii. vi) Limit Series: Checking this box and setting the number of series will limit the number of items displayed on the chart to the specified amount. vii) Show Sum in Data Series: This allows you to chart the total of the other objects graphed and is represented by its own plot line. viii) Time Period: This allows you to set the range displayed on the chart. ix) Sample Interval: This allows you to set the interval that this chart is updated.
Exporting Views to PDF

Many views in the SolarWinds Web Console may be exported directly to portable document format (.pdf). Views that may be exported display Export to PDF in the top right corner of the exportable view. Note: The Export to PDF feature requires IIS Anonymous Access. Confirm that the IUSR_SERVERNAME user is in the local Users group on your SolarWinds server. To export a view to PDF: 1. Open the web console view to export. 2. Click Export to PDF in the top right corner of the view.
3. If you are prompted to save the .pdf file, click Save. 4. Navigate to an appropriate location, provide an appropriate file name, and then click Save.
Creating a Custom Summary View

The SolarWinds Custom Summary View enables you to create a fully customized object-based view composed solely of resources you have selected. The following procedure creates a custom summary view in the web console. To create or edit a custom summary view in the web console: 1. Click Home > Custom Summary. 2. Click Edit in any Custom Object Resource. 3. Provide a Title and Subtitle for the selected Custom Object Resource. 4. Click Select SolarWinds Object. 5. On the Select a network object window, use the Show only and Group by selection fields, as appropriate, to filter the list of monitored objects. 6. Select the SolarWinds object on which you want to base the selected Custom Object resource, and then click Select SolarWinds object. 7. Select the type of information you want the custom resource to display about the selected object, and then customize the resource, as indicated in the following steps: a. If you have selected an alerts resource, indicate whether or not you want to display acknowledged alerts by checking or clearing Show Acknowledged Alerts, as appropriate. b. If you have selected a resource to which SQL filters may be applied, edit available SQL filters as appropriate. For more information, see Using Node Filters on page 137. c. If you have selected a resource with an Auto-Hide option, select Yes or No to enable or to disable the Auto-Hide feature, respectively. If enabled, the resource is automatically hidden if and when related data is not present in the SolarWinds database. d. If you have selected a sortable list resource, in the Sort By field select the property by which you want the list sorted. e. If you have selected a gauge-style resource, select a gauge Style and provide a Gauge Size.
f.
If you have selected a chart-style resource, select an appropriate Time Period and Sample Interval, and then indicate whether or not you want to show a Trend Line.
g. If you have selected a Universal Device Poller resource, select the Universal Device Poller and Chart Format, and then configure all other options as required for similar resource types. 8. Click Submit. Note: For more information about customizing available resource types, click Help in the header of any resource on the Custom Summary view, and then click the corresponding resource type.
Creating and Editing External Website Views

With the external website view feature, any SolarWinds SAM administrator can select any external website and designate it as a SolarWinds Web Console view, as shown in the following procedure. To create or edit an external website view in the web console: 1. Click Settings in the top right of the web console. 2. Click External Websites in the Customize grouping of the SolarWinds Website Administration page. 3. If you want to delete an existing external website, click Delete next to the website you want to delete, and then click Ok to confirm the deletion. 4. If you want to add a new external website, click Add. 5. If you want to edit an existing external website, click Edit next to the name of the website you want to edit. 6. Provide a Menu Title for the external website to display in the Views toolbar. 7. If you want to include a heading within the view, provide an optional Page Title to display within the view. 8. Provide the URL of the external website, in http://domain_name format. 9. Select the Menu Bar to which you want to add the new external website link. Note: For more information about customizing menu bars, see Customizing Web Console Menu Bars on page 118. 10. Click Ok. 11. Click Preview to view the external website as the web console will display it.
Custom Object Resources in the SolarWinds Web Console

The SolarWinds Web Console provides a Custom Object resource that enables you to configure any of a wide array of resources to display performance data for any specific monitored objects. The following sections provide more information about editing a Custom Object resource, selecting monitored objects, and configuring the data displayed in a Custom Object resource: Editing a Custom Object Resource Selecting Custom Objects and Resources Available Custom Resources
Editing a Custom Object Resource

The following procedure edits a Custom Object resource. To edit a Custom Object resource: 1. Click Edit in the header of a Custom Object resource. 2. Edit the resource Title and Subtitle as appropriate. 3. Click Select SolarWinds Object to select an appropriate monitored object. For more information, see Selecting Custom Objects. 4. If you have completed your edits, click Submit.
Selecting Custom Objects and Resources

The following procedure selects a network object for a selected Custom Object resource. To select a custom monitored object for a Custom Object resource: 1. Click Edit in the header of a Custom Object resource. 2. Click Select SolarWinds Object. 3. In the Show only: field, select the type of object you want to monitor in the Custom Object resource. 4. In the Group by: field, select an appropriate object grouping criterion. Note: Defined custom properties are listed for all grouping types. 5. Click the object to monitor in the list on the left, and then select it in the main pane grouping criterion. 6. Click Select SolarWinds Object.
7. Select the desired resource type in the Select object resource field, and then configure options as required. For more information about available resources, see Available Custom Resources.
Available Custom Resources

A Custom Object resource may be configured to provide the same data as any of a number of SolarWinds Web Console resources for a selected network object: Notes: Resource availability is dependent on the SolarWinds products installed. For more information about any available custom resource, click Help in the resource title to view the corresponding help topic.
Integrating SolarWinds Engineers Toolset

When you are browsing the SolarWinds Web Console from a computer that already has a SolarWinds Toolset installed, SolarWinds SAM allows you to launch Toolset tools directly from your web browser. Right-clicking any monitored object listed in a SolarWinds Web Console running the Toolset Integration displays a menu of available Toolset tools and functions. The following sections detail the configuration of the available Toolset integration. Note: For more information about the SolarWinds Engineers Toolset tools, see www.solarwinds.com. Refer to the following sections for more information: Configuring a Toolset Integration Adding Programs to a Toolset Integration Menu
Configuring a Toolset Integration

The following procedure configures SolarWinds Toolset for integration within the SolarWinds Web Console. Note: The first time the Toolset tools are accessed, a security warning may be displayed. Click Yes to allow the toolset integration. To configure SolarWinds Toolset integration settings: 1. Right-click any monitored object displayed within the SolarWinds Web Console. 2. Click Settings. 3. Click SNMP Community String.
Note: The first time you launch a tool requiring an SNMP community string from the right-click menu, the SNMP Community String window displays. 4. If you want to delete any or all saved community strings, select the strings that you want to delete, and then click Remove, or click Remove All. 5. Click Menu Options, and then configure the right-click menu as follows: a. If you want either to add menu items to the right-click menu or to remove menu items from the right-click menu, move menu items between the list of Available Menu Options on the left and Selected Menu Options on the right by selecting items in either column and clicking the right and left arrows, as appropriate. b. If you want to change the order of menu items, select items and then click the up and down arrows next to the Selected Menu Options list. c. If you want to add a separator between items, move the -------------menu option from the Available list to the Selected list, and then move it to your preferred location within the Selected Menu Options list. 6. Click Automatic Menu Items. 7. Check either or both, if available, of the following options: Automatically add sub-menu items to the MIB Browser (Query MIB) menu option from the MIB Browers Bookmarks. Automatically add sub-menu items to the Real Time Interface Monitor menu option from the Real Time Interface Monitor saved report types. Note: These options expand the list of available menu items by incorporating menu links to MIB browser bookmarks and Real Time Interface Monitor saved reports, respectively.
Adding Programs to a Toolset Integration Menu

The following procedure provides the steps required to add any external scripts or applications to the SolarWinds Toolset integration menu. To add a program to the SolarWinds Toolset Integration menu: 1. If you want to add an external script to the Toolset Integration menu, save the script in an appropriate location on the install volume of your SolarWinds server (e.g. <InstallVolume>:\\Scripts\). 2. If you want to add an external application to the Toolset Integration menu, install the application in an appropriate location on the install volume of your SolarWinds server (e.g. <InstallVolume>:\\Application\). 3. Open SWToolset.MenuOptions, the Toolset Integration menu configuration file, in a text editor.
Note: By default, SWToolset.MenuOptions is located in the following folder: <InstallVolume>:\\Program Files\SolarWinds\Common\. 4. Save a copy of SWToolset.MenuOptions as SWToolset_Old.MenuOptions. 5. Add the following line between the <MenuOptions></MenuOptions> tags of the SWToolset.MenuOptions file:
<MenuOption Visible="TRUE" Title="ApplicationName" BeginGroup="FALSE" HasSubMenu="FALSE" ExecString="<InstallVolume>:\\Application\ExecutableFile" Icon="" Extra="" Parent="" Required="4"/>
Note: The string supplied for Title is the name for the added script or application that will display in the menu. The string supplied for the ExecString is the path to the script or application executable file. 6. Save the new SWToolset.MenuOptions to automatically update the Toolset Integration menu.
Web Console Configuration

SolarWinds SAM has the ability to create, restore and clear your web console configuration Refer to the following sections for more information: Creating a Web Console Configuration Backup Restoring a Web Console Configuration Backup Clearing a Web Console Configuration
Creating a Web Console Configuration Backup

The following procedure uses the SolarWinds Web Configuration Backup/Restore utility to create a backup of your SolarWinds Web Console configuration. Note: The SolarWinds Web Configuration Backup/Restore utility does not create a backup of the SolarWinds database. As a result, configuration backups do not retain any of the network device data or statistics for any monitored network objects. To create a SolarWinds Web Console configuration backup: 1. Log in to the SolarWinds Web Console as an administrator. 2. Click Start > All Programs > SolarWinds > Advanced Features > Web Configuration Backup.
3. Click Create Backup. 4. Confirm that the SolarWinds folder is open or browse to it, located, by default within <Volume:>\Program Files\SolarWinds\. 5. Provide an appropriate file name and location, click Save, and then click Ok when the web console configuration backup is completed.
Restoring a Web Console Configuration Backup

The following procedure uses the SolarWinds Web Configuration Backup/Restore utility to restore a saved backup of your SolarWinds Web Console configuration. Warning: Do not restore web console configurations from any version of SolarWinds SAM prior to the version currently installed. To restore a SolarWinds Web Console configuration backup: 1. Log in to the SolarWinds Web Console as an administrator. 2. Click Start > All Programs > SolarWinds > Advanced Features > Web Configuration Backup. 3. In the Restore Web Site Configuration area, select the configuration backup file you want to restore. 4. If you want the restored web console configuration to overwrite your current configuration, select Overwrite, and then click Restore Backup. 5. If you want the restored web console configuration to merge with your current configuration, select Merge, and then click Restore Backup. 6. Click Yes to confirm the restoration of the selected configuration backup.
Clearing a Web Console Configuration

The following procedure clears an existing SolarWinds Web Console configuration. Warning: Clearing a web console configuration deletes all existing user accounts, account and view settings, and menu bar customizations. SolarWinds recommends you create a backup of your current SolarWinds Web Console configuration before you clear it to confirm that no issues arise as a result of the deletion of your web console customizations. To clear your SolarWinds Web Console configuration: 1. Log in to the SolarWinds Web Console as an administrator.
2. Click Start > All Programs > SolarWinds > Advanced Features > Web Configuration Backup. 3. Click File > Clear Web Configuration. 4. Click Yes to confirm the deletion of your current web console configuration. 5. Click Ok after the web console configuration is cleared.
Logging in for the First Time as an Administrator

When you launch the SolarWinds Web Console, you are presented with a login view requiring both a User Name and a Password. To log in to the SolarWinds Web Console: 1. Launch the SolarWinds Web Console using either of the following methods: Click Start > All Programs > SolarWinds > Orion Web Console. Or launch a browser on your SolarWinds server and enter http://ip_address or http://hostname, where ip_address is the IP address of your SolarWinds host server, or where hostname is the domain name of your SolarWinds server. 2. Enter Admin as your User Name, and then click Login. Notes: Until you set a password, you can log in as Admin with no Password. After your first login, you may want to change the Admin password. For more information, see Changing an Account Password on page 100.
Windows Authentication with Active Directory

As of SolarWinds Core version 2010.2, the SolarWinds Web Console can authenticate Active Directory users and users who are members of Active Directory security groups. To enable Active Directory Windows authentication to the web console: 1. Install and configure Active Directory on your local network. Notes: For more information about installing Active Directory on Windows Server 2003, see the Microsoft Support article, How To Create an Active Directory Server in Windows Server 2003. For more information about Active Directory on Windows Server 2008, see the Microsoft TechNet article, Active Directory Services. 2. If you want to enable automatic login for web console accounts using Windows Authentication, configure the SolarWinds Web Console as shown in the following steps:
a. Click Start > All Programs > SolarWinds Orion > Configuration and Auto-Discovery > Configuration Wizard. b. Check Website, and then click Next. c. After providing the appropriate IP Address, Port, and Website Root Directory, select Yes Enable automatic login using Windows Authentication. d. Click Next, and then complete the Configuration Wizard. 3. Log in to the web console using the appropriate domain and user, providing Domain\Username or Username@Domain as the web console User name.
Using the Web Console Notification Bar

Below the web console menu bar, the SolarWinds notification bar provides informational messages related to the following SolarWinds SAM features: If you have configured the SolarWinds Web Console to check for product updates, an announcement displays in the notification bar when an update, including any upgrade, service pack, or hotfix, to SolarWinds SAM or any other SolarWinds modules you currently have installed becomes available. For more information about SolarWinds Product Updates, see Product Updates" on page 82. If you have configured the SolarWinds Web Console to store blog posts, new and unread posts to the SolarWinds Product Team Blog are announced in the notification bar. For more information about SolarWinds Product Updates, see Product Updates" on page 82. If you have currently configured a scheduled discovery, results display in the notification bar when the discovery completes. For more information about Scheduled Discovery, see Discovery Central" on page 74. If you are currently using SolarWinds SAM to monitor any VMware ESX or ESXi Servers, the notification bar can display messages communicating the number of ESX nodes found during any discovery, and, if any discovered ESX nodes require credentials, the notification bar tells you. For more information about managing ESX Servers, see Virtualization" on page 201.
For more information about any displayed notification bar message, click More Details and a web console view relevant to the displayed message opens. To delete a posted message, either click Dismiss Message next to the displayed message, or properly address the situation mentioned in the posted notification. To remove the notification bar from your web console, click Close ( X) at the right end of the notification bar.
Using the SolarWinds Web Console Message Center

The Message Center provides a single, customizable view in the web console where, in a single table, you can review all events, alerts, traps and Syslog messages on your network. To view and configure the Message Center: 1. Click Home > Message Center. 2. If you only want to see messages for specific devices, select appropriate device properties in the Filter Devices area. 3. In the Filter Messages area, select the Time period for the messages you want to review, and then provide the number of messages you want to show. 4. If you want to show all messages, Including messages that have been acknowledged, check Show acknowledged in the Filter Messages area. 5. If you only want to see certain types of messages, filter messages as shown in the following steps: a. If you want to view alerts, confirm that Show triggered alerts is checked, and then select the type of alerts to display. b. If you want to view event messages, confirm that Show event messages is checked, and then select the type of events to display. c. If you want to view Syslog messages, confirm that Show syslog messages is checked, and then select the Severity and Facility of the Syslog messages you want to display. d. If you want to view received traps, confirm that Show received traps is checked, and then select the Trap type and Community String of the traps you want to display. 6. Click Refresh to update the list of displayed messages.
Using Node Filters

When you are managing or monitoring large numbers of network devices, node list resources can easily become very large and difficult to navigate. Filters are optional SQL queries that are used to limit node list displays for easier resource navigation. SQL queries can be made on any predefined or custom properties. For more information about defining custom properties, see Creating Custom Properties on page 465. To apply a node filter: 1. Click Edit in any node list resource.
2. Provide an appropriate SQL query in the Filter Nodes (SQL) field, and then click Submit. The following are a few example filters with associated SQL queries. Note: By default, node list resources are designed to sort nodes alphabetically by node caption. This configuration cannot be overwritten using a SQL filter, so order by clauses included in SQL filters are redundant and will result in Custom SQL filter formatting errors. Filter the results to only show nodes that are not Up:
Status<>1
The following are valid status levels:

0 = Unknown (current up/down status of the node is unknown) 1 = Up (The node is responding to PINGs) 2 = Down (The node is not responding) 3 = Warning (The node may be responding, but the connection from
the server to the Node is dropping packets)
Only show Cisco devices: Vendor = 'Cisco' Only show devices in Atlanta. (using a custom property named City):
City = 'Atlanta'
Only show devices beginning with "AX3-": Caption Like 'AX3-*' Only show Nortel devices that are Down:
Vendor Like 'Nortel*' AND Status=2
Only show devices ending in '-TX': Vendor Like '*-TX'
Accessing Nodes Using HTTP, SSH, and Telnet

The SolarWinds Web Console supports the use of HTTP, SSH, and Telnet protocols for remote device access if associated applications like PuTTy and FiSSH on your SolarWinds server are properly registered. For more information, see the MSDN article, Registering an Application to a URL Protocol. Launch remote access applications from any Details view as follows: To browse directly to the viewed device using a web browser, click To open a secure shell (SSH) to a monitored device, click To open a Telnet session with a monitored device, click . . .
Using Integrated Remote Desktop

Sometimes it is necessary to console into a remote server to troubleshoot an issue. This can be accomplished within the SolarWinds Web Console as follows. Note: Press Ctrl+Alt+Break to enter/exit full screen mode. To launch Integrated Remote Desktop: 1. Open the Node Details view for the server you want to view remotely. Note: The easiest way to open the Node Details view is to click the remote server you want to view in any All Nodes resource. 2. Click , located at the of the Node Details view.
Note: Depending on the security settings of your browser, you may be asked to install an ActiveX control for remote desktop viewing. Follow all prompts to install this required control. 3. Verify the Server IP address or hostname, select an appropriate Screen Size, and then click Connect.
Chapter 5
SolarWinds SAM Settings

You can configure Applications, Templates, and Component Monitors through the SolarWinds Web Console by using the SAM Settings page.
To configure SolarWinds SAM: 1. Log on to your SolarWinds Web Console with an Administrator account. Note: Initially, Admin is the default administrator user ID with a blank password. 2. Click the Applications tab. 3. Click SAM Settings. Refer to the sections that follow for details about the administrative commands available in each category: Getting Started with SAM
SolarWinds SAM Settings 141
Scan Nodes for Applications Manually Assign Application Monitors Find Processes, Services, and Performance Counters Application Monitors
Manage Application Monitors Application Monitor Templates
Manage Templates Create a New Template Component Monitors
Component Monitor Library Manage Assigned Component Monitors Manage Component Monitors within Templates Application Detail Views
Views by Application Type Global SAM Settings
Credentials Library Data and Database Settings License Summary
SAM License Summary thwack Community
Shared thwack Templates SAM thwack Forum
Getting Started with SAM

The Getting Started with SAM category gives you access to the commands that allow you to start monitoring your applications or add new Application Monitors.
142 SolarWinds SAM Settings
Refer to the following sections for more information: Scan Nodes for Applications Manually Assign Application Monitors Find Processes, Services, and Performance Counters
Scan Nodes for Applications

Click Scan Nodes for Applications on the SAM Settings page to scan nodes and automatically add Application Monitors. For more information, see Scanning Nodes for Applications on page 223.
Manually Assign Application Monitors

Click Manually Assign Application Monitors on the SAM Settings page to assign Application Monitors to server nodes. For more information, see Manually Assign Application Monitors on page 225.
Find Processes, Services, and Performance Counters

Click Find Processes, Services, and Performance Counters on the SAM Settings page to scan a node and pick the processes, services, and performance counters you want from a list to create a new template. For more information, see Creating New Templates Using the Browsing Method on page 227.
Application Monitors
The Application Monitors category gives you access to the commands that allow you to actively monitor nodes using a collection of component monitors to determine the overall health of applications. For more information, see Managing Assigned Application Monitors on page 234.
Manage Application Monitors

Click Manage Application Monitors on the SAM Settings page to view, edit, and delete assigned Application Monitors and their component monitors. For more information, see Managing Assigned Application Monitors on page 234.
Application Monitor Templates

The Application Monitor Templates category gives you access to the commands that allow you to edit, copy, export, import, delete, and create new templates. For more information, see Managing Templates on page 228.
Manage Templates
Click Manage Templates on the SAM Settings page to edit, copy, export, import, and delete templates. For more information, see Managing Templates on page 228.
Create a New Template

Click Create a New Template on the SAM Settings page to create a new application template and its component monitors. For more information, see Creating New Templates on page 226.
Component Monitors
Component monitors are the building blocks of SolarWinds SAM. This category gives you access to the commands that allow you to monitor the status and performance of different aspects of an application. Refer to the following sections for more information: Component Monitor Library Manage Assigned Component Monitors Manage Component Monitors within Templates
Component Monitor Library

Click Component Monitor Library on the SAM Settings page to view the component monitors that are provided in the library for monitoring the status and performance of different aspects of an application. For more information, see Viewing the Component Monitor Library on page 237.
Manage Assigned Component Monitors

Click Manage Assigned Component Monitors on the SAM Settings page to view and manage assigned component monitors.
For more information, see Managing Assigned Component Monitors on page 238.
Manage Component Monitors within Templates

Click Manage Component Monitors within Templates on the SAM Settings page to view and manage component monitors that are inside the Application Monitor templates. For more information, see Managing Templates on page 228.
Application Detail Views

The Application Detail Views category gives you access to the command that allows you to customize application detail views.
Views by Application Type

Click Views by Application Type on the SAM Settings page to customize application detail views by application (template) type. You can choose between displaying a generic view or a custom view for each application (template) type.
Global SAM Settings

The Global SAM Settings category gives you access to the commands that allow you to view and manage the global SAM settings for credentials and data access. For more information, see "SolarWinds SAM Settings" on page 141. For more information, see Understanding the Credentials Library on page 220. For more information, see "Data and Database Settings" on page 145.
Credentials Library
Click Credentials Library on the SAM Settings page to create, edit, and delete the credential sets component monitors use to access protected system resources. For more information, see Understanding the Credentials Library on page 220.
Data and Database Settings

Click Data and Database Settings on the SAM Settings page to set the database maintenance interval, as well as the polling engine mode. The four options are as follows:
Database Hourly Statistics Retention Daily Statistics Retention Polling Mode
Database Maintenance The amount of data collected in the database is dependent upon the size of the data collected as well as the number of applications and component monitors you define. Due to the volume of data collected, detailed statistics are stored in hourly averages after a specified time period (7 days, by default). Hourly statistics are compressed into daily statistics after a number of days (30 days, by default). Detailed statistics retention is based on the individual polling intervals for each component monitor. These settings allow you to set a length of time after which SolarWinds SAM purges data from the database. Note: Before modifying your database settings, consider noting your database size and amount of data collection for a week. When the week is complete, recheck your database size. This should help you forecast and plan for an appropriate data compression and retention period. To set the three Statistic Retention Intervals: 1. Log on to your SolarWinds Web Console with an Administrator account. Note: Initially, Admin is the default administrator user ID with a blank password. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Data and Database Settings. 5. Specify the appropriate values for the SolarWinds SAM data retention settings. Polling Engine Mode The polling engine mode specifies the behavior of both the main polling engine and any additional ones you may have. To set the Polling Engine Mode: 1. Log on to your SolarWinds Web Console with an Administrator account.
Note: Initially, Admin is the default administrator user ID with a blank password. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Data and Database Settings. 5. Specify the appropriate value for the Polling Engine Mode: Local-OnlyOnly the main polling engine is used. Poller-BoundEach node is polled by its assigned polling engine. Note: Changes in the Polling Engine Mode do not take effect until SAM is restarted. For more information, see "Managing the SolarWinds SAM Database" on page 451.
License Summary
The License Summary category gives you access to the command that allows you to view the license information summary. For more information, see "SAM License Summary" on page 147.
SAM License Summary

Click SAM License Summary on the SAM Settings page to see a comparison between the number of active component monitors and the limit allowed by your SolarWinds SAM license.
thwack Community
The thwack Community category gives you access to the commands that allow you to view and download useful information from the thwack community for SolarWinds users. Refer to the following sections for more information: Shared thwack Templates SAM thwack Forum
Shared thwack Templates

Click Shared thwack Templates on the SAM Settings page to browse and use application templates contributed by fellow administrators.
For more information, see Exporting and Importing Templates Locally or Using Thwack on page 231.
SAM thwack Forum

Click SAM thwack Forum on the SAM Settings page to browse the information provided in the SAM thwack Forum. For more information, visit thwack.com
Chapter 6
Discovering and Adding Nodes on a Network

There are two methods to add nodes in SolarWinds SAM: Add a Single Node* * For more information, see Adding Nodes for Monitoring on page 88. Network Sonar Discovery
This chapter describes the process of discovering network devices and then adding them to the SolarWinds database via Network Sonar Discovery. The method recommended largely depends on the number of nodes to be added. To discover and add a larger number of nodes across your enterprise, the Network Sonar Discovery and Network Sonar Results wizards are available, respectively. This chapter provides instructions for quickly populating your SolarWinds SAM database with the nodes you want to monitor and manage with SAM. The Web Console also provides an easy to use Web Node Management wizard suited to discovering and adding individual nodes. Refer to the following sections for more information: Discovery Central Network Sonar Discovery Using the Network Sonar Results Wizard Managing Scheduled Discovery Results Using the Discovery Ignore List
Discovery Central
Discovery Central provides a centralized overview of the types and number of nodes you are monitoring. You can also access Network Discovery and Virtualization Discovery from within Discovery Central. To access Discovery Central: Click Settings at the top right of the SolarWinds Web Console. Then, click Discovery Central in the Getting Started with SolarWinds category.
Note: Clicking Go to SolarWinds Home opens the SolarWinds Summary Home view for your entire monitored network.
Discovering and Adding Nodes on a Network 149
Refer to the following sections for more information: Virtualization Discovery Application Discovery
Virtualization Discovery
The Virtualization Discovery category displays information for the VMware infrastructure on your network including vCenters, Datacenters, Clusters, ESX Hosts and Virtual Machines. To use virtualization discovery, click Network Sonar Discovery to discover multiple VMware nodes or click Add A Single Device to add a single VMware node. For more information, see Polling for VMware nodes Using the Network Sonar Wizard on page 209.
Application Discovery
SolarWinds SAM can scan nodes and automatically assign the Application Monitors it deems suitable for each scanned node. You control the nodes to be scanned, the application templates used in the scan, and the scanning parameters that determine a match. For more information, see "Application Discovery" on page 161.
Network Sonar Discovery

SolarWinds SAM employs the easy to use Network Sonar Wizard in order to aid in the discovery of nodes on your network. Before using the Network Sonar Wizard, consider the following points about network discovery in SAM: The Network Sonar Wizard recognizes network devices that are already in your SolarWinds database and prevents you from importing duplicate devices. CPU and Memory Utilization charts are automatically enabled for your Windows, Cisco Systems, VMware, and Foundry Networks devices. The community strings you provide in the Network Sonar Wizard are only used for SNMP GET requests, so read-only strings are sufficient.
The following procedure steps you through the discovery of devices on your network using the Network Sonar Wizard, automatically followed by the Network Sonar Results Wizard:
150 Discovering and Adding Nodes on a Network
To discover devices on your network from Discovery Central: 1. If the Network Sonar Wizard is not already open, click Start > All Programs > SolarWinds > Configuration and Auto-Discovery > Network Discovery. 2. Click Network Sonar Discovery.
3. If you want to create a new discovery, click Add New Discovery. 4. If you have already defined a network discovery, a number of options are available on the Network Sonar Discovery tab. Select one of the following: If you want to edit an existing discovery before using it, select the discovery you want to edit, and then click Edit. If you want to use an existing discovery to rediscover your network, select the discovery you want to use, click Discover Now, and then complete the Network Sonar Results Wizard after discovery completes. For more information about network discovery results, see Using the Network Sonar Results Wizard on page 157. If you want to import some or all devices found in a defined discovery that you may not have already imported for monitoring, select a currently defined discovery, and then click Import All Results. For more information about network discovery results, see Using the Network Sonar Results Wizard on page 157. If you want to import any newly enabled devices matching a defined discovery profile, select a currently defined discovery, and then click Import New Results. For more information about network discovery results, see Using the Network Sonar Results Wizard on page 157. If you want to delete an existing discovery profile, select a currently defined discovery and then click Delete. 5. If the devices on your network do not require community strings other than the default strings public and private provided, click Next on the SNMP Credentials view. 6. If any of your network devices require community strings other than public and private or if you want to use an SNMPv3 credential, complete the following steps to add the required SNMP credential. Note: Repeat the following procedure for each new community string. To speed up discovery, highlight the most commonly used community strings on
your network, and then use the arrows to move them to the top of the list. a. Click Add New Credential, and then select the SNMP Version of your new credential. b. If you are adding an SNMPv1 or SNMPv2c credential, provide the new SNMP Community String. c. If you are adding an SNMPv3 credential, provide the following information for the new credential: User Name, Context, and Authentication Method Authentication Password/Key, Privacy/Encryption Method and Password/Key, if required. d. Click Add. 7. Click Next on the SNMP Credentials view.
8. If you want to discover any VMware VCenter or ESX Servers on your network, confirm that Poll for VMware is checked, and then complete the following steps to add or edit required VMware credentials. Note: Repeat the following procedure for each new credential. To speed up discovery, use the up arrow to move the most commonly used credentials on your network to the top of the list. a. Click Add vCenter or ESX Credential. b. If you are using an existing VMware credential, select the appropriate credential from the Choose Credential dropdown menu. c. If you are adding a new VMware credential, select <New Credential> in the Choose Credential dropdown menu, and then provide a new credential name in the Credential Name field. Note: SolarWinds recommends against using non-alphanumeric characters in VMware credential names. d. Add or edit the credential User Name and Password, as necessary.
e. Confirm the password, and then click Add. 9. Click Next on the Local vCenter or ESX Credentials for VMware view.
10. If you want to discover devices located on your network within a specific range of IP addresses, complete the following procedure.
Note: Only one selection method may be used per defined discovery. a. Click IP Ranges in the Selection Method menu, and then, for each IP range, provide both a Start address and an End address. Note: Scheduled discovery profiles should not use IP address ranges that include nodes with dynamically assigned IP addresses (DHCP). b. If you want to add another range, click Add More, and then repeat the previous step. Note: If you have multiple ranges, click X to delete an incorrect range. c. If you have added all the IP ranges you want to poll, click Next.
11. If you want to discover devices connected to a specific router or on a specific subnet of your network, complete the following procedure: Note: Only one selection method may be used per defined discovery. a. Click Subnets in the Selection Method menu. b. If you want to discover on a specific subnet , click Add a New Subnet, provide both a Subnet Address and a Subnet Mask for the desired subnet, and then click Add. Note: Repeat this step for each additional subnet you want to poll. c. If you want to discover devices using a seed router , click Add a Seed Router, provide the IP address of the Router, and then click Add. Notes: Repeat this step for each additional seed router you want to use. Network Sonar reads the routing table of the designated router and offers to discover nodes on the Class A network (255.0.0.0 mask) containing the seed router and, if you are discovering devices for a SolarWinds SAM installation, the Class C networks (255.255.255.0 mask) containing all interfaces on the seed router, using the SNMP version chosen previously on the SNMP Credentials page. Networks connected through the seed router are NOT automatically selected for discovery. d. Confirm that all networks on which you want to conduct your network discovery are checked, and then click Next. 12. If you already know the IP addresses or hostnames of the devices you want to discover and include in the SolarWinds database, complete the following procedure: a. Click Specific Nodes in the Selection Method menu. b. Type the IPv4 or IPv6 addresses or hostnames of the devices you want to discover for monitoring into the provided field. Note: Type only one address or hostname per line. c. Click Validate to confirm that the provided addresses and hostnames are assigned to SNMP-enabled devices. d. If you have provided all the addresses and hostnames you want to discover, click Next.
13. Configure the options on the Discovery Settings view, as detailed in the following steps: a. Provide a Name and Description to distinguish the current discovery profile from other profiles you may use to discover other network areas.
Note: This Description displays next to the Name in the list of available network discovery configurations on the Network Sonar view. b. Position the slider or type a value, in ms, to set the SNMP Timeout. Note: If you are encountering numerous SNMP timeouts during Network Discovery, increase the value for this setting. The SNMP Timeout should be at least a little more than double the time it takes a packet to travel the longest route between devices on your network. c. Position the slider or type a value, in ms, to set the Search Timeout. Note: The Search Timeout is the amount of time Network Sonar Discovery waits to determine if a given IP address has a network device assigned to it. d. Position the slider or type a value to set the number of SNMP Retries. Note: This value is the number of times Network Sonar Discovery will retry a failed SNMP request, defined as any SNMP request that does not receive a response within the SNMP Timeout defined above. e. Position the slider or type a value to set the Hop Count. Note: If the Hop Count is greater than zero, Network Sonar Discovery searches for devices connected to any discovered device. Each connection to a discovered device counts as a hop.
f.
Position the slider or type a value to set the Discovery Timeout. Note: The Discovery Timeout is the amount of time, in minutes, Network Sonar Discovery is allowed to complete a network discovery. If a discovery takes longer than the Discovery Timeout value provided, the discovery is terminated.
14. If you only want to use SNMP to discover devices on your network , check Use SNMP only. Note: By default, Network Sonar uses ICMP ping requests to locate devices. Most information about monitored network objects is obtained using SNMP queries. 15. If multiple SolarWinds polling engines are available in your environment, select the Polling Engine you want to use for this discovery. 16. Click Next. 17. If you want the discovery you are currently defining to run on a regular schedule, select either Custom or Daily as the discovery Frequency, as shown in the following steps: Notes: Scheduled discovery profiles should not use IP address ranges that include nodes with dynamically assigned IP addresses (DHCP). Default Discovery Scheduling settings execute a single discovery of your network that starts immediately, once you click Discover. Results of scheduled discoveries are maintained on the Scheduled Discovery Results tab of Network Discovery. For more information about managing scheduled discovery results, see Managing Scheduled Discovery Results on page 158. a. If you want to define a custom discovery schedule to perform the currently defined discovery repeatedly in the future, select Custom and then provide the period of time, in hours, between discoveries. b. If you want your scheduled discovery to run once daily, select Daily, and then provide the time at which you want your discovery to run every day, using the format HH:MM AM/PM. 18. If you do not want to run your network discovery at this time, select No, dont run now, and then click Save or Schedule, depending on whether you have configured the discovery to run once or on a schedule, respectively.
19. If you want your Network Sonar discovery to run now, click Discover to start your network discovery.
Note: Because some devices may serve as both routers and switches, the total number of nodes discovered may be less than the sum of reported routers discovered plus reported switches discovered.
Using the Network Sonar Results Wizard

The Network Sonar Results Wizard directs you through the selection of nodes for monitoring opens whenever discovery results are requested. This will happen either when the Network Sonar Wizard completes or when Import All Results or Import New Results is clicked for a selected discovery. The following steps detail the selection of discovered nodes for monitoring in SolarWinds SAM. To select the results of a network discovery for monitoring in SolarWinds SAM: 1. On the Device Types to Import page, check the device types you want to monitor, and then click Next.
Note: If you are not sure if you want to monitor a specific device type, check the device type in question. Later, you can delete the device using Web Node Management. 2. On the Volume Types to Import page, check the volume types you want to monitor, and then click Next. Note: If you are not sure you want to monitor a specific volume type, check the volume type in question. Later, you can delete the volume of the selected type using Web Node Management. 3. If you want to import nodes, even when they are already known to be polled by another polling engine, check the option in the Allow Duplicate Nodes section. For more information about working with multiple polling engines, see Managing Orion Polling Engines on page 193. 4. If there are any devices on the Import Preview that you do not ever want to import, check the device to ignore, and then click Ignore. Selected nodes are added to the Discovery Ignore List. For more information, see Using the Discovery Ignore List on page 159. 5. Confirm that the network objects you want to monitor are checked on the Import Preview page, and then click Import. Note: Imported devices display in the All Nodes resource.
Managing Scheduled Discovery Results

The Scheduled Discovery Results tab of Network Discovery provides a list of all recently discovered, changed, or imported devices on your monitored network. Results are compared between discoveries and results are listed on this tab. The following procedure provides guidelines for managing discovery results. To manage scheduled discovery results: 1. Click Start > All Programs > SolarWinds > Configuration and AutoDiscovery > Network Discovery. 2. Click Scheduled Discovery Results. 3. Select the type of devices you want to view from the Status menu in the left pane. The following options are available: Select Found to view all devices discovered by a scheduled discovery. Select Changed to view all devices that have changed between recent scheduled discoveries. Changes include the addition of device configuration changes. Select Imported to view all devices you have recently imported to your SolarWinds database. For more information about importing devices, see Using the Network Sonar Results Wizard on page 157.
Select Ignored to view all devices you have added to your Discovery Ignore List. For more information about the Discovery Ignore List, see Using the Discovery Ignore List on page 159. Select Found and Changed to view a combined list of all devices found or changed as described above. Select All except Ignored to view all discovered, changed or imported devices you have not already designated as Ignored, as detailed above. 4. If you want to apply a grouping criterion to organize your listed results, select an appropriate criterion from the Group by menu in the left pane. 5. If there are changed or discovered nodes in the results list that you want to add to your SolarWinds database, check them and then click Import Nodes. 6. If there are devices you want SolarWinds SAM to ignore in future discoveries, regardless of discovered updates or changes, check the nodes to ignore, and then click Add to Ignore List. For more information about the Discovery Ignore List, see Using the Discovery Ignore List on page 159.
Using the Discovery Ignore List

Often, devices are found during a network discovery that you never intend to monitor with SolarWinds SAM. The Discovery Ignore List is a record of all such devices on your network. By placing a device on the Discovery Ignore List you can minimize the SNMP processing load associated with discovering devices that you never intend to monitor. To manage devices on the Discovery Ignore List: 1. Click Start > All Programs > SolarWinds > Configuration and AutoDiscovery > Network Discovery. 2. If you want to view the current Discovery Ignore List, click Discovery Ignore List. 3. If you want to add devices to the Discovery Ignore List, complete the following procedure: a. Click Scheduled Discovery Results. b. Check devices you want to ignore, and then click Add to Ignore List. 4. If you want to remove devices from the Discovery Ignore List, complete the following procedure: a. Click Scheduled Discovery Results, and then b. Check the devices you want to remove from the list.
c. Click Remove from Ignore List. d. Confirm that you want to stop ignoring the selected items by clicking Ok. After the Network Sonar Wizard completes the node discovery and imports the results, you are taken directly to the Application Discovery Wizard to discover applications to monitor on the nodes. For more information, see "Application Discovery" on page 161.
Chapter 7
Application Discovery
SolarWinds SAM can scan nodes and automatically assign the Application Monitors it deems suitable for each scanned node. You control the nodes to be scanned, the application templates used in the scan, and the scanning parameters that determine a match. To access Application Discovery, click Settings at the top right of the SolarWinds Web Console. Now click Discovery Central in the Getting Started with SolarWinds category. In the Application Discovery category, click Discover Applications to begin using the wizard-like interface. For more information, see "Add Application Monitors" on page 162. Select Nodes Click [+] in the list to expand the node groups and to select the nodes you want to scan. When you are finished selecting nodes, click Next. Select Applications To keep the scanning time to a minimum, we recommend you initially scan for a limited number of application templates. To see more application templates, select a different template group from the Show Only list. To adjust the template assignment criteria, expand Advanced Scan Settings and move the slider to the desired setting: Exact Match All the components must match to assign the template. Strong Match Most of the components must match to assign the template. Partial Match Some of the components must match to assign the template. Minimal Match At least one component must match to assign the template. When you are finished selecting applications, click Next.
Application Discovery 161
Enter Credentials Some application templates require credentials either to access restricted resources, or to run within the context of a specific user. To scan for these templates, add the necessary credentials to the list. If a template you are scanning for requires credentials, the credentials in this list are tried in the order in which they appear. Warning: Credentials are tried several times over the course of a scan, so an incorrect password is likely to lock out an account. To avoid potential account lockouts that affect actual users, we recommend you create and use service accounts. A service account is an account created specifically for the purpose of providing credentials to use for SolarWinds monitoring. With service accounts, no actual user is affected by an account lockout if a password should be entered incorrectly. If you have domains sharing user names with different passwords, we recommend you run separate application discoveries for each domain. When you are finished entering credentials, click Next. Review and Start Scan Review the summary for the scan. If the automatic discovery matches templates that are already assigned to the node, by default the template is not assigned a second time. If you want to assign duplicate templates, select Yes, Assign Anyway from the Do you want to assign duplicates list. Click Start Scan to begin the scan. The scan runs in the background. If you like, click View progress near the light bulb icon toward the top of the page to view the progress of the scan. You are notified by a message near the top of the window when scanning is completed. Click View Results to see the results of the scan. Click View SAM Summary Page (or > SAM Application Summary) to display the SAM summary page. Add UX Monitors You cannot scan for user experience (UX) monitors, but you can assign them to nodes manually. Adding monitors from this page does not affect your scan.
Add Application Monitors

After adding individual nodes, you are prompted by the Add Application Monitors page to add applications for monitoring the desired application(s) on the new node as described below.
162 Application Discovery
To add Application Monitors on the Add Application Monitors page: 1. Use the Show Only list to select the desired category for the Application Monitors you want to add. 2. Check the check box next to the Application Monitor(s) you want to assign. 3. The selected Application Monitor(s) are added to the list of Selected applications. 4. If you change your mind and want to delete an application, click the red X next to the name of the application in the Selected applications list. 5. If suitable credentials already exist, choose the credential from the Choose Credential list. 6. If suitable credentials do not exist, choose <New Credential> from the Choose Credential list, and then add the new credential by filling out the credential details. 7. Click Test to test the credentials and component monitors against the test node. 8. If the test fails, troubleshoot the problem based on the error messages, and then retest the node. 9. Click Next. 10. On the Change Properties page, modify any of the information as needed, such as the Node Status Polling interval (in seconds) and the Collect Statistics Every frequency (in minutes). 11. Click Ok, Add Node.
Reading the Application Summary

The SAM Application Summary is the first view displayed after launching Server & Application Monitor. This view provides insight into application health and performance conditions over your entire network. The resources listed in this section are the default views included in the SAM Application Summary.
Active Application Alerts

This resource provides the current application-specific alerts, including the time the alert fired, the name of the application that caused the alert, and the alert message. Click the Network Node to see the SolarWinds Node Details view. Click the Application Name to see the SAM Application Details view.
Application Health Overview

This resource provides a status overview of all your assigned application monitors. Click a status to list the assigned application monitors in that status.
The following statuses are depicted on the Application Health Overview: Application Up Assigned application monitors with all component monitors responding and operating within their thresholds. Application Critical Assigned application monitors with at least one component monitor operating past the critical threshold. Application Down Assigned application monitors with at least one unresponsive component monitor.
Application Warning Assigned application monitors with at least one component monitor operating past the warning threshold. Other Assigned application monitors that are suspended due to licensing restrictions. Unknown Assigned application monitors with status that cannot yet be determined.
Applications with Problems

This resource lists the assigned application monitors reporting any status other than up.
Last 25 Application Events

This resource provides a list of application-centric events from the time period you specify. The default time period shows the last 25 application events. Clicking Edit allows you to change the time period, limiting the events displayed in the resource.
Thwack Latest Application Templates

This resource lists the newest application monitor templates that have been added to the Thwack community web site. Click a template to open its download web page.
Top 10 Components Monitored by Response Time

This resource provides a list of the component monitors with the slowest response time.
Top 10 Processes Monitored by CPU Load

This resource provides a list of the component monitors consuming the most CPU.
Top 10 Processes Monitored by Physical Memory

This resource provides a list of the component monitors consuming the most physical memory.
Top 10 Processes Monitored by Virtual Memory

This resource provides a list of the component monitors consuming the most virtual memory.
Chapter 8
Managing Groups and Dependencies

Groups and dependencies enable you to more effectively manage your network. Groups give you the ability to logically organize monitored objects, regardless of device type or location, and dependencies allow you to more faithfully represent what can actually be known about the nodes of your network, eliminating false positive alert triggers and providing more accurate insight into the state of your nodes. Groups contain SolarWinds objects that report a status such as nodes, volumes, applications, and even other groups. You create, delete, and modify groups from the Manage Groups page. Note: Nesting a group within another does not create a strict parent/child relationship. You can include any group as a member in any number of other groups. To access the Manage Groups page: 1. Log on to the SolarWinds Web Console. 2. Click Settings in the top right of the web console. 3. Click Manage Groups in the Node & Group Management grouping of the SolarWinds Website Administration page. The following sections provide more information about creating and managing groups in SAM: Creating Groups Managing the Display of Group Status
Creating Groups
Creating a group is a straightforward process of selecting the SolarWinds objects you want the group to contain. At creation time, you can also decide how you want SolarWinds to roll up the status of the group members. It is also possible to specify group members on the basis of shared properties by adding them with a dynamic query. SolarWinds objects added through dynamic queries are automatically added or removed from the group.
Managing Groups and Dependencies 169
Refer to the following sections for more information: Editing Groups Managing Group Members Deleting Groups Managing the Display of Group Status
To create a new group: 1. Click Start > All Programs > SolarWinds > Orion Web Console. 2. Click Settings in the top right of the web console. 3. Click Manage Groups in the Node & Group Management grouping of the SolarWinds Website Administration page. 4. Click Add New Group. 5. Enter a name for the group in the Name field, and then expand Advanced. 6. If you want the group to roll up the worst status of the group members , select Show Worst Status. 7. If you want the group to roll up the best status of the group members , select Show Best Status. 8. If you want the group to display a warning status if the group members have a mixture of different statuses, select Mixed Status shows warning. 9. Click Next. 10. If you want to individually select group members , follow these steps: a. In the Show Only list, select the type of SolarWinds object you want to add as a group member. b. Check the checkbox of the SolarWinds object and then click Add to Group. 11. If you want to dynamically select group members based on shared properties, follow these steps: a. Click Add dynamic query. b. Type a name for the query in the Dynamic query object name field. c. Select a SolarWinds object type in the SolarWinds Object is list. d. Click Add Condition to specify further selection properties. Note: Use the question mark (?) character as a multiple character wildcard. Use the underscore (_) character as a single character wildcard.
170 Managing Groups and Dependencies
e. Click Preview to verify that the dynamic query is selecting your intended objects. f. Click Save.
12. Continue adding individual SolarWinds objects or dynamic queries until you have finished building your group. 13. Click Create Group.
Editing Groups
You can edit the properties of an existing group or add and remove objects. These are separate editing tasks. To edit properties of an existing group: 1. Click Start > All Programs > SolarWinds > Orion Web Console. 2. Click Settings in the top right of the web console. 3. Click Manage Groups in the Node & Group Management grouping of the SolarWinds Website Administration page. 4. Check the group you want to edit, and then click Edit Properties. 5. Edit the Name and Description of the selected group, as appropriate. 6. If you want to manage the members of the selected group, click Add & Remove Objects. For more information about managing group members, see Managing Group Members on page 171. Note: Expand the Contains summary for the selected group to see all member objects in the group. 7. If you want to configure the calculation of displayed group status or the frequency with which group status is refreshed, expand Advanced, select a Status rollup mode, and then provide a Refresh frequency. Note: For more information about status rollup for groups, see Managing the Display of Group Status on page 172. 8. Click Submit.
Managing Group Members

The following procedure manages the objects included within a defined group. To add and remove the objects of an existing group: 1. Click Start > All Programs > SolarWinds > Orion Web Console.
2. Click Settings in the top right of the web console, and then click Manage Groups in the Node & Group Management grouping of the SolarWinds Website Administration page. 3. Check the group you want to edit, and then click Add & Remove Objects.
Deleting Groups
Deleting an existing dependency is a straightforward process, as shown in the following procedure. To delete a group: 1. Click Start > All Programs > SolarWinds > Orion Web Console. 2. Click Settings in the top right of the web console, and then click Manage Groups in the Node & Group Management grouping of the SolarWinds Website Administration page. 3. Check the group you want to delete, and then click Delete.
Managing the Display of Group Status

The status of any particular group is determined by the status of the members of the group. There are three methods for determining the status displayed for a selected group of monitored objects: Note: For more information about object states in SolarWinds, see Status Icons and Identifiers on page 479. Show Best Status is most useful for displaying groups that are defined as collections of redundant or backup devices. The following table indicates how the Show Best Status option operates: Note: Compare Group Status results under the Show Best Status option with results for the same groups of objects under the Show Worst Status option.
Object States (Up, Warning, Down) (Warning, Down) (Warning, Down, Unknown) Group Status (Up) (Up) (Warning)
Show Worst Status ensures that the worst status in a group of objects is displayed for the whole group. The following table indicates how the Show Worst Status option operates:
Object States (Up, Warning, Down) (Warning, Down) (Warning, Down, Unknown) Group Status (Down) (Warning) (Down)
Mixed Status shows Warning ensures that the status of a group displays the worst warning-type state in the group. If there are no warning-type states, but the group contains a mix of up and down states, then a Mixed Availability ( ) warning status is displayed for the whole group. The following table indicates how the Mixed Status shows Warning option operates:
Object States Group Status (Critical) (Critical) (Mixed Availability)
The following procedure configures the method used to determine group status. To configure the method used to determine the status of a selected group: 1. Click Start > All Programs > SolarWinds > SolarWinds Web Console. 2. Click Settings in the top right of the web console, and then click Manage Groups in the Node & Group Management grouping of the SolarWinds Website Administration page. 3. Check the group you want to edit, and then click Edit Properties. 4. Expand Advanced, and then select a Status rollup mode, as follows: a. If you want the group to roll up the worst status of the group members , select Show Worst Status. b. If you want the group to roll up the best status of the group members , select Show Best Status. c. If you want the group to display a warning status if the group members have a mixture of different statuses, select Mixed Status shows warning. 5. Click Submit.
Managing Dependencies
Dependencies in SolarWinds allow you to account for topological constraints on your network. These constraints may be either the result of the design of a specific device, or the result of the physical architecture of your network itself. SolarWinds offers an Unreachable status to account for the case when a device may appear to be down when its status is actually indeterminate, due to another device being down or unresponsive. Likewise, SolarWinds also makes it possible to define dependencies among distinct devices, as in the case of a subnet of devices on your network that depends on a single WAN link to connect with the rest of your network. In this case, if you have defined a group consisting of the devices in this dependent subnet, you can then define a dependency where the dependent subnet is a child group to the parent router that is serving as the WAN link to the rest of your network. For more information about groups, see Managing Groups and Dependencies" on page 169. The power of dependencies becomes evident when considering alerts. If you have an alert configured to trigger when a monitored object is down, you only want that alert to trigger if a monitored objects is positively down. In other words, you do not want an down object alert to trigger for an object that is not actually down. Without dependencies, all monitored objects on a monitored node that is unresponsive to ICMP queries will also report as down. With dependencies in use, these child objects will instead display as Unreachable, saving you the hassle of sorting through numerous false alerts resulting from the failure of a single node to respond promptly to a status query. Refer to the following sections for more information: Creating a Dependency Editing a Dependency Deleting a Dependency Viewing Alerts on Child Objects
Creating a Dependency
Creating a new dependency is a straightforward process of selecting the parent and children objects, as shown in the following procedure. To create a dependency:
1. Click Start > All Programs > SolarWinds > SolarWinds Web Console. 2. Click Settings in the top right of the web console, and then click Manage Dependencies in the Node & Group Management grouping of the SolarWinds Website Administration page. 3. Click Add new dependency. 4. On the Select Parent page, complete the following steps: a. Use the Show only: and Group by: selection fields to customize the list of displayed objects and groups. Note: The properties listed in the Group by selection field are dynamic. b. Select the parent object or group in the main pane, and then click Next. Note: If you want to define a dependency so that the reported states of child objects are dependent on the status of multiple parent objects, create a group including all parent objects, and then select it on this view. For more information, see Creating Groups on page 169. 5. On the Choose Child page, complete the following steps: a. Edit the Dependency name, as appropriate. b. Use the Show only: and Group by: selection fields to customize the list of displayed objects and groups. Note: Properties listed in the Group by: selection field are dynamically dependent on the selection in the Show only: field. c. Select the child object or group in the main pane, and then click Next. Note: If you want to define a dependency so that the reported states of multiple child objects are dependent on the status one or more parent objects, create a group including all child objects, and then select it on this view. For more information, see Creating Groups on page 169. 6. On the Review Dependency view, review the current settings for the configured dependency. Notes: If any advanced alerts are configured on parent or child objects, they will be listed on this view. Click + to expand alert details. In the event that a parent object is down, all alerts configured on any child objects in a dependency on the down parent object are automatically suppressed. 7. Click Submit to accept the dependency definition.
Editing a Dependency
Editing an existing dependency is a straightforward process, as shown in the following procedure. To edit an existing dependency: 1. Click Start > All Programs > SolarWinds > SolarWinds Web Console. 2. Click Settings in the top right of the web console, and then click Manage Dependencies in the Node & Group Management grouping of the SolarWinds Website Administration page. 3. Check the dependency you want to edit, and then click Edit. 4. On the Select Parent page, complete the following steps: a. Use the Show only: and Group by: selection fields to customize the list of displayed objects and groups. Note: Properties listed in the Group by: selection field are dynamically dependent on the selection in the Show only: field. b. Select the parent object or group in the main pane, and then click Next. Note: If you want to define a dependency so that the reported states of child objects are dependent on the status of multiple parent objects, create a group including all parent objects, and then select it on this view. For more information, see Creating Groups on page 169. 5. On the Choose Child page, complete the following steps: a. Edit the Dependency name, as appropriate. b. Use the Show only: and Group by: selection fields to customize the list of displayed objects and groups. Note: Properties listed in the Group by: selection field are dynamically dependent on the selection in the Show only: field. c. Select the child object or group in the main pane, and then click Next. Note: If you want to define a dependency so that the reported states of multiple child objects are dependent on the status one or more parent objects, create a group including all child objects, and then select it on this view. For more information, see Creating Groups on page 169. 6. On the Review Dependency view, review the current settings for the configured dependency.
Notes: If any advanced alerts are configured on parent or child objects, they will be listed on this view. Click + to expand alert details. If a parent object is down, all alerts configured on any child objects in a dependency on the down parent object are automatically suppressed. 7. Click Submit to accept the dependency definition.
Deleting a Dependency
Deleting an existing dependency is a straightforward process, as shown in the following procedure. To delete an existing dependency: 1. Click Start > All Programs > SolarWinds > SolarWinds Web Console. 2. Click Settings in the top right of the web console, and then click Manage Dependencies in the Node & Group Management grouping of the SolarWinds Website Administration page. 3. Check the dependency you want to delete, and then click Delete. 4. Click Yes to confirm deletion of the selected dependency.
Viewing Alerts on Child Objects

In the event that a parent object is down, all advanced alerts configured on any child objects in a dependency on the down parent object are automatically suppressed. The following procedure displays all advanced alerts currently configured on any child objects in a selected dependency. To view alerts on child objects in a selected dependency: 1. Click Start > All Programs > SolarWinds > SolarWinds Web Console. 2. Click Settings in the top right of the web console. 3. Click Manage Dependencies in the Node & Group Management grouping of the SolarWinds Website Administration page. 4. Check the dependency that includes the child object on which the alerts you want to view are configured, and then click Alerts on Child.
Chapter 9
Managing Accounts
SolarWinds Web Console user accounts, permissions, and views are established and maintained with the SolarWinds Account Manager. When Advanced Customization is enabled on the SolarWinds Website Settings page, you can use Account Manager to customize menu bars and views for different users. For more information, see Customizing Views" on page 104. Notes: This guide assumes that Advanced Customization has been enabled. If it has not been enabled, the range of options available on the pages referenced in the following sections is much more limited. For more information, see Setting Account Limitations on page 184. To prevent issues with web console accounts, your SQL Server should not be configured with the no count connection option enabled. The no count option is set in the Default connection options area of the Server Properties > Connections window of SQL Server Management Studio
Refer to the following sections for more information: Creating Accounts Editing User Accounts
Creating Accounts
New SolarWinds Web Console user accounts may be created by any web console administrator. The following procedure creates a new web console user account. To create a new user account: 1. Log in to the SolarWinds Web Console as an administrator. 2. Click Settings in the top right of the web console. 3. Click Manage Account in the Accounts grouping of the SolarWinds Website Administration page. 4. Click Add New Account. 5. Select the type of account you want to add, and then click Next.
Managing Accounts 179
6. If you selected SolarWinds individual account, complete the following steps: a. Provide a User Name and a Password for the SolarWinds individual account. b. Confirm the password, and then click Next. c. Define user settings and privileges, as appropriate. For more information, see Editing User Accounts on page 180. 7. If you selected Windows individual account, complete the following steps: a. Provide the User Name and Password for a user that has administrative access to your Active Directory or local domain. b. In the Search for Account area, enter the User name of the Active Directory or local domain user for whom you want to create a new web console account, and then click Search. c. In the Add Users area, select the users for whom you want to create new web console accounts, and then click Next. 8. If you selected Windows group account, complete the following steps: a. Provide the User Name and Password for a user that has administrative access to your Active Directory or local domain. b. In the Search for Account area, enter the Group name of the Active Directory or local domain group for which you want to create a new web console account, and then click Search. c. In the Add Users area, select the users for whom you want to create new web console accounts, and then click Next. When the new account is created, the Edit User Account view displays, showing all configurable account options. For more information about editing account settings, see Editing User Accounts on page 180.
Editing User Accounts

The Edit User Account page provides options for configuring web console user accounts. On the Edit User Account page, administrators can disable an account, set an account expiration date, grant administrator and node management rights, set user view limitations, define a default menu bar, and set several other defaults defining how a user account views and uses the SolarWinds Web Console.
180 Managing Accounts
The following sections and procedures detail the configuration of user accounts. Note: To reset a password, click Change Password at the bottom of the page. User Account Access Settings Setting Account Limitations Defining Pattern Limitations Setting Default Account Menu Bars and Views
Configuring an Account Report Folder Configuring Audible Web Alerts
User Account Access Settings

The following procedure is a guide to setting user account access. To edit a user account: 1. Log in to the SolarWinds Web Console as an administrator. 2. Click Settings in the top right of the web console. 3. Click Manage Accounts in the Accounts grouping of the SolarWinds Website Administration page. 4. Select the account that you want to edit, and then click Edit. 5. Set Account Enabled to Yes or No, as appropriate. Note: Accounts are enabled by default, and disabling an account does not delete it. Account definitions and details are stored in the SolarWinds database in the event that the account is enabled at a later time. 6. If you want the account to expire on a certain date, click Browse () next to the Account Expires field, and then select the account expiration date using the calendar tool. Note: By default, accounts are set to Never expire. Dates may be entered in any format, and they will conform to the local settings on your computer. 7. If you want to allow the user to remain logged-in indefinitely, select Yes for the Disable Session Timeout option. Note: By default, for added security, new user accounts are configured to timeout automatically. 8. If you want to grant administrator rights to the selected account, set Allow Administrator Rights to Yes. Notes: Granting administrator rights does not also assign the Admin menu bar to a user. If the user requires access to Admin options, they must be assigned the Admin view. For more information, see Setting Default Account Menu Bars and Views on page 187. Administrator rights are not granted by default, but they are required to create, delete, and edit accounts. User accounts without administrator rights cannot access Admin page information.
9. If you want to allow the user to manage nodes directly from the SolarWinds Web Console, set Allow Node Management Rights to Yes. Note: By default, node management rights are not granted. For more information about node management in the SolarWinds Web Console, see Managing Nodes from the Web Console" on page 87. 10. If you want to allow the user to customize views, set Allow Account to Customize Views to Yes. Note: By default, customized view creation is not allowed. Changes made to a view are seen by all other users that have been assigned the same view. 11. Designate whether or not to Allow Account to Clear Events and Acknowledge Alerts. 12. Select whether or not to Allow Browser Integration. Note: Browser integration can provide additional functionality, including access to right-click menu options, depending on client browser capabilities. 13. If you want to enable audible alerts through the client browser, select a sound from the Alert Sound list. Note: By default, sounds are stored in the Sounds directory, located at C:\Inetpub\SolarWinds\NetPerfMon\Sounds. Sounds in .wav format that are added to this directory become available as soon as the Edit User Account page refreshes. 14. Provide the maximum Number of items in the breadcrumb list. Note: If this value is set to 0, all available items are shown in breadcrumb dropdown lists.
Configuring Audible Web Alerts

When browsing the SolarWinds Web Console, audible alerts can be sounded whenever new alerts are generated. When enabled, you will receive an audible alert the first time, after login, that an alert is displayed on the page. This alert may come from either an alert resource or the Alerts view. You will not receive audible alerts if the Alerts view or the alert resource you are viewing is empty.
Following the initial alert sound, you will receive an audible alert every time an alert is encountered that was triggered later than the latest alert that has already been viewed. For example, a user logs in and sees a group of alerts with trigger times ranging from 9:01AM to 9:25AM, and the user receives an audible alert. If the user
browses to a new page or allows the current page to auto-refresh, a new alert sounds if and only if an alert triggered later than 9:25AM is then displayed. To enable audible web alerts: 1. Log in to the SolarWinds Web Console as an administrator. 2. Click Settings in the top right of the web console. 3. Click Manage Accounts in the Accounts grouping of the SolarWinds Website Administration page. 4. Select the account you want to configure. 5. Click Edit. 6. Select the sound file you want to play when new alerts arrive from the Alert Sound list. Note: By default, sounds are stored in the Sounds directory, located at C:\Inetpub\SolarWinds\NetPerfMon\Sounds. Sounds in .wav format that are added to this directory become available as soon as the Edit User Account page refreshes. 7. Click Submit.
Setting Account Limitations

Account limitations may be used to restrict user access to designated network areas or to withhold certain types of information from designated users. The following procedure sets user account limitations.
To set user account limitations: 1. Log in to the SolarWinds Web Console as an administrator. 2. Click Settings in the top right of the web console, and then click Manage Accounts in the Accounts group of the SolarWinds Website Administration page. 3. If you want to limit an individual user account, complete the following steps: a. On the Individual Accounts tab, check the account you want to limit. b. Click Edit.
c. Click Add Limitation in the Account Limitations section. d. Select the type of limitation to apply, and then click Continue. Notes: Because SolarWinds NetFlow Traffic Analyzer (NTA) initially caches account limitations, it may take up to a minute for account limitations related to SolarWinds NTA to take effect in SolarWinds NTA. Account limitations defined using the Account Limitation Builder display as options on the Select Limitation page. Account limitations can be defined and set using almost any custom properties. For more information, see Creating Account Limitations on page 289. e. Define the limitation as directed on the Configure Limitation page that follows. For more information about defining pattern-type limitations, see Defining Pattern Limitations on page 186. 4. If you want to limit a group account, complete the following steps: Note: Limitations applied to a selected group account only apply to the group account and not, by extension, to the accounts of members of the group. a. On the Groups tab, check the group account you want to limit. b. Click Edit. c. Click Add Limitation in the Account Limitations section. d. Select the type of limitation to apply, and then click Continue. Notes: Because SolarWinds NetFlow Traffic Analyzer (NTA) initially caches account limitations, it may take up to a minute for account limitations related to SolarWinds NTA to take effect in SolarWinds NTA. Account limitations defined using the Account Limitation Builder display as options on the Select Limitation page. Account limitations can be defined and set using almost any custom properties. For more information, see Creating Account Limitations on page 289. e. Define the limitation as directed on the Configure Limitation page that follows. For more information about defining pattern-type limitations, see Defining Pattern Limitations on page 186. 5. Click Add Limitation in the Account Limitations section. 6. Select the type of limitation to apply from the list, and then click Continue. Notes: Account limitations defined using the Account Limitation Builder display as options on the Select Limitation page. Account limitations can be defined and set
using almost any custom properties. For more information, see Creating Account Limitations on page 289. Because SolarWinds NetFlow Traffic Analyzer (NTA) initially caches account limitations, it may take up to a minute for account limitations related to SolarWinds NTA to take effect in SolarWinds NTA. 7. Define the limitation as directed on the Configure Limitation page that follows. For more information about defining pattern-type limitations, see Defining Pattern Limitations on page 186.
Defining Pattern Limitations

Pattern limitations may be defined using OR, AND, EXCEPT, and NOT operators with _ and * as wildcard characters. The following examples show how to use available operators and wildcard characters: Note: Patterns are not case sensitive.
foo matches only objects named "foo. foo_ matches all objects with names consisting of the string "foo" followed by only one additional character, like foot or food, but not seafood or football. foo* matches all objects with names starting with the string "foo , like football or food, but not seafood. *foo* matches all objects with names containing the string "foo , like seafood or Bigfoot. *foo* OR *soc* matches all objects containing either the string "foo" or the string "soc, including football, socks, soccer, and food. *foo* AND *ball* matches all objects containing both the string "foo" and the string "ball, including football but excluding food. *foo* NOT *ball* matches all objects containing the string "foo" that do not also contain the string "ball, including food but excluding football. *foo* EXCEPT *ball* matches all objects containing the string "foo" that do not also contain the string "ball, including food but excluding football.
You may also group operators using parentheses, as in the following example.
(*foo* EXCEPT *b*) AND (*all* OR *sea*) matches seafood and footfall, but not football or Bigfoot.
Setting Default Account Menu Bars and Views

The Default Menu Bar and Views section provides several options for configuring the default menu bar and views for your user account. The following procedure is a guide to setting these options.
To set default menu bar and view options: 1. Log in to the SolarWinds Web Console as an administrator. 2. Click Settings in the top right of the web console, and then click Manage Accounts in the Accounts grouping of the SolarWinds Website Administration page. 3. Select the account that you want to configure, and then click Edit. 4. Scroll down to Default Menu Bar and Views. 5. Select a Home Tab Menu Bar from the available list.
Note: This is the default menu bar displayed when you click Home in the SolarWinds Web Console. If you are editing a user account that must have administrator privileges, set the Home Tab Menu Bar to Admin. 6. Select an Application Tab Menu Bar from the available list. Note: This is the default menu bar displayed when you click Applications in the SolarWinds Web Console. If you are editing a user account that must have administrator privileges, select Admin. 7. Select a Virtualization Tab Menu Bar from the available list. Note: This is the default menu bar displayed when you click Virtualization in the SolarWinds Web Console. If you are editing a user account that must have administrator privileges, select Admin. 8. If you have installed any additional SolarWinds modules, select a SolarWinds Module Tab Menu Bar from each available list. Note: This step configures the default menu bar displayed when you click the tab corresponding to an installed module in the SolarWinds Web Console. If you are editing an account that must have administrator privileges, select Admin. 9. Select a Home Page View. Note: If no Home Page View is specified, the default is designated to be the same as the page that is specified in the Default Summary View field below. 10. If the Home Page View you have selected refers to a specific network device, select a Default Network Device by clicking Edit and selecting from the list of available devices on the next page. Note: If the Home Page View you have selected does not require a specific network device, SolarWinds will select a device to display, automatically. 11. Select a Default Summary View for the account. Note: This is typically the same as the Home Page View. 12. If you want all reports to be available for the account, select \Reports from the Report folder list in the Default Menu Bars and Views area. Note: If you are creating a new user, you must designate the Report Folder the new account is to use to access SolarWinds reports. By default, no report folder is configured for new users. The Reports directory is located in the SolarWinds SAM installation directory: C:\Program Files\SolarWinds\Orion\. 13. If you want to designate default Node, Volume, and Group Details Views for this account, expand SolarWinds General Settings, and then select appropriate Node Detail, Volume Detail, and Group Detail Views.
14. If you want to designate default Virtualization Summary Manager, Cluster Details, and Datacenter Details Views for this account, expand Integrated Virtual Infrastructure Monitor Settings, and then select appropriate default views. 15. Click Submit.
Configuring an Account Report Folder

Reports may be assigned to an account by creating sub-directories within the Reports directory. Desired reports are included within the sub-directory, and the sub-directories are then made available for assignment to an account. This provides a level of security when reports are included in a view or added as custom menu items. For more information, see Creating and Editing External Website Views on page 129.
To configure an account report folder: 1. Log in to the SolarWinds Web Console as an administrator. 2. Click Settings in the top right of the web console, and then click Manage Accounts in the Accounts group of the SolarWinds Website Administration page. 3. Select the account you want to configure, and then click Edit. 4. If you want all reports to be available for the account, select \Reports from the Report folder list in the Default Menu Bars and Views area. Note: If you are creating a new user, you must designate the Report Folder the new account is to use to access SolarWinds reports. By default, no report folder is configured for new users. The Reports directory is located in the SolarWinds SAM installation directory: C:\Program Files\SolarWinds\Orion\. 5. Click Submit.
Server & Application Monitor Settings

From here, you can select the SAM defaults for the following, as shown in the illustration below:
Application Summary View Select the default view. Components Details View Select the default view. Components Details View Select the default view. SAM User Role Select User or Admin. Note: The SAM User Role allows you to define a SAM Administrator role independent of an Orion Administrator role. Real Time Process Explorer Allows you to select whether or not a user can use the Real Time Process Explorer. Temperature Unit - Allows you to select the default temperature unit displayed; Fahrenheit or Celsius. This will affect all charts that display temperature for the current user.
Orion General Settings

From here, you can select the Orion defaults for the following, as shown in the illustration below:
Node Details View - This view is used when details about a single Network Node are displayed.
Volume Details View - This view is used when details about a single physical or logical Volume are displayed. Group Details View - This view is used when details about a single Group are displayed.
Integrated Virtual Infrastructure Monitor Settings

From here, you can select the Integrated Virtual Infrastructure defaults for the following, as shown in the illustration below:
Virtualization Manager Summary View - This view is the target of the "VMware Summary" link in the page header. Cluster Details View - This view is used when details about a single Cluster are displayed. Datacenter Details View - This view is used when details about a single Data Center are displayed
Chapter 10
Managing SolarWinds SAM Polling Engines

To ensure that your polling engines are optimized to run at peak performance, you will need to occasionally tune them. If you use more than one polling engine, you will need to balance the load so that each engine can perform optimally. Refer to the following sections for more information: Viewing Polling Engine Status Configuring Polling Engine Settings SolarWinds Polling Settings Calculating Node Availability Using the Polling Engine Load Balancer Setting the Node Warning Level Managing Packet Loss Reporting
Viewing Polling Engine Status

The SolarWinds Web Console provides the Polling Engines view, giving you immediate insight into the performance of all polling engines in your SolarWinds installation. To display the Polling Engine view: 1. Log in to the SolarWinds Web Console as an administrator. 2. Click Settings in the top right of the web console. 3. Click Polling Engines in the Details group. For more information about configuring the settings on this view in addition to configuring all other available polling engine variables, see Configuring Polling Engine Settings on page 193.
Configuring Polling Engine Settings

Settings for your SolarWinds SAM polling engine are configured on the SolarWinds Polling Settings view within the SolarWinds Web Console. To open the SolarWinds Polling Settings view:
Managing SolarWinds SAM Polling Engines 193
1. Log in to the SolarWinds Web Console as an administrator. 2. Click Settings in the top right of the web console. 3. Click Polling Settings in the Settings group.
SolarWinds Polling Settings

The following poller settings are configurable on the SolarWinds Polling Settings view. Refer to the following sections for more information: Polling Intervals Polling Statistics Intervals Network Calculations & Thresholds
Polling Intervals
The following settings configure default polling intervals. To apply poller settings, click Re-Apply Polling Intervals. Default Node Poll Interval Devices are regularly polled to determine status and response time on this designated interval. By default, this interval is 120 seconds. Default Volume Poll Interval Volumes are regularly polled to determine status and response time on this designated interval. By default, this interval is 120 seconds. Default Rediscovery Interval Your entire network is polled on this interval to detect any re-indexed devices. Monitored network devices are also checked for IOS upgrades permitting EnergyWise support. By default, this interval is 30 minutes. Lock custom values This option is enabled by default. Enabling this option automatically saves any polling customizations made on the SolarWinds Polling Settings view.
Polling Statistics Intervals

The following settings configure default polling intervals for device statistics. To apply poller settings, click Re-Apply Polling Statistic Intervals.
194 Managing SolarWinds SAM Polling Engines
Default Node Statistics Poll Interval Device performance statistics are regularly polled on this interval. By default, this interval is 10 minutes. Default Volume Statistics Poll Interval Volume performance statistics are regularly polled on this interval. By default, this interval is 15 minutes.
Network
The following settings configure ICMP and SNMP requests. ICMP Timeout All ICMP (ping) requests made by the SolarWinds poller time out if a response is not received within the period designated. By default, this period is 2500ms. ICMP Data This string is included within all ICMP packets sent by SolarWinds. SNMP Timeout All SNMP requests made by the SolarWinds poller time out if a response is not received within the period designated. By default, this period is 2500ms. SNMP Retries If a response to an SNMP poll request made by the SolarWinds poller is not received within the configured SNMP Timeout, the SolarWinds poller will conduct as many retries as designated by this value. By default, this value is 2.
Calculations & Thresholds

The following settings designate methods for calculating availability and transmission rate baselines, select the SolarWinds SAM node warning level and counter type, and indicate security preferences for community strings and other potentially sensitive information in the web console. Availability Calculation (advanced) This setting designates the type of calculation SolarWinds SAM performs to determine device availability. For more information, see Calculating Node Availability on page 196.
Baseline Calculation (advanced) Upon startup, SolarWinds can calculate a baseline for the transmission rates of the various elements of your network. This baseline is used as a starting point for any comparison statistics. For more information, see Calculating a Baseline on page 197. Allow Secure Data on Web (advanced) In the interest of security, sensitive information about your network is not viewable in the SolarWinds Web Console. However, if your network is properly secured, you may check this option to allow the viewing of community strings and other potentially sensitive information within the web console. Note: This setting does not affect the display of custom reports that you export to the web. For more information see Creating and Viewing Reports on page 339. Node Warning Level Devices that do not respond to polling within this designated period of time display as Down in the web console. By default, this value is 120 seconds. Counter Rollover This option sets the type of counter SolarWinds SAM is to use. For more information, see Handling Counter Rollovers on page 101.
Calculating Node Availability

The Availability Calculation setting on the SolarWinds Polling Settings view provides a choice between the following two methods for determining device availability. Node Status: The default method is based upon the historical up or down status of the selected node. The selected node is polled for status on the Default Node Poll Interval defined on the SolarWinds Polling Settings view. For more information, see Orion Polling Settings on page 194. If the selected node responds to a ping within the default interval, the node is considered up, and a value of 100 is recorded in the Response Time table of the SolarWinds database. If the node does not respond to a ping within the default interval, the node is considered down and a value of 0 is recorded in the Response Time table of the SolarWinds database. To calculate node availability over a selected time period, the sum of all Response Time table records for the selected node over the selected time period is divided by the selected time period, providing an average availability over the selected time period.
Percent Packet Loss: The second method is a more complicated calculation that effectively bases the availability of a selected node on its packet loss percentage. As in the Node Status method, the selected node is polled for status. If it responds within the Default Node Poll Interval defined on the SolarWinds Polling Settings view, a value of 100 is averaged with the previous 10 availability records. For more information, see Orion Polling Settings on page 194. The result of the Percent Packet Loss calculation is a sliding-window average. To calculate node availability over a selected time period, the sum of all results in the Response Time table for the selected node over the selected time period is divided by the selected time period, providing an average availability over time. Note: The Percent Packet Loss method introduces a historical dependency into each availability node record. In general, it is best to leave calculations based on Node Status unless you specifically need node availability based on packet loss.
Calculating a Baseline
Much of the raw data that SolarWinds SAM polls from nodes is provided initially as counter values. If you do not need statistics immediately, or if you do not want SolarWinds SAM to calculate a baseline at startup, disable baseline calculation at startup by setting the Baseline Calculation option on the SolarWinds Polling Settings view to False. For more information, see Configuring Polling Engine Settings on page 193. Note: Baseline calculation requires significant data gathering and processing. Until baseline calculation is completed, both SolarWinds SAM server performance and the CPU performance of some of network routers may be adversely affected.
Using the Polling Engine Load Balancer

The Polling Engine Load Balancer is a useful tool for reassigning nodes to a new polling engine, deleting an unused polling engine, and performing load balancing between multiple polling engines. The tool is available within the Monitor Polling Engines application, which is an advanced feature of SolarWinds SAM. Reassigning nodes to new polling engines may be required in the following situations: Moving or renaming your SolarWinds SAM server Merging two or more SolarWinds servers
If these or any other conditions present the need for reassignment, complete the following procedure to reassign nodes to a new polling engine.
To reassign nodes to a different polling engine: 1. Click Start > All Programs > SolarWinds > Advanced Features > SolarWinds Service Manager. 2. Click Shutdown Everything. Note: Confirm that you stop the SolarWinds Network Performance Monitor Service on all polling engines. 3. Click Start > All Programs > SolarWinds > Advanced Features > Monitor Polling Engines. 4. Click Servers > Poller Load Balancing. 5. Select the nodes you want to reassign. Note: Use Shift + click to highlight multiple consecutive rows, and use Ctrl + click to highlight multiple non-consecutive rows. 6. Click Polling Engines > Move Selected Nodes to *, substituting the target polling engine for *. The node is reassigned, and it reflects the name of the polling engine in the polling engine column. 7. Click Start > All Programs > SolarWinds > Advanced Features > SolarWinds Service Manager to restart SolarWinds services.
Setting the Node Warning Level

A device may drop packets or fail to respond to a poll for many reasons. Should the device fail to respond, the device status is changed from Up to Warning. On the SolarWinds Polling Settings view, you can specify the Node Warning Level, which is the length of time a device is allowed to remain in the Warning status before it is marked as Down. During the interval specified, the service performs "fast polling" (ICMP) to continually check the node status. Note: You may see events or receive alerts for down nodes that are not actually down. This can be caused by intermittent packet loss on the network. Set the Node Warning Interval to a higher value to avoid these false notifications. For more information about packet loss reporting, see Managing Packet Loss Reporting on page 199. To set the Node Warning Level: 1. Log in to the SolarWinds Web Console using an account with administrative rights. 2. Click Settings in the upper right of the web console, and then click Polling Settings in the Settings group of the SolarWinds Website Administration view.
3. In the Calculations and Thresholds group, set the Node Warning Level to an appropriate interval, in seconds. Note: The default Node Warning Level interval is 120 seconds. 4. Click Submit.
Managing Packet Loss Reporting

To manage the amount of network-wide packet loss reported by SolarWinds, configure the Response Time Retry Count for your polling engine. This setting designates the number of times SolarWinds retries ICMP pings on a monitored device before packet loss is reported. Note: This configuration change requires an insertion into your SolarWinds database. If possible in your environment, SolarWinds recommends installing and using the SQL Server Management Studio to perform this insertion. To configure the Response Time Retry Count for your polling engine: 1. Create a full backup of your SolarWinds database. 2. On your SolarWinds server, click Start > All Programs > SolarWinds > Advanced Features > SolarWinds Service Manager. 3. Click Shutdown Everything. 4. On your SolarWinds database server, click Start > All Programs > Microsoft SQL Server > SQL Server Management Studio. 5. Select your SolarWinds database Server name. 6. Select an appropriate Authentication type, provide any required credentials, and then click Connect. 7. Expand Databases > SolarWindsDatabaseName > Tables. 8. Click New Query. 9. Type the following query into the empty SQL query field: Note: Specify your own custom values for Maximum, CurrentValue, and DefaultValue.
INSERT INTO [SolarWindsDatabaseName].[dbo].[Settings] (SettingID, Name, Description, Units, Minimum, Maximum, CurrentValue, DefaultValue) VALUES (SWNetPerfMon-Settings-Response Time Retry Count, Response Time Retry Count, Number of times SolarWinds retries ICMP pings on a monitored device before reporting packet loss, , 1, Maximum, CurrentValue, DefaultValue)
10. Click Execute. 11. Close SQL Server Management Studio.

12. On your SolarWinds server, click Start > Run, type regedit, and then click Ok. 13. Expand HKEY_LOCAL_MACHINE > SOFTWARE > SolarWinds.Net > SWNetPerfMon. 14. Right-click Settings, and then click New > String Value. 15. Enter Response Time Retry Count as the New Value. 16. Right-click Response Time Retry Count, and then click Modify. 17. In the Value data field, enter the CurrentValue provided in the query above, and then click Ok. 18. Close the Registry Editor. 19. Click Start > All Programs > SolarWinds > Advanced Features > SolarWinds Service Manager. 20. Click Start Everything.
Chapter 11
Virtualization
SolarWinds Integrated Virtual Infrastructure Monitoring (IVIM) built into SolarWinds SAM lets you monitor today's modern network fabric of virtual networks, virtualized data centers, and private clouds. The deep visibility into your virtualized environments helps you ensure that network performance helps and not hinders your virtualization projects SolarWinds SAM is capable of monitoring VMware ESXi and ESX Servers versions 3.5 and higher. VMware Monitoring Monitor your entire VMware virtual infrastructure from the highest to the lowest level: vCenter datacenter cluster ESX hosts individual virtual machines. Track availability and performance metrics including CPU, memory, storage, and network bandwidth utilization Virtual Machine Auto-Summary Automatically discover identify and monitor new virtual machines added to any VMware host server or updated during vMotion. Virtualization Alerting and Reporting SolarWinds' native alerting and reporting capabilities extend seamlessly to your virtual infrastructure. Refer to the following sections for more information: Requirements for Monitoring ESXi and ESX Servers Managing VMware Credentials in the Web Console Adding VMware Servers for Monitoring Virtualization Summary Viewing ESX Host Details Changing Polling Orders for ESX Servers
Virtualization 201
Requirements for Monitoring ESXi and ESX Servers

The following table provides minimal requirements for effectively using SolarWinds SAM to monitor your VMware ESXi and ESX Servers.
Requirement Description SolarWinds SAM uses SNMP to monitor all ESXi and ESX Servers. For more information about enabling SNMP, refer to the following sections: SNMP Enabling SNMP on VMware ESXi Enabling SNMP on ESX Server version 3.5 Enabling SNMP on ESX Server Version 4.0 Creating ESX Server Credentials for SolarWinds SAM
VMware API
SolarWinds SAM uses the VMware API to poll most performance data from devices running ESXi and ESX Server versions 3.5 and 4.0. For more information about creating required credentials, see Creating ESX Server Credentials for Orion on page 207. VMware Tools must be installed on all ESXi and ESX Servers you intend to monitor. VMware Tools is not required on virtual machines running on monitored ESXi and ESX servers, but additional information, including IP addresses, are made available when VMware Tools is installed on virtual machines hosted by monitored ESXi and ESX Servers.
VMware Tools
The following table provides a summary of the methods used by SolarWinds SAM to monitor VMware ESX Servers.
3.5 Detection as ESX Server Volumes Interfaces CPU Memory Total Memory Guest VM List SNMP SNMP SNMP SNMP N/A N/A N/A N/A 3i 4 VMware API SNMP SNMP SNMP SNMP VMware API VMware API N/A SNMP (partial) SNMP SNMP 4i
202 Virtualization
Enabling SNMP on VMware ESXi and ESX Servers

SolarWinds SAM uses SNMP to poll performance data from VMware ESXi and ESX Servers. In order to make this performance data available to SolarWinds SAM, you must enable SNMP on your VMware ESXi and ESX Servers, as described in the following sections: Note: VMware only makes a limited amount of information available to SNMP queries for VMware ESXi and ESX Servers version 4.0 and higher. To access additional information on these versions, SolarWinds SAM utilizes the VMware API.
Enabling SNMP on VMware ESXi

The following procedure enables SNMP on VMware ESXi. Note: The following procedure to enable SNMP requires the vSphere command line interface (CLI). The vSphere CLI is not packaged with your ESXi Server by default, so you will need to download it from VMware, as indicated. To enable SNMP on VMware ESXi: 1. Download and install the VMware vSphere command line interface from the VMware Download Center (http://downloads.vmware.com/d/). 2. Use the vSphere CLI to view your ESXi server SNMP settings, as indicated in the following procedure: a. In the Perl\bin directory of your vSphere installation, execute the following script:
perl ..\..\bin\vicfg-snmp.pl --server ip_address s
Notes:
C:\Program Files\VMware\VMware vSphere CLI\Perl\bin is the default location of the vSphere Perl\bin directory.
Replace ip_address with the IP address of your ESXi server, and replace cstring with the community string you are adding. For most environments, the community string public should be sufficient. b. Enter an appropriate user name at the prompt. Note: For most environments, root should be sufficient. c. Enter the associated password at the prompt.
Virtualization 203
3. Use the vSphere CLI to enable SNMP on your ESXi server, as indicated in the following procedure: a. In the Perl\bin directory of your vSphere installation, execute the following script to add an appropriate community string:
perl ..\..\bin\vicfg-snmp.pl --server ip_address -c cstring
Note: Replace ip_address with the IP address of your ESXi server, and replace cstring with the community string you are adding. For most environments, the community string public should be sufficient. b. Enter an appropriate user name at the prompt. Note: For most environments, root should be sufficient. c. Enter the associated password at the prompt. d. In the Perl\bin directory of your vSphere installation, execute the following script to enable SNMP:
perl ..\..\bin\vicfg-snmp.pl --server ip_address E
Note: Replace ip_address with the IP address of your ESXi server. e. Enter an appropriate user name at the prompt. Note: For most environments, root should be sufficient. f. Enter the associated password at the prompt.
4. Reboot your ESXi server to allow settings to take effect.
Enabling SNMP on ESX Server version 3.5

The following procedure enables SNMP on ESX Server version 3.5. Note: For more information about ESX Server 3.5 and ESX Server MIBs, see the VMware document, Basic System Administration - ESX Server 3.5, ESX Server 3i version 3.5, VirtualCenter 2.5. To enable SNMP on ESX Server version 3.5: 1. Log in to your ESX Server using an account with administrative privileges. 2. Open snmpd.conf in a text editor. Notes: The default location for snmpd.conf is root/etc/snmp/snmpd.conf. To use the default text editor, nano, in a default ESX Server version 3.5 environment, enter nano /etc/snmp/snmpd.conf at the prompt.
204 Virtualization
3. Locate the rocommunity setting and replace the default community string public with an appropriate read-only community string for your environment. Note: Use commas to separate multiple community strings. 4. Save snmpd.conf, and then close your editor. Note: If you are using nano, press Ctrl+X to close nano, and then enter Y to save snmpd.conf. 5. Enter chkconfig snmpd on to enable SNMP when you reboot your ESX Server. 6. Enter esxcfg-firewall -e snmpd to allow SNMP through the ESX Server firewall. 7. Enter service snmpd start to start the SNMP service. 8. Confirm that SNMP polling is enabled on your ESX Server by entering the following command:
snmpwalk -v1 -c cstring localhost .1.3.6.1.4.1.6876 | grep 6876.1
Note: Replace cstring with the community string you provided above. 9. After entering the snmpwalk command, your ESX Server should return information similar to the following:
SNMPv2-SMI::enterprises.6876.1.1.0 = STRING: "VMware ESX Server" SNMPv2-SMI::enterprises.6876.1.2.0 = STRING: "3.5.0" SNMPv2-SMI::enterprises.6876.1.3.0 = OID: SNMPv2SMI::enterprises.6876.60.1.3.5.0 SNMPv2-SMI::enterprises.6876.1.4.0 = STRING: "153875"
Note: The MIB OID SNMPv2-SMI::enterprises.6876.1.4.0 returns the build number for your product, so it may not be the same as the build number displayed above.
Enabling SNMP on ESX Server Version 4.0

The following procedure enables both the system default SNMP daemon snmpd and the proprietary VMware SNMP daemon vmware-hostd on VMware ESX Server version 4.0. Note: For more information about ESX Server 4.0 and ESX Server MIBs, see the VMware document, vSphere Basic System Administration - Update 1, ESX 4.0, ESXi 4.0, vCenter Server 4.0.
Virtualization 205
To enable SNMP on ESX Server version 4.0: 1. Log in to your ESX Server using an account with administrative privileges. 2. Open snmp.xml in a text editor. Notes: The default location for snmp.xml is root/etc/vmware/snmp.xml. To use the default text editor, nano, in a default ESX Server version 4 environment, enter nano /etc/vmware/snmp.xml at the prompt. 3. Locate the communities tag, and then replace the default community string public with an appropriate read-only community string for your environment. Note: Use commas to separate multiple community strings. 4. Locate the enable tag, and then confirm it is set to true. 5. Locate the port tag and confirm it is set to 171. 6. Locate the targets tag and confirm it is set to 127.0.0.1@162/cstring. Note: Replace cstring with the community string you provided above. 7. Save snmp.xml, and then close your editor. Note: If you are using nano, press Ctrl+X to close nano, and then enter Y to save snmp.xml. 8. Enter service snmpd stop to confirm that the SNMP service is stopped. 9. Open snmpd.conf in a text editor. Notes: The default location for snmpd.conf is root/etc/snmp/snmpd.conf. To use the default text editor, nano, in a default ESX Server version 4 environment, enter nano /etc/snmp/snmpd.conf at the prompt. 10. Edit snmpd.conf to include the following two lines:
view systemview included .1.3.6.1.4.1.6876 proxy -v 1 -c cstring 127.0.0.1:171 .1.3.6.1.4.1.6876
Note: Replace cstring with the community string you provided above. 11. Save snmpd.conf, and then close your editor. Note: If you are using nano, press Ctrl+X to close nano, and then enter Y to save snmpd.conf. 12. Enter service mgmt-vmware restart to restart the mgmt-vmware service.
206 Virtualization
13. Enter service snmpd start to start the SNMP service. 14. Enter chkconfig snmpd on to enable SNMP when you reboot your ESX Server. 15. Enter esxcfg-firewall -e snmpd to allow SNMP through the ESX Server firewall. 16. Confirm that SNMP polling is enabled on your ESX Server by entering the following command:
snmpwalk -v1 -c cstring localhost .1.3.6.1.4.1.6876 | grep 6876.1
Note: Replace cstring with the community string you provided above. 17. After entering the snmpwalk command, your ESX Server should return information similar to the following:
SNMPv2-SMI::enterprises.6876.1.1.0 = STRING: "VMware ESX" SNMPv2-SMI::enterprises.6876.1.2.0 = STRING: "4.0.0" SNMPv2-SMI::enterprises.6876.1.4.0 = STRING: "208167"
Note: The OID SNMPv2-SMI::enterprises.6876.1.4.0 returns your product build number, so it may not be the same as the build number above.
Creating ESX Server Credentials for SolarWinds SAM

SolarWinds SAM uses the VMware API to poll most of its performance data from devices running ESX Server versions 3.5 and 4.0. You must create credentials on your ESX Servers for the SolarWinds SAM polling engine, as shown in the following procedure. Note: Credentials created for the SolarWinds SAM polling engine must have read-only rights as a minimum. To create ESX Server credentials for SolarWinds SAM: 1. Log in to your ESX Server using an account with administrative privileges. Note: Typically, the root user name and password is sufficient. 2. If you are prompted with an untrusted SSL certificate warning, click Ignore to continue using the current SSL certificate. 3. Open the Users & Groups tab, and then click Users. 4. Right-click the Users view, and then click Add. 5. On the Add New user window, complete the following procedure: Note: The User Name and Password provided in this step must be provided either in your initial network discovery or whenever you use Web Node Management to add the current ESX Server to SolarWinds SAM for
Virtualization 207
monitoring. a. Provide both a Login and a User Name for the SolarWinds SAM polling engine. b. Enter and confirm a Password. c. Click Ok. 6. Open the Permissions tab. 7. Right-click the Permissions view, and then click Add Permission. 8. On the Assign Permissions window, click Add. 9. Select the user you just created, and then click Add. 10. Click Ok on the Select Users and Groups window. 11. Select an appropriate role in the Assigned Role area, and then click Ok on the Assign Permissions window. The credential you have created is now available to use for monitoring your ESX Server. For more information about adding your ESX Server to the SolarWinds database for monitoring, see Managing VMware Credentials in the Web Console on page 208.
Managing VMware Credentials in the Web Console

If you have to update the user name or password of a VMware credential, you can do so from the VMware Credentials Library tab. To update a VMware credential: 1. Log in to the web console. 2. Click Settings. 3. Click VMware Settings in the Node & Group Management section. 4. Click the VMware Credentials Library tab. 5. Check the credential you need to update, and then click Edit Credential. 6. Make the necessary updates, and then click Ok.
Adding VMware Servers for Monitoring

VMware Vcenter, ESX servers, and virtual machines are added to the SolarWinds database in the same ways other devices are added for monitoring in the SolarWinds Web Console
208 Virtualization
Polling for VMware nodes Using the Network Sonar Wizard The Network Sonar Wizard is the recommended method for adding VM Servers for monitoring in the SolarWinds Web Console. With Network Sonar Discovery, you can define all required credentials at once on the Local ESX Credentials for Vmware view. For more information, see "Virtualization Discovery" on page 150. Adding VMs from the VMware Assets Resource 1. Log in to the web console. 2. Point to the Virtualization tab and then click Virtualization Summary. 3. Click the [+] next to any ESX or Vcenter server listed in the VMware Assets resource to expand the list of virtual machines. 4. Click a virtual machine that is not currently managed by SolarWinds. Unmanaged VMs are listed in italic type. 5. Click Yes, Manage this Node. 6. If the VM is not running VMware Tools, manually enter the IP address of the VM in the Hostname or IP Address field. 7. Check any additional options required to monitor the VM, and then click Next. 8. Follow the remainder of the Add Node wizard to completion, and then click Ok, Add Node.
Virtualization Summary
The Virtualization Summary view shows the overall status of your virtualized infrastructure. To view the Virtualization Summary: 1. Log in to the SolarWinds Web Console. 2. Point to the Virtualization tab and then click Virtualization Summary. The Virtualization Summary view is pre-configured to display the following resources:
Top 10 VMware Hosts by CPU Load Top 10 VMware Hosts by Percent Memory Used VMware Assets Top 10 VMware Hosts by Number of Running VMs Top 10 VMWare Hosts by Network Utilization VMware Asset Summary
To change the properties or contents of any resource, click Edit in the resource box.
Virtualization 209
Viewing ESX Host Details

The ESX Host Details page is displayed when you click an ESX Host server in the Virtualization Summary. This page is pre-configured to display the following resources:
Active Alerts on this Node Average Response Time & Packet Loss Graph CPU Load & Memory Utilization Gauge ESX Host Details List of Virtual Machines Node Details Virtual Machine CPU Consumption Virtual Machine Network Traffic Availability Statistics Average Response Time & Packet Loss Gauge Disk Volumes Event Summary Min/Max AverageCPU Load Graph Polling Details Virtual Machine Memory Consumption
To change the properties or contents of any resource, click Edit in the resource box.
Changing Polling Orders for ESX Servers

If your VMware ESX hosts are controlled by VMware vCenter servers, SolarWinds obtains the status of the ESX hosts from the vCenter server instead of polling the ESX hosts directly. To poll the ESX servers directly you must change the Poll Through setting of the ESX host from the VMware Settings page. From this page, you can also disable and enable polling for ESX hosts and vCenter servers. To poll a vCenter-managed ESX Host from the SolarWinds server: 1. Log in to the web console. 2. Click Settings. 3. Click VMware Settings in the Node & Group Management section. 4. Point to any column heading, click the upside-down triangle, and then click Columns > Polling Through. 5. Select the ESX hosts you want to poll directly. 6. Click Poll Through > Poll ESX server directly.
210 Virtualization
Troubleshooting ESX Hardware Monitoring

When an ESX server returns the message, Unable to connect to remote server, check the following: Ensure CIM is enabled on the ESX server. To enable CIM on ESX/ESXi, refer to the following section: "Hardware Monitoring and VMware" on page 376. Ensure port 5989 is opened on the firewall
If the ESX server returns the message, Unable to establish session with all provided credentials, check the following: Verify the VMware credentials in the VIM are correct Verify the account belongs to the root user group
Virtualization 211
212 Virtualization
Chapter 12
Building Component Monitors and Templates

The following diagram illustrates the work flow involved in creating an application to be monitored by SolarWinds Server & Application Monitor.
Refer to the following sections for more information: Understanding Component Monitors and Application Monitor Templates
Building Component Monitors and Templates 273
Choosing Component Monitors and Templates Based on Protocol Requirements for Component Monitors and Templates that use WMI Monitoring External Nodes Understanding the Credentials Library
272 Building Component Monitors and Templates
Using Application Monitor Templates Managing Assigned Application Monitors Working with Component Monitors Scripting Custom Component Monitors Custom Application Monitor Template Example: Creating a SolarWinds SAM Template Conversion Value Available Data Transformations
Understanding Component Monitors and Application Monitor Templates

The following terms are used throughout this guide to describe the SolarWinds SAM concepts that allow you to monitor your applications. Component Monitors Component monitors are the building blocks of SolarWinds SAM. Each monitors the status and performance of a different aspect of an application. There are several different types of component monitors, each containing settings that define what is monitored and how to monitor it. Some types of component monitors allow you to set threshold conditions on the monitored parameters. You can set separate thresholds to indicate warning and critical conditions. For example, if you are monitoring the percentage of free space remaining on a volume, you can set a warning threshold at 15%, and a critical condition at 5%. As an analogy, pretend SolarWinds SAM is monitoring a car. You would have component monitors to check tire pressure, engine RPM, water temperature, battery voltage, and other important subsystems of that vehicle. You can set alerts to give notification if the water gets too hot, or if the battery voltage drops too low. Application Monitor Templates A template is a group of component monitors modeling the total availability and performance level of an application. A complicated application such as Windows Server may require dozens of component monitors to accurately assess its current status and performance. Instead of creating component monitors one-by-one for every application server, you can assign a pre-made template. The template can either be one included with SolarWinds SAM, or a custom template you make yourself. For example, you can assign the included Microsoft Windows Server 2003-2008 template to your Windows 2003 and Windows 2008 computers and obtain vital statistics on all of them. A template is only a blueprint and does not perform any monitoring on its own. Only after assigning the template to a server node are active assigned component monitors created. To continue the car analogy, pretend you want to monitor a fleet of 50, 2010, blue Dodge Charger automobiles. Instead of defining the component monitors for 50 cars, you can define all the component monitors in a Dodge Charger template.
Assigned Component Monitors Assigned component monitors are created by assigning Application Monitor templates to server nodes. Each actively monitors its assigned node according to its settings. Component monitors inherit these initial settings from the template. If you make a change to a template, that same change is rolled out to all assigned Application Monitors based on the template. You can override the template settings at any time, breaking the inheritance relationship between the component monitor and its template. For example, the user name and password usually differ for each node, and you would select a different credential for each assigned Application Monitor, thus overriding the template setting for the Credentials field. To restore the inheritance relationship between a component monitor and its template, click Inherit From Template next to the setting. Continuing the car analogy, when you assign the Dodge Charger template to a Dodge Charger vehicle, you now have a set of assigned component monitors for monitoring the vehicles tire pressures, engine RPM, and so forth. Assigned Application Monitors An assigned Application Monitor runs its assigned component monitors at regular intervals, and then uses the status results from the component monitors to determine an overall status for the application. If some of the component monitors are up and others are down, the Application Monitor follows the Status Rollup Mode setting in the SolarWinds Web Console Settings to show either the worst status of the group or a warning status. The difference between an assigned Application Monitor and a template is that the template is only a blueprint and does not perform any monitoring on its own. Only after assigning the template to a server node does SolarWinds SAM conduct any actual monitoring on the node. To complete the car example, you assign the Dodge Charger template to all the Dodge Charger vehicles to create the assigned Application Monitor for determining the overall status for your Dodge Charger fleet. For example, the fleet may be 95% available at a given time due to warnings for some of the cars.
Choosing Component Monitors and Templates Based on Protocol

If you have a choice between components or templates that return the needed value using different protocols, consider the following guidelines for making your choice, based on the protocol: 1. SNMP is the best protocol to use from the reliability and speed perspective. It is much faster and more reliable than both Performance counters and WMI, and it has lowest impact on system performance. 2. WMI calls can sometimes take a relatively long time, and they have a significant overhead. RPC vs. WMI The reason some SAM templates only use RPC is primarily customer demand. RPC is generally considered more reliable. It also uses less overheard making it faster than WMI and it is firewall friendly. There are distinct advantages and disadvantages to both RPC and WMI, which is why SAM utilizes both methods for retrieving information.
Requirements for Component Monitors and Templates that use WMI

Microsoft Windows by default uses a random port between 1024 and 65535 for WMI communications. You must create firewall exceptions to allow TCP/UDP traffic on ports 1024 - 65535 or the component monitors and templates that use WMI will not work. The following component monitors use WMI: Performance Counter Monitor Process Monitor WMI (if script uses WMI access) Windows Event Log Monitor Windows PowerShell Monitor (if script uses WMI access) Windows Script Monitor Windows Service Monitor (if script uses WMI access)
The following templates use WMI: Active Directory Blackberry Enterprise Server
Citrix XenApp 5.0 Core WMI Counters Citrix XenApp 5.0 ICA Session WMI Counters Citrix XenApp 5.0 Presentation Server WMI Counters Citrix XenApp 5.0 Services Errors in Application Event Log Exchange 2007 Exchange 2007 Client Access Role Services Exchange 2007 Client Access Role WMI Counters Exchange 2007 Common WMI Counters Exchange 2007 Edge Transport Role Services Exchange 2007 Hub Transport Role Services Exchange 2007 Hub Transport Role WMI Counters Exchange 2007 Mailbox Role Services Exchange 2007 Mailbox Role WMI Counters Exchange 2007 Unified Messaging Role Services Exchange 2007 WMI Counters Exchange 2010 Client Access Role Services Exchange 2010 Common Performance Counters Exchange 2010 Edge Transport Role Services Exchange 2010 Hub Transport Role Services Exchange 2010 Mailbox Role Services Exchange 2010 Unified Messaging Role Services Exchange Server 2000 and 2003 Internet Information Services SolarWinds Server SharePoint Server (MOSS) 2007 SharePoint Services (WSS) 3.0 SQL Server 2005 Database SQL Server 2008 Database
Windows Print Services Windows Server 2003-2008
Monitoring External Nodes

To monitor services and applications on a server you do not directly manage, add the server to the SolarWinds database as an external node. External nodes skip all network performance data collection and polling tasks, but allow you to assign applications to them. For example, you could add www.google.com as an external node, and then assign several HTTP monitors to monitor Google search results. For more information, see Managing Nodes from the Web Console" on page 87.
Understanding the Credentials Library

You typically need to associate credentials with component monitors to enable them to retrieve application data. For example, to use a WMI monitor, you must provide valid domain or computer credentials. Or, if your web server requires credentials, you must provide the appropriate credentials to access the protected sections of your site. You can work with credentials by: Adding credentials to the Credentials Library for use later. See the section Adding Credentials to the Credentials Library on page 221 for details. Creating credentials on the spot (Quick Credentials) when editing templates and component monitors. See the section Using Quick Credentials on page 222 for details. Editing credentials. See the section Editing Credentials in the Credentials Library on page 221 for details. Deleting credentials. See the section Deleting Credentials from the Credentials Library on page 221 for details.
Notes: SolarWinds Server & Application Monitor uses the same SNMP credentials that you entered during node discovery. There is no need to specify additional credentials for SNMP operations. SolarWinds SAM stores credentials encrypted in the database. The ability to Inherit Windows credentials from node is available in the dropdown list.
Adding Credentials to the Credentials Library

Perform the following to add credentials for later use. To add credentials from the Credential Library page: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Credentials Library. 5. Click Add New Credential. 6. Provide a friendly name for the credential set. SolarWinds Server & Application Monitor displays this name in the Credential for Monitoring field of monitors that accept credentials. 7. Provide the user name and password, and then confirm the password and click Submit. If you are providing windows credentials for accessing and harvesting information through WMI, ensure you provide the account name in the following syntax: domainOrComputerName\userName for domain level authentication or userName for workgroup level authentication. You can assign credentials to all the associated components of a template or Application Monitor.
Editing Credentials in the Credentials Library

Perform the following to edit credentials for later use. To edit an existing credential from the Credential Library page: 1. Click Edit for the desired credential. 2. Modify the information as needed. 3. Then click Submit.
Deleting Credentials from the Credentials Library

Perform the following to delete credentials from the Credentials Library. To delete an existing credential from the Credential Library page: 1. Click Delete for the desired credential. 2. Then click Ok to confirm the deletion.
Using Quick Credentials

Perform the following to use Quick Credentials: To create and assign credentials using Quick Credentials when editing a template or Application Monitor: 1. If the credential you want to assign does not exist, create it by following these instructions: a. Select <New Credential> in the Choose Credential field. b. Type a name for the new credential in the Credential Name field. c. Type the user name for the credential in the User Name field. d. Type the password in the Password field, and type it again in the Confirm Password field. 2. If you want to assign an existing credential, select the credential from the Choose Credential field. 3. Click Set Component Credentials to set this credential as the credential for all the components in the Application Monitor or template. Note: The ability to Inherit Windows credentials from node is available in the dropdown list. Anywhere you have the option to specify credentials for an application template or component monitor, you also have the the option to utilize the existing WMI credentials already used to manage the host.
Using Application Monitor Templates

This section discusses the many operations you can perform in SolarWinds SAM regarding the use and management of Application Monitor templates. The topics include: Scanning Nodes for Applications Manually Assign Application Creating New Templates Copying Templates Exporting and Importing Templates Locally or Using Thwack Deleting Templates Managing Component Monitors Within Templates Tagging Templates
Scanning Nodes for Applications

SolarWinds SAM can scan nodes for you and automatically assign the Application Monitors it deems suitable for each scanned node. You control the nodes to be scanned, the application templates used in the scan, and the scanning parameters that determine a match. To use the application discovery: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Scan Nodes for Applications. 5. Follow the instructions in the Select Nodes Wizard. 6. Follow the instructions in the Select Applications Wizard. 7. Follow the instructions in the Enter Credentials Wizard. 8. Follow the instructions in the Review & Start Scan Wizard. 9. Follow the instructions in the Add UX Monitors Wizard. Select Nodes Click [+] in the list to expand the node groups and to select the nodes you want to scan.
Select Applications To keep the time it takes to scan to a minimum, we recommend you initially scan for only a limited number of application templates. To see more application templates, select a different template group from the Show Only list. To adjust the template assignment criteria, expand Advanced Scan Settings and move the slider to the desired setting: Exact Match All the components must match to assign the template. Strong Match Most of the components must match to assign the template. Partial Match Some of the components must match to assign the template. Minimal Match At least one component must match to assign the template. Enter Credentials Some application templates require credentials either to access restricted resources, or to run within the context of a specific user. To scan for these templates, add the necessary credentials to the list. If a template you are scanning for requires credentials, the credentials in this list are tried in the order in which they appear. Warning!: Credentials are tried several times over the course of a scan, so an incorrect password is likely to lock out an account. To avoid potential account lockouts that affect actual users, we recommend you create and use service accounts. A service account is an account that is created specifically for the purpose of providing credentials to use for SolarWinds monitoring. With service accounts, no actual user is affected by an account lockout if a password should be entered incorrectly. If you have domains sharing user names with different passwords, we recommend you run separate application discoveries for each domain. Review & Start Scan Review the summary for the scan. If the automatic discovery matches templates that are already assigned to the node, by default the template is not assigned a second time. If you want to assign duplicate templates, select Yes, Assign Anyway from the Do you want to assign duplicates list.
Click Start Scan to begin the scan. The scan runs in the background. You are notified by a message near the top of the window when scanning is completed. Click View results to see the results of the scan. Add UX Monitors You cannot scan for user experience (UX) monitors, but you can assign them to nodes manually. Adding monitors from this page does not affect your scan.
Manually Assign Application Monitors

The quickest way to assign Application Monitors to nodes is through the Add New Application Monitors Wizard, but you can also assign them through the Manage Templates page. To assign a template using the wizard: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Manually Assign Application Monitors. 5. Select the Application Monitor template you want to apply, and then click Next. 6. Select the server node or nodes to which you want to apply the Application Monitor template, and then click Next. 7. If suitable credentials already exist, choose the credential from the Choose Credential list. 8. If suitable credentials do not exist, choose <New Credential> from the Choose Credential list, and then add the new credential by filling out the credential details. 9. Click Test to test the credentials and component monitors against the test node. 10. If the test fails, troubleshoot the problem based on the error messages, and then retest the node. 11. If the test passes, click Assign Application Monitors. To assign a template through the Manage Application Monitor Templates page: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings.
4. Click Manage Templates. 5. Select the tag by which to filter the templates. 6. Check the check box next to the template you want to assign. 7. Click Assign to Node. 8. Select the server node or nodes to which you want to apply the Application Monitor template, and then click Next. 9. If suitable credentials already exist, choose the credential from the Choose Credential list. 10. If suitable credentials do not exist, choose <New Credential> from the Choose Credential list, and then add the new credential by filling out the credential details. 11. Click Test to test the credentials and component monitors against the test node. 12. If the test fails, troubleshoot the problem based on the error messages, and then retest the node. 13. If the test passes, click Assign Application Monitors. 14. Review the information for the assigned Application Monitor and then click Done.
Creating New Templates

SolarWinds SAM allows you to create new templates by bundling component monitors together. There are two ways of creating a template from scratch. The traditional method allows you to create any kind of template. The browsing method only creates templates monitoring services, processes, and performance counters. Creating New Templates Using the Traditional Method To create a new template using the traditional method: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Create a new template. 5. Type a name for your template in the Template Name field. 6. Specify the values for the Polling Frequency and Polling Timeout fields.
Note: Setting a polling frequency below 30 seconds can result in erratic monitor behavior. 7. If you want to turn on extended debug information to assist Customer Support, expand Advanced and then turn Debug logging On and specify the Number of log files to keep. Here you can also select either 32bit or 64bit from the dropdown list entitled, Platform to run polling job on. Note: Do not turn on Debug logging unless directed by Customer Support. 8. Click Add Component Monitor. 9. Expand the component groups and check all the component monitors you want to add. Note: You can select multiple component monitors of the same type to be added by entering a number in the field next to the check box for the component monitor and then checking the check box. 10. Click Submit. 11. Configure the component monitor settings, and then click Submit. Creating New Templates Using the Browsing Method To create a new template using the browsing method: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Find Processes, Services, and Performance Counters. 5. Select the component monitor type that you want to browse, then click Next. 6. Type the IP address of the node you want to browse, or click Browse and select the node from the list. 7. If suitable credentials already exist, choose the credential from the Choose Credential list. 8. If suitable credentials do not exist, choose <New Credential> from the Choose Credential list, and then add the new credential by filling out the credential details. 9. Click Next. 10. If you selected a performance counter monitor type, select a performance object from Performance Object to populate the list.
11. Check the check boxes next to one or more found items to add as a component monitor. 12. Click Next. 13. Configure the component monitor properties, and then click Next. Note: You can specify the name of a specific process to monitor by entering the name in the Process Name field. 14. Select New Application Monitor Template. 15. Type a name for your template in the Application Monitor Template Name field. 16. Click Next. 17. If you want to assign the template to nodes, select the nodes. 18. If you only want to create the template, do not select any nodes. 19. Click Next, and then click Ok, Create.
Managing Templates
You can create a new template or manage existing templates by using the commands on the SAM Settings page: Creating Templates Assign to Node Editing Templates Copying Templates Exporting and Importing Templates Locally or Using Thwack Deleting Templates Tagging Templates
Creating Templates You can create a new template by specifying the name of the template and then adding the desired component monitors. To create an application template: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings.
4. Click Manage Templates. 5. Click Create New Template. See Creating New Templates Using the Traditional Method for information on completing the new template. Assign to Node You can create an assigned Application Monitor by assigning template(s) to nodes. To create an assigned Application Monitor by assigning template(s) to nodes: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Manage Templates. 5. Check the check box for the template(s) you want to assign. 6. Click Assign to Node. 7. Specify the node(s) to monitor and then click Next. 8. If suitable credentials already exist, choose the credential from the Choose Credential list. 9. If suitable credentials do not exist, choose <New Credential> from the Choose Credential list, and then add the new credential by filling out the credential details. 10. Click Test to test the credentials and component monitors against the test node. 11. If the test fails, troubleshoot the problem based on the error messages, and then retest the node. 12. If the test passes, click Assign Application Monitors. Editing Templates You can modify an existing template by adding or removing its component monitors. You can then save it to a new template by changing the template name if desired. To edit an application template: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab.
3. Click SAM Settings. 4. Click Manage Templates. 5. Check the application template you want to edit, and then click Edit. 6. If you are creating a new template by modifying an existing template, specify the name for your new template in the Template Name field. 7. Specify the values for the Polling Frequency and Polling Timeout fields. Note: Setting a polling frequency below 30 seconds can result in erratic monitor behavior. 8. To turn on extended debug information to assist Customer Support , expand Advanced and then set Debug logging On and specify the Number of log files to keep. Here you can also select either 32bit or 64bit from the dropdown list entitled, Platform to run polling job on. Note: Do not turn on Debug logging unless directed by Customer Support. 9. Click Add Component Monitor. 10. Expand the component groups and check all the component monitors you want to add. Note: You can select multiple component monitors of the same type to be added by entering a number in the field next to the check box for the component monitor and then checking the check box. 11. Click Submit. 12. Remove component monitors if desired by clicking Delete. 13. Configure the component monitor settings, and then click Submit. Copying Templates After successfully creating a complicated template, instead of having to recreate it over for a similar application, consider copying the template. This will allow you to only modify those properties that differ. To copy an application template: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings.
4. Click Manage Templates. 5. Check the application template you want to copy, and then click Copy. Exporting and Importing Templates Locally or Using Thwack You can export and import templates to and from your file system for your own use, or to the SolarWinds community site (thwack.com) where templates can be shared with the network engineering community. Note: thwack.com import and export operations require Internet connectivity to thwack.com and thwack.api.solarwinds.com. In addition, thwack export operations require a valid thwack.com user account. To export a template: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Manage Templates. 5. If you want to export a template to a file, complete the following procedure: a. Check the application template you want to export, and then click Import/Export > Export as File. b. Confirm that you want to save the file by clicking Save. c. If you are prompted for a path, specify or browse to one and then click Save. 6. If you want to export the template to thwack.com, complete the following procedure: a. Click Share Now to open a browser to the Application Monitor Templates area of thwack, where you can upload your newly exported application template. b. Click Sign in and then type your thwack.com user name and password. c. Click Upload a File and then specify the file pathname to your newly exported application template. To import a template from a file: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings.
4. Click Manage Templates. 5. Click Import/Export > Import. 6. Click Browse and select the template file, then click Open. 7. Click Submit. Note: If you import a template with the same name as one of your existing templates, the name of the imported template is modified by appending (n) to the name, where n is an integer. For example, assume you save the template named Tomcat Server Template (shipped with SAM) to a file. If you then import the saved template Tomcat Server Template from the file, the imported template is renamed as Tomcat Server Template (1). If you import the same template again, the next imported template is named Tomcat Server Template (2), and so on. This renaming protects you from accidentally overwriting an existing template. To import a template from thwack: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Shared thwack templates. 5. Check the template(s) you want to import, and then click Import. Then enter your thwack User Name and Password and click Log In. 6. A dialog is displayed informing you that the import operation was successful. Click Close to close the dialog or click View Imported Templates to view the results. Note: If you import a template with the same name as one of your existing templates, the name of the imported template is modified by appending (n) to the name, where n is an integer. For example, assume you save the template named Tomcat Server Template (shipped with SAM) to a file. If you then import the saved template Tomcat Server Template from the file, the imported template is renamed as Tomcat Server Template (1). If you import the same template again, the next imported template is named Tomcat Server Template (2), and so on. This renaming protects you from accidentally overwriting an existing template. Deleting Templates If you no longer need a template, you can delete it. Deleting a template also deletes all the data associated with it, so ensure you no longer need either the template or the associated data before deleting the template. Notes:
Deleting a template also deletes all of its assigned applications, both modified and unmodified. To speed user interface interaction, data is not immediately removed from the database, but systematically updated every few minutes in the background.
To delete a template: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Manage Templates. 5. Check the template(s) you want to delete, and then click Delete. 6. Confirm you want to delete the template(s) by clicking Yes. Tagging Templates Tags are descriptive labels that help you classify and sort your application templates on the Manage Application Monitor Templates page. The application templates included in SolarWinds SAM have already been tagged with several descriptive labels you can modify as you see fit. To add tags: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Manage Templates. 5. Select the templates you want to tag. 6. Click Tags. 7. If you want to add existing tags, follow these instructions: a. Click Add existing tag(s). b. Select the tags from the list. 8. If you want to add new tags, follow these instructions: a. Click Add new tag(s). b. Type the tags in the Add new tag(s) field, separating multiple tag entries with commas. 9. Click Submit.
To remove tags: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Manage Templates. 5. Select the templates you want to tag. 6. Click Tags. 7. Click Remove tag(s). 8. Select the tags from the list. 9. Click Submit.
Managing Assigned Application Monitors

You can manage Assigned Application Monitors by referring to the following sections: Application Discovery Add Application Monitors Editing an Assigned Application Monitor Unmanaging Assigned Application Monitors Remanaging Assigned Application Monitors Deleting Assigned Application Monitors
Editing an Assigned Application Monitor

You can override the template inheritance relationship by editing the components of an assigned Application Monitor. Any modifications you make to an applications components or component properties are independent from the template, including: adding new components and removing existing components New components that you add to the application are not governed by the original template used to create the application. Modified component properties override the original template settings. To edit an individual application: 1. Log on to your SolarWinds Web Console with an Administrator account.
2. Click the Applications tab. 3. Click SAM Settings. 4. Click Manage Application Monitors. 5. Click the group containing the application you want to edit. 6. Check the application you want to edit, and then click Edit Properties. 7. If you want to turn on extended debug information to assist Customer Support, expand Advanced, set Debug logging On, and specify the Number of log files to keep. Here you can also select either 32bit or 64bit from the dropdown list entitled, Platform to run polling job on. Note: Do not turn on Debug logging unless directed by Customer Support. 8. Click Override Template for each polling setting and specify the new value. 9. Expand the component you want to modify, and then click Override Template and specify new values. 10. If you want to add components unique to this specific application , click Add Component Monitor. Note: You can select multiple component monitors of the same type to be added by entering a number in the field next to the check box for the component monitor and then checking the check box. 11. Click Submit to apply your changes.
Unmanaging Assigned Application Monitors

If you need to deactivate an assigned Application Monitor for a period of time, you can do so by unmanaging them. Changes you make to the managed or unmanaged status of an application take affect after the next polling cycle. To unmanage assigned Application Monitors: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Manage Application Monitors. 5. Click the group containing the application you want to unmanage. 6. Check the application(s) you want to unmanage, and then click Unmanage.
7. Specify the date / time when you want to begin the period when the application is unmanaged. 8. Specify the date / time when you want to end the period when the application is unmanaged. 9. Then click Ok. -or1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click an assigned Application Monitor in any resource to view its SAM Application Details View page. 4. Click Unmanage in the Application Details section. 5. Set the duration of the unmanaged state, and then click Ok. Note: Unmanaging a node in SolarWinds SAM automatically unmanages its assigned SolarWinds SAM applications for the same duration.
Remanaging Assigned Application Monitors

Remanage an assigned Application Monitor in order to immediately resume monitoring an unmanaged application. To remanage assigned Application Monitors: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Manage Application Monitors. 5. Click the group containing the application you want to remanage. 6. Check the application(s) you want to remanage, and then click Remanage. -or1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click an assigned Application Monitor in any resource to view its SAM Application Details View page. 4. Click Remanage in the Application Details section.
Deleting Assigned Application Monitors

Delete an assigned Application Monitor if you have no further need of it. To delete assigned Application Monitors: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Manage Application Monitors. 5. Click the group containing the application you want to delete. 6. Check the application(s) you want to delete, and then click Delete. 7. You are prompted whether you want to delete the selected Application Monitors. Click Yes to perform the delete operation.
Working with Component Monitors

Component monitors are the building blocks of SolarWinds SAM. Each monitors the status and performance of a different aspect of an application. You can perform the following activities to manage components using the commands on the SAM Settings page: Viewing the Component Monitor Library Managing Assigned Component Monitors Managing Component Monitors Within Templates
Viewing the Component Monitor Library

The component monitors in the library are grouped by monitor type in the tree view display. For each component monitor, two numbers are displayed. The first number represents the number of Application Monitor templates that contain the specified component monitor. The second number represents the number of Application Monitors that contain the specified component monitor.
Expanding a component monitor shows two categories: Application Monitor templates that contain the specified component monitor Application Monitors that contain the specified component monitor
Expanding a category displays the names of the templates or Application Monitors for the category, respectively. Clicking the name of a template or Application Monitor takes you to a page where you can edit that item.
Managing Assigned Component Monitors

You can manage individual component monitors that have been assigned to collect data on a single object such as a process, port, or performance counter. Management operations are described in the following sections: Creating a New Template with Assigned Component Monitors Assigning Component Monitors to a Node Copying Assigned Component Monitors to an Assigned Application Monitor Copying Assigned Component Monitors to an Application Monitor Template Editing Assigned Application Monitors Deleting Assigned Application Monitors
Creating a New Template with Assigned Component Monitors To quickly create a new template with assigned component monitors: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Manage Assigned Component Monitors. 5. Select the desired component type or assigned Application Monitor whose component monitors you want to list. 6. Select the desired component monitor(s) to add to the new template. 7. Click Create New Template, specify the information for the new template, and then click Submit. Refer to the section Creating New Templates on page 226 for details about specifying the template information. 8. To add additional component monitor(s) to add to the new template, click Add Component Monitor. 9. Expand the component groups and check all the additional component monitors you want to add. Note: You can select multiple component monitors of the same type to be added by entering a number in the field next to the check box for the
component monitor and then checking the check box. 10. Click Submit. 11. Configure the component monitor settings, and then click Submit. The new template is added to the list of all Application Monitor Templates. Assigning Component Monitors to a Node To quickly assign component monitors to a node: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Manage Assigned Component Monitors. 5. Select the desired component type or assigned Application Monitor whose component monitors you want to list. 6. Select the desired component monitor(s) to assign to a node. 7. Click Assign to Node. 8. Enter the name for the application, polling frequency, and polling timeout. 9. If you want to turn on extended debug information to assist Customer Support, expand Advanced, set Debug logging On, and specify the Number of log files to keep. Here you can also select either 32bit or 64bit from the dropdown list entitled, Platform to run polling job on. Note: Do not turn on Debug logging unless directed by Customer Support. 10. Click Next. 11. Select the nodes to which you want to assign the Application Monitor, and then click Next. 12. If suitable credentials already exist, choose the credential from the Choose Credential list. 13. If suitable credentials do not exist, choose <New Credential> from the Choose Credential list, and then add the new credential by filling out the credential details. 14. Click Test to test the credentials and component monitors against the test node.
15. If the test fails, troubleshoot the problem based on the error messages, and then retest the node. 16. If the test passes, click Assign Application Monitors. Copying Assigned Component Monitors to an Assigned Application Monitor To quickly copy component monitors to an assigned Application Monitor: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Manage Assigned Component Monitors. 5. Select the desired component type or assigned Application Monitor whose component monitors you want to list. 6. Select the desired component monitor(s) to copy to an assigned Application Monitor. 7. Click Copy to Assigned Application Monitor. 8. Select the desired Application Monitor(s) to copy to and click Submit. 9. Click Ok to acknowledge the successful copy. Copying Assigned Component Monitors to an Application Monitor Template To quickly copy component monitors to an Application Monitor template: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Manage Assigned Component Monitors. 5. Select the desired component type or assigned Application Monitor whose component monitors you want to list. 6. Select the desired component monitor(s) to copy to an assigned Application Monitor. 7. Click Copy to Application Monitor Template. 8. Select the desired template(s) to copy to and click Submit. 9. Click Ok to acknowledge the successful copy.
Editing Assigned Application Monitors To edit the assigned Application Monitor for a component monitor: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Manage Assigned Component Monitors. 5. Select the desired component type or assigned Application Monitor whose component monitors you want to edit. 6. Select the desired component monitor whose assigned Application Monitor you want to edit. 7. Click Edit Assigned Application Monitor. 8. Edit the desired settings and then click Submit. The edited Application Monitor is displayed in the list of Assigned Application Monitors. Deleting Assigned Application Monitors To delete an assigned component monitor: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Manage Assigned Component Monitors. 5. Select the desired component type or assigned Application Monitor whose component monitor(s) you want to delete. 6. Select the desired component monitor(s) that you want to delete. 7. Click Delete. 8. Click Yes to confirm the deletion of the component monitor(s).
Managing Component Monitors within Templates

You can manipulate and manage the component monitors that are inside the Application Monitor templates in several ways: Listing the Component Monitors Defined in a Template Creating a New Template from Existing Component Monitors Creating Assigned Application Monitors from Existing Component Monitors
Copying a Component Monitor
Listing the Component Monitors Defined in a Template To quickly see the different component monitors within your templates: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Manage Templates. 5. Click Manage Component Monitors (within Templates) , near the top right corner of the window. 6. Select Template in the Group by list. 7. Select the desired template whose component monitors you want to list. Creating a New Template from Existing Component Monitors To create a new template that contains copies of existing component monitors: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Manage Templates. 5. Click Manage Component Monitors (within Templates), near the top right corner of the window. 6. Check the check box next to the component monitors you want in the new template. 7. Click Create New Template, specify the information for the new template, and then click Submit. Refer to the section Creating New Templates on page 226 for details about specifying the template information. Creating Assigned Application Monitors from Existing Component Monitors To create assigned Application Monitors from existing component monitors: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab.
3. Click SAM Settings. 4. Click Manage Templates. 5. Click Manage Component Monitors (within Templates), near the top right corner of the window. 6. Check the check box next to the component monitors you want in the assigned Application Monitors. 7. Click Assign to Node. 8. Specify the name for the application, polling frequency, and polling timeout. 9. If you want to turn on extended debug information to assist Customer Support, expand Advanced, set Debug logging On, and specify the Number of log files to keep. Here you can also select either 32bit or 64bit from the dropdown list entitled, Platform to run polling job on. Note: Do not turn on Debug logging unless directed by Customer Support. 10. Click Next. 11. Select the nodes for which you want to create the assigned Application Monitors, and then click Next. 12. If suitable credentials already exist, choose the credential from the Choose Credential list. 13. If suitable credentials do not exist, choose <New Credential> from the Choose Credential list, and then add the new credential by filling out the credential details. 14. Click Test to test the credentials and component monitors against the test node. 15. If the test fails, troubleshoot the problem based on the error messages, and then retest the node. 16. If the test passes, click Assign Application Monitors. Copying a Component Monitor To copy a component monitor to a template or an assigned Application Monitor: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings.
4. Click Manage Templates. 5. Click Manage Component Monitors (within Templates) , near the top right corner of the window. 6. Check the check box next to the component monitors you want to copy. 7. Click Copy to. 8. If you want to copy to an assigned Application Monitor, click Copy to Assigned Application Monitor. 9. If you want to copy to a template, click Copy to Application Monitor Template. 10. Check the check boxes next to the template or assigned Application Monitors to which you wish to copy the component monitors, and then click Submit.
Scripting Custom Component Monitors

Ten output pairs can be returned when using script monitors. This new ability greatly improves flexibility in the way information is returned. A usage example using the PowerShell script monitor might go something like this: Imagine you have an Exchange PowerShell script. With multiple values returned, you can get a mail traffic report broken down by day, hour, message size, and number of recipients. Note: If you exceed the maximum number of allowed output pairs of ten, the remainder above the tenth output pair will simply be ignored. The following sections provide information and guidance to help you create some of the more complicated types of component monitors. Creating a Linux/Unix Script Monitor Creating a Windows Script Monitor Creating a Nagios Script Monitor Creating a Windows PowerShell Monitor
For general information about the settings for each component monitor, click the More Information help link in the SolarWinds SAM component monitor description.
Note: SolarWinds fully supports scripts written and provided by the company; however, we do not provide customer support for custom scripts written by outside sources. SolarWinds does provide sample scripts that we do support located at: C:\Program Files\SolarWinds\Orion\APM\Sample-Script Monitors. For information on using Data Transformations, refer to the following sections: Conversion Value Available Data Transformations
Creating a Linux/Unix Script Monitor

Linux/Unix Script component monitors allow you to execute a command line script that can return statistical data. When collecting information for this monitor, Server & Application Monitor runs the script with the credentials you define with the Credential Library. Note: A maximum of 10 output pairs can be returned. If you exceed the maximum allowed, remove the excess output pairs or they will simply be ignored. To adapt an existing Perl script to a Linux/Unix Script component monitor in a new template: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Create a new template underneath Application Monitor Templates. 5. Type a name for your template in the Template Name field. 6. If you want to turn on extended debug information to assist Customer Support, expand Advanced, set Debug logging On, and specify the Number of log files to keep. Here you can also select either 32bit or 64bit from the dropdown list entitled, Platform to run polling job on. Note: Do not turn on Debug logging unless directed by Customer Support. 7. Click Add Component Monitor. 8. Expand the Custom Component Monitors group, and then check Linux/Unix Script Monitor. 9. Click Submit. 10. Select credentials with SSH permissions in the Credential for Monitoring field. 11. Type a valid working directory in the Script Working Directory field 12. Click Edit to open the script dialog and enter your script into the Script Body field. 13. Type the Linux command that runs the script in the Command Line field. It should be similar to the following: perl ${SCRIPT} arg1 arg2.
Note: {SCRIPT} is replaced by the actual file name of the

script after its deployed to the target node. (A temporary file is created in temp directory for the script).
14. Click Get Script Output. SAM will then test the script by executing it and parse its output, then return the values. 15. Click Save. 16. Specify the critical and warning thresholds. 17. Click Submit. Here is a sample Perl script using the Linux/Unix component monitor returning multiple output pairs, in this case, two: Note: The code in red shows where the output pairs are defined.
#!/usr/bin/perl if (@ARGV[0] =~ /\bhelp\b/) { print "MemoryUsage.pl SNMPver community hostname\n"; print "SNMPver - version of SNMP protocol\n"; print "community - community name of SNMP protocol\n"; print "hostname - Target host\n"; exit 1; } # Get hostname and trim newline $localhost = `hostname`; $localhost =~ s/\s*$//g; $hostname = shift || $localhost; $community = shift || "public"; $version = shift || "v1"; $results = ""; $MIB_TotalMemory = "UCD-SNMP-MIB::memTotalReal.0"; #$MIB_TotalMemory = "UCD-SNMP-MIB::memTotalReal.0"; $outres = "snmpget -$version -c $community $hostname $MIB_TotalMemory |"; open(OUTMEM,$outres) || die "Unable read pipe\n"; while ($line = <OUTMEM>) { if ($line =~ /\bINTEGER\b/) { $indval = index($line,"="); $indval = index($line,":",$indval); $val = substr($line,$indval+1,length($line) $indval); $val =~ s/[a-zA-Z\/\n ]//g; print "Message.1: Available memory at host \"$hostname\": $val in kB\n"; print "Statistic.1: $val\n"; print "Message.2: Again, the available memory at host \"$hostname\": $val in kB\n"; print "Statistic.2: $val \n";

exit 0; } } print "Statistic: 0\n"; exit 1;
Below is the output from this script:
Linux/Unix Scripts Linux/Unix scripts are uploaded by SSH and then run on the target node using the string from the Command Line field. You can use the following variable in the command line field: ${SCRIPT} Replaced with the script body. You can use the following variables in the script body field: ${IP} Replaced with the target nodes IP address. ${USER} Replaced with the user name from the credential. ${PASSWORD} Replaced with the password from the credential. Example Scripts There are several sample scripts installed with SolarWinds SAM you can use to create Linux/Unix script component monitors. These sample scripts are installed on your SolarWinds SAM server, in the folder:
C:\Program Files\SolarWinds\Orion\APM\SampleScriptMonitors\LinuxSc ripts
Scripts Must Report Status Through Exit Codes Scripts must report their status by exiting with the appropriate exit code:

Exit Code 0 1 2 3 Any other value Meaning Up Down Warning Critical Unknown
For example, if you want to inform SolarWinds SAM that a Script reports Up status, you would exit the script using code similar to the following, where 0 reports Up:
Wscript.quit(0)
Scripts with Text Output Scripts report additional details by sending text to the scripts standard output. In APM 4.0.2 and earlier, each line of output contained a single detail in the following format:
DetailType:Value # Script output comment Message: The directory contains too many files. Statistic: 5
While this is still true, SAM now supports multiple values returned by a script using the following format.
Statistic.Name1: x Message.Name1: abc Statistic.Name2: y Message.Name2: abc
Detail Type
Required
Meaning A numeric value used to determine how the monitor compares to its set thresholds. This must be an integer value, (negative numbers are supported).
Statistic
Yes
Statistic.Name1: 123 Statistic.Name2: 456

An error or information message to be displayed in the monitor status details. Note: Multi-line messages are supported. To use this functionality print each line using a separate command. For example:
Message
No
Message.Name1: abc Message.Name2: def
There is a limit of ten Statistic and Message pairs for the script. These can be placed anywhere in the script output. The Statistic and Message names you give must contain valid letters and/or numbers. Note: A maximum of 10 output pairs can be returned. If you have exceeded the maximum allowed, remove the excess output pairs or they will simply be ignored. Sample output:
# Script comment: This shows two pairs. Ten pairs are possible. Statistic.CPU: 31.08 Message.CPU: svchost.exe cpu usage Statistic.RAM: 1234.56 Message.RAM: svchost.exe ram usage
For information on creating a Nagios Script Monitor, see "Creating a Nagios Script Monitor" on page 258.
Creating a Windows Script Monitor

This component monitor runs a Windows script on the SolarWinds SAM server and then processes the script's exit code and text output. This monitor has the ability to return up to ten pairs, i.e.: 10 statistic values + 10 [optional] messages. This is best used in conjunction with the "Multiple Statistic Chart." Note: A maximum of 10 output pairs can be returned. If you exceed the maximum allowed, remove the excess output pairs or they will simply be ignored. Statistic The statistic for this component monitor is the value returned by the script. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Component Type This describes the type of monitor you are using.
Enable Component This option determines whether or not the component is enabled. Disabling this component leaves it in the application as deactivated and does not influence application availability or status. Credential for Monitoring Select a Windows credential that is both a user who can log on to the SolarWinds SAM server, and has sufficient rights on the target node to do whatever the script needs to do. For example, if the script does something with WMI, the credentials also need WMI rights on the target node. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential.
Script Engine This field allows you to specify the scripting language to be used. The default value is vbscript. Below is a list of scripting engines that the Windows Script Host supports: Name VBScript JScript PerlScript ooRexxScript PythonScript TclScript ActivePHPScript RubyScript Object Rexx engine Delphi scripting engine Roll-Up This option allows you to choose how you would like the monitor to report the returned results based on the output provided by the script. With the ability to have multiple values returned, selecting how your scripts report back to you offers more flexibility. The default selection is Show worst status. For more information, see Managing the Display of Group Status on page 172. Script This field allows you to enter the script you want to run on the target node. To enter your script, click the Edit button that reveals the script editing window. Script Arguments This field is in the script editing window and allows you to specify arguments to pass to the script. You may include the variables ${IP}, ${USER}, and ${PASSWORD}, which are replaced respectively by the IP address of the target node, the credential user name, and the credential password. Body This field is in the script editing window and allows you to enter your script via typing or pasting. File Extensions .vbs .js .pls .rxs .pys .tcls .phps .rbs Availability Installed by default Installed by default Freeware Freeware Freeware Freeware Freeware Freeware Commercial Commercial
User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts" Creating a Windows Script Monitor You can create a Windows Script monitor to have SolarWinds SAM run a script using Windows Script Host. Windows Script Host comes with VBScript and Jscript, but can be extended with other scripting languages. Scripts run on the SolarWinds SAM server and use the credentials you specify. The script must both return an exit code and output a text string containing a statistic value conforming to the specifications described later in this section. Note: Format the Statistic value to use the same decimal separator as the SolarWinds SAM server. The SolarWinds SAM server uses the decimal separator set by its Microsoft Windows regional settings. To adapt an existing Visual Basic script to a Windows Script Monitor in a new template: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Create a New Template underneath Application Monitor Templates. 5. Type a name for your template in the Template Name field. 6. If you want to turn on extended debug information to assist Customer Support, expand Advanced and then set Debug logging On and specify the Number of log files to keep. Here you can also select either 32bit or 64bit from the dropdown list entitled, Platform to run polling job on. Note: Do not turn on Debug logging unless directed by Customer Support. 7. Click Add Component Monitor. 8. Expand the Custom Component Monitors group, and then check Windows Script Monitor. 9. Click Submit. 10. Select credentials with the appropriate permissions to run the script on the SolarWinds SAM server, and that also has appropriate permissions to do whatever else the script requires.
11. Copy the Visual Basic script into the Script Body field. 12. Type any script arguments into the Script Arguments field. 13. Specify the critical and warning thresholds. 14. Click Submit. Macros for Script Arguments Specify script arguments in the Script Arguments field if needed. You can use the following variables as script arguments: ${IP} This is replaced with the target nodes IP Address. ${USER} This is replaced with the user name from the credential set. ${PASSWORD} This is replaced with the password from the credential set. Scripts Must Report Status Through Exit Codes Scripts must report their status by exiting with the appropriate exit code:
For example, if you want to inform SolarWinds SAM that a VBScript reports Up status, you would exit the script using code similar to the following, where 0 reports Up:
Wscript.quit(0)
Scripts with Text Output Scripts report additional details by sending text to the scripts standard output. In APM 4.0.2 and earlier, each line of output contained a single detail in the following format:
DetailType:Value # Script output comment 254 Building Component Monitors and Templates
SolarWinds Server & Application Monitor Administrator Guide Message: The directory contains too many files. Statistic: 5
While this is still true, SAM now supports multiple values returned by a script using the following format.
Statistic.Name1: x Message.Name1: abc Statistic.Name2: y Message.Name2: abc
Detail Type
Required
Meaning A numeric value used to determine how the monitor compares to its set thresholds. This must be an integer value, (negative numbers are supported).
Statistic
Yes
Statistic.Name1: 123 Statistic.Name2: 456

An error or information message to be displayed in the monitor status details. Note: Multi-line messages are supported. To use this functionality print each line using a separate command. For example:
Message
No
There is a limit of ten Statistic and Message pairs for the script. These can be placed anywhere in the script output. The Statistic and Message names you give must contain valid letters and/or numbers. Sample output:
# Script comment: This shows two pairs. Ten pairs are possible. Statistic.CPU: 31.08 Message.CPU: svchost.exe cpu usage Statistic.RAM: 1234.56 Message.RAM: svchost.exe ram usage
Example Scripts Below is a sample vbscript that returns two values; the total number of files in a folder, and twice the total number of files in the same folder. The code that represents these two values are bold, To use this script, copy and paste the following code into the Script Body field. In the Scripts Arguments field, type in C:\Windows, or any other folder you want to monitor.

Option Explicit On Error Resume Next Dim lstArgs, path, fso, objDir, objFiles, objFiles2 Set lstArgs = WScript.Arguments If lstArgs.Count = 1 Then path = Trim( lstArgs( 0 )) Else WScript.Echo "Message: Usage: wscript.exe filelist.vbs [pathToFiles]" &vbCRLF &"[pathToFiles] Local or UNC Path" WScript.Echo "Statistic: 0" WScript.Echo "Message: Usage: wscript.exe filelist.vbs [pathToFiles]" &vbCRLF &"[pathToFiles] Local or UNC Path" WScript.Echo "Statistic: 0" WScript.Quit( 1 ) End If Set fso = Wscript.CreateObject( "Scripting.FileSystemObject" )
If fso.FolderExists( path ) Then Set objDir = fso.GetFolder( path ) If( IsEmpty( objDir ) = True ) Then WScript.Echo "Message: Object Not Initialized" WScript.Echo "Statistic: 0" WScript.Quit( 1 ) End If Set objFiles = objDir.Files If( IsEmpty( objFiles ) = true) Then WScript.Echo "Message: Object Not Initialized" WScript.Echo "Statistic: 0" WScript.Quit( 1 ) End If WScript.Echo "Message.Total: " & CInt( objFiles.Count ) & " files in this folder." WScript.Echo "Statistic.Total: " & CInt( objFiles.Count ) WScript.Echo "Message.Twice: " & CInt( objFiles.Count*2 ) & " = twice the number files in this folder." WScript.Echo "Statistic.Twice: " & CInt( objFiles.Count*2 ) WScript.Quit( 0 ) Else WScript.Echo( "Message: Folder Not Found" ) WScript.Echo "Statistic: 0" WScript.Quit( 1 ) End If
There are several examples of Windows Script component monitors included in templates. These include: File Count, File Modified, LDAP Connection Monitor, Run 3rd Party Application, and Windows Event Log Count.
Sample scripts are installed on your SolarWinds SAM server, in the folder:
C:\Program Files\SolarWinds\Orion\APM\SampleScriptMonitors\Windows Scripts
For another example of a Windows Script component monitor, see Monitoring Large Directories on page 72.
Creating a Nagios Script Monitor

This component uses SSH to upload a Nagios script to a Linux/Unix server, runs the Nagios script on the server and then processes the script's exit code and text output. This monitor has the ability to return multiple values. Note: A maximum of 10 output pairs can be returned. If you exceed the maximum allowed, remove the excess output pairs or they will simply be ignored. Return Codes Nagios determines the status of a host or service by evaluating the return code. The following table shows a list of valid return codes, along with their corresponding service or host states.
Return Code 0 1 2 3 Service State Ok Warning Critical Unknown Host State Up Up or Down/Unreachable Down/Unreachable Down/Unreachable
If the Use Aggressive Host Checking option is enabled, return codes of 1 will result in a host state of DOWN, otherwise return codes of 1 will result in a host state of UP. Your Nagios script must exit with a valid return code and a line of text output. The exit code determines the status of the component. If the exit code is 0 (Ok), the component status may be further modified by thresholds from the optional statistics. To return up to ten optional statistics, separate the statistics from the status message with the pipe (|) symbol using the following syntax:
statusMessage [|'statisticName'=value]
Below is an example of valid output with a status message and two statistics:
The script ran. | 'CPU%'=75.2 'MemoryRemainingInKB'=600784
Statistic The statistic for this component monitor is the value returned by the script. For more information, see http://nagios.sourceforge.net/docs/3_0/pluginapi.html.
Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Component Type This describes the type of monitor you are using. Enable Component This option determines whether or not the component is enabled. Disabling this component leaves it in the application as deactivated and does not influence application availability or status. Credential for Monitoring Select a credential that can access the Linux or Unix server over SSH and that has sufficient rights to run scripts. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Port Number This field allows you to specify the port number used for the SSH connection. The default value is 22. Script Working Directory This field allows you to specify the working directory of the script process. Check Type This determines how the return code is evaluated. Status Roll-Up This option allows you to choose how you would like the monitor to report based on the output provided by the script. The default selection is Show worst status. For more information, see Managing the Display of Group Status" on page 172.
Command Line This field is in the script editing window and allows you to specify the shell command run after the SSH connection is established. The default command line value perl ${SCRIPT} arg1 arg2 attempts to run in a Perl interpreter the script defined in the Body field using the parameters arg1 arg2. Note: The length of the Command Line field is limited to 266 characters for Solaris systems, minus the length of the ${SCRIPT} variable after being resolved to a file name such as the following: APM_937467589.pl. Since the length of the file name will typically be around 16 characters, this means that the actual user Command Line input cannot be longer than 266 16, or 250 characters (not including the length of the 9 characters for the ${SCRIPT} variable itself). If you need to pass a longer command line to the target node, you can create a shell script on the target node (for example: myscript.sh) that contains the long command line and place the call to this script in the Command Line field, for example: /opt/sw/myscript.sh Body This field is in the script editing window and allows you to enter your script via typing or pasting. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
Creating a Windows PowerShell Monitor

With this, you can create a monitor that runs a Windows PowerShell script to monitor specific performance information for troubleshooting a Windows process that may be having issues. Note: A maximum of 10 output pairs can be returned. If you exceed the maximum allowed, remove the excess output pairs or they will simply be ignored. What needs to be monitored: The process you want to monitor is lsass.exe, which enforces security on the system for users who are logging on, changing passwords, and so forth. In particular, you want to monitor the average number of read operations performed to check for spikes. You decide to use the Windows PowerShell monitor to run a PowerShell script that uses the Get-WmiObject call to measure the average ReadOperationCount for the lsass.exe process and monitor its value. 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Create a New Template underneath Application Monitor Templates. 5. Type a name for your template in the Template Name field, for example Lsass.exe PowerShell Monitor. 6. If you want to turn on extended debug information to assist Customer Support, expand Advanced and then set Debug logging On and specify the Number of log files to keep. Here you can also select either 32bit or 64bit from the dropdown list entitled, Platform to run polling job on. Note: Do not turn on Debug logging unless directed by Customer Support. 7. Click Add Component Monitor. 8. Expand the Custom Component Monitors group, and then check Windows PowerShell Monitor. 9. Click Add.. 10. Select the Credential for Monitoring with appropriate permissions to run the script on the SolarWinds SAM server, and that also has appropriate permissions to do whatever else the script requires (in our case, to get the average number of read operations performed on the target node).
11. Select the Execution Mode to use: Local Host can run scripts only locally, that is, on the SolarWinds SAM server. Remote Host can execute scripts remotely (on the remote target node to which the Windows PowerShell monitor is assigned) using the Windows Remote Management (WRM) system component. WRM should be configured separately to get it working with the Windows PowerShell monitor. 12. Copy the following PowerShell script, which uses the Get-WmiObject call to measure the average ReadOperationCount for the lsass.exe process, into the Script Body field:
$avg = Get-WmiObject win32_process -ComputerName '${IP}' -Credential '${CREDENTIAL}' | Where-Object {$_.Name -eq "lsass.exe" } | Measure-Object -property ReadOperationCount -Average; Write-Host 'Statistic: ' exit(0) $avg.Average
The PowerShell code does the following: a. Reads the average ReadOperationCount information for the process lsass.exe from the computer whose IP address is specified by the variable ${IP}using the credential specified by the variable ${CREDENTIAL}. Note: The user name from the Credential for Monitoring that is specified is stored automatically in the ${CREDENTIAL} variable by the monitor. Therefore the ${CREDENTIAL} variable should not be placed in the Script Arguments field, since it is set automatically. When the script is run by powershell, since no password has been provided, it prompts for a password and the password from the Credential for Monitoring that is specified is provided automatically by the Windows Powershell monitor. b. Writes the statistic information gathered by the script. c. Exits the script.
Note: The script does no error checking. 13. Enter the following Script Arguments: Use the token ${IP}and the IP address will be filled in with the IP address of the target node. You can then access the value in the script body using the variable ${IP}. For example, if you type the following for Script Arguments:
${IP}
the PowerShell script will be able to access the IP address for the target node using the variable ${IP} in the script body. 14. Select Run the script under specified account to enable impersonation with the component's credentials. (This works only in local script execution mode.) 15. Select Count Statistic as Difference to change the statistic to be the difference in query values between polling cycles. 16. Change the Statistic Warning Threshold to greater than 800. 17. Change the Statistic Critical Threshold to greater than 1000. 18. Click Set test node. 19. Browse the tree view, select the desired target node for the PowerShell script, and then click SELECT. 20. Click Test. 21. If the test fails, see Troubleshooting the Lsass.exe PowerShell Monitor. 22. If the test passes, click Submit. 23. Click All in the Select tag to filter by list. 24. Locate the Lsass.exe PowerShell Monitor. Beneath the listed templates, locate the Page control. Click the right arrow twice to scroll to page 3. 25. Click the check box next to Lsass.exe PowerShell Monitor. 26. Click Assign to Node. 27. Expand the tree view and select the target node which you tested the script with in step 18. 28. Click Next. 29. Since you already assigned credentials and tested them in the template, check the check box next to Inherit credentials from template. 30. Click Test to confirm the credentials and component monitor against the test node.
31. Click Assign Application Monitors. 32. Click Done. Troubleshooting the Lsass.exe PowerShell Monitor Verify that you are entering the user name and password of an administratorlevel account. If you think you have entered an incorrect credential, correct the mistake and then retest. Make sure that the RPC server is available and that the Windows PowerShell execution policy is not set to Restricted (the default setting). You can check the execution policy by entering the following command at the PowerShell command prompt:
Get-ExecutionPolicy
If you are having trouble using the Windows PowerShell Monitor, see the following KB article for some useful tips: http://knowledgebase.solarwinds.com/kb/questions/2203
JMX Component Monitor Wizard

Creating a standard template for this monitor is not practical because of the amount of variables in any one specific environment. However, adding this monitor to your environment has been made simple with the use of a wizard driven interface. Note: Only values that return numerical data can be monitored. String data is not supported at this time. Non-numerical data will be shown without a check box. To add a JMX component monitor, perform the following steps: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click Settings in the upper right hand corner of the web page. 3. Click SAM Settings. 4. Click Find Processes, Services and Performance Counters underneath Getting Started with SAM. 5. Select JMX Monitor from the dropdown list then click Next. 6. For Server IP Address, click Browse, then select the node you want to monitor. 7. Add the Port number, Protocol type, URL path, and Credentials for the remaining fields.
8. Click Next. The following MBean selection screen appears:
9. Expand the folders by clicking the arrows (or [+]) to expand the tree view folder structure. From here you can drill down to select the attributes you want by checking them. 10. Click Next. Now you are able to edit the JMX Component Monitor properties. For more information, see "JMX Monitor" on page 567. For more information, see "JMX" on page 651.
Custom Application Monitor Template Example: Creating a SolarWinds SAM Template

The following procedure creates a SolarWinds SAM Application Monitor template that monitors a locally installed SQL Server instance. The template is simplified by using the Windows Service component monitors, a TCP port monitor for your SQL Server, and an HTTP monitor for the local Web Console. You do not need to know the specific names of the processes, and you are not limited to a single process per application. With Server & Application Monitor you can group multiple component monitors into a single application and monitor these groupings as one mission critical application. While completing this procedure, you will create an application template with the following component monitors: TCP port component monitor to monitor port 1433, the port through which SolarWinds communicates with the SQL Server. Service component monitors for the following windows services:
SolarWinds Alerting Engine SolarWinds Network Performance Monitor SolarWinds Job Engine SolarWinds Job Scheduler SolarWinds Module Engine SolarWinds Syslog Service SolarWinds Trap Service HTTP component monitor to monitor port 80, the port through which you access the SolarWinds Web Console.
To create a SolarWinds SAM application template: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click the Applications tab. 3. Click SAM Settings. 4. Click Create a new template underneath Application Monitor Templates. 5. Type a name for your template in the Template Name field. For example, type SolarWinds SAM.
6. If you want to turn on extended debug information to assist Customer Support, expand Advanced, set Debug logging On, and specify the Number of log files to keep. Here you can also select either 32bit or 64bit from the dropdown list entitled, Platform to run polling job on. Note: Do not turn on Debug logging unless directed by Customer Support. 7. Click Add Component Monitor. 8. Expand the Network Protocol Component Monitors list, and then check TCP Port Monitor. 9. Click Submit. 10. Click Rename and then type a name for the TCP port monitor. For example, type SolarWinds SAM SQL Server Port. Then click Ok. 11. Ensure the Port Number field corresponds to the port used to communicate with the SolarWinds SAM SQL Server instance. By default, this is port 1433. 12. Click Add Component Monitor. 13. Expand the Process and Service Component Monitors, and then check Windows Service Monitor and click Submit. 14. Click Rename and then type a name for the SolarWinds Alerting Engine monitor. For example, type SW Alerting Engine. Then click Ok. 15. Select the credential set you want to use when accessing the Windows service information. For more information about creating a credential set, see Understanding the Credentials Library on page 220. 16. Type the name of the SolarWinds Alerting Engine service in the Net Service Name field. Note: This field is the Service name of the service to monitor. You can find the Service name on Windows systems by clicking Start > Administrative Tools > Services and then locating the desired service. Right-click the service and select Properties from the context menu. The Service name is the value of the Service name field in the Properties dialog. For the SolarWinds Alerting Engine, this is typically SolarWindsAlertingEngine. 17. Repeat Steps 12 through 16 for the following SolarWinds SAM Windows services: SolarWinds Network Performance Monitor SolarWinds Job Engine v2 SolarWinds Job Scheduler SolarWinds Module Engine
SolarWinds Syslog Service SolarWinds Trap Service 18. Click Add Component Monitor. 19. Expand the User Experience Component Monitors list, and then check HTTP Monitor. 20. Click Rename and then type a name for the HTTP port monitor. For example, type SolarWinds Web Console. Then click Ok. 21. Ensure the Port Number field corresponds to the port you use for the SolarWinds Web Console port. 22. Click Submit.
Conversion Value
Some monitors now offer the option to mathematically convert returned values through the use of Data Transformations. Checking the Convert Value checkbox opens the formula box that enables you to perform various mathematical functions. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. The Custom Conversion option offers more flexibility when manipulating returned values. This option allows you to use the basic arithmetic operators; +, -, *, /, along with built-in functions for more advanced conversions. For a list of these functions, see Available Data Transformations" on page 269. Following is a real world example for converting bytes into megabytes using a predefined formula, or data transformation. In this case, XtoMega, was used to convert bytes to megabytes.
With the XtoMega formula applied, the data transforms from 318767104 bytes to 304 megabytes, which is much easier to read.
Note: The Retrieve Current Value button tests the application and does not apply the data transformation. Instead, the original statistic value will be returned.
Available Data Transformations

SolarWinds SAM provides a number of predefined transformation functions that may be applied to one or more monitors to generate mathematically manipulated results. The following table lists transformation functions that are currently available in SolarWinds SAM:
Data Transformation Syntax Definition Eulers number, commonly called the number e, is defined as the base of the natural logarithm as the limit of a certain sequence, or as the sum of a certain series. Pi is the mathematical constant whose value is the ratio of any circle's circumference to its diameter. Provides a number that is rounded to the specified number of digits. Truncates a monitored value to a designated number of decimal places. Provides the square root of a given number. Provides the result from repeated multiplication of the base number. Provides the Fahrenheit result originally presented in Celsius
Eulers Number
E()
Pi
Pi() Round({value}, {number of decimal places}) Truncate({value},{numbe r of decimal places}) Sqrt({value}) Pow({base value}, {exponent value}) CToF({value})
Rounding
Truncate Square Root Exponentiation Temperature: Celsius to Fahrenheit

Temperature: Fahrenheit to Celsius X to Kilobyte
FToC({value}) XToKilo({value}) XToMega({value}) XToGiga({value}) XToTera({value}) KiloToMega({value}) KiloToGiga({value}) KiloToTera({value}) MegaToGiga({value}) MegaToTera({value}) GigaToTera({value}) TeraToKilo({value}) TeraToMega({value}) TeraToGiga({value})
Provides the Celsius result originally presented in Fahrenheit Provides the number of Kilobytes originally presented in Bytes Provides the number of Megabytes originally presented in Bytes Provides the number of Gigabytes, originally presented in Bytes Provides the number of Terabytes, originally presented in Bytes Provides the number of Megabytes, originally presented in Kilobytes Provides the number of Gigabytes, originally presented in Kilobytes Provides the number of Terabytes, originally presented in Kilobytes Provides the number of Gigabytes, originally presented in Megabytes Provides the number of Terabytes, originally presented in Megabytes Provides the number of Terabytes, originally presented in Gigabytes Provides the number of Kilobytes, originally presented in Terabytes Provides the number of Megabytes, originally presented in Terabytes Provides the number of Gigabytes, originally presented in Terabytes
X to Megabyte
X to Gigabyte
X to Terabyte Kilobyte to Megabyte Kilobyte to Gigabyte Kilobyte to Terabyte Megabyte to Gigabyte Megabyte to Terabyte Gigabyte to Terabyte Terabyte to Kilobyte Terabyte to Megabyte Terabyte to Gigabyte
Multiple Statistic Chart

This chart provides the ability to graphically visualize multiple statistics simultaneously. The advantage of this view is that you can easily determine how certain processes and services are performing in relation to others. For example, you may notice that a spike in RAM usage results in higher CPU usage. This
charted information allows you to get a quick overview of what is being monitored and may answer why certain unexpected events are occurring.
The Multiple Statistic Chart can be added to either the Application Details page or the SAM Component Details page. To add the Multiple Statistic Chart to either page, take the following steps: 1. Drill down to either the Application Details page or the SAM Component Details page. 2. Click Customize Page on the far top right of the page. 3. Click the green [+] to the right of the column in which you want to add this chart. 4. Select and expand SAM Charts - Historical charts for SAM. 5. Check Multiple Statistic Chart, and then click Submit, then click Done. To configure the Multiple Statistic Chart, take the following steps: 1. Once the chart is on your Details page, click Edit at the top right of the chart.
2. From this page, you can 33several options to choose from, including: x) Title: This allows you to change the title of your chart. xi) Select a Time Period: This allows you provide a range for your chart. xii) Select a Sample Interval: This allows you to select how often the chart is updated. xiii) Chart All or Selected Statistics: This allows you to chart certain or all aspects of what you intend to monitor. For more information, see "Creating a Windows Script Monitor" on page 253.
Chapter 13
Viewing Application and Component Performance and Status

The following sections provide a short list and overview of the views and resources provided with Server & Application Monitor that reveal performance and status information. Understanding the SAM Application Summary Understanding SAM Application Details Understanding SolarWinds SAM Component Details Showing SolarWinds SAM Data in Node Details Customizing SAM Application Summary Views Customizing Application Details Views
Understanding the SAM Application Summary

The SAM Application Summary view provides the following resources. You can customize which of these resources appear on the page by clicking Customize Page. All Applications Tree Provides an expandable list of applications that allows custom grouping. Additionally provides the number of problem applications and the duration of the problem state for each application. Applications with Problems Provides a list of applications with the status of down, unknown, warning, or critical. Active Application Alerts Provides a list of the active alerts associated with applications. Application Health Overview Provides an overview of the status of all assigned Application Monitors.
Viewing Application and Component Performance and Status 275
Last 25 Application Events Provides a list of the last twenty-five events associated with applications. For more information about creating alerts for these events, see Creating Alerts on page 291. thwack Community Latest Application Monitor Templates Provides a list of the newest Application Monitor templates that have been added to the thwack community web site. Click a template to open its download web page. Top 10 Components by Statistic Data Provides a list of the monitors with the highest reported statistic data values. Because comparing disparate statistic measurements is of limited use, we suggest you create Statistic Data resource containing filters to limit the statistic sources. For example, you can show the statistic values only of the mail queue size of your Exchange servers. Top 10 Components by Response Time Provides a list of the monitors with the slowest response time on the selected node. Top 10 Processes by CPU Load Provides a list of the monitors consuming the most CPU on the selected node. Top XX Processes by Physical Memory Provides a list of the monitors consuming the most physical memory on the selected node. Top XX Processes by Virtual Memory Provides a list of the monitors consuming the most virtual memory on the selected node. SAM Sample Map Provides a sample map for SolarWinds SAM. All Groups Displays information for the selected SAM Groups.
276 Viewing Application and Component Performance and Status
Custom Object Resource Provides information for an object you select. Allows you to monitor a specific node, volume, application and component resources in a summary view. For example, you can now create a custom object resource to monitor Application Availability in a Network Summary view. For more information about a resource, click Help in the resource.
Understanding SAM Application Details

The SAM Application Details view provides the following resources. You can customize which of these resources appear on the page by clicking Customize Page. You may see different resources depending on the item you are viewing. Note: You can also add SolarWinds SAM node resources to the application details view. For example, you can add the CPU Load & Memory Utilization charts or Packet Loss gauges. For more information about adding resources to views, see Editing Views" on page 105. Application Details Provides a list of application properties, including the application name, application status, application server status, component names, component types, and component status. Buttons are provided to Edit Application Monitor, Unmanage the application, or Poll Now. Last XX Application Events Provides a customizable list of the most current XX events specific to the application. Active Application Alerts Provides a list of the active alerts specific to the application. Components Provides a list of the components included in the application and their response times. Processes and Services Provides a list of the process and service monitors included in the application and the response time for the application you are viewing.
Application Availability Provides a bar chart of the application availability percentage. To modify the chart, click the title of the chart. Ensure you adjust your polling to less than the interval you want displayed in charts. Not adjusting your polling will result in gaps in your charts. For more information about a resource, click Help in the resource.
Understanding SolarWinds SAM Component Details

The Component Details view provides the following resources. You can customize which of these resources appear on the page by clicking Customize Page. Component Statistics Provides a number of gauges that pertain to the selected component. Response time is provided for port components. CPU load, physical memory, and virtual memory gauges are provided for process and service components. Note: SNMP process components do not include the virtual memory gauge. Component Details Provides a number of details about the component, including application status, component status, component type, component-specific properties, last up time, next poll time, and any warning or critical thresholds. Component Availability Provides a chart of component availability. To modify the chart, click the chart title. Ensure you adjust your polling to less than the interval you want displayed in charts. Not adjusting your polling will result in gaps in your charts. Last 25 Component Events Provides the last 25 events specific to the component. Min/Max Average Response Time Provides a chart of the minimum, maximum, and average response times of the component. To modify the chart, click the chart title. This chart is available for port components only. Ensure you adjust your polling to less than the interval you want displayed in charts. Not adjusting your polling will result in gaps in your charts.
Min/Max Average CPU Load Provides a chart of the minimum, maximum, and average CPU loads of the component. To modify the chart, click the chart title. This chart is available for access and process components only. Ensure you adjust your polling to less than the interval you want displayed in charts. Not adjusting your polling will result in gaps in your charts. Min/Max Average Physical Memory Provides a chart of the minimum, maximum, and average physical memory of the component. To modify the chart, click the chart title. This chart is available for access and process components only. Ensure you adjust your polling to less than the interval you want displayed in charts. Not adjusting your polling will result in gaps in your charts. Min/Max Average Virtual Memory Provides a chart of the minimum, maximum, and average virtual memory of the component. To modify the chart, click the chart title. This chart is available for access and process components only. Ensure you adjust your polling to less than the interval you want displayed in charts. Not adjusting your polling will result in gaps in your charts. Min/Max Average Statistic Data Provides a chart of the minimum, maximum, and average statistic data of the component. To modify the chart, click the chart title. This chart is available for access and process components only. Ensure you adjust your polling to less than the interval you want displayed in charts. Not adjusting your polling will result in gaps in your charts. For more information about a resource, click Help in the resource.
Showing SolarWinds SAM Data in Node Details

You have the option of adding the SolarWinds SAM application resources to the Node Details pages. To enable SolarWinds SAM-specific resources: Click Yes when SAM asks on first log on whether you want to include SAM resources on the Node Details page. - or 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click Settings near the top right corner of the window, and then click Manage Views.
3. Select Node Details on the Manage Views page, and then click Edit. 4. Click [+] next to the column in which you want to display SAM resources. 5. Click [+] to expand the Node Detail Reports category, and then check the resources you want to add, for example: Applications Top XX Processes by CPU Load Top XX Components by Response Time 6. Click Submit. 7. Click Done on the Customize Node Details page. 8. Navigate to a node with which you have associated an application and review the new resources.
Customizing SAM Application Summary Views

Filtering SAM Application Summary Views lets you create custom summary views that limit the displayed information to applications or nodes that match certain criteria. For example, you can create a filtered application summary view that shows only information from applications containing Linux in the application name. After creating filter limited views, you can add them as menu items under the Applications tab. Pre-configured Summary Views SolarWinds SAM ships with seven pre-configured summary view menu items. To access these views, move your pointer to the menu bar at the top of the Applications tab in your SolarWinds Web Console and then click one of the following items: SAM Summary This is an unfiltered summary view. Active Directory Summary information for applications with Active Directory in the application name. Exchange Summary information for applications with Exchange in the application name.
SQL Server Summary information for applications with SQL Server in the application name. IIS Summary information for applications with Internet Information in the application name. Windows Summary information for applications with Windows in the applicat ion name. Linux Summary information for applications with Linux in the application name. Summary View Filtering Criteria Each summary view may be filtered by only one view limitation entry, but some view limitation entries allow you to select more than one criteria. For example, the Group of Application Names limitation allows you to select multiple application names. In addition to the standard view limitations of SolarWinds common components, the following view limitations are also available in SolarWinds SAM: Application Name Pattern Limit the view to an assigned application or applications fitting a certain naming pattern. Enter the naming pattern and then click Submit. The asterisk (*) is a valid wildcard for this view limitation type. Group of Application Names Limit the view to a group of assigned applications that share the same application names. You may select multiple application names for this group. Select the applications from the list and then click Submit. Specific Applications Limit the view to individual applications assigned to specific nodes. Select the assigned applications, and then click Submit.
To create a Filtered Applications Summary view based on the default SAM Application Summary view: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click Settings near the top right corner of the window, and then click Manage Views. 3. Select SAM Application Summary and then click Copy. 4. Select Copy of SAM Application Summary and then click Edit. 5. Click Edit in the View Limitation section. 6. Select a view limitation and click Continue. For example, Application Name Pattern. 7. Enter the view limitation criteria and then click Submit. For example:
*Oracle*
8. Enter a new name for this summary view and then click Update. For example: SAM Oracle Application Summary 9. Click Done. To add a summary view menu item to the menu bar in the Applications tab: 1. Log on to your SolarWinds Web Console with an Administrator account. 2. Click Settings near the top right corner of the window, and then click Manage Views. 3. Select the summary view you want to add and then click Edit. For example: SAM Oracle Application Summary. 4. Click Preview. 5. On the preview page, make note of the URL field of the browser. For example, http://SolarWinds/SolarWinds/SummaryView.aspx?viewid=27 6. Click Settings near the top right corner of the window, and then click Customize Menu Bars. 7. Click Edit in the Admin Menu Bar section. 8. Scroll to the bottom of the Available Items list and then click Add. 9. Enter a name for the menu item. For example: Oracle 10. Enter the URL of the summary view. 11. Click Ok. 12. Drag the new menu item from the Available Items list to the Selected Items list and then click Submit.
Customizing Application Details Views

Applications initially share a generic, default application details view. You can add, remove, or rearrange resources in this default view, or you can create completely new views that you can apply to groups of applications according to their templates. Default Application Details View
Application Details Last 25 Application Events Active Application Alerts Node Details Availability Statistics Processes and Services Components Application Availability CPU Load & Memory Statistics
To customize the default SAM application details view: 1. Find an Application Monitor that is using the default view by following these steps: a. Click Settings and then click SAM Settings. b. Click Manage Application Monitors. c. Find an assigned Application Monitor without a Custom View. d. Return to Applications > SAM Summary. 2. Click the Application Monitor to view its application details page. 3. Click Customize Page. 4. Proceed with your customizations. Custom Application Details View You can select and create a custom application details view. This custom view is applied at the template level. Applications inherit the custom view setting from their templates in the same way as other template settings. To customize an application details view for an assigned Application Monitor: 1. Click Settings and then click SAM Settings. 2. Click Manage Application Monitors. 3. Check the check box next to an Application Monitor and then click Edit Properties.
4. Click Modify Template Settings in the field Custom Application Details View. 5. Select Yes, use <TemplateName> Details View in the field Custom Application Details View, where TemplateName is the name of the selected Application Monitor template. 6. Click Submit. 7. Click the name of the assigned Application Monitor to view its application details page. 8. Click Customize Page. 9. Proceed with your customizations. After creating a customized application details view for a template, you can change the Custom Application Details View setting in the template properties to switch between the default view and the custom view. Managing Custom Application Details Views For each template or application based upon a template, you can select either the default application details view or the template's custom details view. To select a view for a template: 1. Click Settings and then click SAM Settings. 2. Click Manage Templates. 3. Check the check box next to a template and then click Edit. 4. If you want applications based on this template to use the default view , set Custom Application Details View to No, use Default Application Details View. 5. If you want applications based on this template to use the custom view , set Custom Application Details View to Yes, use <TemplateName> Details View, where TemplateName is the name of the selected template. 6. Click Submit. To select a view for an application: 1. Click Settings and then click SAM Settings. 2. Click Manage Application Monitors. 3. Check the check box next to an Application Monitor and then click Edit Properties. 4. Click Modify Template Settings in the field Custom Application Details View.
5. If you want this application to use the default view, set Custom Application Details View to No, use Default Application Details View . 6. If you want this application to use the custom view , set Custom Application Details View to Yes, use <TemplateName> Details View, where TemplateName is the name of the selected template. 7. Click Submit.
Viewing Node and Application Data in Tooltips

Node and application tooltips in SolarWinds SAM provide immediate status overviews of monitored nodes and applications. To view a quick overview of any monitored node or application in the web console, hover over the name of the item. Depending on the selected device, the information in the following tables is displayed immediately. Node Tooltips
Hover over To see Current status of the node (up, down, warning, unplugged, or unmanaged) Note: SolarWinds SAM now supports the ability to include applications in calculation of node child status. So if node is up, but application on that device is down, you will see a child status icon indicating there is a problem. The IP address currently assigned to the selected node The vendor icon and vendor description of the selected node The measured average response time of the selected node as of the last node poll The percent of all transmitted packets that are lost by the selected node as of the last node poll The percent of available processing capacity on the selected node that is currently used as of the last node poll The percent of available memory on the selected node that is currently used as of the last node poll Number of running VMS and total VMS Status of the ESX Host
Node Status
IP Address Machine Type Average Response Time Packet Loss CPU Load Memory Used # of Running VMS ESX Host Status
Application Tooltips
Hover over App Name App Status To see The name of the application. The status of the application (up, down, unknown, warning, or critical).

Server Status Components with Problems Operational status of the server (up, down, warning, unplugged, or unmanaged). List of the components with problems and their statuses.
Monitoring Network Events in the Web Console

SolarWinds SAM automatically logs all events that occur to any monitored devices on your network. These events are then displayed in the SolarWinds Web Console, so you can view and acknowledge them as your network management policies require.
Viewing Event Details in the Web Console

SolarWinds logs network events and lists them in the readily customizable Events view of the Web Console. Events are shown in order of occurrence, and they may be viewed by device, date and time, and event or device type. Note: The Network Event Log is maintained as part of the Nightly Database Maintenance plan defined within the Database Settings area of the SolarWinds Polling Setting page in the SolarWinds Web Console. Records are kept for the number of days specified Events Retention field (the default is 30 days). For more information, see Orion Polling Settings on page 194. To view event details in the Web Console: 1. Click Start > All Programs > SolarWinds > SolarWinds Web Console. 2. Log in to the SolarWinds Web Console, and then click Events in the Views toolbar. 3. If you want to filter your events view by object, select the Network Object or Type of Device to which you want to limit your view in the Filter Devices area. 4. If you want to limit your events view to show only events of a specific type, select the appropriate Event Type in the Filter Events area. 5. If you only want to see events from a specific period of time, complete either of the following options: Select a predefined period from the Time Period menu. Select Custom from the Time Period menu, and then click the appropriate fields to provide Begin and End dates and times. 6. In the Show X Events field, provide the maximum number of events you want to view. 7. If you want to show all events, including events that have already been cleared, check Show Cleared Events.
8. Click Refresh to complete your events view configuration.
Acknowledging Events in the Web Console

Acknowledging network events is straightforward in the Web Console, as shown in the following procedure. To acknowledge events in the Web Console: 1. Click Start > All Programs > SolarWinds > SolarWinds Web Console. 2. Log in to the SolarWinds Web Console, and then click Events in the Views toolbar. 3. Provide appropriate filter criteria for the displayed events. For more information, see Viewing Event Details in the Web Console on page 286. 4. Click Refresh to ensure that all selected view criteria take effect. 5. Check individual events to acknowledge or click Select All. 6. Click Clear Selected Events.
Chapter 14
Creating Account Limitations

The Account Limitation Builder application allows you to create and customize account limitations for the SolarWinds Web Console. These limitations ensure that users of the web console can only view the network objects that are pertinent to their job duties. The following are but a few examples of the uses of account limitation in the SolarWinds Web Console: Limit customer views to specific network nodes Limit views by department or functional area Limit views by device type or device role Limit views based on the geographic location of devices
SolarWinds SAM provides predefined account limitations that use built-in SolarWinds SAM property to limit user access. For greater flexibility, however, you can use the Account Limitation Builder to create your own account limitations based on predefined or custom properties. For more information about enabling account limitations in the SolarWinds Web Console, see Setting Account Limitations on page 184. For more information about custom properties, see Creating Custom Properties on page 465.
Using the Account Limitation Builder

Before you can use the Account Limitation Builder, you must have first created the custom property that you want to use to limit the Server & Application Monitor Web Console view. For more information, see Creating Custom Properties on page 465. After you have defined custom properties and populated them with data, you may use the Account Limitations Builder as directed in the following procedure.
Creating an Account Limitation

The following steps create an account limitation. To create an account limitation: 1. Click Start > All Programs > SolarWinds > Grouping and Access Control > Account Limitation Builder. 2. Click Start on the splash screen. 3. Click Edit > Add Limitation.
Creating Account Limitations 289
4. Select a Custom Property. Notes: If Custom Property is empty, you need to define a custom property. For more information, see Creating Custom Properties on page 465. The remaining boxes are populated automatically, based upon your selection. 5. Choose a Selection Method. Note: This is the selection format that will appear when you are choosing values for the account limitation through the web Account Manager. For more information, see Setting Account Limitations on page 184. 6. If you want to include your own description of your account limitation, type your description over the default text provided in the Description field. 7. Click Ok. Your newly defined account limitation is added to the top of the table view. You may now use the new limitation in the SolarWinds Web Console Account Manager. For more information, see Setting Account Limitations on page 184.
Deleting an Account Limitation

The following steps delete an account limitation using the Account Limitation Builder utility. To delete an account limitation: 1. Click Start > All Programs > SolarWinds > Grouping and Access Control > Account Limitation Builder. 2. Click Start on the splash screen. 3. Click the row of the limitation that you want to delete. Note: Use Shift+click to highlight multiple consecutive rows or Ctrl+Click to highlight multiple non-consecutive rows. 4. Click Edit > Delete Selected Limitations. Note: Although SolarWinds deletes the selected limitations from the table, ensuring that they will no longer be available through the web Account Manager, if you delete a limitation using the Account Limitation Builder, all accounts that have been assigned that limitation will remain limited. Deleting a limitation makes it unavailable for future use in the SolarWinds Web Console.
290 Creating Account Limitations
Chapter 15
Alerting and Reporting

The following sections provide an in-depth look into the alerting and reporting capabilities built into SolarWinds SAM. Refer to the following sections for more information: Creating Alerts Adding Alert Actions Testing Alert Actions Viewing Alerts in the SolarWinds Web Console Restarting Windows Services with an Alert Action Acknowledging Advanced Alerts in the Web Console Escalated Advanced Alerts Viewing Alerts from Mobile Devices Restarting Windows Services with an Alert Action Creating SolarWinds SAM-Specific Reports
Creating Alerts
SolarWinds SAM provides application and component alerts you can use with SolarWinds Advanced Alert Manager to actively monitor and respond to detected issues. Note: Only advanced alerts may be used for SolarWinds SAM-specific purposes. Basic alerts cannot be configured to trigger on SolarWinds SAM conditions or events. Refer to the following sections for more information: Configuring SolarWinds SAM Alerts
Alerting and Reporting 291
SolarWinds SAM Alerts
Configuring SolarWinds SAM Alerts

To configure a new alert: 1. Log on to the Windows server hosting SolarWinds SAM. 2. Click Start > All Programs > SolarWinds > Alerting, Reporting, and Mapping > Advanced Alert Manager. 3. Click Configure Alerts. This opens the Manage Alerts window. Example 1: SolarWinds SAM Alert This example sets up an alert triggered when a components status is Critical, and logs the alert to the NetPerfMon event log. To set up this alert trigger condition: 1. Click New in the Manage Alerts window. 2. Type Alert me when a component goes critical in the Name of Alert field. 3. Click the Trigger Condition tab. 4. Select APM: Component from the Type of Property to Monitor list. 5. Click Add, and then click Simple Condition from the shortcut menu. 6. Click the first asterisk (*) in the statement * is equal to *. 7. Point to APM Component Monitors and then click Component Status in the shortcut menu.
292 Alerting and Reporting
8. Click the remaining asterisk (*) in the statement Component Status is equal to *. 9. Type Critical in the list box. To set up the alert trigger action: 1. Click the Trigger Actions tab. 2. Click Add New Action. 3. Select Log the Alert to the NetPerfMon Event Log, and then click Ok. 4. Type "The component" in the message field, and then click Insert Variable. 5. Select APM:Component from the Variable Category list, select ComponentName from the Select A Variable list, and then click Build Selected Variable. 6. Type "of node" in the message field, and then click Insert Variable. 7. Select General from the Variable Category list, select NodeName from the Select A Variable list, and then click Build Selected Variable. 8. Type "is" in the message field, and then click Insert Variable. 9. Select APM:Component from the Variable Category list, select ComponentStatus from the Select A Variable list, and then click Build Selected Variable. Note: The full message should read "The component ${ComponentName} of node ${NodeName} is ${ComponentStatus}. 10. Click Ok to close the Log Alert window. 11. Click Ok to close the Edit Alert window. 12. Click Done to close the Manage Alerts window. If any of your components go into a critical state, you will now see a line item for each in the SolarWinds SAM Event Log. Example 2: Displaying Root Cause of Group Status in SolarWinds SAM Alert This example sets up an alert that is triggered when the group is Down, displays the root cause for the groups status in the alert, and logs the alert to the NetPerfMon event log. To set up this alert trigger condition: 1. Click New in the Manage Alerts window. 2. Type Alert me and show the root cause for the groups status in the Name of Alert field.
3. Click the Trigger Condition tab. 4. Select Group from the Type of Property to Monitor list. 5. Click Add, and then click Simple Condition from the shortcut menu. 6. Click the first asterisk (*) in the statement * is equal to *. 7. Point to Group and then click Group Status in the shortcut menu. 8. Click the remaining asterisk (*) in the statement Group Status is equal to *. 9. Type Down in the list box. To set up the alert trigger action: 1. Click the Trigger Actions tab. 2. Click Add New Action. 3. Select Log the Alert to the NetPerfMon Event Log, and then click Ok. 4. Type "Group" in the message field, and then click Insert Variable. 5. Select Group from the Variable Category list, select ContainerName from the Select A Variable list, and then click Build Selected Variable. 6. Type "is" in the message field, and then click Insert Variable. 7. Select Group from the Variable Category list, select ContainerStatusName from the Select A Variable list, and then click Build Selected Variable. 8. Type " because " in the message field, and then click Insert Variable. 9. Select Group from the Variable Category list, select StatusRootCause from the Select A Variable list, and then click Build Selected Variable. Note: The full message should read "Group ${ContainerName} is ${ContainerStatusName} because ${StatusRootCause}. 10. Click Ok to close the Log Alert window. 11. Click Ok to close the Edit Alert window. 12. Click Done to close the Manage Alerts window. If any of your groups go into a Down state, you will now see a line item for each that displays the first-level root cause of the group status for the alert in the SolarWinds SAM Event Log. For example, Group g3 is Down because Internet Information Services on TESTBED is Down.
Note: SolarWinds SAM does not recurse into a sub-group with problems to locate the root cause for the problem status ${StatusRootCause}. For example, if an object 2 levels deep inside a sub-group is actually responsible for the problem status, SolarWinds SAM will not recurse all the way down inside the sub-group to name the actual object that is responsible for the problem. It simply reports the sub-groups name and its status.
SolarWinds SAM Alerts

Your installation of SolarWinds SAM supplements the alerting abilities of SolarWinds common components with a number of SolarWinds SAM-specific configurable alerts. The following list provides the SolarWinds SAM properties on which you can trigger alerts: Component Monitor Alerting Properties Provides the following alert possibilities: Component Name This allows you to base your alert criteria on component names. Component Type This allows you to base your alert criteria on component types. Specify the component monitor type by value using the following table.
Component Monitor Type None DHCP User Experience Monitor Directory Size Monitor DNS Monitor - TCP DNS Monitor - UDP DNS User Experience Monitor Download Speed Monitor File Age Monitor File Change Monitor File Count Monitor File Existence Monitor File Size Monitor FTP Monitor FTP User Experience Monitor HTTP Form Login Monitor HTTP Monitor Value 0 35 38 4 5 15 25 36 23 39 28 22 7 24 27 6

HTTPS Monitor IMAP4 Monitor IMAP4 User Experience Monitor JMX Monitor LDAP User Experience Monitor Linux/Unix Script Monitor MAPI User Experience Monitor Nagios Script Monitor NNTP Monitor ODBC User Experience Monitor Oracle User Experience Monitor Performance Counter Monitor POP3 Monitor POP3 User Experience Monitor Process Monitor SNMP Process Monitor - WMI RADIUS User Experience Monitor SMTP Monitor SNMP Monitor SQL User Experience Monitor TACACS+ User Experience Monitor TCP Port Monitor Tomcat Server Monitor Web Link Monitor Windows Event Monitor Windows PowerShell Monitor Windows Script Monitor Windows Service Monitor WMI Monitor 14 13 30 49 34 21 31 50 11 16 18 37 12 29 8 1 40 10 32 17 41 2 33 26 42 45 20 9 19
Component Status This allows you to alert on Critical, Down, Unknown, Up, and Warning status. Response Time This allows you to alert on response time. Statistic Data This allows you to alert on statistic data.
Process (Service) Name This allows you to alert on the process or service name. For example: dns.exe, or AlertingEngine. Process Instance Count This allows you to alert on the instance count of a process. Percent CPU This allows you to alert on the percentage of CPU in use. Percent Physical Memory This allows you to alert on the percentage of physical memory in use. Percent Memory Used This allows you to alert on the percentage of total memory in use. Percent Virtual Memory This allows you to alert on the percentage of virtual memory in use. Virtual Memory Used This allows you to alert on the amount of virtual memory in use, in bytes. Application Monitor Alerting properties Below are alert possibilities: Application Name This allows you to select the names of currently configured application templates as values. Application Status This allows you to select whether the application is in a Critical, Down, Unknown, Up, or Warning status.
Application Monitor Variables for Alerts SolarWinds SAM adds the following variables to the core SolarWinds Orion variables when selecting APM-Application as the property type. For a complete list of Core variables, see "SolarWinds Variables and Examples" on page 481.
Application Variable Definition Hyperlink to application details page that is either the current alert triggered on or the details page of the application that the component that triggered the alert belongs to. Provides the status of the application. Provides a commadelimited list of components in a down, unknown, warning, or critical state. List of components that are not up along with component status included formatted with html tags. Html formatting is used for send e-mail action to provide improved appearance of listed components. List of components that are not up along with component status included. Formatted with html tags for events that appear on the web console. Provides a commadelimited list of all components and their current status. List of components with component status included formatted with html tags. Html formatting is used for send e-mail action to provide improved appearance of listed components. List of components with component status Formatted with html tags for events that appear on the web console.
${APM:ApplicationDetailsURL}
${Availability}
${ComponentsWithProblems}
${ComponentsWithProblemsFormatted}
${ComponentsWithProblemsFormattedHtml}
${ComponentsWithStatus}
${ComponentsWithStatusFormatted}
${ComponentsWithStatusFormattedHtml}

Provides the numeric application ID of the specific application. Provides the date and time the application was last seen in an Up state. Provides the name of the component, for example, SW Module Engine. Provides the numeric node ID of the server on which the application is monitored. System summary. Html formatting is used for send e-mail action to provide improved appearance of listed components. System summary. Formatted with html tags for events that appear on the web console. Provides the last polling date and time of an application.
${ID}
${LastTimeUp}
${Name}
${NodeID}
${SystemSummaryFormatted}
${SystemSummaryFormattedHtml}
${TimeStamp}
Component Monitor Variables for Alerts SolarWinds SAM adds the following variables to the core SolarWinds Orion variables when selecting APM-Component as the property type.
Component Monitor Variable ${APM:ComponentDetailsURL} ${ApplicationId} ${ApplicationName} ${ApplicationStatus} ${ComponentId} ${ComponentMessage} ${ComponentName} ${ComponentStatus} ${ComponentType} Definition Hyperlink to component details page that is the current alert triggered on. Provides the unique numeric identifier of the application. This value is analogous to the node ID. Provides the name of the monitored application. Provides the status of the application. Provides the numeric component ID of the specific application. Message sent when alerting on component status. Provides the name of the component, for example, SW Module Engine. Provides the status of the specific component. Provides the numeric component type. For more information, see SolarWinds SAM Alerts on page 295.

${DisplayType} ${LastTimeUp} ${MemoryUsed} ${MultiValueMessages} ${MultiValueStatistics} ${NodeID} ${PercentApplicationAvailability} ${PercentComponentAvailability} ${PercentCPU} ${PercentMemory} ${PercentVirtualMemory} ${ProcessInstanceCount} ${ProcessName} ${ResponseTime} ${StatisticData} ${StatusOrErrorDescription] ${Threshold-CPU-Critical} ${Threshold-CPU-Warning} ${Threshold-PhysicalMemory-Critical} ${Threshold-PhysicalMemory-Warning} ${Threshold-ResponseTime-Critical} ${Threshold-ResponseTime-Warning} ${Threshold-Statistic-Critical} ${Threshold-Statistic-Warning} ${Threshold-VirtualMemory-Critical} ${Threshold-VirtualMemory-Warning} ${TimeStamp} Provides the display type, for example, Windows Service, for the specific monitor. Provides the date and time a component was last seen in the Up state. Provides the memory used by a component, in bytes. Message sent when alerting on Multiple Value Chart. Statistics sent when alerting on Multiple Value Chart. Provides the numeric node ID of the server on which the application is monitored. Provides the availability of an application as a percentage. Provides the availability of a component as a percentage. Provides the CPU used by a component as a percentage. Provides the memory used by a component as a percentage. Provides the virtual memory used by a component as a percentage. Provides the instance count of a process. Provides the process name. Provides the response time of a component. Provides the statistics data value of a component. Provides the status of the component, including the full text of any error messages. Provides the critical threshold for CPU. Provides the warning threshold for CPU. Provides the critical threshold for physical memory. Provides the warning threshold for physical memory. Provides the critical threshold for response time. Provides the warning threshold for response time. Provides the critical threshold for statistics. Provides the warning threshold for statistics. Provides the critical threshold for virtual memory. Provides the warning threshold for virtual memory. Provides the last polling date and time of a component.

Provides a description of the component. Note: A default description is given by SolarWinds. Any changes you make will override the default description and be automatically saved. Provides notes from the user about a component. Changes you make will automatically be saved. Provides the virtual memory used by a component, in bytes.
${UserDescription}
${UserNotes} ${VirtualMemoryUsed}
Testing Alert Actions

The Advanced Alert Manager provides an alert action test feature so you can confirm the desired function for actions you have configured to fire when SolarWinds detects an alert condition on your network. Complete the following procedure to test an alert action. To test an alert action: 1. Click Start > All Programs > SolarWinds > Alerting, Reporting, and Mapping > Advanced Alert Manager. 2. Click Configure Alerts. 3. Click the alert for which the action you want to test is configured. 4. Click Test. 5. If the alert is configured to fire on a node condition, select Alert on Network Node, and then select the node against which you want to test the action. 6. If the alert is configured to fire on an interface condition, complete the following steps: Note: Testing alert actions against interfaces is only available if SolarWinds Network Performance Monitor is installed and monitoring interfaces on your network. For more information, see the SolarWinds Network Performance Monitor Administrator Guide. a. Select Alert on Network Node, and then select the parent node of the interface against which you want to test the action. b. Select Select Interface on ParentNode, and then select the interface against which you want to test the action. 7. If the alert is configured to fire on a volume condition, complete the following steps:
a. Select Alert on Network Node, and then select the parent node of the volume against which you want to test the action. b. Select Select Volume on ParentNode, and then select the volume against which you want to test the action. 8. To test an alert trigger action, click Test Alert Trigger. 9. To test an alert reset action, click Test Alert Reset. 10. When the test completes, as indicated by the test log, click Done. Confirm that the expected action occurred as a result of the selected alert trigger or reset.
Viewing Alerts in the SolarWinds Web Console

The Triggered Alerts for All Network Devices page provides a table view of your alerts log. You can customize the list view by using the following procedure to select your preferred alert grouping criteria. To view alerts in the Web Console: 1. Click Start > All Programs > SolarWinds > SolarWinds Web Console. 2. Click Alerts in the Views toolbar. 3. To filter your alerts table view by device, select the device to which you want to limit your alerts view in the Network Object field. 4. To filter your alerts table by type of device, select the device type to which you want to limit your alerts view in the Type of Device field. 5. To limit your alerts table to show a specific type of alert, select the alert type in the Alert Name field. 6. In the Show Alerts field, provide the number of alerts you want to view. 7. To show all alerts, even if they have already been cleared or acknowledged, check Show Acknowledged Alerts. 8. Click Refresh to complete your Alerts view configuration.
Acknowledging Advanced Alerts in the Web Console

SolarWinds SAM allows you to acknowledge advanced alerts in the SolarWinds Web Console, allowing you to eliminate time lost either when multiple users attempt to resolve the same issue or when a user tries to address an issue that has already been resolved. To acknowledge advanced alerts using the SolarWinds Web Console:
1. Log in to the SolarWinds Web Console using an account that has been granted alert acknowledgement privileges. Note: For more information about access privileges for SolarWinds Web Console users, see User Account Access Settings on page 182. 2. Click Alerts on the Views toolbar. 3. To limit the list of alerts to only those dealing with a single device, select the specific device from the Network Object list. Note: This option is only available if alerts fire on multiple network devices. 4. To limit the list of alerts to only those dealing with a single type of device, select the device type from the Type of Device list. Note: This option is only available if SolarWinds is monitoring multiple types of network devices. 5. To limit the list of alerts to only those of a single type, select the specific alert type from the Alert Name list. Note: This option is only available when multiple types of SolarWinds SAM alerts have been triggered. 6. Confirm the number of alerts displayed in the Show Alerts field. 7. If you want acknowledged alerts to remain in the Alerts view, even after they have been acknowledged, check Show Acknowledged Alerts. 8. Click Refresh to update the alerts list with your new settings. 9. Check Acknowledged next to the alerts you want to acknowledge. 10. Click Acknowledge Alerts.
Viewing Alerts from Mobile Devices

SolarWinds SAM is capable of detecting when you are accessing the SolarWinds Web Console from a mobile device. This mobile alerts view allows you to view and acknowledge existing active alerts. To view and acknowledge alerts from a mobile device: 1. Using a browser on your mobile device, log in to your SolarWinds Web Console as a user with alert management rights. 2. Click Alerts in the Views toolbar. Note: If you want to view the mobile alerts view from a desktop or server browser, add ?IsMobileView=true to the URL of the Alerts view in your SolarWinds Web Console. 3. Check alerts you want to acknowledge, and then click Acknowledge.
Clickable links in alert messages provide more information about triggered alerts.
Restarting Windows Services with an Alert Action

You can use the alert trigger action "Execute program" to restart a Windows service that is down. SolarWinds SAM restarts the service by running an included program named APMServiceControl.exe. When given the Component ID number of a Windows Service monitor, this program restarts the service using the service name and credential defined in the monitor. The Component ID number of a monitor is an internal designation. If the alert is an SAM Component-based alert, use the ${ComponentId} variable to pass the Component ID to the program.
Usage: APMServiceControl ComponentId [-h] [-c=COMMAND-NAME] [-t=TIMEOUT] Options: ComponentId: The ID of the Windows Service Component Monitor to control. In the Advanced Alert Engine, you can use the alert variable ${{ComponentId}} to
determine this value.

-c = COMMAND NAME: The command to sent to the service. This must be START, STOP, or RESTART. The default is {0}. -t = TIMEOUT: Timeout for the command in seconds. Default is {1}
second.
-h = This is help text.
SolarWinds Server & Application Monitor Administrator Guide Example:
From a Component Alert Trigger:

APMServiceControl ${{ComponentId}} -c=RESTART
would look like the following:

APMServiceControl.exe 156849 -c=RESTART
To manually determine the Component ID number, go to the Component Details View in the Web Console. The number after AM: in the URL of the page is the Component ID. For example:
http://localhost/SolarWinds/SAM/MonitorDetails.aspx?NetObject=AM:1 1
Example Alert Manager Trigger Action to Restart a Windows Service

Execute program: APMServiceControl.exe ${ComponentId}
Using the Preconfigured Restart a Service Alert The SolarWinds Alert Manager includes a pre-configured alert called Restart a Service that has a recovery action to restart a service if a Windows service component monitor is down. You must enable this alert manually because it is disabled by default. To enable the Restart a Service alert: 1. Click Start > All Programs > SolarWinds > Alerting, Reporting, and Mapping > Advanced Alert Manager. 2. Click Configure Alerts. 3. Check Restart a Service. 4. Click Done.
Creating a New Advanced Alert

The following procedure creates a new advanced alert. To create a new advanced alert: 1. Click Start > SolarWinds > Alerting, Reporting, and Mapping > Advanced Alert Manager. 2. Click View > Configure Alerts.
3. Click New.
The Edit Alert window displays, providing an array of configurable alerting options, including trigger and reset conditions, suppressions, and date and time limitations. The following sections provide more information about configuring alert options.
Naming, Describing, and Enabling an Advanced Alert

Use the following steps, after clicking New, Copy, or Edit from the Manage Alerts Window, to name and describe an advanced alert. To name and describe an advanced alert: 1. Click Start > SolarWinds > Alerting, Reporting, and Mapping > Advanced Alert Manager. 2. Click View > Configure Alerts. 3. To create a new alert, click New.
4. To copy or edit an existing alert, select an alert from the list, and then click Copy or Edit, as appropriate.
5. Click General, type the name of your alert in the Name of Alert field, and then type a description of your alert in the description field.
6. Check Enable this Alert.
7. Type the Alert Evaluation Frequency and select Seconds, Minutes, or Hours from the list to set the checking interval for your alert.
8. Click Trigger Condition to set the trigger condition for your alert. For more information, see Setting a Trigger Condition for an Advanced Alert on page 308.
Setting a Trigger Condition for an Advanced Alert

You can set the specific conditions for triggering an advanced alert with the following procedure. Note: Properly defining alert trigger conditions to address specific network conditions on selected network objects can eliminate the need for alert suppression conditions. SolarWinds recommends the use of appropriately specific trigger conditions to define alerts instead of suppression conditions, if possible. For more information about defining conditions, see Understanding Condition Groups on page 316. To set the trigger conditions for an advanced alert: 1. Click Start > SolarWinds > Alerting, Reporting, and Mapping > Advanced Alert Manager. 2. Click View > Configure Alerts. 3. To create a new alert, click New.
4. To copy or edit an existing alert, select an alert from the list, and then click Copy or Edit, as appropriate. 5. Click Trigger Condition. 6. Select the Type of Property to Monitor from the list. Note: The following image is a screen capture from a SolarWinds Network Performance Monitor installation. Other modules will look similar, but different objects may be present.
7. If you select Custom SQL Alert, complete the following steps: a. Select the object on which you want to alert in the Set up your Trigger Query field. b. Provide your custom SQL in the field below the object selection query. c. To delay the trigger of this alert, provide the value and unit of your desired alert trigger delay. d. To confirm your provided SQL, click Validate SQL. 8. If you select a type of monitored object, complete the following steps: a. Generate trigger conditions in the text field by selecting appropriate descriptors from the linked context menus and by clicking Browse () on the left of the text field. b. Click the linked text to select the number of conditions that you want to apply (all, any, none, not all). For more information about linked text conditions, see Understanding Condition Groups on page 316.
c. Click Browse () to view the following condition options: Note: The has changed condition is only valid for the Last Boot, IOS Version, and IOS Image Family device characteristics.
To generate a condition based on a comparison of device states, click Add a Simple Condition.
To generate a condition based on a comparison of device fields and values, click Add a Complex Condition. To define more conditions, click Add a Condition Group. To remove a selected condition, click Delete Current Condition. To change the order of your conditions, click Move Down or Move Up, as appropriate. d. To add a condition, click Browse (), and then click Add ConditionType, as appropriate for the condition you want to add. e. To delete a condition, click Browse (), next to the condition you want to delete, and then click Delete Current Condition. Notes: Conditions may be exported for use with other alerts by clicking Export Conditions and saving as appropriate. Click Import Conditions to import existing conditions from other alerts. Imported trigger conditions automatically overwrite any existing trigger conditions.
f.
To specify a time duration for the condition to be valid, type the interval and select Seconds, Minutes, or Hours from the list. Note: You may need to delay alert trigger actions until a condition has been sustained for a certain amount of time. For example, an alert based on CPU load would not trigger unless the CPU Load of a node has been over 80% for more than 10 minutes. To set up a sustained-state trigger condition, at the bottom of the Trigger Condition tab, provide an appropriate amount of time the alert engine should wait before any actions are performed. By default, the alert triggers immediately, if the trigger condition exists. The maximum alert action delay is eight hours after the trigger condition is met.
g. When done, click OK.
Setting a Reset Condition for an Advanced Alert

Set specific conditions for resetting an advanced alert using the following steps. To set the conditions for resetting an advanced alert: 1. Click Start > SolarWinds > Alerting, Reporting, and Mapping > Advanced Alert Manager. 2. Click View > Configure Alerts, and then click New or select an alert from the list and click Copy or Edit. 3. Click Reset Condition. 4. If you want a simple alert reset when trigger conditions no longer exist, select Reset when trigger conditions are no longer true. 5. If you want a conditional alert reset, select Reset this alert when the following conditions are met. Notes: Generate reset conditions in the text field by selecting appropriate descriptors from the linked context menus and by clicking Browse (). 6. To copy the condition used on the Trigger Condition tab, click Copy From Trigger. 7. Click the linked text to select the number of conditions to apply. For more information, see Understanding Condition Groups on page 316.
8. Click Browse () to view the following condition options: To generate a condition based on a comparison of device states, click Add a Simple Condition. To generate a condition based on a comparison of device fields and values, click Add a Complex Condition . To further define condition application, click Add a Condition Group. To remove a selected condition, click Delete Current Condition. To change the order of your conditions, click Move Down or Move Up. 9. To add a condition, click Add, and then select the type of condition you want to add. 10. To delete a condition, select the condition from the condition list, and then click Delete. Notes: Conditions may be exported for use with other alerts by clicking Export Conditions and saving as appropriate. Conditions from other alerts may be imported to the current alert by clicking Import Conditions. Warning: Imported trigger conditions automatically overwrite any existing trigger conditions. Because there are many situations where the reset conditions are the opposite of, or are very similar to, the trigger conditions, SolarWinds has provided a function that copies the trigger conditions to the reset conditions. Click Copy From Trigger to add the trigger condition. 11. To specify a time duration for the condition to be valid, type the time interval and select Seconds, Minutes, or Hours from the list. Note: It is often appropriate to delay alert reset actions until a condition has been sustained for a certain amount of time. For example, an alert based on node status would not reset until the node has been up for more than five minutes. To establish a sustained-state reset condition, provide an appropriate interval at the bottom of the Reset Condition tab for the amount of time that the alert engine should wait before any actions are performed. The default setting is to reset the alert immediately, once the reset condition exists. The maximum interval between when the trigger condition first exists and when the corresponding alert action is performed is eight hours. 12. When done, click OK.
Setting a Suppression for an Advanced Alert

You can set the specific conditions for suppressing an advanced alert using the following procedure. Notes: Alert Suppression is only available if you have checked Show Advanced Features in the lower left of the Edit Advanced Alert window. In many cases, because suppression conditions are checked against all monitored objects on your network, properly defining alert trigger conditions may eliminate the need for alert suppression. For more information about defining alert trigger conditions, see Setting a Trigger Condition for an Advanced Alert on page 308 and Understanding Condition Groups on page 316.
To set conditions for advanced alert suppression: 1. Click Start > All Programs > SolarWinds > Alerting, Reporting, and Mapping > Advanced Alert Manager. 2. Click View > Configure Alerts. 3. Click New or select an alert from the list. 4. Click Copy or Edit, as appropriate. 5. Click Alert Suppression. Note: Generate suppression conditions in the text field by selecting appropriate descriptors from the linked context menus and by clicking Browse () on the left of the text field. 6. To copy the condition used on the Trigger Condition tab, click Copy From Trigger. 7. Click the linked text to select the number of conditions that you want to apply (all, any, none, not all). For more information about linked text conditions, see Understanding Condition Groups on page 316. 8. Click Browse () to view the following condition options: To generate a condition based on a comparison of device states, click Add a Simple Condition. To generate a condition based on a comparison of device fields and values, click Add a Complex Condition .
To further define the application of your conditions, click Add a Condition Group. To remove a selected condition, click Delete Current Condition. To change the order of your conditions, click Move Down or Move Up. 9. To add a condition, click Add and then select the type of condition you want to add. 10. To delete a condition, select the condition from the condition list, and then click Delete. Note: Conditions may be exported for use with other alerts by clicking Export Conditions and saving as appropriate. Conditions from other alerts may be imported to the current alert by clicking Import Conditions. Warning: Imported conditions automatically overwrite existing conditions. 11. If you are finished configuring your advanced alert, click Ok.
Setting the Monitoring Period for an Advanced Alert

You can select the specific time periods and days that your advanced alert will monitor your network objects with the following procedure. To set the monitoring time period and days for an advanced alert: 1. Click Start > All Programs > SolarWinds > Alerting, Reporting, and Mapping > Advanced Alert Manager. 2. Click View > Configure Alerts. 3. Click New or select an alert from the list. 4. Click Copy or Edit. 5. Click Time of Day. 6. Enter the time period over which you want to monitor your network. Note: Alerts only trigger if the trigger condition is met within this time period. 7. Select the days on which you want to monitor your network. Note: Alerts will only trigger if your trigger condition is met on the days selected. 8. Wne done, click OK.
Setting a Trigger Action for an Advanced Alert

Select actions that will occur when your advanced alert is triggered as follows. To set a trigger action for an advanced alert:
1. Click Start > SolarWinds > Alerting, Reporting, and Mapping > Advanced Alert Manager. 2. Click View > Configure Alerts. 3. Click New or select an alert from the list, and then click Copy or Edit, as appropriate. 4. Click Trigger Actions. 5. To add a new advanced alert action, click Add New Action, and then select the actions you want to occur when the alert triggers. 6. To edit an existing advanced alert action, select the existing alert action, and then click Edit Selected Action. 7. Follow the instructions to configure each action. Note: Depending on the type of action selected, different options will be displayed to configure the alert action. For more information about individual alert actions, see Alerting and Reporting" on page 291. 8. To delete an action, select the action and then click Delete Selected Action. 9. When done, click OK.
Setting a Reset Action for an Advanced Alert

Select actions that will occur when your advanced alert is reset with the following procedure. To set a reset action for an advanced alert: 1. Click Start > SolarWinds > Alerting, Reporting, and Mapping > Advanced Alert Manager. 2. Click View > Configure Alerts. 3. Click New Alert, Copy Alert, or Edit Alert, as appropriate. 4. Click Reset Actions. 5. To add an advanced alert action, click Add New Action, and then select the actions you want to occur when the alert triggers. 6. To edit an advanced alert action, select the existing alert action, and then click Edit Selected Action.
7. Follow the instructions to configure each action. Note: Depending on the type of action selected, different options display configuring the alert action. For more information about individual alert actions, see Escalated Advanced Alerts" on page 335. 8. To delete a selected action, click Delete Selected Action. 9. When done, click OK.
Alert Escalation
When editing any trigger or reset action, use the Alert Escalation tab, if it is available, to define additional alert action options. Depending on the alert action being configured, any or all of the following options may be available on the Alert Escalation tab: To disable the action when the alert has been acknowledged, check Do not execute this Action if the Alert has been Acknowledged. To execute the action repeatedly as long as the trigger condition exists, check Execute this Action repeatedly while the Alert is Triggered and then provide an appropriate action execution interval. To delay the execution of the alert action, check Delay the execution of this Action and then provide an appropriate interval that the alert engine should wait after the alert condition is met before the alert action is executed.
For more information, see Escalated Advanced Alerts on page 335.
Understanding Condition Groups

A condition group is a set of user-defined rules governing alert triggers and resets. By default, the condition group Trigger Alert when all of the following apply is added when new alert triggers or reset conditions are created. Four different logical descriptors are used to create conditions: all, any, none, and not all, and clicking the word all and enables you to select different values. The following sections describe these logical descriptors. All Condition Group
Trigger Alert when all of the following apply means that every
condition in the group must be true before the alert is triggered. In the following example, there are three conditions within the condition group: Node Status is equal to Up Percent Loss is greater than or equal to 75 CPU Load is greater than or equal to 85
This alert will not trigger unless the Node is Up, packet loss is greater than or equal to 75%, and CPU load is greater than or equal to 85%. When setting the condition group to all, picture every condition as being separated by an and statement. So, in this example, the alert trigger would read:
Alert when: (Node Status = Up) and (Percent Loss >= 75) and (CPU Load >= 85)
Any Condition Group Changing the condition group to Trigger Alert when any of the following apply changes the logic to or statements. In this example, changing the condition group to any would change the alert trigger to:
Alert when: (Node Status = Up) or (Percent Loss >= 75) or (CPU Load >= 85)
In this situation, if any of the three conditions become true, the alert will trigger. None Condition Group Changing the condition group to Trigger Alert when none of the following apply means that all conditions in the group must be false before the alert is triggered. In this example the alert trigger would read:
Alert when: (Node Status = Down) and (Percent Loss <= 75) and (CPU Load <= 85)
Each condition is separated by an and statement just like the all condition group; however, the conditions have been inverted (Node Status = Down instead of Node Status = Up). Not All Condition Group Changing the condition group to Trigger Alert when not all of the following apply means that any condition in the group must be false before the alert is triggered. So, in this example the alert trigger would read:
Alert when: (Node Status = Down) or (Percent Loss <= 75) or (CPU Load <= 85)
Each condition is separated by an or statement just like the any condition group; however, the conditions have been inverted (Node Status = Down instead of Node Status = Up).
Note: The states of Down and Unreachable are not equivalent. They are two distinct states. For example: If the trigger condition, Status is not equal to Up, is met, an alert will be triggered for Unreachable applications.
Using the Advanced Alert Manager

The Advanced Alert Manager is an interface used to view network events and alerts. You can also use Advanced Alert Manager to create and manage advanced alerts. The following procedures introduce the main features of the Advanced Alert Manager showing how to configure and view advanced alerts. Current Events Window The Current Events window of the Advanced Alert Manager shows the most recent network events with their descriptions and other information from the events log. To use the Current Events window to view network events: 1. Click Start > All Programs > SolarWinds > Alerting, Reporting, and Mapping > Advanced Alert Manager. 2. Click View > Current Events. 3. Select one of the following Group By criteria for grouping events: Event Type, Object Type, Network Node, Acknowledged, or No Grouping. 4. To change the viewable category columns in the Current Events window , click Include, and then complete the following procedure: a. Click the Event View Columns tab, and then select column IDs from the All Columns field. b. Click the right arrow to move your column IDs into the Selected Columns field. c. If there are any column IDs in the Selected Columns field that you do not want to view, select them, and then click the left arrow to move your selected column IDs to the All Columns field. d. Click the up or down arrows to change the order of your selected columns accordingly. e. Position the slider to set the Event View refresh rate. f. Type the number of events that you want to be able to review in the Display a maximum of XXXX events in the Event View field.
g. When done, click OK.
5. Click Refresh to update the Current Events window with the latest events and column IDs. 6. To acknowledge a network event, click X next to the event. Active Alerts Window The Active Alerts window of the Advanced Alert Manager shows network alerts with their descriptions and other information from the alerts log. To use the Active Alerts window to view active network alerts: 1. Click Start > All Programs > SolarWinds > Alerting, Reporting, and Mapping > Advanced Alert Manager. 2. Click View > Active Alerts. 3. Select one of the Group By criteria for grouping alerts: Alert Name, Object Type, Object Name, Alert State, Acknowledged, Acknowledged By, or No Grouping. 4. Click Include, and then check the types of alerts that you want to view: Acknowledged, Trigger Pending, Triggered, or Reset Pending. 5. To change the viewable category columns in the Current Events window, click Include > Select Alert Columns, and then complete the following procedure: a. Select column IDs from the All Columns field. b. Click the right arrow to move your column IDs into the Selected Columns field. c. If there are any column IDs in the Selected Columns field that you do not want to view, select them, and then click the left arrow to move your selected column IDs to the All Columns field. d. Click the up or down arrows to change the order of your selected columns accordingly. e. Position the slider to set the Alert View refresh rate. f. When done, click OK.
6. Click Refresh to update the Active Alerts window with the latest alerts and column IDs. 7. Click Configure Alerts to change the settings for individual alerts. For more information, see Creating and Viewing Reports" on page 339. 8. To acknowledge an active alert, check the alert in the Acknowledged column. Note: As soon as the alert is acknowledged, the user information and
date/time is recorded in the database. Alert Viewer Settings Alert views in the SolarWinds Advanced Alert Manager are configured in the Alert Viewer Settings window, as presented in the following procedure. To configure alert views in the Advanced Alert Manager: 1. Click Start > All Programs > SolarWinds > Alerting, Reporting, and Mapping > Advanced Alert Manager. 2. Click File > Settings. Note: The Configure Alerts tab of the Alert Viewer Settings window displays all available network alerts, and from this window you can create, copy, edit, and delete alerts. 3. Click Alert View Columns. 4. Select the information titles that you want to see about your alerts from the All Columns list. 5. Click the right arrow to transfer them to the Selected Columns list. Note: The Selected Columns list provides a list of all the information that the Alert Viewer will show for each active alert. 6. To remove titles from the Selected Columns list, select titles that you want to remove from the active view in the Selected Columns list, and then click the left arrow. 7. To rearrange the order in which the different pieces of alert information are presented in the Alert Viewer, select titles from the Selected Columns list and use the up and down arrows to arrange the titles accordingly. 8. Position the slider at the bottom of the tab to set the Alert View refresh rate. 9. Click Event View Columns. 10. Select the information titles that you want to see about events from the All Columns list. 11. Click the right arrow to transfer them to the Selected Columns list. Note: The Selected Columns list provides a list of all the information that the Alert Viewer will show for each recorded event. 12. To remove titles from the Selected Columns list, select titles that you want to remove from the active view in the Selected Columns list, and then click the left arrow.
13. To rearrange the order in which the different pieces of event information are presented in the Alert Viewer, select titles from the Selected Columns list and use the up and down arrows to arrange the titles accordingly. 14. Position the slider at the bottom of the tab to set the Event View refresh rate. 15. Enter the number of events that you want to see in the Event View.
Adding Alert Actions

SolarWinds Network Performance Monitor provides a variety of actions to signal an alert condition on your network. These alert actions are available for both basic and advanced alerts, and the following procedure assigns actions to the alert conditions that you have defined for your network. To add an alert action: 1. Click Start > All Programs > SolarWinds > Network Performance monitor > System Manager. 2. Click Alerts > Active Alerts, and then click either Configure Basic Alerts or Configure Advanced Alerts, as appropriate. 3. Check the alert to which you want to add the action, and then click Edit Alert. 4. Click Actions, and then select the action you want to edit. 5. Click Add Alert Action, and then click the action to add to your chosen alert. Refer to the following sections for more information: Sending an E-mail / Page Playing a Sound Logging an Advanced Alert to a File Logging an Advanced Alert to the Windows Event Log Logging an Advanced Alert to the NetPerfMon Event Log Sending a Syslog Message Executing an External Program Executing a Visual Basic Script Emailing a Web Page Using Text to Speech Output
Sending a Windows Net Message Sending an SNMP Trap Using Get or Post URL Functions Dial Paging or SMS Service
Sending an E-mail / Page

The following procedure configures an e-mail/page action for an advanced alert. Note: Emails and pages are sent in plain text. To configure an email/page action for an advanced alert: 1. Click E-mail/Pager Addresses, and then 2. Complete the To, CC, BCC, Name, and Reply Address fields. Note: You must provide at least one email address in the To field, and multiple addresses must be separated with commas. Some pager systems require a valid reply address to complete the page. 3. Click Message. 4. Select the format (Plain text or HTML) for your alert email. 5. Type the Subject and Message of your alert trigger email/page. Note: Messaging is disabled if both Subject and Message fields are empty. 6. To insert a variable into the Subject or Message field, click the location of the new variable, and then complete the following procedure: a. Click Insert Variable. b. Select a Variable Category, and then select the variable to add. c. To change the parser, check Change Parser, and then select the parser you want to use. d. To define the SQL variable to copy to the clipboard, check Define SQL Variable, and then click Insert Variable From Above List. e. Click Build Selected Variable. Note: For more information about messages that use variables, see SolarWinds Variables and Examples" on page 481. 7. Click SMTP Server.
8. Type the Hostname or IP Address of your SMTP Server and the designated SMTP Port Number. Note: The SMTP server hostname or IP address field is required. You cannot send an email/page alert without identifying the SMTP server. 9. To use SSL/TLS encryption for your alert email, check Enable SSL. 10. If your SMTP server requires authentication, check This SMTP Server requires Authentication. 11. Click Time of Day. 12. Enter the time period over which you want to activate your alert action, and then select the days on which you want to activate your alert action. 13. To enable alert escalation, click the Alert Escalation tab, and then check any of the following options, as appropriate for your alert: To disable the action when the alert has been acknowledged, check Do not execute this Action if the Alert has been Acknowledged . To execute the action repeatedly as long as the trigger condition exists, check Execute this Action repeatedly while the Alert is Triggered and then provide an appropriate action execution interval. To delay alert action execution, check Delay the execution of this Action, and then provide an appropriate interval the alert engine should wait after the alert condition is met before the alert action is executed. 14. When done, click OK.
Playing a Sound
SolarWinds can be configured to play a sound upon alert trigger or reset. The following procedure configures a sound to play for an advanced alert. Note: Due to restrictions on Windows service applications, the Play a Sound action is not available to SolarWinds installations on either Windows 7 or Windows Server 2008 and higher. To configure a play sound action for an advanced alert: 1. Click Play Sound. 2. Specify a sound file for the alert trigger by doing either of the following in the Sound file to play field: Type the complete directory path and file name. Click Browse () to navigate your file system and select the target file.
3. Click the musical note button to the right of either text field to test the sound file you have specified. 4. Click Time of Day. 5. Enter the time period over which you want to activate your alert action, and then select the days on which you want to activate your alert action. 6. To enable alert escalation, click Alert Escalation, and then check any of the following options, as appropriate for your alert: To disable the action when the alert has been acknowledged, check Do not execute this Action if the Alert has been Acknowledged . To execute the action repeatedly as long as the trigger condition exists, check Execute this Action repeatedly while the Alert is Triggered and then provide an appropriate action execution interval. To delay alert action execution, check Delay the execution of this Action, and then provide an appropriate interval the alert engine should wait after the alert condition is met before the alert action is executed. 7. When done, click OK.
Logging an Advanced Alert to a File

SolarWinds can be configured to log alerts to a designated file. The following procedure logs an advanced alert to a designated file To configure an alert log file for an advanced alert: 1. Click Event Log, and then specify an alert log file by doing either of the following in the Alert Log Filename field: Note: If the file specified does not exist, it will be created with the first alert occurrence. Type the complete path and name of the target file. Click Browse () to navigate your file system and select the target file. 2. Type the message you want to log to your alert log file in the Message field. 3. To insert a variable into the Message field, complete the following procedure: a. Click Insert Variable, and then select a Variable Category. b. Select the variable you want to add. c. To change the parser, check Change Parser, and then select the parser you want to use.
d. To define the SQL variable to copy to the clipboard, check Define SQL Variable, and then click Insert Variable From Above List. e. Click Build Selected Variable. Note: For more information about messages that use variables, see SolarWinds Variables and Examples" on page 481. 4. Click Time of Day. 5. Enter the time period over which you want to activate your alert action. 6. Select the days on which you want to activate your alert action. 7. To enable alert escalation, click the Alert Escalation tab, and then check any of the following options, as appropriate for your alert: To disable the action when the alert has been acknowledged, check Do not execute this Action if the Alert has been Acknowledged . To execute the action repeatedly as long as the trigger condition exists, check Execute this Action repeatedly while the Alert is Triggered and then provide an appropriate action execution interval. To delay alert action execution, check Delay the execution of this Action, and then provide an appropriate interval the alert engine should wait after the alert condition is met before the alert action is executed. 8. When done, click OK.
Logging an Advanced Alert to the Windows Event Log

You may specify that an alert be logged to the Windows Event Log either on the SolarWinds server or on a remote server. The following procedure logs an advanced alert to the Windows Event Log on a designated server. To configure advanced alert logging to the Windows Event Log: 1. Click Windows Event Log. 2. If you want your alert to write to the Windows Event Log on your SolarWinds server, select Use Event Log Message on Network Performance Monitor Server. 3. If you want your alert to write to the Windows Event Log on a remote server, select Use Event Log Message on a Remote Server, and then provide the Remote Server Name or IP Address. 4. Type the message you want to log to the Windows Event Log in the Message to send to Windows Event Log field. 5. To insert a variable into the Message field, complete the following procedure: a. Click Insert Variable.
b. Select a Variable Category. c. Select the variable you want to add. d. To change the parser, check Change Parser, and then select the parser you want to use. e. To define the SQL variable to copy to the clipboard, check Define SQL Variable, and then click Insert Variable From Above List. f. Click Build Selected Variable. Note: For more information about messages that use variables, see SolarWinds Variables and Examples" on page 481. 6. Click Time of Day. 7. Enter the time period and select the days over which you want to activate your alert action. 8. To enable alert escalation, click Alert Escalation, and then check any of the following options, as appropriate for your alert: To disable the action when the alert has been acknowledged, check Do not execute this Action if the Alert has been Acknowledged . To execute the action repeatedly as long as the trigger condition exists, check Execute this Action repeatedly while the Alert is Triggered and then provide an appropriate action execution interval. To delay alert action execution, check Delay the execution of this Action, and then provide an appropriate interval the alert engine should wait after the alert condition is met before the alert action is executed. 9. When done, click OK.
Logging an Advanced Alert to the NetPerfMon Event Log

You may specify that an alert be logged to the NetPerfMon Event Log either on the SolarWinds server or on a remote server. The following procedure logs an advanced alert to the NetPerfMon Event Log on a designated server. To configure advanced alert logging to the NetPerfMon Event Log: 1. Click SAM Event Log. 2. Type the message you want to log to the NetPerfMon Event Log in the Message to send to Network Performance Monitor Event Log field. 3. To insert a variable into the Message field, complete the following procedure: a. Click Insert Variable. b. Select a Variable Category.
c. Select the variable you want to add. d. To change the parser, check Change Parser, and then select the parser you want to use. e. To define the SQL variable to copy to the clipboard, check Define SQL Variable, and then click Insert Variable From Above List. f. Click Build Selected Variable. Note: For more information about messages that use variables, see SolarWinds Variables and Examples" on page 481. 4. Click Time of Day. 5. Enter the time period and select the days over which you want to activate your alert action. 6. To enable alert escalation, click Alert Escalation, and then check any of the following options, as appropriate for your alert: To disable the action when the alert has been acknowledged, check Do not execute this Action if the Alert has been Acknowledged . To execute the action repeatedly as long as the trigger condition exists, check Execute this Action repeatedly while the Alert is Triggered and then provide an appropriate action execution interval. To delay alert action execution, check Delay the execution of this Action, and then provide an appropriate interval the alert engine should wait after the alert condition is met before the alert action is executed. 7. When done, click OK.
Sending a Syslog Message

SolarWinds can log received alerts to the Syslog of a designated machine. The following procedure configures an advanced alert to send a message to a designated Syslog server. To configure an advanced alert to send a Syslog message: 1. Click Syslog Message. 2. Type the Hostname or IP Address of the Syslog Server to which you want to send Syslog messages. 3. Select the Severity of your alert Syslog message.
Note: For more information, see Using the SolarWinds Web Console Message Center" on page 137. 4. Select Facility of your alert Syslog message. Note: For more information, see Using the SolarWinds Web Console Message Center" on page 137. 5. Type the Syslog Message you want to send. 6. To insert a variable into the Message field, complete the following procedure: a. Click Insert Variable. b. Select a Variable Category. c. Select the variable you want to add. d. To change the parser, check Change Parser, and then select the parser you want to use. e. To define the SQL variable to copy to the clipboard, check Define SQL Variable, and then click Insert Variable From Above List. f. Click Build Selected Variable. Note: For more information on the use of variables, see Syslog Alert Variables." 7. Click Time of Day. 8. Enter the time period over which you want to activate your alert action. 9. Select the days on which you want to activate your alert action. 10. To enable alert escalation, click Alert Escalation, and then check any of the following options, as appropriate for your alert: To disable the action when the alert has been acknowledged, check Do not execute this Action if the Alert has been Acknowledged. To execute the action repeatedly as long as the trigger condition exists, check Execute this Action repeatedly while the Alert is Triggered and then provide an appropriate action execution interval. To delay alert action execution, check Delay the execution of this Action, and then provide an appropriate interval the alert engine should wait after the alert condition is met before the alert action is executed. 11. When done, click OK.
Executing an External Program

There are several circumstances where you may want to execute a program when a specific network event occurs. Use the Edit Execute Program Action window to specify the executable that should be started when the specified alert is triggered or reset, as shown in the following procedure. Note: External programs selected for this action must be executable using a batch file called from the command line. To configure an advanced alert to execute an external program: 1. Click Execute Program. 2. Specify the batch file to execute, either by typing the complete path and name of the target file into the Program to execute field or by clicking Browse (), to browse your folder structure and select the target executable. 3. Click Time of Day, and then enter the time period when you want to execute the external program. 4. Select the days on which you want to execute the external program. 5. Click Alert Escalation, and then check any of the following options, as appropriate for your alert: To disable the action when the alert has been acknowledged, check Do not execute this Action if the Alert has been Acknowledged . To execute the action repeatedly, while the trigger condition exists, check Execute this Action repeatedly while the Alert is Triggered , and then provide an action execution interval. To delay alert action execution, check Delay the execution of this Action, and then provide the interval the alert engine should wait. 6. When done, click OK.
Executing a Visual Basic Script

In some situations you may want to execute a Visual Basic (VB) script when a network event occurs. The Edit Execute VB Script Action window is used to specify the name and complete path of the file that shall be executed when the specified alert is triggered or reset. To configure alerts to execute a Visual Basic (VB) script: 1. Click VB Script. 2. Select an available VB Script Interpreter.
3. Specify a VB script to execute either by typing the complete path and name of the VB script into the VB Script to execute field or by clicking Browse () to browse your folder structure and select the script. 4. Click Time of Day, and then enter the time period and select the days on which you want to execute the selected VB script. 5. Click Alert Escalation, and then check any of the following options, as appropriate for your alert: To disable the script when the alert has been acknowledged, check Do not execute this Action if the Alert has been Acknowledged . To execute the script repeatedly as long as the trigger condition exists, check Execute this Action repeatedly while the Alert is Triggered and then provide an appropriate action execution interval. To delay script execution, check Delay the execution of this Action, and then provide an appropriate interval the alert engine should wait after the alert condition is met before the script executes. 6. When done, click OK.
Emailing a Web Page

The Edit E-mail Web Page Action window includes several tabs for configuration. The following procedure configures an e-mail URL action for an advanced alert. Note: Emails are sent in plain text. To configure an email web page action for an advanced alert: 1. Click E-mail a Web Page, and then click Ok. 2. Complete the To, CC, BCC, Name, and Reply Address fields. Note: You must provide at least one address in the To field. When entering multiple addresses, you may only separate addresses with a comma. Some pager systems require a valid reply address to complete the page. 3. Click SMTP Server. 4. Type the Hostname or IP Address of your SMTP Server and the designated SMTP Port Number. Note: The SMTP server hostname or IP address field is required. You cannot email a web page without identifying the SMTP server. 5. Click URL, and then type the Subject of your alert email.
Note: Messaging is disabled if both Subject and URL fields are empty. 6. ITo insert a variable into the Subject field, click the location of the new variable, and then complete the following procedure: a. Click Insert Variable, select a Variable Category, and then select the variable to add. b. To change the parser, check Change Parser, and then select the parser you want to use. c. To define the SQL variable to copy to the clipboard, check Define SQL Variable, and then click Insert Variable From Above List. d. Click Build Selected Variable. Note: For more information on the use of variables, see Syslog Alert Variables," on page 406. 7. Provide the URL of your alert email. Note: Messaging is disabled if both Subject and URL fields are empty. 8. If the web server of the URL you want to email requires user access authentication, provide both the Web Server UserID and the Web Server Password in the Optional Web Server Authentication area. 9. Click Time of Day, and then enter the time period and select the days when you want to activate your alert action. 10. To enable alert escalation, click Alert Escalation, and then check any of the following options, as appropriate for your alert: To disable the action when the alert has been acknowledged, check Do not execute this Action if the Alert has been Acknowledged. To execute the action repeatedly, as long as the trigger condition exists, check Execute this Action repeatedly while the Alert is Triggered and then provide an appropriate action execution interval. To delay alert action execution, check Delay the execution of this Action, and then provide an appropriate interval for the alert engine to wait after the alert condition is met before executing the alert action. 11. When done, click OK.
Using Text to Speech Output

You may specify a phrase that will be spoken upon alert trigger and a separate phrase for the alert reset. SolarWinds uses Microsoft Speech Synthesis Engine version 5.0, as included with Windows 2003 and XP Professional. If you have SolarWinds maintenance, you may also install and use other text-to-speech engines by visiting the SolarWinds website. The following procedure configures text-to-speech output for an advanced alert trigger or reset. Note: Due to restrictions on Windows service applications, the Text to Speech action is not available to SolarWinds installations on either Windows 7 or Windows Server 2008 and higher. To configure a text-to-speech output action for an advanced alert: 1. Click Text to Speech output, and then click Ok. 2. On the General tab, Select a Speech Engine, and then use the sliders to set the required Speed, Pitch and Volume. 3. On the Phrase tab, type the text you want to output as speech in the Phrase to speak field. Note: Click Speak to hear the text, as provided, with the options configured as set on the General tab. 4. On the Time of Day tab enter the time period and select the days on which you want to activate your alert action. 5. To enable alert escalation, open the Alert Escalation tab, and then check any of the following options, as appropriate for your alert: To disable the action when the alert has been acknowledged, check Do not execute this Action if the Alert has been Acknowledged . To execute the action repeatedly, as long as the trigger condition exists, check Execute this Action repeatedly while the Alert is Triggered and then provide an appropriate action execution interval. To delay alert action execution, check Delay the execution of this Action, and then provide an appropriate interval for the alert engine to wait after the alert condition is met before executing the alert action. 6. When done, click OK.
Sending a Windows Net Message

Alerts can be configured to display a pop-up Windows Net Message either on a specific computer or on all computers in a selected domain or workgroup. The following steps configure Windows Net messaging for triggered or reset alerts.
Note: The only operating systems supporting Windows Net Messaging on which SolarWinds supports SolarWinds installations are Windows Server 2003 and Windows XP. SolarWinds only supports evaluation installations of SolarWinds on Windows XP. To configure SolarWinds to send a Windows Net message upon alert: 1. Click Send a Windows Net Message, and then click Ok. 2. On the Net Message tab, enter the Computer Name or IP Address of the machine where you want to send a Windows Net message upon an alert trigger or reset. 3. To send the message to all computers in the domain or workgroup of your target computer, check Send to all Computers in the Domain or Workgroup. 4. Enter the Windows Net message you want to send in the Message to send field. 5. On the Time of Day tab enter the time period and select the days on which you want to activate your alert action. 6. To enable alert escalation, open the Alert Escalation tab, and then check any of the following options, as appropriate for your alert: To disable the action when the alert has been acknowledged, check Do not execute this Action if the Alert has been Acknowledged . To execute the action repeatedly, as long as the trigger condition exists, check Execute this Action repeatedly while the Alert is Triggered and then provide an appropriate action execution interval. To delay alert action execution, check Delay the execution of this Action, and then provide an appropriate interval for the alert engine to wait after the alert condition is met before executing the alert action. 7. When done, click OK.
Sending an SNMP Trap

The following steps configure an alert to send an SNMP trap on trigger or reset. To configure SolarWinds to send an SNMP trap upon alert: 1. Click Send an SNMP Trap, and then click Ok.
2. On the SNMP Trap tab, in the SNMP Trap Destinations field, enter the IP addresses of the servers to which you want to send your generated SNMP traps. Note: Use commas to separate multiple destination IP addresses. 3. Select the type of trap to send on alert trigger from the Trap Template list. Note: Some trap templates may use an alert message. You may change any provided text, if you want, but it is important that you understand the use of variables beforehand. For more information on the use of variables, see Syslog Alert Variables," on page 406. 4. Enter the SNMP Community String for your network in the designated field. 5. On the Time of Day tab enter the time period and select the days on which you want to activate your alert action. 6. To enable alert escalation, open the Alert Escalation tab, and then check any of the following options, as appropriate for your alert: To disable the action when the alert has been acknowledged, check Do not execute this Action if the Alert has been Acknowledged . To execute the action repeatedly, as long as the trigger condition exists, check Execute this Action repeatedly while the Alert is Triggered and then provide an appropriate action execution interval. To delay alert action execution, check Delay the execution of this Action, and then provide an appropriate interval for the alert engine to wait after the alert condition is met before executing the alert action. 7. When done, click OK.
Using Get or Post URL Functions

SolarWinds can be configured to communicate alerts using HTTP GET or POST functions. As an example, a URL may be used as an interface into a trouble ticket system, and, by correctly formatting the GET function, new trouble tickets may be created automatically. The following procedure configures SolarWinds to use GET or POST HTTP functions to communicate alert information. To configure SolarWinds to use GET or POST URL functions with alerts: 1. Click Get or Post a URL to a Web Server, and then click Ok. 2. Select either Use HTTP GET or Use HTTP POST to set the function that you want to use to communicate alert information. 3. If you selected Use HTTP GET, enter the URL you want to GET. 4. If you selected Use HTTP POST, enter the URL you want to POST, and then enter the Body to POST.
5. On the Time of Day tab enter the time period and select the days on which you want to activate your alert action. 6. To enable alert escalation, open the Alert Escalation tab, and then check any of the following options, as appropriate for your alert: To disable the action when the alert has been acknowledged, check Do not execute this Action if the Alert has been Acknowledged . To execute the action repeatedly, as long as the trigger condition exists, check Execute this Action repeatedly while the Alert is Triggered and then provide an appropriate action execution interval. To delay alert action execution, check Delay the execution of this Action, and then provide an appropriate interval for the alert engine to wait after the alert condition is met before executing the alert action. 7. When done, click OK.
Dial Paging or SMS Service

If NotePager Pro is installed SolarWinds can be configured to communicate alerts using paging and SMS services. For more information about installation and configuration, see SolarWinds Network Performance Monitor Integration at www.notepage.net.
Escalated Advanced Alerts

By creating an escalated alert, SolarWinds SAM enables you to customize a series of alerts to trigger successive actions as an alert condition persists. The following sections provide both a scenario where an escalated alert may be useful and the steps required to create one using the SolarWinds Advanced Alert Manager. Refer to the following sections for more information: Escalated Alert Example Creating a Series of Escalated Alerts
Escalated Alert Example

WidgetCo is a business with a small IT staff, consisting of two technicians and an IT manager. To ensure that issues are addressed appropriately, the IT manager has created multiple escalated alerts for a range of potential network events, including device failures and excessive disk space or bandwidth usage. Typically, the escalated alerts configured by the WidgetCo IT manager proceed as follows:
1. Immediately, as soon as SolarWinds SAM recognizes an alert condition, SolarWinds SAM generates both an email and a page that are sent to one of the two technicians. An entry is also recorded in the SolarWinds events log. 2. If the alert is not acknowledged in the SolarWinds Web Console within 20 minutes, a second alert is fired, generating another email and another page, both sent to both technicians. An entry is also recorded in the SolarWinds events log. 3. If the second alert is not acknowledged within 20 minutes, SolarWinds SAM fires a third alert that sends both an email and a page to both technicians and to the IT manager. An entry is also recorded in the SolarWinds events log. Escalated alerts ensure that everyone on the WidgetCo IT staff is notified of any significant network alert conditions within 45 minutes without burdening the IT manager with excessive alert notifications. The following section provides a procedure to create a similar escalated alert scheme.
Creating a Series of Escalated Alerts

The following procedure creates a series of escalated alerts similar to the scheme described in the preceding example. Note: Repeat these steps to create a separate alert for each notification level. The example provided in the previous section uses a three-level escalated alert, The following procedure should be completed three times, once for each alert, to replicate the escalated alert of the previous section. To create an escalated alert: 1. Click Start > All Programs > SolarWinds > Alerting, Reporting, and Mapping > Advanced Alert Manager. 2. Click Configure Alerts. 3. Click New, and then click General. 4. Type Level X , where X is the level corresponding to the currently configured alert, as the name of your escalated alert in the Name of Alert field. Note: The example provided in the previous section uses a three-level escalated alert. 5. Type a description of your first level escalated alert in the description field, and then check Enable this Alert. 6. Type the Alert Evaluation Frequency and select Seconds, Minutes, or Hours from the list to set the checking interval for your alert. 7. Click Trigger Condition. Note: For more information about configuring trigger conditions, see Setting
a Trigger Condition for an Advanced Alert on page 308. 8. Select Node as the Type of Property to Monitor. 9. Confirm that the linked text in the alert definition field displays all. Note: Click the linked text to select the number of conditions that you want to apply (all, any, none, not all). For more information about linked text conditions, see Understanding Condition Groups on page 316. 10. Click Browse (), and then click Add a Simple Condition. 11. Click the first asterisk (*), and then select Network Nodes > Node Details > Node Name. 12. Confirm that is equal to is the linked condition text in the trigger definition. Note: Click the linked text to select the condition you want to apply (equal, greater, less, ). For more information about linked text conditions, see Understanding Condition Groups on page 316. 13. Click the second asterisk (*), and then select your production web server from the list of monitored nodes. 14. Click Add, and then click Simple Condition. 15. Click the first asterisk (*) in the second condition, and then select Network Nodes > Node Status > Node Status. 16. Confirm that is equal to is the linked condition text in the second trigger definition. Note: Click the linked text condition to select the condition you want to apply (equal, greater, less, ). For more information about linked text conditions, see Understanding Condition Groups on page 316. 17. Click the second asterisk (*) in the second condition, and then select Down. 18. To apply any reset conditions to your escalated alert, click Reset Condition, and then provide appropriate conditions. For more information, see Setting a Reset Condition for an Advanced Alert on page 311. 19. To apply any alert suppressions to your escalated alert, click Alert Suppression, and then provide appropriate suppression conditions. For more information, see Setting a Suppression for an Advanced Alert on page 313. 20. To restrict when your escalated alert is valid, click Time of Day, designate the Valid Time of Day for your escalated alert, and then select the Days of the Week on which your escalated alert is valid. For more information, see Setting the Monitoring Period for an Advanced Alert on page 314. Note: By default, your escalated alert is always valid. 21. Click Trigger Actions, and then click Add New Action.
22. Select Send an E-mail / Page, and then click Ok. 23. Click E-mail/Pager Addresses, and then complete the To, CC, BCC, Name, and Reply Address fields for your Level 1 contact. Note: You must provide at least one email address in the To field. When entering multiple addresses in a field, y separate addresses with a comma. 24. Click Message, and then type the Subject and Message of your escalated alert email. Notes: Messaging is disabled if both Subject and Message fields are empty. For more information about variables in email subjects and messages, see Sending an E-mail / Page on page 322. 25. Click SMTP Server, and then provide the Hostname or IP Address of your SMTP Server and the designated SMTP Port Number. Note: The SMTP server hostname or IP address field is required. You cannot send an email/page alert without identifying the SMTP server. 26. If your SMTP server requires authentication, check This SMTP Server requires Authentication. 27. To restrict when your escalated alert is valid, check Execute this Action only between specific hours, and then configure the appropriate settings. Note: By default, your escalated alert is always valid. For more information, see Setting the Monitoring Period for an Advanced Alert on page 314. 28. Click Alert Escalation. 29. Check Do not execute this Action if the Alert has been Acknowledged. 30. To execute the action repeatedly as long as the trigger condition exists, check Execute this Action repeatedly while the Alert is Triggered, and then provide an appropriate action execution interval. 31. To delay alert action execution, check Delay the execution of this Action, and then provide an appropriate interval the alert engine should wait after the alert condition is met before the alert action is executed. Note: Typically, if you are configuring the first level alert, you should leave this option unchecked. If you are configuring the second level alert, check this option and provide the desired delay between the first and second notifications. If you are configuring the third level alert, check this option and provide the desired delay between the first and third notifications. 32. Click OK.
33. If you want your escalated alert to perform any actions upon reset, click the Reset Action tab, and then configure appropriate actions. For more information, see Setting a Reset Action for an Advanced Alert on page 315. 34. When done, click OK.
Creating and Viewing Reports

Over time, your SolarWinds SAM database accumulates a great deal of information. SolarWinds has developed Report Writer to provide a quick and easy way for you to extract data from your database and present it in a useful form. Several standard reports that you can modify are included in the Report Writer distribution, and you can create new reports as necessary. Report Writer includes powerful tools to help you format your information and easily preview your reports before you display them. When you have finished editing your reports, you can print them with the click of a button, and most reports are also enabled for viewing through the Server & Application Monitor Web Console, by default. For more information about adding reports to SolarWinds Web Console views, see Customizing Views on page 104. Note: Report Writer capabilities are enhanced when used in conjunction with the Custom Property Editor. Once added, properties are available for report sort and filter functionality. Refer to the following sections for more information: Predefined SolarWinds Reports Viewing Reports Using Report Writer Creating and Modifying Reports Customizing the Report Header and Footer Image Exporting Reports Example Device Availability Report Using SolarWinds Report Scheduler Reports and Account Limitations
Creating SolarWinds SAM-Specific Reports

SolarWinds SAM information is easily presented in a variety of formats using SolarWinds Report Writer. SolarWinds provides Report Writer as a quick and easy way for you to extract data from your database, including SolarWinds SAM statistics, for presentation in a useful form. A number of predefined SolarWinds SAM-specific reports are available with your installation of SolarWinds SAM.
Report Writer also enables custom SolarWinds SAM report creation, as necessary, using criteria and conditions you choose. When you have finished editing your reports, you can view them through the Web Console and print them with the click of a button. A report scheduling application is available to all customers with a current maintenance agreement. This tool schedules automatic email reports that can be sent to individual users or groups of users. Log in to the customer portal of www.solarwinds.com and download the Report Scheduler. Report Writer capabilities are further enhanced when they are used in conjunction with the Custom Property Editor. Custom properties are available for report sorting and filtering. Refer to the following sections for more information: Using Predefined SolarWinds SAM Reports Viewing SolarWinds Server & Application Monitor Reports Filtering and Grouping Data in Resources SQL Syntax SWQL Syntax (Semantic Web Query Language)
Using Predefined SolarWinds SAM Reports

The following historical SolarWinds SAM reports are immediately available with your SolarWinds SAM installation. You can modify reports to suit your Application Monitoring report requirements. For more information about using SolarWinds Report Writer, see Viewing SolarWinds Server & Application Monitor Reports on page 342. Current Application and Component Status The following reports are predefined for reporting current data on your monitored applications. Average Response Time of each Component Generates a report including the node, application, component and the component average and maximum response time. Current CPU Load of each Component Generates a report including the node, application, component, and percent of CPU load.
Current Memory Utilization of each Component Generates a report including the node, application, component, actual and percent of physical and virtual memory used. Current Status of each Application Generates a report including the application and its status, for example, up or down. Current Status of each Component Generates a report including the node, application, component, and the individual status of the component, for example, up or down. Daily Application Availability The following reports are predefined for reporting daily monitored application availability. Application Availability Last Month Generates a report that includes all applications and their average availability over the last month. Application Availability This Month Generates a report that includes all applications and their average availability during the current month. Application Availability This Year Generates a report that includes all applications and their average availability over the last year. Historical Application CPU and Memory Reports The following reports are predefined for reporting historical on your monitored applications. CPU Load for each Application Monitor Last Month Displays the average CPU load for each monitor, grouped by node and application name, through the previous month. CPU Load for each Application Monitor This Month Displays the average CPU load for each monitor, grouped by node and application name, for the current month.
CPU Load for each Application Monitor This Year Displays the average CPU load for each monitor, grouped by node and application name, through the previous month. Memory Load for each Application Monitor Last Month Displays the average memory load for each monitor, grouped by node and application name, through the previous month. Memory Load for each Application Monitor This Month Displays the average memory load for each monitor, grouped by node and application name, for the current month. Memory Load for each Application Monitor This Year Displays the average memory load for each monitor, grouped by node and application name, through the previous month.
Viewing SolarWinds Server & Application Monitor Reports

Before you can use Report Writer, you must have collected at least a few minutes worth of data in a database that is populated with the devices that you want to monitor. A variety of reports are included with Report Writer, and icons that precede report names distinguish the different types of reports that are available. The following procedure starts Report Writer. To start Report Writer: 1. Click Start > All Programs > SolarWinds > Alerting, Reporting, and Mapping > Report Writer. 2. Click File > Settings. 3. In the General tab of the Report Writer Settings window, select either of the following as a default viewing mode: Preview displays the report as it will appear in printed form. Report Designer is the report creation and editing interface. Note: You can toggle between Preview and Report Designer modes at any time by clicking Preview or Design, respectively, on the toolbar. 4. To separate the data for individual network objects with horizontal lines, click Report Style, and then check Display horizontal lines between each row. 5. Click OK to exit Report Writer Settings.
6. If you want to open a predefined report, select one from the list in the left pane of the main window. Note: SolarWinds Server & Application Monitor supplies the following predefined reports: Current Application and Component Status Average Response Time of each Component Current CPU Load of each Component Current Memory Utilization of each Component Current Status of each Application Current Status of each Component Daily Application Availability Application Availability Last Month Application Availability This Month Application Availability This Year Historical Application CPU and Memory Reports: CPU Load for each Application Monitor Last Month CPU Load for each Application Monitor This Month CPU Load for each Application Monitor This Year Memory Load for each Application Monitor Last Month Memory Load for each Application Monitor This Month Memory Load for each Application Monitor This Year Historical Reports Page File Usage Last 7 Days Page File Usage Last Month Page File Usage This Month
7. If you want to create a new report, click File > New Report. Note: For more information on how to use the SolarWinds Report Writer application, see Creating and Modifying Reports" on page 357.
Filtering and Grouping Data in Resources

You can reorganize and filter application data within a resource using SQL or SolarWinds Query Language (SWQL), a SQL-like filter syntax. The filter description on each resource tells you whether to use SQL or SWQL. Grouping Applications The following procedure walks you through changing the way node data is grouped in a resource. To group resource data by category: 1. Log on to the SolarWinds SAM Web Console. 2. Click the Applications tab. 3. Click Edit on the resource with the grouping you want to change. 4. Select the category that you want to group by from the Level 1 list. 5. If you want to group by more subcategories, select additional categories from the Level 2 and the Level 3 lists. 6. Click Submit. Filtering Data Using Filter Criteria The following procedure explains how to limit the data sources in a resource by setting filter criteria in SWQL syntax. For more information about the filter syntax, see SWQL Syntax on page 346. To filter application data using filter syntax: 1. Log on to the SolarWinds SAM Web Console. 2. Click the Applications tab. 3. Click Edit on the resource that you want to change. 4. Type your filter criteria in the Filter Applications (SWQL) field. 5. Click Submit. For more information, see "Filter Syntax Reference" on page 639.
SQL Syntax
Some resources allow you to filter data using the SQL syntax described below. Wildcards The wildcard character in SQL syntax is: %. Example: Node.Caption Like 'AX3%' Filtering by Custom Property The property syntax to filter by custom property is: dataType.CustomProperty.propertyName Example filter to only show nodes with the custom property City that matches Atlanta:
Node.CustomProperty.City = 'Atlanta'
Filtering by Built-in Properties Many properties have the same name between data types. To prevent ambiguity, SolarWinds SAM prefixes the property names with the data type. Examples Example filter to show only data from processes with the name svchost.exe:
pe.Name like 'svchost.exe'
Example filter to show data only from component monitors named Server Load Monitor:
Monitor.Name like 'Server Load Monitor'
Example filter to show data from devices beginning with "AX3":

Node.Caption Like 'AX3%'
Example filter to show data from Process Monitor SNMP (type 8) component monitors:
Monitor.ComponentType = 8
Filtering by Status To filter by the status, you must know the valid status levels.
Level 0 Status Unknown

1 2 3 14 Up Down Warning Critical
Example filter to only show monitors that are not down:

MonitorStatus.Availability<>2
Built-in SQL Application Properties

Application.Name ApplicationStatus.Availability
Built-in SQL Component Monitor Properties

ec.ErrorDescription MonitorStatus.ApplicationID MonitorStatus.lasttimeUp pe.AvgPercentCPU pe.AvgResponceTime pe.ErrorCode pe.PID pe.StatusCodeType threshold.Warning thresholdStat.Critical Monitor.ComponentType MonitorStatus.Availability MonitorStatus.timestamp pe.AvgPercentMemory pe.AvgStatisticData pe.ErrorMessage pe.PortNumber sc.StatusDescription thresholdRT.Critical thresholdStat.Warning Monitor.Name MonitorStatus.ComponentID pe.AvgMemoryUsed pe.AvgPercentVirtualMemory pe.AvgVirtualMemoryUsed pe.Name pe.StatusCode threshold.Critical thresholdRT.Warning
Built-in SQL Node Properties

Nodes.Caption Nodes.NodeID Nodes.Status
SWQL Syntax (Semantic Web Query Language)

Some resources allow you to filter data using the SWQL syntax described below. Wildcards The wildcard character in SWQL syntax is: %. Example: Node.Caption Like 'AX3%'
Filtering by Custom Property The property syntax to filter by custom property is: dataType.CustomProperties.propertyName Example filter to only show nodes with the custom property City that matches Atlanta:
Node.CustomProperties.City = 'Atlanta'
Filtering by Built-in Properties Many properties have the same name between data types. To prevent ambiguity, SolarWinds SAM prefixes the property names with the data type. Examples Example filter to show data from Cisco devices:
Node.Vendor = 'Cisco'
Example filter to show data from Windows Server 2003-2008 applications:

Application.Name = 'Windows Server 2003-2008'

Example filter to show data from Process Monitor SNMP type component monitors:
Filtering by Status To filter by the status property, you must know the valid status levels.
Level 0 1 2 3 14 Status Unknown Up Down Warning Critical

Built-in SWQL Application Properties

Application.ID Application.TemplateID Application.UnmanageFrom Application.LastModified Application.Name Application.JobId Application.UnmanageUntil Application.NodeID Application.Unmanaged Application.Created
Built-in SWQL Application Status Properties

ApplicationStatus.ApplicationID ApplicationStatus.TimeStamp ApplicationStatus.Availability ApplicationStatus.LastTimeUp
Built-in SWQL Component Monitor Properties

Monitor.ApplicationID Monitor.JobId Monitor.ComponentType Monitor.Name Monitor.ID Monitor.TemplateID
Built-in SWQL Component Monitor Status Properties

MonitorStatus.ApplicationID MonitorStatus.ComponentStatusID MonitorStatus.Availability MonitorStatus.LastTimeUp MonitorStatus.ComponentID MonitorStatus.TimeStamp
Built-in SWQL Nodes Properties

Node.AvgResponseTime Node.Contact Node.GroupStatus Node.IPAddress Node.Location Node.MemoryUsed Node.ObjectSubType Node.PercentMemoryUsed Node.Status Node.SysObjectID Node.Vendor Node.CPULoad Node.DNS Node.IOSImage Node.LastBoot Node.MachineType Node.MinResponseTime Node.OrionID Node.ResponseTime Node.StatusDescription Node.SystemUpTime Node.VendorIcon Node.Caption Node.Description Node.IOSVersion Node.LastSync Node.MaxResponseTime Node.NodeID Node.PercentLoss Node.Severity Node.SysName Node.TotalMemory
Predefined SolarWinds Reports

The following sections describe the reports that are immediately available with your SolarWinds installation. These reports may be modified, as necessary, to suit your network performance reporting requirements. Note: If the report you require is not listed in any of the following sections, you can use SolarWinds Report Writer to create your own custom report. For more information about creating your own custom reports, see Using Report Writer on page 356. Refer to the following predefined reports for more information:
Availability Current Node Status Current Volume Status Daily Node Availability Events Historical CPU and Memory Reports Historical Response Time Reports Historical VMware ESX Server Reports Groups: Current Groups and Groups Members Status Groups: Daily Group Availability Groups: Group Availability (with members) Groups: Historical Groups Status Historical Volume Usage Reports Inventory
Availability
The following network availability reports are provided by default with SolarWinds. Availability Last Month Displays the IP address and average availability of all monitored nodes over the last month. Availability This Year Displays the IP address and average availability of all monitored nodes over the last year. Availability Yesterday Displays the IP address and average availability of all monitored nodes over the previous day. Availability of Entire Network Last Month Displays the availability of all monitored nodes on the entire network over the last month.
Top 25 Percent Down Last Month Displays the top 25 nodes, by percent downtime, over the last month.
Current Node Status

The following node status reports are provided by default with SolarWinds. Average Response Time Displays both average and peak response times for all monitored nodes. Current CPU Load Displays current CPU load percentage for all monitored nodes with CPUs. Current Response Time Displays the IP address and current, average, and peak response times for all monitored nodes. Current Status of each Node Displays the IP address and a verbal statement of the current operational status of all monitored nodes. Down Nodes Displays all monitored nodes that are currently down. Last Boot Time for each Node Displays the machine type and the date and time of last boot for all nodes.
Current Volume Status

SolarWinds provides an Available Space on each Volume report by default. This report displays the volume size, available space on the volume, and a percentage measure of the available space on the volume for all monitored volumes. Volumes are listed beneath their respective parent nodes.
Daily Node Availability

The following node availability reports are provided by default with SolarWinds. Availability - Last Month Displays the IP address and average daily availability of all monitored nodes over the current month.
Availability - This Month Displays the IP address and average daily availability of all monitored nodes over the current month. Availability - This Year Displays the IP address and average daily availability of all monitored nodes over the last 12 months.
Events
The following network events reports are provided by default with SolarWinds. All Down Events Displays a list of all events in the database involving nodes that have stopped responding to polling over the last 12 months. For each down event, this report displays the down event date and time, the node name and IP address, and a verbal statement of the down event. Down Events - Windows Devices Displays a list of all events in the database involving Windows devices that have stopped responding to polling over the last month. For each down event, this report displays the down event date and time, the node name, and a verbal statement of the down event. Last 250 Events Displays the last 250 events involving any monitored device. For each event, this report displays the event date and time, the node involved, and a message describing the event. Nodes that went down - Last 24 Hours Displays a list of all nodes that have stopped responding over the last 24 hours. For every event of a node going down, this report displays the event date and time, an icon representing the current node status, the node name, and a verbal statement of the down event. Triggered Alerts - Last 30 Days Displays a list of all triggered alerts over the past 30 days. For each triggered alert event, this report displays the date and time of the alert trigger, the node that triggered the alert, and a message describing the triggered alert event.
Triggered and Reset Alerts - Last 30 Days Displays a list of all triggered and reset alerts over the past 30 days. For each triggered or reset alert event, this report displays the date and time of the alert event, the node that triggered or reset the alert, and a message describing the alert event.
Historical CPU and Memory Reports

SolarWinds provides a CPU Load - Last Month report by default. This report displays the vendor icon and average and peak CPU load percentages for all monitored nodes with CPUs over the previous calendar month.
Historical Response Time Reports

The following response time reports are provided by default with SolarWinds. Response Time - Last Month Displays average and peak response times for all monitored nodes over the previous calendar month. Response Time - Top 10 Last Month Displays the average and peak response times for the top ten monitored nodes over the previous calendar month.
Historical VMware ESX Server Reports

SolarWinds SAM provides the following VMware ESX Server performance reports by default with SolarWinds. Network Traffic by VM for Last 7 Days For each monitored VMware ESX Server, this report displays the average daily network traffic on the ESX Server per hosted VM for the last 7 days. Network Traffic by VM for Last Month For each monitored VMware ESX Server, this report displays the average daily network traffic on the ESX Server per hosted VM for the last month. Percent of CPU by VM for Last 7 Days For each monitored VMware ESX Server, this report displays the average daily CPU load on the ESX Server due to each hosted VM for the last 7 days. Percent of CPU by VM for Last Month For each monitored VMware ESX Server, this report displays the average daily CPU load on the ESX Server due to each hosted VM for the last month.
Percent of Memory by VM for Last 7 Days For each monitored VMware ESX Server, this report displays the average daily memory load on the ESX Server due to each hosted VM for the last 7 days. Percent of Memory by VM for Last Month For each monitored VMware ESX Server, this report displays the average daily memory load on the ESX Server due to each hosted VM for the last month. Percent of Time Running vs. Stopped For each monitored VMware ESX Server, this report displays both the percentage of time that each hosted VM has been running and the percentage of time that each hosted VM has been stopped.
Groups: Current Groups and Groups Members Status

The following group and group members status reports are provided by default with SolarWinds. Current Status of each Group Current Status of each Group Current Status of each Group Member Current Status of each Group Member Groups and Group Members Groups and Group Members
Groups: Daily Group Availability

The following group availability reports are provided by default with SolarWinds. Group Availability Last Month Group Availability Last Month Group Availability This Month Group Availability This Month Group Availability This Year Group Availability This Year
Groups: Group Availability (with members)

The following group availability reports that include member availability are provided by default with SolarWinds. Group Availability (with members) Last Month Group Availability (with members) Last Month Group Availability (with members) This Month Group Availability (with members) This Month Group Availability (with members) This Year Group Availability (with members) This Year
Groups: Historical Groups Status

The following historical group status reports are provided by default with SolarWinds. Historical Status of each Group Last 7 Days Historical Status of each Group Last 7 Days Historical Status of each Group Last Month Historical Status of each Group Last Month Historical Status of each Group This Month Historical Status of each Group This Month
Historical Volume Usage Reports

SolarWinds provides an Average Disk Space Used - Last 12 Months report by default. For all monitored volumes, this report displays the volume type and size, percentage of the volume space that is currently available, amount of the available space that is currently used, and the amount of volume space that is currently available. Volumes are listed beneath their respective parent nodes.
Inventory
The following network inventory reports are provided by default with SolarWinds. All Disk Volumes For all monitored volumes, this report displays the volume type and size, available space on the volume, amount of the available space that is currently used, and the peak amount of the available space that has been
used on the volume, with the month in which peak usage occurred, over the last 12 months. Volumes are listed beneath their respective parent nodes. Device Types Displays a list of monitored machine types and the number of each type that are currently monitored. IOS Versions of Cisco Devices For all monitored Cisco devices, this report displays the device name, machine type, and Cisco IOS Version and Image.
Viewing Reports
All reports, custom or predefined, are available for viewing in both the SolarWinds Web Console and in Report Writer, as shown in the following procedures: Viewing Reports in the Orion Web Console Viewing Reports in the Orion Report Writer
Note: By default, no report folder is configured for newly created users. If a new user is not seeing reports, you may need to select a Report Folder for the new user. For more information, see Configuring an Account Report Folder on page 189. Viewing Reports in the SolarWinds Web Console The following procedure opens reports for viewing in the SolarWinds Web Console. To view reports in the SolarWinds Web Console: 1. Click Start > All Programs > SolarWinds > SolarWinds Web Console. 2. Log in to the SolarWinds Web Console, and then click Home > Reports. 3. Select a report group name to expand the report group. 4. Click the title of the report you want to view, and it displays directly in the web console browser. It is also possible to include a report within a web console view as a Report from SolarWinds Report Writer resource. For more information about adding the Report from SolarWinds Report Writer resource, see Editing Views on page 105.
Viewing Reports in the SolarWinds SAM Report Writer The following procedure opens reports for viewing in the SolarWinds SAM Report Writer. To view reports with SolarWinds SAM Report Writer: 1. Click Start > All Programs > SolarWinds > Alerting, Reporting, and Mapping > Report Writer. 2. If report groups are not already expanded in the left pane, click [+] next to a report group name to expand the group, and then click the title of the report you want to view. 3. Click Preview.
Using Report Writer

Before using Report Writer, you must have collected at least a few minutes worth of data in a database populated with devices you want to monitor. A variety of reports are included with Report Writer, and icons that precede report names distinguish available report types. The following procedure starts Report Writer. To start Report Writer: 1. Click Start > All Programs > SolarWinds > Alerting, Reporting, and Mapping > Report Writer. 2. Click File > Settings. 3. In the General tab of the Report Writer Settings window, select either of the following as a default viewing mode: Preview displays the report as it will appear in printed form. For more information, see Preview Mode on page 356. Report Designer is the report creation and editing interface. For more information, see Design Mode on page 357. Note: You can toggle between Preview and Report Designer modes at any time by clicking Preview or Design, respectively, on the toolbar. 4. To separate the data for individual network objects with horizontal lines, click Report Style, and then check Display horizontal lines between each row. 5. Click Ok to exit Report Writer Settings. Preview Mode Preview mode shows a report as it will print. When you open a report in Preview mode, or switch to Preview mode from Design mode, SolarWinds runs the query to generate the report, and then Report Writer displays the results.
The Preview window toolbar provides the following actions and information: Current page number and total number of pages in the report. Page navigation buttons: First Page, Page Up, Page Down, and Last Page Zoom views Note: Double-click a preview to zoom in and double-right-click to zoom out. Print report
Design Mode Use Design mode to create new reports and modify or rename existing reports. The options available for both creating and modifying reports are the same. Design mode options are also dynamic, based upon the type of report, included report data, and report presentation. Available options differ according to the type of report that you are designing, but all reports require that you select the data to include and decide how that data will be sorted, ordered, filtered, and presented.
Creating and Modifying Reports

Use the following procedure to modify or create reports in Report Writer. To open a report with Report Writer: 1. To modify an existing report, click an existing report from the inventory in the left pane of the main Report Writer window. 2. To create a new report, click File > New Report, select the type of report that you would like to create, and then click OK. Each report offers different configuration options, so, depending on the report, some formatting tabs described in the following sections may not be available. Notes: The SQL query used to generate a report may be viewed in an additional tab. Click Report > Show SQL to add a read-only SQL tab to the Design window. A preview of your report is also available at any time. Click Preview to enter Preview Mode, and then click Design to return to Design Mode.
Refer to the following sections for more information: General Options Tab Select Fields Options Tab Filter Results Options Tab Top XX Records Options Tab
Time Frame Options Tab Summarization Options Tab Report Grouping Options Tab Field Formatting Options Tab
General Options Tab The General tab opens by default and shows titling and display options. To configure General options: 1. Specify the Report Group, Report Title, Subtitle, and Description. Note: If you use an existing report group name, the new report is added to that existing group in the left pane of the main window. 2. Select the display Orientation of your report. 3. If you are configuring an historical report and you do not want to group data by days, clear Group historical data by days. Note: By default, data in some availability and historical reports is grouped by days when displayed in the SolarWinds Web Console. Data grouping by days is not viewable in Report Viewer. 4. If you do not want to make this report available on your SolarWinds Web Console, clear Make this Report available from the SolarWinds website. Note: By default, most reports are made available for display in the SolarWinds Web Console. For more information, see Customizing Views on page 104. Select Fields Options Tab The Select Fields tab allows you to select the data fields in a report. To select and configure fields: 1. Click Select Fields. 2. If you are creating a new report or adding fields to an existing report, click the ellipsis, select Add a new field, and then dynamically define each new report field as follows: a. Click the asterisk after Field:, and then select the type of information to include in the current report field. b. To sort the data in the current field, click the sort asterisk and select a sort order.
c. To perform an operation on the data in the current field, click the function asterisk and select an operation. 3. If you are modifying an existing report, click the Field, sort, or function that you want to change and select a new value as follows. a. Click the asterisk after Field:. b. Select the type of information to include in the current report field. c. To sort the data in the current field, click the sort asterisk and select a sort order. d. To perform an operation on the data in the current field, click the function asterisk and select an operation. 4. To test your selections as you assemble your report, click Execute SQL Query to view the current query results. 5. To delete a field or rearrange the order of the fields that are listed in your report, select a field, click Browse (), and then select the appropriate action. Note: Unchecked fields are not displayed in your report, but their sort and function configurations are retained. 6. To preview your report, click Preview. Filter Results Options Tab The Filter Results tab allows you to generate filter conditions for field data by selecting appropriate descriptors from the linked context menus. Results filters are configured as follows. To configure results filters: 1. Click Browse (), and then select from the following options: Select Add a new elementary condition to generate a condition that is based on a direct comparison of network object data fields. Select Add a new advanced elementary condition to generate a condition based on a comparison of device data fields and values. Select Add a new complex condition to define a condition that filters other defined conditions. Select Delete current condition to remove a selected condition. Select Move current condition forward or Move current condition backward to change the order of your conditions accordingly. Note: The lists of available linked descriptors are dynamically generated in consideration of all other variables within the same condition. For more
information about condition groups and their application, see Understanding Condition Groups on page 316. 2. Check or clear individual filter conditions to enable or disable their application, respectively, to your report. Top XX Records Options Tab The Top XX tab allows you to limit the number of records that are shown in your report to either a top number or a top percentage of all results. Top XX options are configured as shown in the following procedure. To configure Top XX records: 1. To show all records in your report, select Show All Records. 2. To specify a truncated list of eligible items for your report, complete the following steps: a. select either Show only the Top number Records or Show the Top percentage % of Records b. Provide appropriate number or percentage values. Time Frame Options Tab The Time Frame options tab allows you to limit the scope of your report to a specific period of time. To configure Time Frame options, select a Named, Relative, or Specific Time Frame, and then select or provide required values. Notes: If you receive a SQL Timeout error message, you may edit the timeout setting in the SWNetPerfMon.db file. By default, this file is located in the C:\Program Files\SolarWinds\Orion directory Since the Relative Time Frame is continuously variable, reports run with it may show different results, even if they are run close together in time.
Summarization Options Tab The Summarization tab allows you to generate summaries of your results over specific periods of time. Summarization options are configured as follows. To configure results summarization: 1. If you do not want to summarize your results, confirm that Do not Summarize the Results is selected.
2. To summarize your results, complete the following steps: a. Select Summarize the Results by Hour, Date, Month, and so on, and then select the summarization period. b. Specify the location of the summary field for your report. c. Select a location for the Summary Date/Time field. Report Grouping Options Tab The Report Grouping tab allows you to group results by field descriptor within your report. Add, edit and delete report groups to organize the data in your report. Establish and edit report groups as follows. To add and edit report groups: 1. To add a new report group, select a field from the list to define your group, and then click Add Report Group to add your selected field to the Report Groups list. Note: Use up and down arrows to change the grouping order accordingly. 2. To edit an existing report group, select the field from the Report Groups list, and then click Edit Report Group. 3. The following options may be changed as needed: The Group Header is the text that designates groups on your report. The Web URL is the dynamic location of your published report with respect to your SolarWinds Web Console. Font size, face, color, and background may all be modified by clicking associated ellipses. Alignment may be left, center, or right. Check Transparent Background for better results when publishing your report to the Web. If you want to change the grouping order, use the up and down arrows to change the grouping order accordingly. Field Formatting Options Tab The Field Formatting tab allows you to customize the format of the various results fields in your report. To format results fields, select the field you want to format, and then edit labels and select options as appropriate. Notes:
The formatting options available for each field may be different according to the nature of the data contained in that field. Check Hidden Field to hide any field in your report. To view your changes at any time, click Preview.
Using SolarWinds Report Scheduler

SolarWinds provides the SolarWinds Report Scheduler to configure reports for automatic generation and distribution. Refer to the following sections for more information: Creating a Scheduled Report Job Using SolarWinds Report Scheduler with HTTPS Troubleshooting the SolarWinds Report Scheduler
Creating a Scheduled Report Job The following procedure creates a scheduled report job for regularly printed or emailed SolarWinds reports. To schedule a report: 1. Click Start > All Programs > SolarWinds > SolarWinds Web Console. 2. Click Reports. 3. Click [+] as required to locate the report you want to schedule. 4. Click the name of the report you want to schedule.
5. Copy the URL of the report you want to schedule. 6. Click Start > All Programs > SolarWinds > Alerting, Reporting, and Mapping > SolarWinds Report Scheduler. 7. Click Edit > Add New Job. 8. Provide a job name for this scheduled report, and then click Continue. 9. Paste the URL of the report you want to schedule into the link field. 10. If you need to provide Windows login credentials to view the report you are scheduling, click the NT Account login tab, and then provide the user account details needed to log in. 11. To create a printable report that excludes the SolarWinds Web Console banner and menu bar, on the SolarWinds Web Login tab, check Retrieve a Printable Version of this Page.
12. If the report you are scheduling requires a SolarWinds user account, on the SolarWinds Web Login tab, check Send SolarWinds Username / Password in URL, and then provide the required user credentials to view the SolarWinds report. 13. Click Continue. 14. Configure the scheduling for your report job, and then click Continue. 15. To email the report, complete the following procedure: a. Confirm that either Email the Web Page (as HTML) or Email the Web Page (as PDF) are selected, and then click Continue. b. Provide required email addresses and a subject in the appropriate fields on the Email To tab. c. Provide a name and reply address on the Email From tab. d. On the SMTP Server tab, type the hostname or IP address and confirm the port number of the server used to send email from the SolarWinds server. e. Click Continue. 16. To print the report, complete the following steps: a. Select Print the Web Page, and then click Continue. b. Select the Printer, Orientation, and number of Copies you want to print. c. Click Continue. 17. Enter the user name and password for the Windows account that will email the report. 18. Click Continue. 19. Add any additional comments or notes about this job, and then click Finish. Using SolarWinds Report Scheduler with HTTPS If you are using HTTPS to view reports in the SolarWinds Web Console, your HTTPS server may require the SolarWinds Report Scheduler to provide a trusted certificate before the requested report may be printed or sent. To use SolarWinds Report Scheduler with HTTPS, either provide valid certificates to all users accounts requesting reports from the HTTPS server using SolarWinds Report Scheduler or disable certificate checking in each of the browsers used by your SolarWinds Report Scheduler users, as shown in the following procedure. To disable certificate checking: 1. If you are configuring Internet Explorer, complete the following steps:
a. Open Internet Explorer on the user computer. b. Click Tools > Internet Options, and then click the Advanced tab. c. In the Security section, confirm that the following options are cleared: Check for publishers certificate revocation Check for server certificate revocation (requires restart) Warn about invalid site certificates d. Click Ok. 2. If you are configuring Mozilla Firefox, complete the following steps: a. Open Mozilla Firefox on the user computer. b. Click Tools > Options. c. Click Advanced, and then click the Encryption tab. d. In the Protocols area, clear both Use SSL 3.0 and Use TLS 1.0. e. In the Certificates area, select Select one automatically, and then click Validation. f. Clear the option Use the Online Certificate Status Protocol (OCSP) to confirm the current validity of certificates, and then click Ok.
Troubleshooting the SolarWinds Report Scheduler The following known issues have been encountered while using the SolarWinds Report Scheduler: Printing Web Pages from Report Scheduler SolarWinds Report Scheduler and Internet Explorer Enhanced Security
Printing Web Pages from Report Scheduler If any warning dialogs are open on the SolarWinds server when a web page is scheduled for printing in Report Scheduler, the print job may not complete. To ensure that print jobs configured in the Report Scheduler complete, confirm the following:
Print the Web Page is selected when the scheduled task is configured in Report Scheduler. All open dialogs, including SWToolset.exe and javascript warnings, are closed. All scheduled print tasks are configured to run even when the current user is not logged in.
SolarWinds Report Scheduler and Internet Explorer Enhanced Security When Internet Explorer (IE) Enhanced Security Configuration is installed, SolarWinds report Scheduler may hang intermittently when attempting to perform a scheduled report print job. To address this issue, complete either of the following procedures: (Recommended) Add the SolarWinds Web Console as a trusted site in your browser. For more information about Internet Explorer Enhanced Security Configuration and adding sites to the trusted sites list, see the Microsoft document, "Adding Sites to the Enhanced Security Configuration Zones . Uninstall IE Enhanced Security Configuration.
Customizing the Report Header and Footer Image

The image that is displayed at the top and bottom of each report can be changed. To add your company logo as the report header and footer, save your logo as Header.jpg in the SolarWinds\Common\WebResources folder, typically located in C:\Program Files\, and then click Refresh. Note: The image must be in JPEG format with a height of 150 pixels or less.
Exporting Reports
SolarWinds Report Writer gives you the ability to present your created reports in any of the following industry-standard formats: Comma-delimited (*.csv, *.cdf) Text (*.txt) HTML (*.htm, *.html) MIME HTML, with embedded images (*.mhtml) Excel spreadsheet (*.xls) Adobe PDF (*.pdf) Image (*.gif)
The following procedure presents the steps required to export an open report from SolarWinds Report Writer into any of the previously listed formats. To export a report from Report Writer: 1. Select a report to export by clicking any of the following: Select a report from the file tree in the left pane File > Open to open an existing report File > New Report to create a new report. For more information about creating reports, see Creating and Viewing Reports on page 339. 2. Select File > Export and then click the format in which you want to export your report: 3. Check the fields in your open report that you want to export into the selected format, and then click Ok. 4. Select a location to save your file. 5. Provide a File name, and then click Save.
Example Device Availability Report

The following procedure generates an example report of network device availability information over the previous week. The final report is sorted so that the worst errors are viewed first. Down nodes that are still down are at the top with all devices listed in order of increasing availability. Note: At any point during the creation of a report (or perhaps at many points), you may save what you have done by clicking File > Save. The first time you save you must give your report a filename or accept the default, which will be the report title that you assign in the following procedure. To generates an example report of network device availability information: 1. Click Start > All Programs > SolarWinds > Alerting, Reporting, and Mapping > Report Writer. 2. Click File > New Report. 3. The example calls for a report on availability over the past week, so select Historical Availability Details, and then click Ok.
4. Type My Reports in the Report Group field, and then enter Last Weeks Availability as the Report Title.
5. Select Portrait for the paper orientation, and then confirm that Make this Report available from the SolarWinds website is checked.
6. Click Select Fields.
7. Click Browse (), and then select Add a new field.
8. Click the Field asterisk, and then select Network Nodes > Node Details > Node Name.
9. Click Browse (), and then select Add a new field.
10. Click the Field asterisk, and then select Network Nodes > Node Status > Status Icon. Note: While this field makes a distinct visual difference for a report viewed in color, it will make little or no difference if printed in black and white.
11. Click Browse (), and then select Add a new field. 12. Click the Field asterisk, and then select Network Nodes > Node Status > Status.
13. Click Execute SQL Query to view the report data in the preview window. Note: The report preview should show information about both current and historical status. Current status entries must be relabeled to avoid confusion.
14. Click Field Formatting.
15. Click Status in the Select a Field list, and then change the Column Header entry to Current Status.
16. Click Status_Icon in the Select a Field list, and then change the Column Header entry to Current Status. 17. Click Execute SQL Query. Note: Column widths are adjustable. To change a column width, place your cursor on the column divider and drag it to a different position. 18. Click Select Fields.
19. Click the sort asterisk on the Status field line, and then select descending.
20. Click Execute SQL Query to confirm your choice. 21. Click Browse (), and then select Add a new field. 22. Click the Field asterisk, and then select Historical Response Time and Availability > Availability.
23. Click the Sort asterisk on the new line, and then select ascending. 24. Click Execute SQL Query to view the report. 25. Click Time Frame.
26. Select Relative Time Frame, type 7 in the text field, and then select Days from the list.
27. To break down the report day-by-day, click Summarization and specify your choices.
28. To filter your report, click Filter Results and specify filter rules, as on the Select Fields tab.
29. Click File > Save to save your work.
Reports and Account Limitations

Reports created with SolarWinds Report Writer respect SolarWinds Web Console account limitations. For security, by default, reports are not available to users with limited accounts unless a SolarWinds administrator specifically provides access. The following procedure creates a reports folder for an account-limited user and configures the account-limited user to access SolarWinds reports from it. Note: For more information about creating user accounts, see Creating New Accounts on page 179. For more information about applying account limitations to user accounts, see Setting Account Limitations on page 184. To allow account-limited users access to reports: 1. Open the SolarWinds Reports folder. Note: All reports created or predefined in SolarWinds Report Writer are, by default, stored, in C:\Program Files\SolarWinds\Orion\Reports. 2. Create a new folder using the name of the account-limited user. 3. Copy the reports you want the account-limited user to see from the SolarWinds Reports folder into the new, account-limited user folder. 4. Click Start > All Programs > SolarWinds > SolarWinds Web Console. 5. Log in to the SolarWinds Web Console as an administrator. 6. Click Settings in the top right of the web console. 7. Click Manage Accounts in the Accounts grouping of the SolarWinds Website Administration page. 8. Select the account-limited user, and then click Edit. 9. In the Default Menu Bar and Views section, select the Report Folder you created in the SolarWinds Reports folder for the account-limited user. 10. Click Submit.
Chapter 16
Monitoring Hardware Health

SAM monitors hardware by polling nodes and utilizing the Hardware Monitoring Agent software provided by the hardware manufacturer. SAM can monitor hardware from VMware hosts, HP ProLiant, Dell PowerEdge, and the IBM XSeries using this software, which can be found using the links below: HP System Insight Manager (SIM v6.2 or higher is recommended) Dell OpenManage Server Administrator IBM Director (Common Agent, v6.3 or higher is recommended)

Hardware monitoring for HP ProLiant, Dell PowerEdge, and the IBM X-Series, is achieved by polling via SNMP or WMI, depending upon the node. For SNMP and WMI nodes, hardware monitoring must be enabled manually through SAM's web console. For more information, see "Adding Server Hardware Monitoring" on page 378. If you run a scheduled Network Sonar Discovery of your existing servers, SAM will automatically collect any servers that support hardware health information the next time the scheduled discovery runs. For more information, see: "Managing Scheduled Discovery Results" on page 158 Note: Only SAM administrators can enable hardware health monitoring. ________________________
HP Insight Management WBEM Providers for Windows Server 2003/2008 is an optional component for HP System Insight Manager that must be installed for SAM to monitor hardware via WMI. This component can be found using the following link: HP Insight Management WBEM Providers for Windows Server 2003/2008 Additionally, you may need to install the HP ProLiant Support Pack for Windows. This link can be found here: HP Proliant Support Pack
IBM's ServeRAID Manager software must be installed on IBM X-Series servers for storage hardware health information to be displayed in SolarWinds SAM. Installation instructions can be found using the following link: IBM's ServeRAID Manager
Monitoring Hardware Health 375
Hardware Items Monitored by SAM

Fan status Power Supply status Temperature Disk status Battery status Array Controller status Physical Memory status Chassis Intrusion status CPU Temperature and/or status
Hardware Monitoring and VMware

Hardware monitoring is automatically enabled for VMware ESX and ESXi servers. Monitoring of VMware servers uses the CIM protocol which should be enabled by default after the installation of ESX/ESXi hosts. If installing Hardware Monitoring Agent software on a VMware host, hardware information will be detected by SAM and the checkbox to monitor Hardware Health of Servers will be displayed, even where hardware information might already be collected via the vCenter using the VMWare API. When this option is displayed for a VMware host, checking it will not change the hardware polling method when Poll for VMware is also selected. If you are polling your hosts though the vCenter, you will not see the hardware option listed when you click List Resources as these nodes tend to be ICMP. This information is automatically collected by SAM, when available, through the VMware API. You will need to ensure you have the vCenter Hardware Status plug-in enabled on your V-Center for this information to be available though the VMware API, as shown below:
Note: Port 5989 must be opened when polling VMware servers using the CIM protocol.
376 Monitoring Hardware Health
If you run a scheduled Network Sonar Discovery of your existing servers, SAM will automatically collect any servers that support hardware health information the next time the scheduled discovery runs. For more information, see: "Managing Scheduled Discovery Results" on page 158. "Virtualization" on page 201.
Accessing Hardware Monitoring Agent Software

Each vendors hardware monitoring agent software includes a web server that operates on a unique port. Navigating to https://{remote.ip.address}:{Port} successfully will validate that the agent software is installed. Refer to the table below for the list of ports used by each vendor.
Vendor: Port: HP 2381
Dell 1311
IBM 423
For example: Navigating to https://10.186.16.100:1311 in your web browser will take you to the Dell OpenManage Server Administrator page on the remotely monitored host. ___________________________________
If HP Insight Management WBEM Providers for Windows Server 2003/2008 is installed for HP System Insight Manager, the Data Source in the SIM web interface will read "WBEM." If this component is not installed, the Data Source will read "SNMP." The IBM Director web-based access is an optional component for version 6.x and is not installed by default.
Adding Server Hardware Monitoring

There are two ways for administrators to add server hardware monitoring for nodes; through the Add Node wizard, and through the Node Details group of the Node Details page. Add Node Wizard From the Add Node wizard, the option to display Hardware Health of Servers is available after a node has been defined. Check this box to enable hardware health monitoring.
Manually Add Hardware Monitoring To add hardware health monitoring without using the Add Node wizard, follow these steps: 1. Click the Home tab in the SAM web console. 2. In the All Nodes group, click the node you want to monitor. 3. In the Node Details group of the Node Details page, click the List Resources button as shown below:
The following screen appears:
Here you can select the available hardware you want to monitor by checking the appropriate boxes and then clicking Submit. To disable hardware monitoring, navigate back to this screen and uncheck Hardware Health of Servers, then click Submit.
Hardware Details
Once you have chosen the hardware you want to monitor, the Hardware Health Details group appears on the Node Details page and looks similar to the following illustration, providing general information about your hardware and its status:
Note: This view will be hidden if hardware monitoring is disabled. For more information, see "Current Hardware Health Status" on page 381.
Current Hardware Health Status

The current status of your hardware's health can be determined by the Current Hardware Health grouping, as shown below. The status for most items will read Ok, Warning, or Critical, depending upon the set threshold values and the returned values. The icon colors for each item will change between green, yellow, and red, respectively. Gray icons indicate a status of Unknown, which suggests a polling failure. You can click on the [+] and [-] icons to expand and collapse a particular tree branch of hardware that is being monitored. When collapsed, the top level view (or roll-up status) of each hardware item will display the worst status of an item in that branch.
Note: The default temperature measurement is in degrees, Fahrenheit (F). To change this to Celsius (C), from the web console, navigate to Settings > Manage Accounts > Select Account > Edit. The Temperature Unit dropdown menu can be found under the Server & Application Monitor Settings category.
Changing Threshold Values

Threshold values for each monitored item cannot be set within SAM; however, some values can be configured through the Hardware Monitoring Agent Software installed on your hardware. Dell OpenManage Server Administrator is one such example. The illustration below shows how threshold values for the temperature can be changed from the default values using Dell's software.
Different default thresholds exist for different items in the Hardware Monitoring Agent Software. Some of these thresholds may be accessible and open to editing, some may not. Consult your Hardware Monitoring Agent Software user guide for specific information about editing thresholds. You can manually define alerting thresholds for any hardware sensor or category in the Advanced Alert Manager. For information, see: "Manually Changing Alert Thresholds" on page 387. "Accessing Hardware Monitoring Agent Software" on page 377.
Hardware Health Chart

This chart allows you to visualize multiple hardware statistics simultaneously. The advantage of this view is that you can easily see how your hardware objects are performing over a given period of time in relation to one another. Tabs at the top of the chart allow you to quickly navigate between different groups of hardware, allowing you to see the performance and status of an entire group of the same hardware on a single page.
Note: This view will be hidden if hardware monitoring is disabled.
Customizing the Hardware Health Chart

Click Edit at the top-right of the chart to be taken to the following screen. You can customize the following user-specific aspects of the chart display: Sample Interval This is the interval of time that will be displayed on the chart. Title This will give a title to display for your chart. Subtitle This will give a subtitle to display for your chart. Temperature Display This allows you to set the temperature units. This will affect all charts that display temperature for the current user. Note: For information on changing the measurement units between Fahrenheit and Celsius, see "Server & Application Monitor Settings" on page 190. Time Period for Chart This allows you to select the span of time the chart will display.
Click Submit to save the settings.
Clicking the chart itself opens the following screen which allows you to edit multiple, self-explanatory settings pertaining to the Hardware Chart.
Click Submit to save the settings. Note: The Raw Data button will deliver the chart data by downloading an Excel spreadsheet. The Chart Data button displays the data in a web page.
Alerting on Hardware Health

SAM has the ability to create alerts on all aspects of monitored hardware. You can access these alerts in the Advanced Alert Manager by navigating to the Trigger Condition tab, then selecting either APM: Hardware, APM: Hardware Type, or APM: Hardware Sensor from the Type of Property to Monitor dropdown menu, as shown in the following illustration:
For a list of hardware variables, see "Hardware Specific Variables" on page 494. For information on Alerting and Reporting, see "Configuring SolarWinds SAM Alerts" on page 292.
Manually Changing Alert Thresholds

You can manually define alerting thresholds for any hardware sensor or category in the Advanced Alert Manager. The illustration below shows an example of how to define an alert for when a fan's speed exceeds 3600 RPM.
For a list of hardware variables, see "Hardware Specific Variables" on page 494. For information on Alerting and Reporting, see "Configuring SolarWinds SAM Alerts" on page 292. For information on hardware health alerting, see "Alerting on Hardware Health" on page 386.
Chapter 17
Monitoring Processes in Real Time

The Real Time Process Explorer (RTPE) is available using WMI and SNMP monitored nodes. This feature is similar to the Processes tab found in the Windows Task Manager. The advantage of the RTPE is that you no longer need to physically, or remotely, log in to a particular machine and run the Task Manager to retrieve that machine's vital statistics. Information for both monitored and unmonitored processes is displayed directly through SAM using the RTPE.
Notes: Only SAM administrators can enable and disable the RTPE. Using the RTPE on a node monitored via ICMP which has no working component will require you to select Windows credentials manually. Consider promoting the selected node to SNMP or WMI to avoid this prompt. For more information, see: "Promoting a Node from ICMP to SNMP Monitoring" on page 94. "Promoting a Node from ICMP to WMI Monitoring" on page 96.
Monitoring Processes in Real-Time 389
Accessing the Real Time Process Explorer

There are three places within SAM that you can access the RTPE: the Node Details page, the Application Details page, and the Component Details page. Node Details page On the Node Details page, the Real-Time Process Explorer button can be found at the bottom of each Top 10 list, as highlighted below:
To navigate to the Node Details page: 1. Click the Home tab in the SAM web console. 2. In the All Nodes group, click a node. Note: The Real-Time Process Explorer button will not be available on the Node Details page in situations where the Top 10 lists are hidden, or when an assigned application template does not contain an SNMP Process Monitor or WMI/Windows Service Monitor. Clicking Real-Time Process Explorer will open the RTPE in a new window and will be sorted by the Top 10 category. For example, clicking the Real-Time Process Explorer button from the Top 10 Monitored Processes by CPU Load category will open the RTPE window with the processes sorted by CPU usage. The same is true for each Top 10 category. Note: Pop-ups must be enabled in your browser to view the Real Time Process Explorer.
390 Monitoring Processes in Real-Time
Application Details page The RTPE window can be accessed from the Application Details page, as highlighted below:
To navigate to the Application Details page: 1. Click the Home tab in the SAM web console. 2. In the All Applications group, click an Application. Component Details page On the Component Details page, the Real-Time Process Explorer button can be found by the Management field, as highlighted in the following illustration:
To navigate to the Component Details page: 1. Click the Home tab in the SAM web console. 2. In the All Applications group, click an Application. 3. Click a Component.
Using the Real Time Process Explorer

Different information is displayed in the RTPE depending on what protocol you use to monitor a particular node. The table below shows the differences in the information gathered based on the protocol used: Available RTPE processes via: Monitored Process: Name Process ID Assigned Application CPU usage Physical Memory Virtual Memory Disk I/O Polling interval WMI Yes Yes Yes Yes Yes Yes Yes Five seconds SNMP Yes Yes Yes Yes Yes No No Up to two minutes
Notes: Windows servers do not update their SNMP statistics more frequently than every two minutes. It takes at least two updates to these statistics to provide an accurate calculation. This means data displayed in the RTPE via SNMP can take up to four minutes to display. If this is unacceptable, consider changing the protocol to WMI, which updates every five seconds. SNMP uses significantly less bandwidth than WMI.
Each column can be sorted by clicking the column head or hovering over the column name and clicking the dropdown arrow. Columns can also be added or removed this way. Each column can also be resized and/or re-arranged by dragging the separators between each column head to change the width, or the column heads themselves to change their position. By default, all available columns are shown for the top ten running processes.
To show all running processes, click the Show All button at the bottom-left of the window. To show a set number of running processes, change the number in the text box next to the Show All button from 10 to any number that suits your needs. You can pause the polling process by clicking the Pause Polling button at the top-left of the window. For Windows based nodes, you can change the credentials used by clicking the Use Different Credentials button to bring up the credential library dialog box. Clicking the button will re-poll the running processes.
Monitoring Unmonitored Processes

Processes currently monitored by SAM are indicated by the application icon with the name of the assigned application beside it. Processes that are not currently monitored by SAM are indicated by the [+] symbol, followed by the words, "Start monitoring."
If you want to monitor a process that is not currently being monitored, click Start monitoring. From here, you will be taken to the Edit Properties section of the Find Processes, Services and Performance Counters wizard. At this point, you can begin customizing the selected component monitor. For more information, see "Find Processes, Services, and Performance Counters" on page 143.
Real Time Process Explorer Alerts

Three alerts are included with the Real Time Process Explorer: High CPU Percent Utilization with Top 10 Processes. (This alert will send an email when the CPU utilization is greater than 80%.) High Physical Memory Utilization with Top 10 Processes. (An alert will be sent when physical memory usage is at or above 90%.) High Virtual Memory Utilization with Top 10 Processes. (An alert will be sent when virtual memory usage is at or above 90%.)
These alerts can be found in the Alert Manager as highlighted in the following illustration:
As with all alerts, these three can be customized to suit your needs by selecting an alert via the checkbox and clicking the Edit button. For more information, see "Adding Alert Actions" on page 321. Note: Alerts may lag if you are monitoring hardware via SNMP. Windows servers do not update their SNMP statistics more frequently than every two minutes. It takes at least two updates to these statistics to provide an accurate calculation, meaning an alert can take up to four minutes to reach its recipient. If this is unacceptable, consider changing the protocol to WMI, which updates every five seconds. For more information, see "Using the Real Time Process Explorer" on page 392.
Chapter 18
Monitoring Syslog Messages

Syslog messages are one type of real time notification that network devices can send in response to designated network events. SolarWinds SAM provides the SolarWinds Syslog Service, allowing SolarWinds to receive Syslog messages from any monitored network device. The SolarWinds Syslog Service also has the ability to open multiple connections to your SQL server, so it can handle large numbers of simultaneously incoming Syslog messages from all your monitored devices. SolarWinds SAM uses the SolarWinds Syslog Service to listen on UDP port 514 for incoming Syslog messages. Received messages are then decoded and stored in the SolarWinds database. Until they are acknowledged, Syslog messages are available for viewing either in the web console Syslog view or in the Syslog Viewer application. The Syslog view in the SolarWinds Web Console provides quick access to current messages, filtered by any or all of the following criteria: Name or type of network object sending the message. Message Severity, Facility, Type, or Pattern Time Period in which the message was sent.
The Syslog Viewer application also allows you to tailor your view of Syslog messages using fully customizable rules. Additionally, the Syslog Viewer gives you the ability both to search your SolarWinds database and to configure Syslog-specific alerts for received Syslog messages. Note: When configuring your network devices to send Syslog messages, confirm that messages are sent to the IP address assigned to your SolarWinds SAM server. To ensure the proper configuration of a network device for Syslog messaging, refer to the documentation supplied by the device vendor.
Configuring the SolarWinds Syslog Port

SolarWinds listens for Syslog messages on port 514 (UDP). You can configure this port in the SyslogService.exe.config file, as indicated in the following procedure. Note: Running the Configuration Wizard will revert any and all changes made to the SyslogService.exe.config file. If you run the Configuration Wizard, you must repeat this procedure to restore your required port setting.
Monitoring Syslog Messages 395
To configure the Syslog port: 1. Log on to your SolarWinds server using an account with administrative privileges. 2. Open SyslogService.exe.config in a text editor. Note: By default, SyslogService.exe.config is located in C:\Program
Files\SolarWinds\Orion\.
3. Locate the following line:

<add key="UDPListenPort" value="514">
4. Edit value="514" as required to indicate the port on which your monitored devices are configured to send Syslog messages to your SolarWinds server. 5. Save SyslogService.exe.config.
Syslog Messages in the Web Console

The SolarWinds Web Console provides both Syslog-specific resources and a Syslog view that provides a table of Syslog messages received by your SolarWinds server. The following sections provide an overview of available Syslog resources and procedures for viewing and acknowledging Syslog messages within the SolarWinds Web Console.
Syslog Resources
SolarWinds SAM provides the following Syslog-related resources for inclusion within web console views. Advanced Syslog Counts Every Syslog message has a designated severity. For more information about Syslog severities, see Syslog Severities on page 408. The Advanced Syslog Counts resource groups by severity all Syslog messages received by the currently viewed node. For each severity, this resource provides the number of received Syslog messages. Advanced Syslog Parser The Advanced Syslog Parser resource provides a comprehensive view of the Syslog messages most recently received by the viewed node. The most recent messages of each severity are listed. For more information about Syslog severities, see Syslog Severities on page 408. Advanced Syslog Summary The Advanced Syslog Summary resource groups by message type all Syslog messages received by the currently viewed node, where the message type is
396 Monitoring Syslog Messages
encoded in the Syslog message packet. For each message type, this resource provides the severity, the hostname or IP address of the message originator, and the total number of Syslog messages received. Last 25 Syslog Messages The Last 25 Syslog Messages resource provides a list of the last 25 syslog messages that have been sent by monitored network devices to the viewed node. For each message, this resource presents the date and time the message was sent, the hostname and IP address of the device sending the message, and the message text. Clicking the hostname, IP address, or message text opens the corresponding Object Details page, providing extensive diagnostic information about the monitored network object sending the message. Clicking Edit opens the Edit Last 25 Syslog Messages page where you can set the maximum number of displayed messages, select the time period for viewing messages, and establish filters to limit the messages this resource displays. For more information, see Using Node Filters on page 137. Syslog Summary The Syslog Summary resource lists the number of Syslog messages received by the viewed node from monitored network devices over a specified period of time.
Viewing Syslog Messages in the Web Console

You can customize the list view by using the following procedure to select your preferred message grouping criteria. To view Syslog messages in the Web Console: 1. Click Start > All Programs > SolarWinds > SolarWinds Web Console. 2. Log in to the SolarWinds Web Console, and then click Syslog in the Views toolbar. 3. If you want to view Syslog messages for a specific Syslog-enabled network object, specify the selected object in the Network Object field. Note: Only objects that have sent a Syslog message to the SolarWinds server will be listed in this field. 4. If you want to filter your Syslog messages table by device type, select the type to which you want to limit your view in the Type of Device field. 5. If you want to filter your Syslog messages table by severity, select the severity level to which you want to limit your view in the Select Severity field.
Note: For more information, see Syslog Severities on page 408. 6. If you want to filter your Syslog messages table by facility, select the facility to which you want to limit your view in the Select Facility field. Note: For more information, see Syslog Facilities on page 407. 7. If you want to limit your Syslog messages table to show only messages of a designated type, type the appropriate string in the Message Type field. 8. If you want to limit your Syslog messages table to show only messages containing a designated pattern, provide the appropriate string in the Message Pattern field. Note: An asterisk (*) is required as a wildcard character, both before and after the pattern string, unless the provided pattern is any of the following: The beginning of the message The end of the message The full message 9. If you only want to see Syslog messages from a specific period of time, select a time period from the Time Period menu. 10. Confirm the number of messages displayed in the Show Messages field. 11. If you want cleared or acknowledged messages to remain in the Syslog view, check Show Cleared Messages. 12. Click Refresh to update the Syslog messages list with your new settings.
Acknowledging Syslog Messages in the Web Console

Acknowledging Syslog messages is straightforward in the SolarWinds Web Console, as shown in the following procedure. To acknowledge Syslog messages in the SolarWinds Web Console: 1. Click Start > All Programs > SolarWinds > SolarWinds Web Console. 2. Log in to the SolarWinds Web Console. 3. Click Syslog in the Views toolbar. 4. Provide filter criteria for the Syslog messages table. For more information, see Viewing Syslog Messages in the Web Console on page 397. 5. Click Refresh to ensure that all selected view criteria take effect. 6. Check the messages you want to acknowledge, and then click Clear Selected Messages.
Using the Syslog Viewer

SolarWinds also provides the standalone Syslog Viewer application for viewing and acknowledging Syslog messages on your network. Syslog Viewer collects Syslog messages from your network and presents them in a readily reviewable and searchable list so that you can easily monitor your network. The following sections provide a guide to using the Syslog Viewer application for viewing, acknowledging, and triggering alerts in response to Syslog messages on your network. To open the Syslog Viewer, click Start > All Programs > SolarWinds > Syslog and SNMP Traps > Syslog Viewer.
Viewing and Acknowledging Current Messages

The Syslog Viewer makes it easy to view and acknowledge messages. The following procedure views and then acknowledges current Syslog messages. To view and acknowledge current Syslog messages: 1. Click View > Current Messages 2. Acknowledge current messages using either of the following methods: Right-click any message, and then select Acknowledge Selected. Add an Acknowledged column to the Syslog Viewer, and then check each message that you want to acknowledge. For more information, see Syslog Server Settings on page 400.
Searching for Syslog Messages

Collected Syslog messages may be searched within Syslog Viewer. The following steps both search for Syslog messages and format search results. To search the Syslog message list: 1. Click View > Search Messages. 2. Enter appropriate search criteria, and then click Search Database. 3. If you want to group messages for easier navigation, select the type of grouping from the Grouping list. Note: Messages can be acknowledged in the search results just as they can be acknowledged in the Current Messages view. For more information, see Syslog Server Settings on page 400. 4. If you want to limit the number of messages that are shown, enter or select a number in the Maximum number of messages to display field.
5. If you want to view messages that meet your search criteria as they arrive, select a number for the Auto Refresh every number seconds field. Note: Auto Refresh is only available when you are viewing current messages. The Date/Time Range must be set to Today, Last 24 Hours, Last 2 Hours, or Last Hour.
Syslog Server Settings

Use the following procedure as a guide to starting and configuring the Syslog Viewer. To start and configure the Syslog Viewer: 1. Click Start > All Programs > SolarWinds > Syslog and SNMP Traps > Syslog Viewer. 2. Click File > Settings. 3. Click the General tab in the Syslog Server Settings window. 4. Adjust the Maximum number of messages to display in Current Messages view slider to set the number of messages you want to display. 5. If you want to Automatically Refresh the Current Messages View , check the option accordingly, and then set the refresh rate with the middle slider. 6. Adjust Retain Syslog messages for how many days? to set the length of time Syslog messages should stay in the database. 7. Click the Displayed Columns tab. 8. Use the arrow keys to select and order the fields of information you want to see in the Current Messages view. Note: You can make it easier to acknowledge Syslog messages by selecting the Acknowledged column to add to your view. 9. If you want to wrap Syslog message text in the Current Messages view, check Word wrap long messages. 10. If you do not expect to use Syslog Server as your primary viewer for Syslog messages, select the Message Parsing tab, and then complete the following steps: Note: The following data points are saved within the Syslog tables in your SolarWinds database. Removing the added data from each record helps you to proactively reduce the size of your database. 11. Check Remove embedded Date/Time from Syslog Messages, Remove Message Type from Syslog Messages , and Remove Domain Name from DNS Lookups.
Configuring Syslog Viewer Filters and Alerts

The Syslog Viewer can be configured to signal SolarWinds alert actions when Syslog messages that are received from network devices match defined rules. The steps in the following procedure establish rules that filter Syslog messages and initiate alert actions as you determine. Note: Syslog rules may not be applied to nodes in an unmanaged state. For more information about designating nodes as unmanaged, see Setting Device Management States on page 97. To configure Syslog Viewer filters and alerts: 1. Click Start > All Programs > SolarWinds > Syslog and SNMP Traps > Syslog Viewer. 2. Click File > Settings. 3. Click Alerts/Filter Rules. 4. If you are creating a new rule, click Add New Rule. 5. If you are editing an existing rule, select the rule, and then click Edit Selected Rule. 6. On the General tab, complete the following steps: a. Provide or edit the Rule Name, and then check Enabled. b. Select appropriate servers from the Apply this Rule to list. c. Enter the IP addresses or subnets to which this rule applies in the Source IP Addresses area. Note: Use the examples provided on this tab to ensure that the list of source IP addresses is properly formatted. 7. If you want to limit the rule to only messages from specific hosts, domains, or hostname patterns, on the DNS Hostname tab enter a DNS Hostname Pattern. Notes: The DNS Hostname Pattern rule is case sensitive. When Use Regular Expressions in this Rule is checked, you may use regular expressions in place of like statements. For more information about using regular expressions in SolarWinds SAM, see Regular Expression Pattern Matching on page 483.
8. If you want to limit the rule to only specific message types or text within a Syslog message, on the Message tab enter rules as appropriate for Message Type Pattern and Syslog Message Pattern. Notes: Use the examples listed on this tab to format the list properly. When Use Regular Expressions in this Rule is checked, regular expressions can be used in place of like statements. For more information about using regular expressions in SolarWinds SAM, see Regular Expression Pattern Matching on page 483. 9. If you want to apply specific severity or facility types, on the Severity / Facility tab check the severity and facility types you want to apply. Note: By default, all message severities and facilities are selected. For more information about Syslog severities and facilities, see Syslog Message Priorities on page 407. 10. If you want to limit rule application to within a specific period of time, select the Time of Day tab, check Enable Time of Day checking, enter the time period, and then check the days of the week on which to apply the rule. Notes: Enabling Time of Day checking creates more overhead for the CPU. Messages received outside the specified timeframe will not trigger alerts. 11. If you want to suppress alert actions until a specified number of messages arrive that match the rule, complete the following procedure: a. Select the Trigger Threshold tab. b. Check Define a Trigger Threshold for this Rule. c. Enter option values as appropriate. Note: When Suspend further Alert Actions for is checked, alert actions are not sent until the specified amount of time has expired. Once the time period has expired, only new alerts are sent. All alerts suppressed during the time period are discarded. 12. Configure Syslog alert actions on the Alert Actions tab, as shown in the following steps: a. If you are associating a new action to the rule, click Add New Action. For more information about available actions, see Available Syslog Alert Actions on page 403. b. If you want to edit an existing action for the rule, select an action from the list, and then click Edit Selected Action.
c. Configure the action as appropriate. For more information about available actions, see Available Syslog Alert Actions on page 403. Note: Syslog alerts use a unique set of variables.
Previous reboot was at ${LastBoot-Previous}. Alert: ${NodeName} has exceptionally high response time. Average Response Time is ${AvgResponseTime} and is varying from ${MinResponseTime} to ${MaxResponseTime}. Current packet loss for ${NodeName} is ${%Loss}. Average Response time is ${AvgResponseTime} and is varying from ${MinResponseTime} to ${MaxResponseTime}. Alert: The SNMP Community string used to query ${NodeName} has been changed from ${CommunityPrevious} to ${Community}. SolarWinds uses the new Community String to query ${NodeName}.
d. If you need to delete an action, select the action, and then click Delete Action. e. Use the arrow buttons to set the order in which actions are performed. Note: Actions are processed in the order listed, from top to bottom. f. Click Ok to save all changes and return to Syslog Viewer Settings.
13. Use the arrow buttons to arrange the order in which the rules are applied. Note: Rules are processed in the order they appear, from top to bottom.
Available Syslog Alert Actions

The following list provides definitions of the actions available for each Syslog alert type. For more information about how to assign alert actions, see Configuring Syslog Viewer Filters and Alerts on page 401. Discard the Syslog Message Allows you to delete unwanted Syslog messages sent to the Syslog server. Tag the Syslog Message Allows you to add a custom tag to received Syslog messages. Ensure you include the Tag column in the viewer when assigning a tag.
Modify the Syslog Message Modify the severity, facility, type, or contents of a Syslog message. Log the Message to a file Allows you to specify a file and a series of variables with which to tag Syslog messages sent to the file. Ensure you have already created the log file you want to use. The alert cannot create a file. Windows Event Log Write a message to local or remote Windows Event Logs. Forward the Syslog message Specify the IP address or hostname and the port to forward a Syslog event. Send a new Syslog message Trigger a new Syslog message, sent to a specific IP address or hostname, on a specific port, with a customizable severity, facility, and message. Send an SNMP Trap Allows you to send a trap to an IP address following a specific trap template and using a specific SNMP community string. Play a sound Allows you to play a sound when a matching Syslog message is received. Text to Speech output Define the speech engine, speed, pitch, volume, and message to read. Execute an external program Allows you to specify an external program to launch using a batch file. This action is used when creating real time change notifications in SolarWinds SAM. Execute an external VB Script Allows you to launch a VB Script using the selected script interpreter engine and a saved script file. Send a Windows Net Message Allows you to send a net message either to a specific computer or to an entire domain or workgroup. Note: The only operating systems supporting Windows Net Messaging on which SolarWinds supports SolarWinds installations are Windows Server
2003 and Windows XP. SolarWinds only supports evaluation installations of SolarWinds on Windows XP. Send an E-mail / Page Send an email from a specified account to a specified address, using a specific SMTP server, and containing a customizable subject and message. Stop Processing Syslog Rules Stops the processing of Syslog rules for the matching Syslog message.
Forwarding Syslog Messages

The Syslog message forwarding action allows you to forward received Syslog messages. Additionally, if you have WinPCap version 3.0 or higher installed on your SolarWinds SAM server, you can forward Syslog messages as spoofed network packets. The following procedure configures available options for forwarded Syslog messages. Note: The following procedure assumes you are editing a Forward the Syslog Message alert action. For more information about Syslog alert actions, see Configuring Syslog Viewer Filters and Alerts on page 401. To configure the forward syslog message action: 1. Provide the hostname or IP address of the destination to which you want to forward the received Syslog message. 2. Provide the UDP Port you are using for Syslog messaging. Note: The default is UDP port 514. 3. If you want to retain the IP address of the source device, complete the following steps: a. Check Retain the original source address of the message. b. If you want to designate a specific IP address or hostname as the Syslog source, check Use a fixed source IP address (or hostname), and then provide the source IP address or hostname. c. If you want to spoof a network packet, check Spoof Network Packet, and then select an appropriate Network Adapter. 4. Click Ok to complete the configuration of your Syslog forwarding action.
Syslog Alert Variables

The following variables can be used in Syslog alert messages. Each variable must begin with a dollar sign and be enclosed in curly braces as, for example, ${VariableName}. Syslog alerts also support the use of Node alert variables. For more information, see Orion Variables and Examples on page 481.
Syslog Date/Time Variables

Syslog Date/Time Variable ${AbbreviatedDOW} ${AMPM} ${D} ${DD} ${Date} ${DateTime} ${DayOfWeek} ${DayOfYear} ${H} ${HH} ${Hour} ${LocalDOW} ${LongDate} ${LocalMonthName} ${LongTime} ${M} ${MM} ${MMM} ${MediumDate} ${Minute} ${Month} ${N} ${S} ${Second} ${Time} ${Year2} ${Year} Description Current day of the week. Three character abbreviation. AM or PM corresponding to current time (before or after noon) Current day of the month Current day of the month (two digit number, zero padded) Current date. (Short Date format) Current date and time. (Windows control panel defined Short Date and Short Time format) Current day of the week. Numeric day of the year Current hour Current hour. Two digit format, zero padded. Current hour. 24-hour format Current day of the week. Localized language format. Current date. (Long Date format) Current month name in the local language. Current Time. (Long Time format) Current numeric month Current month. Two digit number, zero padded. Current month. Three character abbreviation. Current date. (Medium Date format) Current minute. Two digit format, zero padded. Full name of the current month Current month and day Current second. Current second. Two digit format, zero padded. Current Time. (Short Time format) Two digit year Four digit year
Other Syslog Variables

Syslog Variable ${Application} ${Copyright} ${DNS} ${Hostname} ${IP_Address} ${Message} ${MessageType} ${Severity} ${Version} Description SolarWinds application information Copyright information Fully qualified node name Host name of the device triggering the alert IP address of device triggering alert Status of device triggering alert The name of the triggered alert A number (0-7) corresponding to the designated severity of a message. For more information, see Syslog Severities on page 408. Version of the SolarWinds software package
Syslog Message Priorities

Included at the beginning of each Syslog message is a priority value. The priority value range spans between 0 and 191 and is enclosed in angle bracket ( < and >) delimiters. The priority value is calculated using the following formula:
Priority = Facility * 8 + Severity
Syslog Facilities
The facility value indicates which machine process created the message. The Syslog protocol was originally written on BSD Unix, so Facilities reflect the names of UNIX processes and daemons, as shown in the following table. Note: If you are receiving messages from a UNIX system, consider using the User Facility as your first choice. Local0 through Local7 are not used by UNIX and are traditionally used by networking equipment. Cisco routers, for example, use Local6 or Local7.
Number 0 1 2 3 4 5 6 7 8 9 Source kernel messages user-level messages mail system system daemons security/authorization messages messages generated internally by Syslog line printer subsystem network news subsystem UUCP subsystem clock daemon Number 12 13 14 15 16 17 18 19 20 21 Source NTP subsystem log audit log alert clock daemon local use 0 (local0) local use 1 (local1) local use 2 (local2) local use 2 (local3) local use 2 (local4) local use 2 (local5)

10 11 security/authorization messages FTP daemon 22 23 local use 2 (local6) local use 2 (local7)
Syslog Severities
The following table provides a list of Syslog severity levels with descriptions and suggested actions for each.
Number 0 1 Severity Emergency Alert Suggested Actions A "panic" condition affecting multiple applications, servers, or sites. System is unusable. Notify all technical staff on call. A condition requiring immediate correction, for example, the loss of a backup ISP connection. Notify staff who can fix the problem. A condition requiring immediate correction or indicating a failure in a primary system, for example, a loss of a primary ISP connection. Fix CRITICAL issues before ALERT-level problems. Non-urgent failures. Notify developers or administrators as errors must be resolved within a given time. Warning messages are not errors, but they indicate that an error will occur if required action is not taken. An example is a file system that is 85% full. Each item must be resolved within a given time. Events that are unusual but are not error conditions. These items might be summarized in an email to developers or administrators to spot potential problems. No immediate action is required. Normal operational messages. These may be harvested for network maintenance functions like reporting and throughput measurement. No action is required. Information useful to developers for debugging an application. This information is not useful during operations.
Critical
Error
Warning
Notice
6 7
Informational Debug
Chapter 19
Monitoring SNMP Traps

SNMP traps signal the occurrence of significant events by sending unsolicited SNMP messages to a monitoring device. The SolarWinds Trap Server listens for incoming trap messages on UDP port 162 and then decodes, displays, and stores the messages in the SolarWinds SAM database. The SolarWinds Trap Service allows SolarWinds SAM to receive and process SNMP traps from any type of monitored network device, and, because the SolarWinds Trap Service is multi-threaded, it can handle large numbers of simultaneously incoming traps. You can view SNMP traps in the Trap Viewer application. The Trap Viewer application allows you to configure trap-specific alerts, to view and search traps, and to apply powerful trap filtering. Note: When configuring devices to send SNMP traps, confirm that traps are sent to the IP address assigned to the SolarWinds SAM server. To ensure proper configuration, refer to the documentation supplied by the vendor of your devices.
The SNMP Trap Protocol

SNMPv1 (Simple Network Management Protocol) and SNMPv2c, along with the associated Management Information Base (MIB), allow you to take advantage of trap-directed notification. When monitoring a large number of devices, where each device may have a large number of its own connected objects, it can become impractical to request information from every object on every device. Consider having each managed device notify the SolarWinds SAM SNMP Trap Server of any issues without solicitation. In this configuration, a problem device notifies the server by sending a message. This message is known as a trap of the event. After receiving the event, the Trap Viewer displays it, allowing you to choose to take action or automatically trigger an action based on the nature of the event.
Viewing SNMP Traps in the Web Console

Customize the Traps view as shown in the following procedure. To view SNMP traps in the Web Console: 1. Click Start > All Programs > SolarWinds > SolarWinds Web Console. 2. Click Traps in the Views toolbar. 3. If you want to filter your traps table view by device, select the device to which you want to limit your view in the Network Object field.
Monitoring SNMP Traps 409
4. If you want to filter your traps table by device type, select the device types you want to view in the Type of Device field. 5. If you want to limit your traps table to show only traps of a designated type, select the appropriate type in the Trap Type field. 6. If you want to limit your traps table to show only traps originating from a specific IP address, type the IP Address in the Source IP Address field. 7. If you want to limit your traps table to show only traps with a designated community string, select the appropriate community string in the Community String field. 8. If you only want to see traps from a specific period of time, select the time period from the Time Period menu. 9. Confirm the number of traps displayed in the Show Traps field. 10. Click Refresh to update the Traps view with your new settings.
Using the Trap Viewer

After the monitored devices on your network are configured to send traps to the SolarWinds SAM server, configure the SolarWinds Trap Viewer to display received trap information, as shown in the following sections. Notes: To ensure proper configuration of your network devices, refer to the documentation supplied by the vendor of your network devices. The SolarWinds Trap Viewer receives traps on UDP port 162.
Viewing Current Traps

Trap Viewer makes it easy to view trap messages, as shown in the following steps. To view current trap messages: 1. Click Start > All Programs > SolarWinds > Syslog and SNMP Traps > Trap Viewer. 2. Click View > Current Traps. 3. Click a column header to order listed traps by the selected trap characteristic. 4. Configure the Trap Viewer by clicking and dragging columns to order the presentation of trap characteristics.
410 Monitoring SNMP Traps
Searching for Traps

Collected trap messages may be searched within Trap Viewer. The following steps both search for trap messages and format the search results list. To search the trap message list: 1. Click Start > All Programs > SolarWinds > Syslog and SNMP Traps > Trap Viewer. 2. Click View > Search Traps. 3. Enter appropriate search criteria, and then click Search Database. 4. If you want to group messages for easier navigation, select the type of grouping from the Grouping list. 5. If you want to limit the number of messages that are shown, enter or select a number in the Maximum number of messages to display field. 6. If you want to view messages that meet your search criteria as they arrive, select a number for the Auto Refresh every number seconds field. Note: Auto Refresh is only available when you are viewing current messages. The Date/Time Range must be set to Today, Last 24 Hours, Last 2 Hours, or Last Hour. 7. If you want to hide the search criteria pane, toggle the pane open and closed by clicking the double up arrows in the top right of the page.
Trap Viewer Settings

Use the following procedure to start and configure the Trap Viewer. To start and configure the Trap Viewer: 1. Click Start > All Programs > SolarWinds > Syslog and SNMP Traps > Trap Viewer. 2. Click File > Settings. 3. On the General tab, configure the following Trap server settings: a. Position the top slider to set the Maximum number of traps to display in Current Traps view. b. If you want SolarWinds SAM to Automatically Refresh the Current Traps View, check the option accordingly, and then position the middle slider to set the refresh rate. c. Position the Retain Trap messages for how many days? slider to set the length of time that traps remain in the database.
4. On the Displayed Columns tab, use the arrow keys to select and order the fields of information you want to see in the Current Traps view. 5. If you do not need the domain name from your trap messages, check Remove Domain Name from DNS Lookups on the Message Parsing tab. Note: Checking this option will remove the domain name from your trap messages, and this will help to reduce the size of your database.
Configuring Trap Viewer Filters and Alerts

The Trap Viewer can be configured to trigger SolarWinds SAM alert actions when received trap messages match defined rules. The following steps establish rules to filter trap messages and initiate alert actions as you determine. Notes: With the exception of the asterisk (*) wildcard, SolarWinds recommends against using non-alphanumeric characters in filter definitions. Trap rules are not applied to unmanaged nodes. For more information, see Setting Device Management States on page 97.
To configure Trap Viewer filters and alerts: 1. Click Start > All Programs > SolarWinds > Syslog and SNMP Traps > Trap Viewer. 2. Click File > Settings, and then click the Alerts / Filter Rules tab. 3. If you are creating a new rule, click Add Rule. 4. If you are editing an existing rule, click Edit Rule. 5. Click the General tab, 6. Enter a Rule Name, and then check Enabled to enable the rule. 7. Select appropriate servers from the Apply this Rule to list. 8. Enter the IP addresses or subnets to which this rule applies. Note: Use the examples listed on this tab to format the list properly. 9. If you want the rule limited to messages from specific hosts, domains, or hostname patterns, click DNS Hostname, and then enter a DNS Hostname Pattern. Notes: The DNS Hostname Pattern rule is case sensitive. When Use Regular Expressions in this Rule is checked, regular expressions can be used in place of like statements. For more information about using
regular expressions in SolarWinds SAM, see Regular Expression Pattern Matching on page 483. 10. If you want the rule limited on the basis of content within the Trap Details field, click Trap Details, and then enter a Trap Details Pattern. Note: When Use Regular Expressions in this Rule is checked, regular expressions can be used in place of like statements. For more information about using regular expressions in SolarWinds SAM, see Regular Expression Pattern Matching on page 483. 11. If you want the rule limited to specific community strings, click Community String, and then enter appropriate patterns in the Community String Pattern field. Notes: When Use Regular Expressions in this Rule is checked, regular expressions can be used in place of like statements. For more information about using regular expressions in SolarWinds SAM, see Regular Expression Pattern Matching on page 483. 12. Click Conditions, and then generate trigger conditions for rule application in the text field as follows: Select appropriate object identifiers and comparison functions from the linked context menus. Click Browse () to Insert an OR condition, to Insert an AND condition, or to Delete a condition as necessary. Note: For more information about conditions and condition groups, see Understanding Condition Groups on page 316. 13. If you want to limit rule application to within a specific period of time, click Time of Day, check Enable Time of Day checking, enter the time period, and then select days of the week on which to apply the rule. Notes: Enabling Time of Day checking creates more overhead for the CPU. Messages received outside the specified timeframe will not trigger alerts. 14. If you want to suppress alert actions until a specified number of traps arrive that match the rule, click Trigger Threshold, check Define a Trigger Threshold for this Rule, and then enter option values as appropriate. Note: When Suspend further Alert Actions for is checked, alert actions are not sent until the specified amount of time has expired. Once the time period has expired, only new alerts are sent. All alerts that are suppressed during the time period will never be sent. 15. Click Alert Actions.
16. If you are associating a new action to the rule, click Add New Action, and then select an action from the list to configure. For more information about adding alert actions, see Adding Alert Actions on page 321. 17. If you are editing an existing action for the rule, select an action from the list, click Edit Action, and then configure the action. For more information about adding alert actions, see Adding Alert Actions on page 321. 18. Use the arrow buttons to set the order in which actions are performed. Note: Actions are processed in the order they appear, from top to bottom. 19. If you need to delete an action, select the action, and then click Delete Action. 20. Click Ok to save all changes and return to Trap Viewer Settings. 21. Use the arrow buttons to arrange the order in which the rules are applied. Note: Rules are processed in the order they appear, from top to bottom.
Available Trap Alert Actions

The following actions are available for trap alerts. For more information about assigning and configuring alert actions, see Adding Alert Actions on page 321. Discard the Trap Allows you to delete unwanted traps sent to the SNMP Trap server. Tag the Trap Allows you to add a custom tag to received traps. Ensure you include the Tag column in the viewer when assigning a tag. Flag the Trap with a specific color Allows you to assign a specific color for display in the SolarWinds Web Console and the Trap Viewer to flag traps matching the rule. Log the Trap to a file Allows you to specify a file and a series of variables with which to tag traps sent to the file. Ensure you have already created the log file you want to use. The alert cannot create a file. Windows Event Log Allows you to write a message to the local Windows Event Log or to a remote Windows Event Log.
Forward the Trap Allows you to specify the IP address or hostname and the port on which to forward the trap. Specify the IP address or hostname of the trap destination and the port on which the trap should be sent. Check Include Source Address to include the IP address of the trap source. Play a sound Allows you to play a sound when a matching SNMP trap is received. Text to Speech output Allows you to define a specific speech engine, the speed, pitch, volume, and message to read. Execute an external program Allows you to specify an external program to launch using a batch file. This action is used when creating real time change notifications in SolarWinds SAM. Execute an external VB Script Allows you to launch a VB Script using the selected script interpreter engine and a saved script file. Send a Windows Net Message Allows you to send a Windows Net message either to a specific computer or to an entire domain or workgroup. Note: The only operating systems supporting Windows Net Messaging on which SolarWinds supports SolarWinds installations are Windows Server 2003 and Windows XP. SolarWinds only supports SolarWinds evaluations on Windows XP. Send an E-mail / Page Allows you to send an email from a specified account to an address, using a specific SMTP server, and containing a customizable subject and message. Stop Processing Trap Rules Stops the processing of SNMP trap rules for the matching trap.
Trap Alert Variables

The following variables can be used in trap alert messages with the SolarWinds SAM Trap Server. You must begin each variable with a dollar sign and enclose each variable identifier in curly braces as, for example, ${VariableName}.
Note: Trap alerts may also use any valid node variables. For more information about node alert variables, see Orion Variables and Examples on page 481.
Trap Date/Time Variables

Trap Date/Time Variable ${AbbreviatedDOW} ${AbbreviatedMonth} ${AMPM} ${D} ${DD} ${Date} ${DateTime} ${Day} ${DayOfWeek} ${DayOfYear} ${H}, ${Hour} ${HH} ${LocalDOW} ${LongDate} ${LongTime} ${M} ${MM} ${MMM} ${MMMM} ${MediumDate} ${MediumTime} ${Minute} ${MonthName} ${S} ${Second} ${Time} ${Year} ${Year2} Description Current day of the week. Three character abbreviation. Current month of the year. Three character abbreviation. AM or PM corresponding to current time (before or after noon) Current date. (MM/DD/YYYY format) Current day of the month (two digit number, zero padded) Current date. (MM/DD/YYYY format) Current day, date and time. (DAY NAME MONTH DD, YYYY HH:MM AM/PM) Current date. (MM/DD/YYYY format) Current day of the week. Numeric day of the year Current hour. 24-hour format Current hour. Two digit format, zero padded. Current day of the week. Localized language format. Current date. (DAY NAME, MONTH DAY, YEAR) Current Time. (HH:MM:SS AM/PM) Current numeric month Current month. Two digit number, zero padded. Current month. Three character abbreviation. Full name of the current month Current date. (DAY NAME, MONTH DAY, YEAR) Current Time. (HH:MM:SS AM/PM) Current minute. Two digit format, zero padded. Full name of the current month Date-time to current second (YYYY-MM-DDTHH:MM:SS) Current second. Two digit format, zero padded. Current Time. (HH:MM AM/PM) Four digit year Two digit year
Other Trap Variables

Trap Variable ${Application} ${Community} ${Copyright} Description SolarWinds application information Node community string Copyright information

${DNS} ${Hostname} ${IP} ${IP_Address} ${Message} ${MessageType} ${Raw} ${RawValue} ${vbData1} ${vbName1} Fully qualified node name Host name of the device triggering the trap IP address of device triggering alert IP address of device triggering alert Message sent with triggered trap and displayed in Trap Details field of Trap Viewer Name or type of trap triggered Raw numerical values for properties sent in the corresponding incoming trap. Raw numerical values for properties sent in the corresponding incoming trap. The same as ${Raw}. Trap variable binding value Trap variable binding name
Chapter 20
Network Atlas
Network Atlas is a powerful tool for creating custom maps and network diagrams. The maps created in Network Atlas enable users to view a graphical depiction of their network in the SolarWinds Web Console. You can also use Network Atlas maps to create your own network documentation, which can then be printed and exported as needed.
What is in a Map?
Map objects can be SolarWinds SAM applications and components. The numerous presentation options for your network maps include: A large set of predefined background colors, textures, and images for use in your maps, and the ability to use your own custom background graphics The ability to project real time weather or natural disaster maps onto your network maps using linked web graphics as a background The ability to customize the shape, size, color, and style of map links to illustrate the status or the relative bandwidth of associated objects The ability to show map objects in multiple styles to display application status Map nesting that selectively reveals increasing levels of map detail with the status of child objects on nested maps bubbled up to the parent map Linked Backgrounds The linked backgrounds feature allows you to create maps with backgrounds sourced directly from the Internet. Using a linked background, you can create maps that include dynamic weather information relevant to your distributed network sites. For more information, see Selecting a Background Image. AutoArrange AutoArrange options allow you to quickly structure or reorganize objects on your map. For more information, see Selecting Automatic Layout Styles."
Example Maps
The following figures are examples of the types of maps you can create using Network Atlas.
Network Atlas 419
420 Network Atlas
Installing Network Atlas

Network Atlas is pre-installed on SolarWinds EOC v1.1 and higher. Users can also run Network Atlas as a standalone application on any remote computer meeting the stated minimum requirements.
Network Atlas Requirements

The following table provides the minimum requirements for a Network Atlas installation: Note: To take full advantage of Network Atlas features, users of Network Atlas must either have node management rights in SolarWinds SAM or be assigned the administrator role in SolarWinds EOC.
Server Component Operating System Memory Hard Drive Space Ports Requirements Microsoft Windows XP, Windows Vista, Windows 7, Windows Server 2003, or Windows Server 2008 R2. 1 GB 150 MB Remote instances of Network Atlas require TCP on port 17777 to either the SolarWinds NPM or the SolarWinds EOC server.
Installing Network Atlas on a Remote Computer

The following procedure installs Network Atlas on a remote computer. To install Network Atlas on a remote computer: 1. Log on to your SolarWinds server. 2. Click Start > All Programs > SolarWinds > SolarWinds Web Console. 3. In the Network Map resource, click Download Network Atlas. Note: If you do not see a Download Network Atlas link in your Network Map resource, click Edit, and then check the Show Network Atlas Download link option on the Edit Network Map resource page (administrative access may be required). 4. Save the installer (NetworkAtlas.exe) to an appropriate location on your remote computer. 5. Run the Network Atlas installer on your remote computer. 6. Click Next on the Welcome window.
Network Atlas 421
7. If you have previously installed Network Atlas, you may be prompted to change, repair or remove your installation. Click Repair, and then click Repair again on the Ready to repair window. 8. If you are installing Network Atlas for the first time, complete the following steps: a. Accept the terms in the license agreement, and then click Next. b. Provide an appropriate installation destination folder, and then click Next. c. Click Install on the Ready to Install window. 9. Click Finish when the Setup Wizard completes. For more information about starting Network Atlas and creating a new map, see Creating a Basic Map.
422 Network Atlas
Creating a Basic Map

Creating a map can be as easy as selecting a background image, dragging network resources onto the drawing area, and connecting the objects with lines. This section provides procedures to accomplish the following tasks: Starting Adding Map Objects Connecting Map Objects Manually Using Object Links to Represent Interface Status Interpreting Map Links Using Anchor Points to Reshape Map Links Adding a Background Saving Maps Opening Maps Displaying Maps in the Web Console
Starting Network Atlas

The following procedure launches Network Atlas. Note: To take full advantage of Network Atlas' features, users of Network Atlas must either have node management rights in Network Atlas or be assigned the administrator role in SolarWinds EOC. To start Network Atlas: 1. Log on to the computer hosting your Network Atlas installation. 2. Click Start > SolarWinds > Network Atlas. 3. Connect to your SolarWinds server, as directed in the following procedure: a. Provide your SolarWinds Login and Password. Note: Your SolarWinds Login and Password correspond to your SolarWinds Web Console User Name and Password. b. Provide your SolarWinds server IP address or hostname in the Address field. c. If you are connecting to an Network Atlas server, select Orion as the Connect to target.
Network Atlas 423
d. If you are connecting to a SolarWinds EOC server, select EOC as the Connect to target. e. Click Connect.
Adding Map Objects

Any objects monitored by SolarWinds SAM may be added to a Network Atlas map. The following procedure adds monitored network objects to your Network Atlas map. To add monitored objects to your map: 1. If you are creating a new map, click the Network Atlas button ( then click New Map. ), and
2. If you are adding objects to an existing map, complete the following steps: a. Click the Network Atlas button ( b. Click Open Map. c. Navigate to your existing map, and then click Open. 3. Expand and navigate the node tree in the left pane to locate the network nodes and monitored objects you want to add to your map. Note: All monitored applications, application components, and volumes associated with monitored nodes, in addition to other maps listed in the left pane, are available as map objects. Click [+] to expand any listed node and object types and view associated volumes and/or applications. 4. Drag selected objects onto the drawing area. Notes: If you want to add all the objects of a selected type on a selected node to your map in a single operation, click [+] next to the node name to reveal all its associated monitored network objects, and then drag all objects in the desired object group onto the drawing area. A checkmark ( map. ) next to a node indicates you have already added it to your ).
To view details about a map object, hover over it with the mouse pointer. To locate a specific map object in your map, click its network resource in the left pane. This selects the map object.
424 Network Atlas
Connecting Map Objects Manually

You can represent network links in your map by drawing lines between map objects. If a connected object is down, any connected links change color to red. To manually connect map objects: 1. Click Home. 2. Click Straight ( ) or Curved Line ( ) in the Lines group, as appropriate.
3. Click an object with the line drawing tool to begin drawing the link 4. Click and drag as needed to set optional anchor points along the link path. 5. Click a second object to finish drawing the link. 6. If you want the links connecting your mapped objects to communicate the status of connected interfaces, complete the following steps: a. Right-click a link, and then select Properties. b. Select Status in the left pane of the Link Properties page. c. Drag the appropriate interface objects from the left pane of the SolarWinds Network window to the link status assignment areas.
Using Object Links to Represent Interface Status

The following procedure configures an object link to represent the status of its connected interfaces. To use object links to represent actual interface states: 1. Right-click a link, and then select Properties. 2. Select Status in the left pane of the Link Properties page. 3. Drag the appropriate interface objects from the left pane of the SolarWinds Network window to the link status assignment areas.
Interpreting Map Links

Links created on maps are not merely connectors between network objects. Map links display the states of the applications through which your linked objects are connected. Node states are determined from SolarWinds SAM polling data.
Using Anchor Points to Reshape Map Links

You can use anchor points to change the shape of object links on your map, as shown in the following procedure.
Network Atlas 425
Note: Use multiple anchor points to create more complex shapes and curves. To use object link anchor points: 1. Click Select in the Tools group or click the middle mouse button.
2. Click and drag the link you want to reshape.
Adding a Background
You can select colors, textures, and locally-hosted or Internet-hosted images to serve as your map backgrounds: Selecting a Background Color Selecting a Background Texture Selecting a Background Image Clearing the Background
Selecting a Background Color Network Atlas supports 24-bit color backgrounds. To set a map background color: 1. Click Home. 2. Click Background > Background Color ( ).
3. Select a color from the palette, or click More Colors to select a custom color. Selecting a Background Texture Network Atlas also provides numerous colored textures that can serve as map backgrounds. To set a map background textures: 1. Click Home. 2. Click Background > Background Texture ( ).
3. Enter appropriate values for the Width and Height of your map in the Map Size in Pixels area. Note: The default values are the smallest area bounding the existing map objects and labels. 4. Select a texture to apply as your map background, and then click OK.
426 Network Atlas
Selecting a Background Image Network Atlas allows you to use images as your map background. The source of the background image can be a graphics file on your hard drive or a URL link to a graphics file on the Internet in any of the following graphics formats: Graphics Interchange Format (.gif, non-animated) Tagged Image File Format (.tiff) Joint Photographic Experts Group (.jpg) Microsoft Windows Bitmap (.bmp) Portable Network Graphics (.png) Linked backgrounds are updated when the map is accessed or when the browser page is refreshed. In a typical use case, a linked background is used to provide weather data from an Internet weather service on a network map. Notes: Files used for linked backgrounds must be continuously accessible by URL reference. Files used for static backgrounds must be available within the local file system. Background images you supply display at their full size in the SolarWinds Web Console, so consider their dimensions. You may rescale images within the application, but images displayed at full scale provide optimal quality. In determining map size and resolution, consider web page layouts and potential display screen resolutions. Example background images are in the NetworkAtlas Backgrounds folder located in your default shared documents folder. Clicking Background Image always starts you in this background images folder.
To select a background image: 1. Click Home. 2. If you want to use a background image from disk, click Background > Background Image ( ), and then navigate to the image you want to use. 3. If you want to use a background image from the Internet, complete the following steps: Notes: In the web console, map background images linked from the Internet are refreshed with the SolarWinds Web Console refresh.
Network Atlas 427
If the SolarWinds SAM server is behind a web proxy, the proxy settings entered into Microsoft Internet Explorer are used to create the Internet connection. If the web proxy requires authentication, you cannot link directly to the background image. A workaround is to write a script that periodically downloads the Internet image and saves it to a folder on the web server. You can then specify the saved image as the linked background image. a. Click Background > Linked Background ( b. Type the URL of the image you want to use. c. Click Validate. d. Click OK. Clearing the Background To clear the current map background, click Home, and then click Background > Clear Background ( ). ).
Saving Maps
Network Atlas saves your maps directly to the server to which you are connected. Note: To save a map to your hard drive instead of your SolarWinds server, click > Export > Export Map. To save a map: 1. Click the Network Atlas button ( ), and then click Save.
2. If you are saving the map for the first time, name the map, and then click OK. 3. If you want to save your map to your hard drive, complete the following steps: a. Click > Export > Export Map.
b. Navigate to an appropriate location on your hard drive. c. Provide a File name, and then click Save.
Opening Maps
Maps are loaded from the SolarWinds server to which you are connected. They appear in the left pane of the Network Atlas window. To open a map,
428 Network Atlas
1. Click [+] to expand the Maps group in the left pane of the Network Atlas window. 2. Double-click the map you want to open.
Displaying Maps in the Web Console

You can display saved maps in the SolarWinds web console Network Map resource. The procedure for selecting Network Maps is different between SolarWinds EOC and Network Atlas, and maps created for one are not compatible with the other. Select either of the following procedures, as appropriate: Map Resources in the Network Atlas Web Console Displaying Maps in the SolarWinds Web Console Displaying Maps in the SolarWinds EOC Web Console
Map Resources in the Network Atlas Web Console

The following map-related resources are available in the SolarWinds SAM Web Console: Network Map The Network Map resource displays a selected map within the SolarWinds Web Console. Objects on the map a user is not permitted to see are hidden from the user, as are any connections to those objects. For more information about including Network Atlas maps in the SolarWinds Web Console, see Displaying Maps in the SolarWinds Web Console. All Maps This resource provides a list of all available network maps. Clicking any map name opens a view containing the selected map with a list of the objects included in the map. Clicking an object name or its description opens the corresponding SolarWinds SAM device details page, providing extensive diagnostic information about the selected map object. Custom List of All Maps This resource is a customizable version of the All Maps resource. List of Objects on Network Map This resource lists all objects displayed on the map shown in the Network Map resource. Clicking an object name or its description opens the corresponding SolarWinds SAM Device Details page, providing extensive diagnostic information about the selected map object.
Network Atlas 429
Displaying Maps in the SolarWinds Web Console

The following procedure opens a saved map in the SolarWinds Web Console. To display a saved map in the Home view of the SolarWinds Web Console: 1. Log on to the SolarWinds Web Console using an account with administrative privileges.. 2. Click Edit in the Network Map resource. 3. Select your map from the Select Network Map list. 4. Click Submit.
Displaying Maps in the SolarWinds EOC Web Console

The following procedure opens a saved map in the SolarWinds EOC Web Console. To display a saved map in the Home view of the SolarWinds EOC web console: 1. Log on to the SolarWinds EOC web console with an Administrator account. 2. Click Settings. 3. Click Manage Views. 4. Select Home, and then click Edit View. 5. Click Resource. 6. Click Network Map in the Added list. 7. Select your map from the Select Network Map list, and then click Save. 8. Click OK, Save Changes. 9. If prompted to confirm your changes, click OK. 10. Click the Home view to see your map.
Advanced Mapping Techniques

You can apply a number of advanced mapping techniques to enhance the usefulness of your maps. This section discusses the following topics: Zooming In and Out of a Map Creating Nested Maps Displaying Map Object Metrics
430 Network Atlas
Adding Independent Map Objects and Floating Labels Changing the Appearance of Map Objects Changing the Appearance of Links Changing the Appearance of Labels Linking Map Objects to URLs Linking or Embedding Maps in Web Pages
Zooming In and Out of a Map

Network Atlas allows you to zoom into a map to enlarge details or to zoom out to reduce its size. Zoom level is a visual aid, and it is not saved with the map. Use any of the following methods to zoom in or out on a displayed map: Press and hold CTRL while rotating the mouse wheel button. Click the Zoom slider on the status bar, and then slide the zoom control to the zoom level you want
Click View, and then select the type of zoom you want to use from the Zoom group.
Creating Nested Maps

Nested maps allow you to navigate through a map to see multiple levels of detail. For example, a map of the United States can include an icon for a child map of Oklahoma. You can then click the Oklahoma object to open the child map.
Network Atlas 431
The map of Oklahoma can then become a parent map to a network diagram.
Each child map can include a view of the objects, either devices or other maps, deployed on it. Any nested objects can then be clicked to view the next level of map detail, until the level of the final network device is reached and all available network information is displayed. Note: The total number of objects on a map, including those displayed on child maps, affects how fast the map loads in the SolarWinds Web Console. If your maps load slowly, decrease the number of map objects. To create a nested map: 1. Drag a map from the Maps group in the left pane onto the parent map, and then position the map icon appropriately. 2. If you want the status of a child map to also indicate the status of its child objects, complete the following steps: a. Right-click the child map icon on the map, and then select Properties. b. Check Include child status on the Status properties page, and then click OK. The object status icon now includes the secondary status indicator.
Displaying Map Object Metrics

The status of a map object icon reflects its current state, such as up or down. You can add a secondary status indicator to a map object to reflect metrics such as response time, CPU load, or the state of any child objects. This secondary status indicator appears at the bottom right corner of the status icon. To add the secondary status indicator: 1. Right-click the map object, and then select Properties. 2. Check Include child status on the Status properties page, and then click OK.
432 Network Atlas
To change the thresholds of the metrics: 1. Right-click the map object, and then select Properties. 2. Click Metrics to view the Metrics properties page. 3. If you want to change the warning or critical threshold for a metric, click the threshold value, and then type a new value. 4. If you want to ignore a metric, uncheck the metric. 5. Click OK. Notes: The secondary status indicator respects the SolarWinds web console Status Rollup Mode setting for displaying status. All child objects and selected metric thresholds are taken into account to determine secondary status.
Adding Independent Map Objects and Floating Labels

You can add independent map objects and labels that do not have associations to network nodes or resources. To add an independent object: 1. Click Home. 2. Click Add Object in the Objects group to add a gray map object to the map. Independent labels may also be placed anywhere on your map. To add an independent label: 1. Click Home. 2. Click Add Label in the Labels group. A label is added to the map.
Changing the Appearance of Map Objects

Changing the graphics that represent map objects is an excellent way of increasing the information density of your map without increasing the map complexity. You can set the default representation style for all map object of a certain type, or you can change the appearance of selected map objects. To set the default representations of map objects: 1. Click the Network Atlas button , and then click Network Atlas Settings.
Network Atlas 433
2. Click Graphic Styles in the left column. 3. Select an appropriate default style for each available map object. Changing the representation of selected map objects opens up another level of graphical information. For example, you can set an object icon to display a mainframe graphic, visually designating the type of device being monitored. You can then select a status style, such as 3D Pad Underneath, to illustrate the map object status. To change the representation of selected map objects: 1. Right-click a map object, and then select Properties. 2. Click Appearance in the left column of the Properties page. 3. If you want the map object to appear as a fixed-size, LED-type graphic, complete these steps: a. Select SolarWinds LED Status Icon. b. Select a style from the SolarWinds LED Status Icon Style list, and then click OK. 4. If you want the map object to appear as a scalable shape, complete these steps: a. Select Shape b. Select a style from the Shape Style list, and then click OK. c. Drag a corner handle on the map object to resize the shape. 5. If you want the map object to appear as a scalable graphic, complete these steps. a. Select Graphic. b. Click Select Graphic, select an appropriate graphic, and then click OK. c. Select a status style from the Graphic Style list, and then click OK. d. Drag a corner handle on the map object to resize the graphic.
Pasting Custom Icons from the Windows Clipboard

You can paste graphics from the Windows clipboard directly into your Network Atlas maps and then display an overlay behind them to depict the status. Icons that you paste into Network Atlas are saved to the SolarWinds database, and made available for reuse in other maps under the "Imported" icon grouping. Pasted icons saved to the SolarWinds database can be accessed and used by remote instances of Network Atlas.
434 Network Atlas
To paste a custom icon into Network Atlas: 1. Open the icon image in a graphics program such as Visio or Photoshop. 2. Copy the image to the Windows clipboard with the Copy command. 3. Open the desired map in Network Atlas. 4. Paste the image as new object following these steps: a. Right-click on the map and then click Paste. b. Select Paste the image from the Clipboard as a new object . c. Enter a name for the this new image in the Please enter a name for the new image field. d. Click OK. Icons added in this manner are also saved on the SolarWinds SAM server in the path %APPDATA%\SolarWinds\NetworkAtlas\Maps\Orion\<orion server address>\NetObjects\Imported. %APPDATA% is typically C:\Documents and Settings\<logged on user>\Application Data for Windows XP, and C:\Users\<logged on user>\AppData\Roaming for Windows Server 2008. To delete a custom icon: 1. Determine which file on the SolarWinds SAM server contains the icon (for example, mypicture.wmf). 2. Add .del to the file name (for example, mypicture.wmf.del) 3. Start Network Atlas on the SolarWinds SAM server to delete the icons from the database.
Adding Custom Icons from Graphics Files

You can use any Windows Media File (.wmf) or Graphics Interchange Format (.gif) format graphic as a custom icon, but you must name the graphic files according to their roles. The file name must not contain any other dash (-) characters other than depicted in this table.
Role Down status External status Icon with no status Unknown status Unmanaged status Unplugged status Unreachable status File name
iconName-down.gif iconName-external.gif iconName.gif iconName-unknown.gif iconName-unmanaged.gif iconName-unplugged.gif iconName-unreachable.gif Network Atlas 435

Up status Warning status
iconName-up.gif iconName-warning.gif
To add custom icons from graphics files: 1. On your SolarWinds SAM server, create the folder:
%APPDATA%\SolarWinds\NetworkAtlas\Maps\Orion\<orion server addr ess>\NetObjects\User Graphics. %APPDATA% is typically C:\Documents and Settings\<logged on user>\Application Data for Windows XP, and C:\Users\<logged on user>\AppData\Roaming for Windows Server 2008.
2. Copy the graphics files to this folder. 3. Start Network Atlas on the SolarWinds SAM server to finalize the additional icons. After copying the graphics files to their location, you can assign them as an icon as you would any other graphic image. To assign a custom icon to an object: 1. Right-click the object on the map, and then click Select Graphic. 2. Select User Graphics in the left pane. 3. Select your desired graphic image, and then click OK.
Changing the Appearance of Links

Network Atlas allows you to change the appearance of network links by customizing their width, color, and line styles. To change the appearance of a link: 1. Right-click a link, and then select Properties. 2. Select Appearance in the left column of the Properties page. 3. Select a line width in pixels from the Width list. 4. Select a line color from the Color list. 5. Select a line style from the Style list. 6. Click OK. Note: The color setting only changes the color of links that have Up status.
436 Network Atlas
Changing the Appearance of Labels

Network Atlas allows you to change the appearance of labels by changing text attributes, borders, and background colors. To move a label: Drag the label to the desired location. To edit the text in a label: Double-click the label. Press SHIFT+ENTER to separate multiple lines within the same label. To change the appearance of a label: 1. Right-click the label, and then select Properties. 2. Select Appearance in the left column of the Properties page. 3. If you want to change the font attributes, click the button, select appropriate font attributes, then click OK. 4. If you want to change the text alignment, select an alignment from the Text Alignment list. 5. If you want to change the text color, click the Text Color color box, and then select a new color. 6. If you want to add a label border, select the border width in pixels from the Border Width list. 7. If you want to change the label border color, click the Border Color color box, and then select a new color. 8. If you want to remove a label border, select 0 from the Border Width list. 9. If you want to add a label background, uncheck Transparent Background. 10. If you want to change the label background color, click the Background Color box, and then select a new color. 11. If you want to remove a label background, check Transparent Background. 12. Click OK.
Network Atlas 437
Linking Map Objects to URLs

Network Atlas allows users to click on map objects in the SolarWinds web console to see more details. By default, map objects are linked to the most relevant SolarWinds details page for the object. You can customize the URL hyperlink to link to external web sites and pages as necessary. To link a map object to a URL. 1. Right-click the map object, and then select Edit Hyperlink. 2. If you want to link to the relevant SolarWinds page for the map object, select Logical page in SolarWinds. 3. If you want to link to a custom URL, select Manually set address, and then type the URL. 4. Click OK.
Linking or Embedding Maps in Web Pages

You can link or embed your maps in other web pages by referencing the URL for the map. The map URL is in the form:
http://orionServer/Orion/NetPerfMon/MapView.aspx?Map=mapName
orionServer This is the IP address or host name of your SolarWinds SAM server. mapName This is the display name of the map. If the map display name contains space characters, substitute %20 for the spaces when specifying the name.
Customizing SolarWinds Web Console Tooltips

In the web console, hovering over map objects displays a tooltip providing current identification and status information about the object. Tooltips are customizable for all map object types, and you can customize the tooltips in the SolarWinds SAM web console to display additional information by inserting SolarWinds alert variables, custom properties, and other text. Notes: Tooltip customizations are global and affect all maps. SolarWinds EOC does not support custom web console tooltips. For a complete list of variables available for use in Network Atlas tooltips, see, "Network Atlas Tooltip Variables."
438 Network Atlas
Use ${CR} to enter a carriage return.
To add additional information to map object tool tips: 1. Log on to SolarWinds SAM as an administrator. 2. Click Edit in the Network Map resource. 3. Click Customize map tooltips. 4. Type the variables and any text you want to add in the text field for the appropriate map object type. 5. Click Submit. Example Custom SolarWinds Node Tooltip Enter this custom node tooltip definition in the Orion.Nodes field to display node location and contact information: Orion.Nodes
Location: ${Location}${CR}Contact: ${Contact}
For more information about available tooltip variables, see Network Atlas Tooltip Variables."
Advanced Map Layouts

You can improve the visual layout and organization of your maps by using the advanced layout tools to help you align and distribute your objects and links. This section discusses the following topics: Displaying Grid Guides Aligning Map Objects Distributing Map Objects Selecting Automatic Layout Styles
Network Atlas 439
Displaying Grid Guides

A grid guide helps you maintain structural and spatial relationships as you arrange your map objects. Network Atlas allows you to select two kinds of grids and to change the grid spacing. Grids are not map objects, and are neither saved with a map nor displayed in the SolarWinds Web Console. To display a grid: 1. Click View. 2. Click Show Grid To customize the grid: 1. Click View. 2. If you want grid lines, click Grid Option > Grid Lines. 3. If you want grid points, click Grid Options >Grid Points. 4. If you want to change the grid size, click Grid Options > Grid Size, and then select a grid size. in the Grid group.
Aligning Map Objects

You can change the relative alignment of your map objects using the alignment tools. 1. Click Edit. 2. Select the map objects you want to align. 3. Click the appropriate button in the Align group to arrange your selected objects
Button Function Align Left Align Right Align Bottom Align Top Center Vertically Center Horizontally Description Aligns all selected objects on the left edge of the group Aligns all selected objects on the right edge of the group Aligns all selected objects on the bottom edge of the group Aligns all selected objects on the top edge of the group Centers all selected objects vertically Centers all selected objects horizontally
440 Network Atlas
Distributing Map Objects

You can distribute your map objects evenly across the selection area using the distribution tools. 1. Click Edit. 2. Select the map objects you want to distribute. 3. Click the appropriate button in the Distribute group to arrange your selected objects
Button Function Distribute Horizontally Distribute Vertically Description Distributes all objects so that they are equidistant from the left edge of the leftmost object to the right edge of the rightmost object Distributes all objects so that they are equidistant from the top edge of the topmost object to the bottom edge of the bottommost object
Selecting Automatic Layout Styles

You can select from the following five styles to automatically change the relative positioning of objects your map: Circular Emphasizes the clusters inherent in the topology of a map. It emphasizes prominent links between main objects and its peripherals. Object groups have radial placements. Use circular layouts for maps containing ring and star network topologies. Symmetrical Emphasizes the symmetrical patterns inherent in the map topology. It emphasizes an even distribution of objects, and minimizes edge crossings. Object groups have star spiral placements. Use symmetrical layouts for maps that have fairly homogenous or uniform clusters. Hierarchical Emphasizes mapped dependency relationships by placing objects at different levels. Use hierarchical layouts to depict data dependencies.
Network Atlas 441
Orthogonal Emphasizes compact drawings and uses only horizontal and vertical edges. Objects are enlarged if necessary to provide enough space for edge connections. Use orthogonal layouts for maps that need to depict multiple clusters in a space-efficient manner. Tree Emphasizes parent and child relationships. Child objects are arranged farther from the root object than their parent objects. Use tree layouts for maps that have a central control object. Reorganize Moves all mapped objects back to the center of the map view. Arrange Labels Restores the default relative position of all object labels. To arrange map objects according to a layout style: 1. Click Edit. 2. Click an appropriate layout style from the AutoArrange group.
Map Properties
The Map Properties window allows you to configure options regarding the following aspects of your map: Setting the Map Up Status Threshold Overriding Account Limitations Setting the Map Up Status Threshold The UP status threshold is the percentage of map objects that must be in an up state on a given map for the map to be represented as up on the parent map. To set the percentage of map objects that determine Up status of a map: 1. Right-click any empty portion of the map, and then select Map Properties. 2. Slide the Map status will be UP slider to configure an appropriate up state threshold on the Map Properties page.
442 Network Atlas
Overriding Account Limitations For security reasons, you may wish to prevent web console users who have account limitations from seeing network nodes on the map they are not allowed to see. By hiding the restricted nodes and links, users with account limitations remain unaware that the nodes even exist. To hide nodes from users who have account limitations: 1. Right-click any empty portion of the map, and then select Map Properties. 2. Select Remove nodes that users do not have permission to view . If you choose to reveal restricted nodes to all users, all web console users can see the restricted nodes, but users with account limitations cannot retrieve any additional information about the restricted node. To reveal nodes to all users: 1. Right-click any empty portion of the map, and then select Map Properties. 2. Select Allow all users to view all nodes on this map . Note: A SolarWinds SAM user with account limitations, but who has permission to run and use the Network Atlas application, can change this setting in the map and see the presence of restricted nodes. Although the user cannot retrieve any information regarding the restricted nodes, this can still be considered a security risk. If this is a concern, do not give node management permissions to SolarWinds SAM users who have account limitations.
Network Atlas Settings

You can customize the default icon styles, map defaults, and node tree specifications from the Network Atlas Settings window. To open the Network Atlas Settings window, click the Network Atlas button ( and then click Network Atlas Settings. The following sections describe the options available in the Network Atlas Settings window. Connection Settings The options in this section allow you to select the default SolarWinds server details. ),
Network Atlas 443
Map Defaults The options in this section allow you to set a device threshold for the overall map status. The status indicator reflects the state of many objects at once; therefore, SolarWinds recommends that the map status be set at 100%. At this setting, when any device on a map or sub-map is down, the problem status will be indicated. Node Tree The options in this section allow you to customize the view of the node tree located on the left pane of the Network Atlas main window. Some users find it helpful to display the status icons of each node and interface, while others find the vendor network node and interface icons more useful. You may also specify that node names and/or IP addresses be included in the display. Graphic Styles The options in this section allow you to select the default graphical styles for Network Atlas. You can change the default style types for network objects, and you can select a color scheme for Network Atlas itself.
444 Network Atlas
Network Atlas Tooltip Variables

Many of the variables that are available for use in SolarWinds SAM alerts are also available for use in Network Atlas tooltips. These variables are dynamic, and they parse when the tooltip is opened. For example, the variable ${CPULoad} will parse with the current processor utilization of the node you are viewing. The following sections provide tables of variables corresponding to the types of objects you can map with Network Atlas. Notes: For more information about viewing and customizing Network Atlas tooltips, see Customizing SolarWinds Web Console Tooltips. In some cases, the table name may be required for alert variables, as in ${Nodes.Description}. The following tables provide the table name in listed variables when it is required. In earlier versions of Network Atlas, variables were referred to as macros.
Application Variables
The following application variables are valid for use in Network Atlas tooltips.
Variable ${ApplicationID} ${ApplicationTemplateID } ${JobId} ${Name} ${NodeID} ${Status} ${StatusDescription} ${UnManaged} Description Internal unique identifier of the application Internal unique identifier of the parent template Internal unique identifier of the SolarWinds Job Engine task associated with this application Application name Internal unique identifier of assigned node Numerical application status code. For more information see Status Icons and Identifiers in the SolarWinds Network Performance Monitor Administrator Guide. User friendly application status States if application is currently unmanaged
Application Component Monitor Variables

The following application component monitor variables are valid for use in Network Atlas tooltips.
Variable ${ApplicationId} ${ComponentId} ${ComponentType} Description Internal unique identifier of the associated application Internal unique identifier of the component Numerical component monitor type code. For more information, see Alerting and Reporting" on page 291.
Network Atlas 445

${Name} ${Status} ${StatusDescription} ${TemplateID} Component monitor name Numerical application status code. For more information see Status Icons and Identifiers in the SolarWinds Network Performance Monitor Administrator Guide. User friendly application status Internal unique identifier of the parent template
Date and Time Variables

The following date and time variables are valid for Network Atlas tooltips.
Variable ${AbreviatedDOW} ${AMPM} ${D} ${Date} ${DateTime} ${DayOfWeek} ${ DayOfYear} ${DD} ${H} ${HH} ${Last24Hours} ${Last2Hours} ${Last7Days} ${LastHour} ${LocalDOW} ${LocalMonthName} ${LongDate} ${M} ${MediumDate} ${Minute} ${MM} ${MMM} ${MMMM} ${S} ${Second} ${Time} ${Today} ${Year} ${Year2} Description Abbreviated current day of the week. AM/PM indicator Current day of the month Current date. (Short Date format) Current date and time. (Windows control panel defined Short Date and Short Time format) Current day of the week. Numeric day of the year Current day of the month (two digit number, zero padded) Current hour Current hour. Two digit format, zero padded. Time period: the last 24 hours Time period: the last 2 hours Time period: the last 7 days Time period: the last hour Current day of the week. Localized language format. Current month name in the local language. Current date. (Long Date format) Current numeric month Current date. (Medium Date format) Current minute. Two digit format, zero padded. Current month. Two digit number, zero padded. Current month. Three character abbreviation. Full name of the current month Current second. Current second. Two digit format, zero padded. Current Time. (Short Time format) Time period: today Four digit year Two digit year
446 Network Atlas

${Yesterday} Time period: yesterday
General Variables
The following general variables are valid for use in Network Atlas tooltips.
Variable ${Acknowledged} ${AcknowledgedBy} ${AcknowledgedTime} ${AlertTriggerCount} ${AlertTriggerTime} ${Application} ${Copyright} ${CR} ${ObjectName} ${Release} ${Version} Description Acknowledged status Who the alert was acknowledged by Time the alert was acknowledged Count of triggers Date and time of the last event for this Alert. (Windows control panel defined Short Date and Short Time) SolarWinds application information Copyright information Line Feed Carriage Return Description/Name of the object in the alert Release information Version of the SolarWinds software package
Node Variables
The following node variables are valid for use in tooltips.
Variable ${AgentPort} ${Allow64BitCounters} ${AvgResponseTime} ${BlockUntil} ${Caption} ${Community} ${CPULoad} ${CustomPollerLastStati sticsPoll} ${CustomPollerLastStati sticsPollSuccess} ${DateTime} ${Description} ${DNS} ${DynamicIP} ${EngineID} Description Node SNMP port number Node allows 64-bit counters (1), or not (0) Average node response time , in msec, to ICMP requests Day, date, and time until which node polling is blocked User friendly node name Node community string Node CPU utilization rate at last poll Day, date, and time of last poll attempt on node Day, date, and time that node was last successfully polled Current date and time. (Windows control panel defined Long Date and Long Time format) Node hardware and software Fully qualified node name If node supports dynamic IP address assignment via BOOTP or DHCP (1); static IP address return (0) Internal unique identifier of the polling engine to which node is assigned
Network Atlas 447

${External} ${GroupStatus} ${IOSImage} ${IOSVersion} ${IP_Address} ${LastBoot} ${LastSync} ${MachineType} ${MaxResponseTime} ${MemoryUsed} ${MinResponseTime} ${NextPoll} ${NextRediscovery} ${NodeID} ${NodeName} ${ObjectSubType} ${PercentLoss} ${PercentMemoryUsed} ${PollInterval} ${RediscoveryInterval} ${ResponseTime} ${RWCommunity} ${Severity} ${SNMPVersion} ${StatCollection} ${Status} ${StatusDescription} ${StatusLED} ${SysName} ${SysObjectID} ${SystemUpTime} ${TotalMemory} ${UnManaged} ${UnManageFrom} States if node is currently designated as external Filename of status icon for node and its interfaces Family name of Cisco IOS on node Cisco IOS version on node Node IP address Day, date and time of last node boot Time and date of last node database and memory synchronization Node manufacturer or distributor and family or version information Maximum node response time , in msec, to ICMP requests Total node memory used over polling interval Minimum node response time , in msec, to ICMP requests Day, date and time of next scheduled node polling Time of next node rediscovery Internal unique identifier of node Node hostname. Defaults to node IP address ${IP_Address} if hostname does not resolve. States if node supports SNMP or is ICMP-only ICMP packet loss percentage when node last polled Percentage of total node memory used over polling interval Node polling interval, in seconds Node rediscovery interval, in minutes Node response time, in milliseconds, to last ICMP request Node read/write community string; acts as security code for read/write SNMP access A network health score providing 1 point for an interface in a warning state, 1000 points for a down interface, and 1 million points for a down node. States the version of SNMP used by the node Statistics collection frequency, in minutes Numerical node status. For more information see Status Icons and Identifiers in the SolarWinds Network Performance Monitor Administrator Guide. User friendly node status Filename of node status icon String reply to SNMP SYS_NAME OID request Vendor ID of the network management subsystem in OID form. Clearly determines the type of node. Time, in hundredths of a second, since monitoring started Total node memory available States if node is currently unmanaged Day, date, and time when node is set to Unmanaged
448 Network Atlas

${UnManageUntil} ${Vendor} ${VendorIcon} Day, date, and time when node is scheduled to be managed Node manufacturer or distributor Filename of node vendor logo icon
Volume Variables
The following volume variables are valid for use in Network Atlas tooltips.
Variable ${Caption} ${FullName} ${LastSync} ${NodeID} ${Status} ${StatusLED} ${VolumeAllocationFailuresThisHour} ${VolumeAllocationFailuresToday} ${VolumeDescription} ${VolumeID} ${VolumeIndex} ${VolumePercentUsed} ${VolumeResponding} ${VolumeSize} ${VolumeSpaceAvailable} ${VolumeSpaceUsed} ${VolumeType} ${VolumeTypeIcon} Description User friendly volume name User friendly volume name including captions of parent node and interface Time and date volume last synchronized in database and memory models Internal unique identifier of parent node Numerical volume status: (0=Unknown, 1=Up, 2=Shutdown, 3=Testing) Filename of volume status icon Number of volume allocation errors for this volume in last hour Number of volume allocation errors for this volume in current day User friendly volume description Internal unique identifier of volume Unique index of volume within the parent node Percentage of volume currently in use (Y) = volume is currently responding to SNMP queries Size of volume, in bytes Total space available on volume, in bytes Total space used on volume, in bytes Volume type, as reported by hrStorageType OID (Removable Disk/Fixed Disk/Compact Disc/Virtual Memory/RAM/etc) Filename of icon for volume type
Wireless Variables
The following wireless variables are valid for use in Network Atlas tooltips.
Variable ${WirelessAP} ${ WirelessLastStatPoll } Description States if node is being polled by the wireless poller (1) or not (0) Date and time node last polled by wireless poller
Network Atlas 449

${ WirelessPollInterval } ${ WirelessStatBlockUntil } Interval, in minutes, between wireless polling attempts on node Date and time node may be polled again by wireless poller
Group Variables
The following group variables are valid for use in Network Atlas tooltips.
Variable ${ContainerID} ${DetailsURL} ${Frequency} ${IsDeleted} Description Designated identifier for a mapped group URL of the Group Details view for a mapped group Interval on which group membership is evaluated and group snapshots are taken. When a group is marked for deletion, it is not deleted immediately. If a group is marked for deletion but not yet deleted, ${IsDeleted} returns 1. The date and time of the last change made to the definition of a group. This does not include changes made to group members resulting from dynamic queries. The name assigned to the mapped group SolarWinds product appropriate to the mapped group type Name of roll-up logic calculator that evaluates status of the mapped group based on member statuses. 0 = Mixed, 1 = Worst, 2 = Best. The Worst method reports group status as the worst status of any of its members. The Mixed method reports group status as Warning when members are of multiple different statuses. The Best method reports group status as the best status of any of its members. Status of the mapped group. For more information, see Managing the Display of Group Status in the SolarWinds Common Components Administrator Guide. Name of roll-up logic calculator that evaluates status of the mapped group based on member statuses. 0 = Mixed, 1 = Worst, 2 = Best. The Worst method reports group status as the worst status of any of its members. The Mixed method reports group status as Warning when members are of multiple different statuses. The Best method reports group status as the best status of any of its members. Uri used by SolarWinds Information Service (SWIS) to refer to the selected group member within the web console. URL of the Group Details view for a mapped group
${LastChanged} ${Name} ${Owner}
${RollupType}
${Status}
${StatusCollector}
${Uri} ${WebUri}
For a complete list of SAM specific variables, "Configuring SolarWinds SAM Alerts" on page 292.
450 Network Atlas
Chapter 21
Managing the SolarWinds SAM Database

All SolarWinds network monitoring and management products use a Microsoft SQL Server database to store web console settings and collected network performance and configuration data. The following database utilities are packaged with SolarWinds products to help you manage your SolarWinds database. Database Manager Allows you to perform queries, edit database values, export data, and perform database repair and compaction on your SolarWinds database. For more information, see Using Database Manager on page 451. Database Maintenance Allows you to summarize, clean, and compact your SolarWinds database. For more information, see Database Maintenance on page 461. The database SolarWinds uses is hosted on a Microsoft SQL Server. When installing SQL Server, you have the option of installing the SQL Server Management Studio. If you are the database administrator for the SQL Server hosting your SolarWinds database, SolarWinds generally recommends that you install this utility as it provides a number of features that are not currently available in the SolarWinds Database Manager. For more information, see Using SQL Server Management Studio on page 458. Note: SolarWinds Network Configuration Manager maintains its own additional database for device configurations and user activity logging.
Using Database Manager

The Database Manager can be used to perform queries, view database and table details, export data, and edit database values. You may also repair, compact, restore, or backup the database from the Database Manager application. The following procedures present some of the basic database management operations that are available with Database Manager.
Adding a Server
If you have not already designated a database for use with SolarWinds as a backup or supplement, use the following steps to add a SQL server to the Database Manager. Once added, your selected server and associated databases display in the tree structure in the left pane of Database Manager.
Managing the SolarWinds SAM Database 451
To add a SQL server to Database Manager: 1. Click Start > All Programs > SolarWinds > Advanced Features > Database Manager. 2. Click File > Add Server. 3. Select from the SQL Server list or enter the IP address of the SQL server. 4. Select the login style. Note: You may choose to Log in using Windows NT Integrated Security to automatically pass the Windows user ID and password to the SQL server, or select Log in using an SQL Server userid and password to use a separate login. Upon selecting the latter option, the window changes to provide fields to enter the separate SQL Server User Name and Password that you want to use. 5. Click Connect to Database Server.
Creating Database Backups

You should periodically back-up your databases. For more information about scheduling regular database backups, see Creating a Database Maintenance Plan on page 457. The following procedure is used to back-up your databases in Database Manager. To back-up a database in Database Manager: 1. Click Start > All Programs > SolarWinds > Advanced Features > Database Manager. 2. If the SQL Server hosting your SolarWinds database is not listed in the left pane, you must add the SQL Server hosting your SolarWinds database. For more information, see Adding a Server on page 451. 3. Click + to expand the SQL Server hosting your SolarWinds database.. 4. Right-click the name of the database you want to back-up, and then click Backup Database. 5. Provide a Description of the database backup. 6. Specify a path for the Backup Filename either by clicking Browse () and navigating to the location or by entering the path directly. Note: Typically, the default backup location for a SolarWinds database is designated as C:\Program Files\SolarWinds\. Ensure that the target location for the database backup has sufficient available disk space. 7. Select either Append to the end of the Backup File or Overwrite Backup File, as appropriate, and then click Ok.
452 Managing the SolarWinds SAM Database
Restoring a Database
The following steps restore a database that you have backed up. To restore a database from backup: 1. Click Start > All Programs > SolarWinds > Advanced Features > Database Manager. 2. If the SQL Server hosting your SolarWinds database is not listed in the left pane, you must add the SQL Server hosting your SolarWinds database. For more information, see Adding a Server on page 451. 3. Click + in the left pane to expand the SQL Server hosting your SolarWinds database, and then click your SolarWinds database. 4. Click Database > Restore Database. 5. Click Browse () to navigate to the database that you want to restore, or enter a valid SQL backup database name and path. Note: Typically, the default location for a SolarWinds database backup is C:\Program Files\SolarWinds\. 6. Click Verify to ensure that you have selected a valid SQL database. Notes: When you select a database, the remaining fields are completed for you. The Database Name field is populated with the name that SQL Server uses to refer to the specified database. The remaining two fields display the data ( .mdf) and transaction log (.ldf) files for the database. You can change the values provided. Database Manager does not create directories. You may only specify a path that already exists. You also cannot restore a database that is currently in use. 7. Click Ok to restore the selected database.
Compacting your Database

Compacting a database shrinks it, re-indexes it, and removes whitespace. You can compact a database by performing the following steps. To compact a database with Database Manager: 1. Click Start > All Programs > SolarWinds > Advanced Features > Database Manager.
2. If the SQL Server hosting your SolarWinds database is not listed in the left pane, you must add the SQL Server hosting your SolarWinds database. For more information, see Adding a Server on page 451. 3. Click + in the left pane to expand the SQL Server hosting your SolarWinds database, and then click your SolarWinds database. 4. Click Database > Compact Database. Note: Upon completion, Database Manager displays a window comparing the size of the database before and after compaction. If the sizes are the same, there may not be enough free space in the database to rearrange data. If you need to free up more space for database compaction to occur, see Compacting Individual Tables on page 454.
Compacting Individual Tables

If you are not able to perform a full database compaction due to limited server disk space, you can compact database tables individually, using the Database Manager application, as shown in the following procedure. To compact individual tables: 1. Click Start > All Programs > SolarWinds > Advanced Features > Database Manager. 2. If the SQL Server hosting your SolarWinds database is not listed in the left pane, you must add the SQL Server hosting your SolarWinds database. For more information, see Adding a Server on page 451. 3. Click + in the left pane to expand the SQL Server hosting your SolarWinds database, and then click your SolarWinds database. Note: SolarWinds Orion is the default name of the SolarWinds database. 4. Click a table to compact in the expanded database, and then click Table > Compact/Rebuild Indexes.
Viewing Database Details

The Database Details window in Database Manager presents two tabs that display property and tables information about a selected database. The following procedure is a guide to the information that is available in the Database Details window.
To view database details: 1. Click Start > All Programs > SolarWinds > Advanced Features > Database Manager. 2. If the SQL Server hosting your SolarWinds database is not listed in the left pane, you must add the SQL Server hosting your SolarWinds database. For more information, see Adding a Server on page 451. 3. Click + in the left pane to expand the SQL Server hosting your SolarWinds database, and then click your SolarWinds database. Note: SolarWinds Orion is the default name of the SolarWinds database. 4. Click Database > Database Details. Notes: The Properties tab provides general statistics and descriptions of the selected database. The Tables tab shows a list of the tables in the selected database and their respective sizes. 5. If the Last Backup field on the Properties tab is blank, you have not generated a backup of the selected database. For more information about scheduling a recommended regular database backup, see Creating a Database Maintenance Plan on page 457.
Viewing Table Details

The Database Manager Table Details window provides property, column, and index information about the selected table. You can also query the selected table directly from the Table Details window., as shown in the following procedure. To view table details: 1. Click Start > All Programs > SolarWinds > Advanced Features > Database Manager. 2. If the SQL Server hosting your SolarWinds database is not listed in the left pane, you must add the SQL Server hosting your SolarWinds database. For more information, see Adding a Server on page 451. 3. Click + in the left pane to expand the SQL Server hosting your SolarWinds database, and then click + to expand your SolarWinds database. Note: SolarWinds Orion is the default name of the SolarWinds database. 4. Click a table to view in the expanded database.
5. Click Table > Table Details. Note: The Properties tab includes general statistics relating to the table size and creation date; the Columns tab describes the columns in the table, table keys, and field types; and the Indexes tab lists indexes used within the table. 6. If you want to query the open table, click Query in the tool bar. Warning: Special care should be taken while editing database values as you can easily compromise the integrity of your database. For more information, see Editing Database Fields on page 456. Note: A default SQL statement is provided, as well as radio buttons for displaying the data in read or read/write view.
Editing Database Fields

Database fields may be edited within the Database Manager application from the query view. The following procedure directs you in editing database fields in SolarWinds Database Manager. Warning: Be very careful when you are editing database values, as you can jeopardize the integrity of your database. To edit database fields with Database Manager: 1. Stop the SolarWinds Network Performance Monitor service as follows: a. Click Start > All Programs > SolarWinds > Advanced Features > Orion Service Manager b. Click SolarWinds Network Performance Monitor under Services, and then click Stop. 2. Click Start > All Programs > SolarWinds > Advanced Features > Database Manager. 3. If the SQL Server hosting your SolarWinds database is not listed in the left pane, you must add the SQL Server hosting your SolarWinds database. For more information, see Adding a Server on page 451. 4. Click + in the left pane to expand the SQL Server hosting your SolarWinds database, and then click + to expand your SolarWinds database. Note: SolarWinds Orion is the default name of the SolarWinds database. 5. Click a table to view in the expanded database. 6. Click Table > Query Table. 7. Use the provided SQL statement or enter your own in the query field. 8. If you want to view the query results in table view, click Refresh.
9. If you want to edit table fields, select Read/Write at the top of the window, and then edit fields as necessary. 10. If you use the same SQL query often, you can save time by making the query a favorite, as follows: a. Enter the query in the query field. b. Click Add to Favorites. c. Enter a name for the command, and then click Ok. Note: Database Manager saves the command with the name that you have provided. You can now use this command again, directly, by clicking Paste from Favorites.
Detaching a Database
Detaching a database removes its reference from the SQL Server, allowing you to safely move files to different locations. Database Manager allows you to detach a database and leave the data files of a database intact, as shown in the following procedure. Note: SolarWinds does not recommend using the Detach Database option to migrate a database from one SQL Server to another. For more information, see Migrating your Database on page 462. To detach a database: 1. Click Start > All Programs > SolarWinds > Advanced Features > Database Manager. 2. If the SQL Server hosting your SolarWinds database is not listed in the left pane, you must add the SQL Server hosting your SolarWinds database. For more information, see Adding a Server on page 451. 3. Click + in the left pane to expand the SQL Server hosting your SolarWinds database, and then click your SolarWinds database. Note: SolarWinds Orion is the default name of the SolarWinds database. 4. Click Database > Detach Database from the menu.
Creating a Database Maintenance Plan

Using Database Manager, you can create a database maintenance plan that will automatically compact and backup the database on a scheduled basis. As a security and information integrity issue, it is very important to regularly back-up your databases. Database Manager allows you to do this easily, using the following steps.
Note: SQL Server Agent must be running to execute database maintenance. To create a database maintenance plan: 1. Click Start > All Programs > SolarWinds > Advanced Features > Database Manager. 2. If the SQL Server hosting your SolarWinds database is not listed in the left pane, you must add the SQL Server hosting your SolarWinds database. For more information, see Adding a Server on page 451. 3. Click + in the left pane to expand the SQL Server hosting your SolarWinds database, and then click your SolarWinds database. Note: SolarWinds Orion is the default name of the SolarWinds database. 4. Click Database > Database Backup Schedule. 5. Select to run the backup either once a Day or once a Week. 6. If you to want to run the backup once a week, choose the Backup Day. 7. Set the Backup Time. 8. Click Next. 9. If you want to compact and shrink the database before the backup, check Compact and Shrink Database before Backup. Note: SolarWinds recommends both that you perform database compaction weekly and that you compact and shrink databases before backups. 10. Enter the path to the directory where you would like to place backup files or click Browse () and then navigate to an appropriate directory. 11. If you want to keep backup reports, check Generate a backup report each time the backup Job runs, and then enter the path to the directory where you would like to Place Backup reports or click Browse () and then navigate to an appropriate directory. 12. Click Finish.
Using SQL Server Management Studio

If you have a licensed, Standard or Enterprise Edition copy of SQL Server 2005 or 2008 with SQL Server Management Studio installed, you can use it to maintain your SolarWinds SAM database. The following procedure is a basic guide to configuring a daily SolarWinds database maintenance plan in SQL Server Management Studio.
Notes: Your specific environment may require additional configuration. You may need to contact your database administrator to gain access to SQL Server Management Studio for your SolarWinds database. The following procedure clears historical maintenance records and creates a backup of your SolarWinds database. In general, however, SolarWinds recommends that you contact your database administrator and reference the Microsoft documentation provided with SQL Server for instructions on using SQL Server Management Studio to manage your SolarWinds database.
To use SQL Server Management Studio to manage your SolarWinds database: 1. Click Start > Microsoft SQL Server > SQL Server Management Studio. 2. Click View > Object Explorer. 3. Expand the SQL Server instance containing your SolarWinds database in the Object Explorer pane on the left. Note: Expand the Databases folder for any instance to confirm included databases. By default, the SolarWinds database is named SolarWinds Orion. 4. Expand the Management folder, right-click the Maintenance Plans folder, and then click Maintenance Plan Wizard. 5. Click Next to start the SQL Server Maintenance Plan Wizard. 6. Provide an appropriate Name and Description for your maintenance plan. 7. Click Browse () next to the Server field. 8. Check your SQL Server\Instance, and then click Ok. Note: If your SQL Server\Instance is not in the list, provide it manually. 9. Select the authentication type that is used to connect to the SQL server, and, if required, provide appropriate User name and Password credentials. Note: Use the same authentication type and credentials you provided in the SolarWinds Configuration Wizard to access your SolarWinds database. 10. Check Clean Up History and Back Up Database (Full) Note: When a task is clicked, the Maintenance Plan Wizard provides a brief task description. 11. Click Next. 12. Set the order of task execution, top to bottom, by selecting tasks and clicking Move Up and Move Down as needed.
Note: The following steps assume the Clean Up History task precedes the Back Up Database (Full) task. 13. Click Next when the task execution order is set. 14. On the Define Cleanup History Task view, check the types of historical data to delete, and then set the threshold age for historical data removal. 15. Click Next. 16. On the Database Back Up (Full) view, complete the following steps: a. Click the Databases field. b. Select These databases. c. Check your SolarWinds database. 17. Click Ok. 18. Select Database in the Backup component area. 19. In the Destination area, complete the following steps: a. Select Disk. b. Select Create a backup file for every database. c. Click Browse () to select an appropriate database backup file destination with sufficient free space. 20. Click Next. 21. On the Select Plan Properties view, click Change. 22. Configure the database maintenance job schedule as follows: a. Provide an appropriate Name for the new job schedule. b. Select Recurring as the Schedule type. c. Check Enabled, and then select Daily in the Occurs field. d. Provide an off-peak network usage time in the Occurs once at field. e. Select a Start date, and then select No end date. 23. Click Ok. 24. Click Next, and then check Write a report to a text file. 25. Click Browse () to select an appropriate maintenance report file destination. 26. Review wizard results, click Finish, and then, when the wizard successfully finishes, click Close.
For additional help with using SQL server Management Studio, visit the Microsoft Support Website at http://support.microsoft.com.
Database Maintenance
The primary tasks that are available for maintaining a SQL database are data summarization and database compaction. Data summarization occurs automatically as a part of the nightly maintenance program. You can also run database maintenance on demand from the Windows Start menu.
Running Database Maintenance

Database maintenance performs a series of data summarizations that help you optimize the size of your SolarWinds database. Data summarization consists of gathering all the collected network data for a defined period of time, calculating statistics from the data, and then discarding the data itself while retaining the statistics. By regularly running database maintenance, you can realize significant space savings and performance improvements. Database maintenance can either be run directly from the Start menu, or scheduled for a set Archive Time and initiated from the SolarWinds Polling Settings view in the SolarWinds Web Console. In either case, once started, database maintenance normally proceeds without further attention. For more information about setting the Archive Time for database maintenance on the SolarWinds Polling Settings view, see Orion Polling Settings on page 194. The following procedure provides the steps to perform Database Maintenance: Note: Administrative privileges are required to run Database Maintenance. To run the Database Maintenance utility: 1. If you want to run database Maintenance from the SolarWinds Web Console, complete the following steps: a. Click Settings in the top right of the web console, and then click Polling Settings in the Settings group. b. Select the Archive Time field in the Database Settings area and adjust the time accordingly, then click Submit. (Note: If you want to run this utility immediately, set the time to one minute in the future). 2. If you want to run database Maintenance from the Start menu, click Start > All Programs > SolarWinds > Advanced Features > Database Maintenance, and then click Start.
Migrating your Database

If you are modifying your SolarWinds SAM implementation to use a different database server, you can migrate data from one SolarWinds database to another. Both the database from which you export data and the database into which you want to import data must be from the same version of SolarWinds. Warning: You will not lose Web Console customizations when you overwrite your website, unless you have manually overwritten or modified the HTML within the .asp pages. Note: Do not skip tabs or deviate from the tab order. Click Start, and then click Continue to complete the wizard in order. Completing tabs out of order may adversely affect the install process. To export data from one SolarWinds database and import it into another: 1. Connect to your database server with Database Manager. For more information, see Adding a Server on page 451. 2. Select your database, and then click Database > Backup Database. 3. Enter a Description of the database backup. 4. Enter a path or click Browse () and then navigate to a Backup Filename. 5. Click Ok. 6. Copy the newly created backup file to a folder on the new server. Note: The backup file is named after your SolarWinds database and given a .bak extension. For example, if you have designated OrionDB as the name of your SolarWinds database, the backup is named OrionDB.bak. 7. Click Start > All Programs > SolarWinds > Advanced Features > Database Manager. 8. Click Add Server. 9. Select the name of the SQL instance from the SQL Server list. If your server is not listed, complete the procedure in Adding a Server on page 451. 10. Select the appropriate authentication type, and then click Connect to Database Server. 11. Select your new server in the list, and then click Server > Connect to Server. 12. Click Server > Restore Database. 13. Enter the path to the database backup file on the server or click Browse () and then navigate to the location of the database backup file. 14. Click Ok.
15. Close the Database Manager. 16. Click Start > All Programs > SolarWinds > Configuration and AutoDiscovery > Configuration Wizard. 17. Specify the newly restored database in the Database Setup section of the wizard. 18. When prompted, click Yes to use the existing database.
Chapter 22
Creating Custom Properties

All SolarWinds product installations have access to the Custom Property Editor, which allows you to add a custom property to any monitored device. Custom properties are additional fields, such as country, building, asset tag, or serial number, that you can define and store in your SolarWinds database. After properties are added, they are available for display and filtering both within the SolarWinds Web Console and within the Report Writer application. A few more examples of how custom properties may be used are as follows: Add information to nodes, such as contact, owner, or support contract. Add a custom property that is used as an account limitation on nodes. Add a custom property to nodes for grouping them on the web or in a report. Add a custom property and display it as an annotation on a chart.
Custom Property Editor lets you choose from a provided collection of the most commonly used properties, or you can easily and efficiently build your own custom properties. For more information, see Creating a Custom Property on page 465. Once your custom property is defined, the Import Wizard allows you to populate your new property from either a text- or comma-delimited file. For more information, see Importing Custom Property Data on page 467. Alternatively, if you only have a few individual changes or additions, you may choose to make those changes using the Edit view. For more information, see Editing Custom Properties on page 468.
Creating a Custom Property

The following procedure provides steps required to create a custom property using the Custom Property Editor. To create a property with Custom Property Editor: 1. Click Start > All Programs > SolarWinds > Grouping and Access Control > Custom Property Editor. 2. Click Add Custom Property.
Creating Custom Properties 465
3. If you want to add predefined properties, complete the following procedure: a. Select Add Predefined Properties. b. Check Show Advanced Properties to view additional predefined properties. c. Check the properties you want to add, and then click Ok. 4. If you want to generate a completely new custom property, complete the following procedure: a. Select Build a Custom Property from scratch. b. Select the SolarWinds database table to which you want to add the new custom property. c. Provide the new Property Name. Notes: To ensure full custom property functionality, do not leave the Property Name field empty. Although most non-alphanumeric characters used in custom property names are replaced by underscores (_) when names are stored in the SolarWinds database, SolarWinds recommends against using non-alphanumeric characters in custom property names. Hash characters (#) are not allowed in any property name. d. Select the Property Type. e. Enter a Max. Text length. Note: Regardless of the value provided in this field, SolarWinds SAM does not support custom properties defined with more than 4000 characters. f. Click Ok.
Removing a Custom Property

Custom properties are easily removed using the Custom Property Editor, as shown in the following procedure. To remove a custom property: 1. Click Start > All Programs > SolarWinds > Grouping and Access Control > Custom Property Editor. 2. Click Properties > Remove Custom Properties.
466 Creating Custom Properties
3. Check each property you want to remove. 4. If you are satisfied with your selections, click Ok.
Importing Custom Property Data

Once you have defined custom properties, the Custom Property Editor Import tool assists in populating the custom property data. For example, you may already possess a spreadsheet listing the asset tags of all your network nodes, and you would like to have this information available for reporting and publication in the web console. In this scenario, Asset Tag is added as a custom property, and then the import wizard is used to populate the asset tag values from the spreadsheet. The following steps outline the process for importing custom properties data. For more information, see Creating Custom Properties on page 465. To import custom property data: 1. Click Start > All Programs > SolarWinds > Grouping and Access Control > Custom Property Editor. 2. Click File > Import, and then select Import from Comma Delimited File or Import from Text File as appropriate. 3. Navigate to the file that contains your custom property data. 4. Select the file that contains your custom property data, and then click Open. 5. Select the delimiter that separates the data in your file. 6. If your data file contains a header row, check First row contains field names. 7. Specify the characters that may surround text fields in your file, and then click Next. 8. Select the data table that has the custom properties into which you want to import your data, and then click Next. 9. Use the drop down menus to select the key field from your file on the left and the corresponding field of the table on the right. Note: Depending on your file data, you may need to specify multiple key fields so that the import wizard properly matches your data to the table fields. 10. Click Next. 11. Specify the fields from your file on the left that you want to import by clicking corresponding blank cell on the right, and then select the target field that you want your data field to populate.
Note: Click the cell to enable a menu. Use the menu items to select the target field that you want your data to populate. 12. If you have specified all cell matches between your data and the SolarWinds database, click Import. 13. If your import is successful, confirm the count of successfully imported rows, and then click Ok.
Custom Property Editor Settings

The Custom Property Editor Settings window allows you to customize the display for nodes and volumes. To configure Custom Property Editor settings: 1. Click Start > All Programs > SolarWinds > Grouping and Access Control > Custom Property Editor. 2. Click File > Settings. 3. Click Node Editing and check the system properties you want to see in the Edit Node Properties window. Repeat for Volume Editing. 4. If you want to enable Auto-Search, click Auto-Search, and then check Enable Auto-Search. Note: With Auto-Search enabled, the current column is searched as you type. Select a cell and then press Enter to edit its contents. With AutoSearch disabled, typing will begin editing the cell.
Editing Custom Properties

The Custom Property Editor allows you to easily modify custom properties. To edit a custom property: 1. Click Start > All Programs > SolarWinds > Grouping and Access Control > Custom Property Editor. 2. Click Properties > Edit Object Properties, where Object is Node or Volume, as appropriate. 3. Click the cells in the table that you want to edit, and then enter or modify the cell contents, as necessary. 4. If you want to create or edit a filter for your custom properties, click No Active Filter or Filter Active, and then define the filter that you want to apply. For more information, see Using Filters in Edit View on page 469. 5. If you are satisfied with your edits, click Ok.
Using Filters in Edit View

Filtering is available in the Edit Custom Properties windows for all devices, and you can apply filters to manipulate available data views. Custom Property Editor allows you to edit the text within custom property fields to which a filter is applied. The following procedures show how to use filters within Custom Property Editor.
Creating Custom Properties Filters

The following procedure creates a custom properties filter. To create a filter: 1. Click Start > All Programs > SolarWinds > Grouping and Access Control > Custom Property Editor. 2. Click Properties > Edit Object Properties, where Object is Node or Volume, as appropriate. 3. Click Filter Active or No Active Filter, and then click Apply Filter. Note: The text of the Filter Active / No Active Filter button changes dynamically, indicating the filter status for the currently viewed data. 4. Click the hyperlinked text to select the appropriate criteria. 5. Click the ellipsis, and then select from the following options: Note: The lists of available linked descriptors are dynamically generated in consideration of all other variables within the same condition. For more information, see Understanding Condition Groups on page 316.Click Browse () to select a condition type. Select Add a new elementary condition to generate a condition that is based on a direct comparison of network object data fields. Select Add a new advanced elementary condition to generate a condition based on a comparison of device data fields and values. Select Add a new complex condition to define a condition that filters other defined conditions. Select Delete current condition to remove a selected condition. Select Move current condition forward or Move current condition backward to change the order of your conditions accordingly. 6. Continue to click hyperlinked text and use the cascading menus to select filtering criteria. 7. If you have completed the configuration of your filter, click Ok. Note: The Edit Object Properties view changes, based upon the selected
filter, and the text of the Filter Active / No Active Filter now displays Filter Active, indicating that the filter is being applied to the currently viewed properties.
Removing Custom Properties Filters

The following procedure removes a custom properties filter. To remove a filter: 1. Click Start > All Programs > SolarWinds > Grouping and Access Control > Custom Property Editor. 2. Click Properties > Edit Object Properties, where Object is Node or Volume, as appropriate. 3. Click Filter Active, and then click Remove Filter. Note: The Edit Object Properties view now displays all custom properties.
Appendix A
Additional Polling Engine and Web Console

Installing additional pollers and Web Consoles help you extend your SolarWinds Server & Application Monitor (SAM) implementation. You can install additional polling engines to aid you in load balancing and configure additional websites to ensure redundant access through more than one web server. By sharing the same database, you can also share a unified user interface, making the addition of polling engines transparent to your staff. The following sections provide descriptions and installation procedures for adding polling engines and websites. These components are licensed and purchased separately from your main SolarWinds Server & Application Monitor install and require the installation of the SolarWinds SAM Additional Polling Engine. For more information about purchasing licenses, contact your sales representative (sales@solarwinds.com) or customer service. Refer to the following sections for more information: Understanding How Polling Engines Work Requirements for Installing an Additional Polling Engine Installing an Additional Polling Engine Installing an Additional Web Console
Understanding How Polling Engines Work

Before you install an additional SolarWinds Server & Application Monitor (SolarWinds SAM) polling engine, review the following sections and ensure you understand how SolarWinds SAM polls when first installed and how SolarWinds SAM additional polling engines work. Refer to the following sections for more information: SolarWinds SAM is Poller-Unaware By Default SolarWinds SAM Additional Polling Engines are Poller-Aware
Additional Polling Engine and Web Console 471
SolarWinds SAM is Poller-Unaware By Default

When you install SolarWinds SAM on your SolarWinds server, SolarWinds SAM is poller-unaware. This means that SolarWinds SAM can poll all nodes that are monitored by SAM.
472 Additional Polling Engine and Web Console
SolarWinds SAM Additional Polling Engines are PollerAware

After you install an additional SolarWinds SAM polling engine and set the Polling Engine Mode on the SolarWinds SAM Server to Poller-Bound, the additional polling engines as well as the main polling engine on the SolarWinds SAM server become poller-aware. Poller-aware means each polling engine, including the SolarWinds SAM server, polls only those nodes assigned to it.
The SolarWinds Module Engine must also be restarted before the Polling Engine Mode setting takes effect. For more information, see To configure the additional polling engines to be poller-aware: on page 475.
Nodes are assigned to particular polling engines by selecting the desired Polling Engine when adding a node using the Add Node wizard. Note: The option to select the Polling Engine when adding a node is not displayed until the Polling Engine Mode is set to Poller-Bound. An additional method for assigning nodes to polling engines is to use the Poller Load Balancing option in the Monitor Polling Engines tool. For more information, see To assign nodes to polling engines: on page 476.
Requirements for Installing an Additional Polling Engine

System requirements for adding an additional polling engine are the same as for installing SolarWinds SAM. For more information about SolarWinds SAM requirements, refer to Requirements for Orion Common Components on page 7 and Additional SolarWinds SAM Requirements on page 10.
Installing an Additional Polling Engine

Download the special installation package for SolarWinds SAM additional polling engines (SolarWinds-Orion-APM-vx.y.z-Poller.exe, where x is the major release number, y is the minor release number, and z is the point release number) to the server where you want to install the additional polling engine. Note: You will find the SAM installer for the additional polling engine packaged in the following product in your customer portal: SolarWinds Additional Polling Engine v2011.1. Note: After completing the following procedure, SolarWinds SAM polling engines emulate the same behavior as SolarWinds NPM additional polling engines. They monitor only those applications on nodes associated with the SolarWinds SAM additional polling engine. To install the additional polling engine: 1. Log on with a Windows administrator account to the server where you want to install the additional polling engine. 2. Run the installer for the SolarWinds SAM Poller downloaded abovethe installer automatically detects the SolarWinds NPM additional polling engine if present and, in this case, only installs SolarWinds SAM to an existing installation so that the additional polling engine will be usable for both SolarWinds SAM and SolarWinds NPM. 3. Review the Welcome page, and then click Next. 4. Accept the license agreement, and then click Next.
5. Chose a destination location (or accept the default), and then click Next. 6. Click Next to start copying files. 7. Click Finish to complete the Installation Wizard. 8. Click Enter Licensing Information to enter your license, or click Continue Evaluation. 9. Review the Configuration Wizard Welcome page, and then click Next. 10. Configure the database for your environment by selecting the appropriate SQL Server database and Authentication information, and then click Next. 11. Configure the database by selecting Use an existing database, and then selecting the name of the SQL Server database for the SolarWinds SAM server. Then click Next. 12. Select whether to Create a new account, or Use an existing account, and then enter the account information. Then click Next. 13. If the Website Settings page is displayed, configure the IP Address, Port, and Website Root Directory as appropriate and select whether you want to enable automatic login. Then click Next. 14. Ensure that all the services displayed in the Service Settings page are checked, including the SAM Job Engine Plug-in, and then click Next. 15. Review the Configuration wizard Summary page, and then click Next. 16. Click Finish to complete the Configuration Wizard. To configure the additional polling engines to be poller-aware: 1. If this is the first additional poller you have installed, complete the following procedure: a. Log on to your SolarWinds Web Console with an Administrator account. b. Click the Applications tab. c. Click SAM Settings. d. Click Data and Database Settings. e. Select Poller-Bound as the Polling Engine Mode. f. Click Submit.
g. Log on to the SolarWinds SAM server with a Windows administrator account. h. Click Start > All Programs > SolarWinds > Advanced Features > Orion Service Manager. i. Select SolarWinds Module Engine, and then click Restart.
j.
If you encounter any issues with the additional polling engine, rerun the Configuration Wizard on the SolarWinds SAM server.
To assign nodes to polling engines: You can assign nodes to the polling engines by selecting the desired Polling Engine in the Add Node wizard. You can also perform Poller Load Balancing using the Monitor Polling Engines tool to assign nodes to polling engines. Click Start > All Programs > SolarWinds > Advanced Features > Monitor Polling Engines. Then click Servers > Poller Load Balancing to display a dialog where you can assign nodes to particular polling engines. For more information, see Understanding How Polling Engines Work" on page 471.
Installing an Additional Web Console

Download the special installation package for SAM additional web consoles (SolarWinds-Orion-APM-vx.y.z-WebOnly.exe, where x is the major release number, y is the minor release number, and z is the point release number) to the server where you want to install the additional web console. Note: You will find the SAM installer for the additional web console packaged in the following product in your customer portal: SolarWinds Additional Web Server v2011.1. TCP port 17777 must be open on both the SolarWinds SAM server and the website. Ensure you schedule an appropriate maintenance window in which to install the additional Web Console. To install the additional Web Console: 1. Log on to your current SolarWinds SAM additional Web Console server with a Windows administrator account. 2. Run the SolarWinds SAM installerthe installer automatically detects the SolarWinds SAM Additional Web Console if present. 3. Review the Welcome page, and then click Next. 4. Accept the license agreement, and then click Next. 5. Choose a destination location (or accept the default), and then click Next. 6. Click Next to start copying files. 7. Click Finish to complete the Installation Wizard. 8. Review the Configuration Wizard Welcome window, and then click Next.
9. Specify the appropriate information on the Database Settings window, and then click Next. 10. Specify the appropriate database to use, and then click Next. Ensure you have stopped your polling engines before continuing. 11. Specify the appropriate database account on the Database Account window, and then click Next. 12. Select the IP address, port, and Website root directory on the Website Settings window, and then click Next. 13. Review the configuration summary, and then click Next. 14. Click Finish to complete the Configuration Wizard. Copying the Default Reports Additional Web Console installations do not include the default SAM reports. To ensure your default SAM reports are available on your Additional Web Console install, copy the Reports folder to your Additional Web Console server. This folder is typically C:\Program Files\SolarWinds\Orion\Reports.
Appendix B
Status Icons and Identifiers

The following table lists SAM icons with associated status indications.
Icon Status Indication Application is Up Application s in a Warning state Application is in a Critical state Application is Down Application is in an Unknown state Component is Up Component is in a Warning state Component is in a Critical state Component is Down Component is in an Unknown state
Status Icons and Identifiers 479
480 Status Icons and Identifiers
Appendix C
SolarWinds Variables and Examples

SolarWinds SAM product components, including the Advanced Alert Manager, both the Traps Viewer and the Syslog Viewer, and Network Atlas can employ SolarWinds variables. These variables are dynamic and, in the case of alerts, parse when the alert is triggered or reset. For example, the variable ${ResponseTime} will parse with the current response time of the node that is triggering the alert. Note: In some cases, the database table name may be required for alert variables, as in ${Nodes.CPULoad}. If a variable does not respond as intended, include the relevant table name for the desired variable.
Variable Modifiers
The variables in the following sections can be modified by appending any of the variable modifiers in the following table.
Variable Modifier -Raw -Previous -Cooked -PreviousCooked Description Displays the raw value for the statistic. For example, if Transmit Bandwidth is set to 10 Mbps, then the raw value would be10000000. The cooked value would be 10 Mbps. Displays the previous value for the statistic before the Alert was triggered Displays the cooked value for the statistic. For example, if Transmit Bandwidth is set to 10 Mbps, then the raw value would be 10000000 and cooked value would be 10 Mbps. Displays the previous cooked value for the statistic before the Alert was triggered
95th Percentile Calculations

Calculation of the 95 percentile, a well-known statistical standard used to discard maximum spikes, is based on 5 minute data samples. The calculation gathers these values every 5 minutes for however long you select, throws away th the top 5%, yielding the 95 percentile value at the beginning of the list. Consider the following example of how the 95 percentile is calculated for a 10 hour work day from 8am to 6pm (600 minutes): 1. Over the 10 hours, the following 120 values were collected for inbound traffic (Mb/s): 0.149 0.623 0.281 0.136 0.024 0.042 0.097 0.185 0.198 0.243 0.274 0.390
SolarWinds Variables and Examples 481
th th
0.971 0.633 0.238 0.142 0.119 0.176 0.131 0.127 0.169 0.223 0.291 0.236 0.124 0.072 0.197 0.105 0.138 0.233 0.374 0.290 0.871 0.433 0.248 0.242 0.169 0.116 0.121 0.427 0.249 0.223 0.231 0.336 0.014 0.442 0.197 0.125 0.108 0.244 0.264 0.190 0.471 0.033 0.228 0.942 0.219 0.076 0.331 0.227 0.849 0.323 0.221 0.196 0.223 0.642 0.197 0.385 0.098 0.263 0.174 0.690 0.571 0.233 0.208 0.242 0.139 0.186 0.331 0.124 0.249 0.643 0.481 0.936 0.124 0.742 0.497 0.085 0.398 0.643 0.074 0.590 0.771 0.833 0.438 0.242 0.092 0.376 0.231 0.627 0.249 0.663 0.181 0.636 0.224 0.342 0.697 0.285 0.108 0.211 0.074 0.490 0.271 0.133 0.338 0.242 0.519 0.376 0.331 0.227 2. When reordered from high to low: 0.971 0.942 0.936 0.871 0.849 0.833 0.771 0.742 0.697 0.690 0.663 0.643 0.643 0.642 0.636 0.633 0.627 0.623 0.590 0.571 0.519 0.497 0.490 0.481 0.471 0.442 0.438 0.433 0.427 0.398 0.390 0.385 0.376 0.376 0.374 0.342 0.338 0.336 0.331 0.331 0.331 0.323 0.291 0.290 0.285 0.281 0.274 0.271 0.264 0.263 0.249 0.249 0.249 0.248 0.244 0.243 0.242 0.242 0.242 0.242 0.238 0.236 0.233 0.233 0.231 0.231 0.228 0.227 0.227 0.224 0.223 0.223 0.223 0.221 0.219 0.211 0.208 0.198 0.197 0.197 0.197 0.196 0.190 0.186 0.185 0.181 0.176 0.174 0.169 0.169 0.149 0.142 0.139 0.138 0.136 0.133 0.131 0.127 0.125 0.124 0.124 0.124 0.121 0.119 0.116 0.108 0.108 0.105 0.098 0.097 0.092 0.085 0.076 0.074 0.074 0.072 0.042 0.033 0.024 0.014 3. Drop the first 6, as these equal the top 5% of the values: 0.771 0.742 0.697 0.690 0.663 0.643 0.643 0.642 0.636 0.633 0.627 0.623 0.590 0.571 0.519 0.497 0.490 0.481 0.471 0.442 0.438 0.433 0.427 0.398 0.390 0.385 0.376 0.376 0.374 0.342 0.338 0.336 0.331 0.331 0.331 0.323 0.291 0.290 0.285 0.281 0.274 0.271 0.264 0.263 0.249 0.249 0.249 0.248 0.244 0.243 0.242 0.242 0.242 0.242 0.238 0.236 0.233 0.233 0.231 0.231 0.228 0.227 0.227 0.224 0.223 0.223 0.223 0.221 0.219 0.211 0.208 0.198 0.197 0.197 0.197 0.196 0.190 0.186 0.185 0.181 0.176 0.174 0.169 0.169 0.149 0.142 0.139 0.138 0.136 0.133 0.131 0.127 0.125 0.124 0.124 0.124 0.121 0.119 0.116 0.108 0.108 0.105 0.098 0.097 0.092 0.085 0.076 0.074 0.074 0.072 0.042 0.033 0.024 0.014 4. The 95 percentile is 0.771.
th
482 SolarWinds Variable and Examples
Regular Expression Pattern Matching

When editing comparison criteria, the following regular expressions can be used for pattern matching. Examples a re provided at the end of this section. Characters
Character Any character except [,\,^,$,.,|,?,*,+,(,), \ (backslash) followed by any of [,\,^,$,.,|,?,*,+,(,), \xFF where FF are 2 hexadecimal digits \n, \r and \t Description All characters except the listed special characters match a single instance of themselves. A backslash escapes special characters to suppress their special meaning. Matches the character with the specified ASCII/ANSI value, which depends on the code page used. Can be used in character classes. Match an LF character, CR character and a tab character respectively. Can be used in character classes. Example a matches a
\+ matches + \xA9 matches when using the Latin-1 code page. \r\n matches a DOS/Windows CRLF line break.
Character Classes or Character Sets [abc]

Character Classes or Sets Description Starts a character class. A character class matches a single character out of all of the possibilities offered by the character class. Inside a character class, different rules apply. The rules in this section are only valid inside character classes. The rules outside this section are not valid in character classes, except \n, \r, \t and \xFF All characters except the listed special characters. A backslash escapes special characters to suppress their special meaning. Specifies a range of characters. (Specifies a hyphen if placed immediately after the opening [) [abc] matches a, b or c Example
[ (opening square bracket)
Any character except ^,-,],\ add that character to the possible matches for the character class. \ (backslash) followed by any of ^,-,],\ - (hyphen) except immediately after the opening [
[\^\]] matches ^ or ] [a-zA-Z0-9] matches any letter or digit

Negates the character class, causing it to match a single character not listed in the character class. (Specifies a caret if placed anywhere except after the opening [) Shorthand character classes matching digits 0-9, word characters (letters and digits) and whitespace respectively. Can be used inside and outside character classes
^ (caret) immediately after the opening [
[â-d] matches x (any character except a, b, c or d)
\d, \w and \s
[\d\s] matches a character that is a digit or whitespace
Anchors
Anchors Description Matches at the start of the string to which the regular expression pattern is applied. Matches a position rather than a character. Most regular expression flavors have an option to make the caret match after line breaks (i.e. at the start of a line in a file) as well. Matches at the end of the string to which the regular expression pattern is applied. Matches a position rather than a character. Most regular expression flavors have an option to make the dollar match before line breaks (i.e. at the end of a line in a file) as well. Also matches before the very last line break if the string ends with a line break. Matches at the start of the string to which the regular expression pattern is applied to. Matches a position rather than a character. Never matches after line breaks. Matches at the end of the string to which the regular expression pattern is applied. Matches a position rather than a character. Never matches before line breaks, except for the very last line break if the string ends with a line break. Matches at the end of the string to which the regular expression pattern is applied. Matches a position rather than a character. Never matches before line breaks. Example ^. matches a in abc\ndef. Also matches d in "multi-line" mode.
^ (caret)
$ (dollar)
.$ matches f in abc\ndef. Also matches c in "multi-line" mode.
\A
\A. matches a in abc
\Z
.\Z matches f in abc\ndef
\z
.\z matches f in abc\ndef
Quantifiers
Quantifiers ? (question mark) Description Makes the preceding item optional. The optional item is included in the match, if possible. Makes the preceding item optional. The optional item is excluded in the match, if possible. This construct is often excluded from documentation due to its limited use. Repeats the previous item zero or more times. As many items as possible will be matched before trying permutations with fewer matches of the preceding item, up to the point where the preceding item is not matched at all. Repeats the previous item zero or more times. The engine first attempts to skip the previous item before trying permutations with ever increasing matches of the preceding item. Repeats the previous item once or more. As many items as possible will be matched before trying permutations with fewer matches of the preceding item, up to the point where the preceding item is matched only once. Repeats the previous item once or more. The engine first matches the previous item only once, before trying permutations with ever increasing matches of the preceding item. Repeats the previous item exactly n times. Repeats the previous item between n and m times. Will try to repeat m times before reducing the repetition to n times. Repeats the previous item between n and m times. Will try to repeat n times before increasing the repetition to m times. Repeats the previous item at least n times. Will try to match as many items as possible before trying permutations with fewer matches of the preceding item, up to the point where the preceding item is matched only m times. Repeats the previous item between n and m times. The engine first matches the previous item n times before trying permutations with ever increasing matches of the preceding item. Example abc? matches ab or abc abc?? matches ab or abc
??
* (star)
.* matches "def" "ghi" in abc "def" "ghi" jkl
*? (lazy star)
.*? matches "def" in abc "def" "ghi" jkl
#NAME?
.+ matches "def" "ghi" in abc "def" "ghi" jkl
+? (lazy plus)
.+? matches "def" in abc "def" "ghi" jkl
{n} where n is an integer >= 1 {n,m} where n >= 1 and m >= n {n,m}? where n >= 1 and m >= n
a{3} matches aaa a{2,4} matches aa, aaa or aaaa a{2,4}? matches aaaa, aaa or aa
{n,} where n >= 1
a{2,} matches aaaaa in aaaaa
{n,}? where n >= 1
a{2,}? matches aa in aaaaa
Dot
Dot Character . (dot) Description Matches any single character except line break characters \r and \n. Example . matches x or most any other character
Word Boundaries
Word Boundary Description Matches at the position between a word character (anything matched by \w) and a non-word character (anything matched by [^\w] or \W) as well as at the start and/or end of the string if the first and/or last characters in the string are word characters. Matches at the position between two word characters (i.e the position between \w\w) as well as at the position between two non-word characters (i.e. \W\W). Example
\b
.\b matches c in abc
\B
\B.\B matches b in abc
Alternation
Alternation Character | (vertical bar or pipe) | (vertical bar or pipe) Description Causes the regular expression engine to match either the part on the left side or the part on the right side. Can be strung together into a series of options. The vertical bar has the lowest precedence of all operators. Use grouping to alternate only part of the regular expression. Example abc|def|xyz matches abc, def or xyz abc(def|xyz) matches abcdef or abcxyz
Regular Expression Pattern Matching Examples The following examples illustrate uses of regular expression pattern matching.
snmp-server community public
Finds any line that includes the text snmp-server community public. There can be text before and/or after the string on the same line.
service tcp-keepalives-in.*\n(.*\n)*.*service tcp-keepalives-out
Finds the first line service tcp-keepalives-in and then looks for service tcp-keepalives-out on any line after that. The regular expression string .*\n(.*\n)*.* is used to search any number of lines between strings.
access-list 105 deny.*tcp any any eq 139 log
Finds the line with access-list 105 deny, followed by any number of characters of any type, followed by tcp any any eq 139 log on the same line. The regular expression string .* finds any character and any number of characters on the same line. This expression can be used to find spaces, tabs, numbers, letters, or special characters.
ntp clock-period \d*
Finds any line that includes ntp clock-period, followed by any number. The regular expression string \d* will find any number at any length, such as 3, 48, or 2394887.
user \x2a
Finds any line that includes user *. The regular expression string \x, followed by a hexadecimal value, specifies an individual character. In this example, \x2a represents the asterisk character, which has a hexadecimal value of 2a.
Advanced Alert Engine Variables

The following variables can be used in alert messages within SolarWinds SAM and SolarWinds Modules. You must begin each variable with a dollar sign and enclose each variable identifier in braces as, for example, ${ObjectName}. For a complete list of Core variables, see
General
The following are valid, general advanced alert variables.
General Variable ${Acknowledged} ${AcknowledgedBy} ${AcknowledgedTime} ${AlertTriggerCount} ${AlertTriggerTime} ${Application} ${CR} ${Copyright} ${ObjectName} ${Release} ${Version} Description Acknowledged status Who the alert was acknowledged by Time the alert was acknowledged Count of triggers Date and time of the last event for this Alert. (Windows control panel defined Short Date and Short Time) SolarWinds application information Line Feed Carriage Return Copyright information Description/Name of the object in the alert Release information Version of the SolarWinds software package
Date/Time
The following are valid date and time variables.
Date/Time Variable ${AMPM} ${AbreviatedDOW} ${D} ${DD} ${Date} ${DateTime} ${DayOfWeek} ${DayOfYear} ${H} ${HH} ${Last2Hours} ${Last24Hours} ${Last7Days} ${LastHour} ${LocalDOW} ${LocalMonthName} ${LongDate} ${M} ${MM} ${MMM} ${MMMM} ${MediumDate} ${Minute} ${S} ${Second} ${Time} ${Today} ${Year} ${Year2} ${Yesterday} Description AM/PM indicator Current day of the week. Three character abbreviation. Current day of the month Current day of the month (two digit number, zero padded) Current date. (Short Date format) Current date and time. (Windows control panel defined Long Date and Long Time format) Current day of the week. Numeric day of the year Current hour Current hour. Two digit format, zero padded. Last two hours Last 24 hours Last seven days (Short Date format) Last hour Current day of the week. Localized language format. Current month name in the local language. Current date. (Long Date format) Current numeric month Current month. Two digit number, zero padded. Current month. Three character abbreviation. Full name of the current month Current date. (Medium Date format) Current minute. Two digit format, zero padded. Current second. Current second. Two digit format, zero padded. Current Time. (Short Time format) Today (Short Date format) Four digit year Two digit year Yesterday (Short Date format)
Group Variables
The following are valid group variables.
Group Variable ${GroupDetailsURL} Description URL of the Group Details view for a selected group

${GroupFrequency} ${GroupID} ${GroupMemberDisplayName} ${GroupMemberDisplayNamePlural} ${GroupMemberFullName} ${GroupMemberName} ${GroupMemberPercentAvailability} ${GroupMemberSnapshotID} ${GroupMemberStatusID} ${GroupMemberStatusName} ${GroupMemberUri} ${GroupName} ${GroupOwner} ${GroupPercentAvailability} Interval on which group membership is evaluated and group snapshots are taken. Designated identifier for a defined group Display name of group member type: Node, Volume, Component, Application, and so on. Display name of multiple group members of a type: Nodes, Components, Applications, and so on. Full name of a group member, including location Name of a group member Percent availability of a group member when group member status is Up, Warning, or Critical and 0% if status is anything else. Unique identifier of group member snapshot. Identifier assigned to a group member indicating its status. For more information see Status Variables on page 490. Name of group member status. For more information see Status Variables on page 490. Uri used by SolarWinds Information Service (SWIS) to refer to the selected group member within the web console. Name of the group. SolarWinds product appropriate to the group type 100% when group status is Up, Warning, Critical and 0% if status is anything else. Name of roll-up logic calculator that evaluates status of group based on member statuses. (0 = Mixed, 1 = Worst, 2 = Best) Name of roll-up logic calculator that evaluates status of group based on member statuses. (Mixed, Worst, Best) Identifier assigned to a group indicating its status. For more information see Status Variables on page 490. Name of group status. For more information see Status Variables on page 490. A list of all group members that are not Up NULL every time - just for legacy support.
${GroupStatusCalculatorID}
${GroupStatusCalculatorName}
${GroupStatusID} ${GroupStatusName} ${GroupStatusRootCause} ${NodeID}
SQL Query
Any value you can collect from the database can be generated, formatted, or calculated using a SQL query as a variable. To use a SQL query as a variable in SolarWinds SAM, use ${SQL:{query}} as shown in the following example that returns the results of the SQL query Select Count(*) From Nodes:
${SQL:Select Count(*) From Nodes} SolarWinds Variables and Examples 489
Status Variables
When using the ${Status} variable with a monitored object, status values are returned, as appropriate. The following table provides a description for each status value.
Status Value 0 1 2 3 4 5 6 7 8 9 10 11 12 14 15 16 17 19 22 24 25 26 27 28 Description Unknown Up Down Warning Shutdown Testing Dormant Not Present Lower Layer Down Unmanaged Unplugged External Unreachable Critical Mixed Availability Misconfigured Could Not Poll Unconfirmed Active Inactive Expired Monitoring Disabled Disabled Not Licensed
Node Variables
The following are valid node variables.
Node Variable ${AgentPort} ${Allow64BitCounters} ${AvgResponseTime} ${BlockUntil} Description Node SNMP port number Node allows 64-bit counters (1), or not (0) Average node response time , in msec, to ICMP requests Day, date, and time until which node polling is blocked

Device-dependent count of big buffer misses on node in current hour, queried with MIB 1.3.6.1.4.9.2.1.30 Device-dependent count of big buffer misses on node in current day, queried with MIB 1.3.6.1.4.9.2.1.30 Device-dependent count of huge buffer misses on node in current hour, queried with MIB 1.3.6.1.4.9.2.1.62 Device-dependent count of huge buffer misses on node in current day, queried with MIB 1.3.6.1.4.9.2.1.62 Device-dependent count of large buffer misses on node in current hour, queried with MIB 1.3.6.1.4.9.2.1.38 Device-dependent count of large buffer misses on node in current day, queried with MIB 1.3.6.1.4.9.2.1.38 Device-dependent count of medium buffer misses on node in current hour, queried with MIB 1.3.6.1.4.9.2.1.22 Device-dependent count of medium buffer misses on node in current day, queried with MIB 1.3.6.1.4.9.2.1.22 Count of buffer errors due to low memory on node in current hour Count of buffer errors due to low memory on node in current day Device-dependent count of small buffer misses on node in current hour, queried with MIB 1.3.6.1.4.9.2.1.14 Device-dependent count of small buffer misses on node in current day, queried with MIB 1.3.6.1.4.9.2.1.14 User friendly node name Node community string Contact information for person or group responsible for node Node CPU utilization rate at last poll Day, date, and time of last poll attempt on node Day, date, and time that node was last successfully polled Node hardware and software Fully qualified node name If node supports dynamic IP address assignment via BOOTP or DHCP (1); static IP address return (0) Internal unique identifier of the polling engine to which node is assigned
${BufferBgMissThisHour}
${BufferBgMissToday}
${BufferHgMissThisHour}
${BufferHgMissToday}
${BufferLgMissThisHour}
${BufferLgMissToday}
${BufferMdMissThisHour}
${BufferMdMissToday} ${BufferNoMemThisHour} ${BufferNoMemToday} ${BufferSmMissThisHour}
${BufferSmMissToday} ${Caption} ${Community} ${Contact} ${CPULoad} ${CustomPollerLastStatisticsPoll} ${CustomPollerLastStatisticsPollSuccess} ${Description} ${DNS} ${DynamicIP} ${EngineID}

${GroupStatus} ${IOSImage} ${IOSVersion} ${IP_Address} ${LastBoot} ${LastSync} ${Location} ${MachineType} ${MaxResponseTime} ${MemoryUsed} ${MinResponseTime} ${NextPoll} ${NextRediscovery} ${NodeID } ${ObjectSubType} ${PercentLoss} ${PercentMemoryUsed} ${PollInterval} ${RediscoveryInterval} ${ResponseTime} ${RWCommunity} ${RWSNMPV3AuthKey} ${RWSNMPV3AuthKeyIsPwd} ${RWSNMPV3AuthMethod} ${RWSNMPV3Context} ${RWSNMPV3PrivKey} ${RWSNMPV3PrivKeyIsPwd} ${RWSNMPV3PrivMethod} ${RWSNMPV3Username} Filename of status icon for node and, in SolarWinds NPM, its interfaces Family name of Cisco IOS on node Cisco IOS version on node Node IP address Day, date and time of last node boot Time and date of last node database and memory synchronization Physical location of node Node manufacturer or distributor and family or version information Maximum node response time , in msec, to ICMP requests Total node memory used over polling interval Minimum node response time , in msec, to ICMP requests Day, date and time of next scheduled node polling Time of next node rediscovery Internal unique identifier of node States if node supports SNMP or is ICMP-only ICMP packet loss percentage when node last polled Percentage of total node memory used over polling interval Node polling interval, in seconds Node rediscovery interval, in minutes Node response time, in milliseconds, to last ICMP request Node read/write community string; acts as security code for read/write SNMP access SNMPv3 read/write credential authentication key States if the SNMPv3 read/write credential authentication key is the password SNMPv3 read/write credential authentication method SNMPv3 read/write security context information SNMPv3 read/write credential key States if the SNMPv3 read/write credential privacy key is the password SNMPv3 read/write credential privacy encryption method User friendly name for SNMPv3 read/write credential

A network health score determined additively by scoring the status of monitored objects. For example, in SolarWinds NPM 1 point is provided for an interface in a warning state, 1000 points for a down interface, and 1 million points for a down node. States if node only supports SNMPv1 or SNMPv2 SNMPv3 authentication key States if node SNMPv3 authentication key is password SNMPv3 authentication type Group or domain of user with SNMPv3 access to node SNMPv3 credential key States if node SNMPv3 credential key is the password SNMPv3 credential key type User friendly name for SNMPv3 credential States the version of SNMP used by the node Statistics collection frequency, in minutes Numerical node status. For more information, see Node Status Variables on page 490. User friendly node status Filename of node status icon String reply to SNMP SYS_NAME OID request Vendor ID of the network management subsystem in OID form. Clearly determines the type of node. Time, in hundredths of a second, since network monitoring started Total node memory available States if node is currently unmanaged Day, date, and time when node is set to Unmanaged Day, date, and time when node is scheduled to be managed Node manufacturer or distributor Filename of node vendor logo
${Severity}
${SNMPV2Only} ${SNMPV3AuthKey} ${SNMPV3AuthKeyIsPwd} ${SNMPV3AuthMethod} ${SNMPV3Context} ${SNMPV3PrivKey} ${SNMPV3PrivKeyIsPwd} ${SNMPV3PrivMethod} ${SNMPV3Username} ${SNMPVersion} ${StatCollection} ${Status} ${StatusDescription} ${StatusLED} ${SysName} ${SysObjectID} ${SystemUpTime} ${TotalMemory} ${UnManaged} ${UnManageFrom} ${UnManageUntil} ${Vendor} ${VendorIcon}
Volume Variables
The following are valid volume variables.
Volume Variable ${Caption} Description User friendly volume name

${FullName} ${LastSync} ${NextPoll} ${NextRediscovery} ${NodeID} ${PollInterval} ${RediscoveryInterval} ${StatCollection} ${Status} ${StatusLED} ${VolumeAllocationFailuresThisHour} ${VolumeAllocationFailuresToday} ${VolumeDescription} ${VolumeID} ${VolumeIndex} ${VolumePercentUsed} ${VolumeResponding} ${VolumeSize} ${VolumeSpaceAvailable} ${VolumeSpaceUsed} ${VolumeType} ${VolumeTypeIcon} User friendly volume name including captions of parent node and, in SolarWinds NPM, interface Time and date volume last synchronized in database and memory models Day, date and time of next scheduled volume polling Scheduled time of next volume rediscovery Internal unique identifier of parent node Volume status polling interval, in seconds Volume rediscovery interval, in minutes Statistics collection frequency, in minutes Numerical volume status: (0=Unknown, 1=Up, 2=Shutdown, 3=Testing) Filename of volume status icon Number of volume allocation errors for this volume in last hour Number of volume allocation errors for this volume in current day User friendly volume description Internal unique identifier of volume Unique index of this volume within the parent node Percentage of volume currently in use (Y) = volume is currently responding to SNMP queries Size of volume, in bytes Total space available on volume, in bytes Total space used on volume, in bytes Volume type, as reported by hrStorageType OID (Removable Disk/Fixed Disk/Compact Disc/Virtual Memory/RAM/and so on) Filename of icon for volume type
Hardware Specific Variables

Variables for hardware come in three groups; Hardware Status, Node Hardware Type, and Node Hardware Status. Use these variables to receive specific alerts and reports on various aspects of your hardware. Note: Hardware variables are new to SAM 5.0 and intentionally have the APM prefix.
Hardware Status The following are valid hardware status variables:

Hardware Variable ${APM_HardwareAlertData.HardwareStatus} ${APM_HardwareAlertData.HardwareStatusDescription} ${APM_HardwareAlertData.Manufacturer} ${APM_HardwareAlertData.Model} ${APM_HardwareAlertData.ServiceTag} ${APM_HardwareAlertData.LastPollTime} ${APM_HardwareAlertData.LastPollMessage} ${APM_HardwareAlertData.NodeName} ${APM_HardwareAlertData.IsPollingDisabled} Description Current hardware status Current description of hardware status Manufacturer Hardware model Service tag/Serial Number Time of the last poll Message or error message returned from the last poll Name of the node Information relating to nodes for which polling is disabled Comma separated list of all child hardware components and their statuses Comma separated list of all child hardware components (in status other than "Up") and their statuses
${APM_HardwareAlertData.SensorsWithStatus}
${APM_HardwareAlertData.SensorsWithProblems}
Node Hardware Type The following are valid node hardware type variables:
Hardware Variable ${APM_HardwareTypeAlertData.HardwareTypeStatus} ${APM_HardwareTypeAlertData.HardwareTypeStatusDescription} ${APM_HardwareTypeAlertData.TypeName} ${APM_HardwareTypeAlertData.NodeName} Description Rollup status for this hardware type Current hardware description Type of hardware (Fan, Battery, and so on.) Name of the node Comma separated list of all child hardware components and their statuses Comma separated list of all child hardware components (in status other than "Up") and their statuses
${APM_HardwareTypeAlertData.SensorsWithStatus}
${APM_HardwareTypeAlertData.SensorsWithProblems}
Node Hardware Sensor The following are valid node hardware sensor variables:
Hardware Variable ${HardwareTypeStatus} ${HardwareTypeStatusDescription} ${CategoryName} ${NodeName} ${SensorUniqueName} ${SensorDisplayName} ${SensorValue} ${SensorUnit} ${SensorOrionStatus} ${SensorOrionStatusDescription} ${SensorOriginalStatus} ${SensorMessage} Description Status of the parent object Description of the status of the parent object Name of the parent hardware type (Fan, Battery, and so on.) Name of the node Unique name of the sensor Display name of the sensor Value returned from the last poll Sensor unit (Degree F, Watts, and so on.) Sensor status Sensor status description Original status returned by the remote node Message or error message from the last poll
Example Messages Using Variables

The following examples illustrate some of the uses of variables.
Administrator Guide SolarWinds Server & Application Monitor Previous reboot was at ${LastBoot-Previous}. Alert: ${NodeName} has exceptionally high response time. Average Response Time is ${AvgResponseTime} and is varying from ${MinResponseTime} to ${MaxResponseTime}. Current packet loss for ${NodeName} is ${%Loss}. Average Response time is ${AvgResponseTime} and is varying from ${MinResponseTime} to ${MaxResponseTime}. Alert: The SNMP Community string used to query ${NodeName} has been changed from ${Community-Previous} to ${Community}. SolarWinds SAM uses the new Community String to query ${NodeName}.
Syslog Alert Variables

The following variables can be used in Syslog alert messages within Server & Application Monitor applications. You must begin each variable with a dollar sign and enclose each variable identifier in curly braces as, for example, ${ObjectName}.
Syslog Date/Time Variables

Syslog Date/Time Variable ${AbreviatedDOW} ${AMPM} ${D} ${DD} ${Date} ${DateTime} ${DayOfWeek} ${DayOfYear} ${H} ${HH} ${Hour} ${LocalDOW} ${LongDate} ${LocalMonthName} ${LongTime} ${M} ${MM} ${MMM} ${MediumDate} Description Current day of the week. Three character abbreviation. AM or PM corresponding to current time (before or after noon) Current day of the month Current day of the month (two digit number, zero padded) Current date. (Short Date format) Current date and time. (Windows control panel defined Short Date and Short Time format) Current day of the week. Numeric day of the year Current hour Current hour. Two digit format, zero padded. Current hour. 24-hour format Current day of the week. Localized language format. Current date. (Long Date format) Current month name in the local language. Current Time. (Long Time format) Current numeric month Current month. Two digit number, zero padded. Current month. Three character abbreviation. Current date. (Medium Date format)

${Minute} ${Month} ${N} ${S} ${Second} ${Time} ${Year2} ${Year} Current minute. Two digit format, zero padded. Full name of the current month Current month and day Current second. Current second. Two digit format, zero padded. Current Time. (Short Time format) Two digit year Four digit year
Other Syslog Variables

Syslog Variable ${Application} ${Copyright} ${DNS} ${IP_Address} ${Message} ${MessageType} ${Release} ${Severity} ${Version} Description SolarWinds application information Copyright information Fully qualified node name IP address of device triggering alert Status of device triggering alert Assigned alert name Release information A network health score providing 1 point for an interface in a warning state, 1000 points for a down interface, and 1 million points for a down node. Version of the SolarWinds software package
Trap Alert Variables

The following variables can be used in trap alert messages within SolarWinds products.
General Trap Variables

Trap Variable ${Application} ${Community} ${Copyright} ${DNS} ${Hostname} ${IP} ${IP_Address} ${Message} ${MessageType} ${Raw} Description SolarWinds application information Node community string Copyright information Fully qualified node name Host name of the device triggering the trap IP address of device triggering alert IP address of device triggering alert Message sent with triggered trap and displayed in Trap Details field of Trap Viewer Name or type of trap triggered Raw numerical values for properties sent in the corresponding incoming trap

${RawValue} Raw numerical values for properties sent in the corresponding incoming trap. The same as ${Raw}
Trap Date/Time Variables

Trap Date/Time Variable ${AbbreviatedDOW} ${AbbreviatedMonth} ${AMPM} ${D} ${DD} ${Date} ${DateTime} ${Day} ${DayOfWeek} ${DayOfYear} ${H} ${HH} ${Hour} ${LocalDOW} ${LongDate} ${LongTime} ${M} ${MM} ${MMM} ${MMMM} ${MediumDate} ${MediumTime} ${Minute} ${MonthName} ${S} ${Second} ${Time} ${Year} ${Year2} Description Current day of the week. Three character abbreviation. Current month of the year. Three character abbreviation. AM or PM corresponding to current time (before or after noon) Current day of the month Current day of the month (two digit number, zero padded) Current date. (MM/DD/YYYY format) Current date and time. (MM/DD/YYYY HH:MM format) Current day of the month Current day of the week. Numeric day of the year Current hour Current hour. Two digit format, zero padded. Current hour. 24-hour format Current day of the week. Localized language format. Current date. (DAY NAME, MONTH DAY, YEAR format) Current Time. (HH:MM:SS AM/PM format) Current numeric month Current month. Two digit number, zero padded. Current month. Three character abbreviation. Full name of the current month Current date. (DD-MMM-YY format) Current time. (HH:MM AM/PM format) Current minute. Two digit format, zero padded. Full name of the current month Current second. Current second. Two digit format, zero padded. Current Time. (HH:MM format) Four digit year Two digit year
Appendix D
Configuring Automatic Login

The SolarWinds SAM Web Console allows you to log in using any of the following methods: Windows Active Directory Authentication, available in all Orion products. Windows Pass-through Security. If you choose to employ Windows Passthrough Security, SolarWinds SAM users can be authenticated through Windows Security, with no need to log in using a separate SolarWinds SAM Account or User Name and Password. For more information, see Using Windows Pass-through Security on page 501. DirectLink. If a DirectLink account is activated, any URL referring directly to an Orion Web Console page will bypass the Orion Web Console login page by logging the user into the DirectLink account. For more information, see Using the DirectLink Account on page 504. URL Pass-through. For more information, see Passing Login Information Using URL Parameters on page 504.
SolarWinds SAM prioritizes user login in the following manner: 1. Windows Active Directory Authentication is enabled. To enable Windows Active Directory Authentication, check the Windows Authentication option when configuring the Orion Web Console in the Configuration Wizard. 2. The Account or User ID and Password passed on the URL. 3. The Account or User ID and Password entered on the login.aspx page. 4. The Windows User if IIS NT Security is enabled, logging the user in using NT Security. 5. The Windows Domain to which the User belongs, for example, Development\Everyone. 6. The presence of a DirectLink Account.
Using Windows Pass-through Security

On all Orion products released before Orion NPM version 10.1, you may take advantage of the Windows Pass-through Security functionality when IIS NT Security is enabled. SolarWinds SAM users can be authenticated through Windows Security, with no need to log in using a separate SolarWinds SAM account or User Id and Password. Pass-through Security can be configured to employ either Domain or Local computer security. Both may also be used at the
Configuring Automatic Login 501
same time. The Server & Application Monitor Account or User ID and Passwords must then be set up to match the Account or User ID and Passwords that are used for the Domain and/or Local computer security. Use the following procedure to enable IIS NT Security for logging in to the SolarWinds Web Console with Windows Pass-through Security. Note: When authenticating users with Windows Security, ensure your SolarWinds server uses the NetBIOS domain name, instead of the fully qualified domain name. To enable IIS NT security for Windows Pass-through Security: 1. If you are using NT Domain Authentication Format for pass-through accounts, create these pass-through accounts in the SolarWinds Web Console Account Manager using Domain\UserID as the User Name, as follows:
Washington\Edward StLouis\Bill
Note: For more information about creating accounts using the SolarWinds Web Console Account Manager, see Creating New Accounts on page 179. 2. If you are using Local Computer Authentication Format for pass-through accounts, create these accounts in the SolarWinds Web Console Account Manager using Computer\UserID as the User Name, as follows:
SolarWindsS2\Edward Server3\JonesR
Note: For more information about creating accounts using the SolarWinds Web Console Account Manager, see Creating New Accounts on page 179. 3. Click Start > Control Panel > Administrative Tools > Internet Information Services (IIS) Manager. 4. If you are using Windows Server 2003, complete the following steps: a. Expand Internet Information Services > Local Computer > Web Sites in the left pane. b. Select SolarWinds NetPerfMon. c. Click Action > Properties. d. Click the Directory Security tab. e. Click Edit within the Authentication and access control area. f. Clear Enable anonymous access.
502 Configuring Automatic Login
g. Check Integrated Windows authentication in the Authenticated access group. h. Click Ok to close the Authentication Methods window. i. j. Click Apply, if available, and then click Ok to close the SolarWinds NetPerfMon Properties window. Collapse Internet Information Services > Local Computer > Web Sites.
k. Collapse Internet Information Services > Local Computer in the left pane. l. Click Action > All Tasks > Restart IIS.
m. Confirm that Restart Internet Services on Local Computer is selected, and then click Ok. n. Close the IIS Manager. 5. If you are using Windows Server 2008, complete the following steps: a. Click Start > Administrative Tools > Server Manager. b. Expand Roles. c. Click Web Server (IIS). d. In the Role Services area, confirm that Web Server > Security > Windows Authentication is installed. e. If Windows Authentication is not installed, click Add Role Services, check Web Server > Security > Windows Authentication, click Next, and then complete the service installation. f. Click Start > Administrative Tools > Internet Information Services (IIS) Manager.
g. Select your SolarWinds server in the left pane. h. Click Authentication in the IIS group of the main pane. i. j. Right-click Anonymous Authentication, and then click Disable. Right-click Windows Authentication, and then click Enable.
k. Click your SolarWinds server, and then click Restart in the Actions pane. 6. Close the IIS Manager. 7. Log in to the SolarWinds Web Console using the Windows account credentials you have already established.
Configuring Automatic Login 503
Passing Login Information Using URL Parameters

The user ID and password can be passed as parameters within the URL. This allows you to create a favorite or bookmark within a browser, or on your desktop. Create a favorite with a link in the following form to pass the login information:
http://DOMAIN/Orion/Login.aspx?AccountID=USER&Password=PASSWORD
Provide the hostname or IP address of your SolarWinds server as the DOMAIN. Provide your SolarWinds User ID as the USER, and then provide your SolarWinds user account password as the PASSWORD. Warning: HTTP requests are not encrypted, so User IDs and Passwords sent in HTTP requests are not secure. For more information about enabling HTTPS on your SolarWinds server, consult www.microsoft.com.
Using the DirectLink Account

Enabling a DirectLink account allows you to make direct hyperlinks to specific web console views available to individuals who do not already have SolarWinds Web Console user accounts. Any URL referring directly to a SolarWinds SAM web page bypasses the login screen, logging the user into the DirectLink account. The DirectLink account is created like any other account, and it can include custom views and account limitations. For more information web console accounts, see Creating New Accounts on page 179. To enable a DirectLink account for the SolarWinds Web Console: 1. Log in to the SolarWinds Web Console as an administrator. 2. Click Settings in the top right of the web console, and then click Manage Accounts in the Accounts grouping. 3. Click Add. 4. Type DirectLink as the new User Name. 5. Type a Password, confirm it, and then click Submit. 6. Edit DirectLink account options, as necessary, for your installation of SolarWinds Network Performance Monitor. For more information about editing account options, see Editing User Accounts on page 180. 7. Create a custom view to be used as the home page of the DirectLink account. For more information, see Creating New Views on page 102. 8. Specify the new DirectLink view as a default view in Account Manger. For more information, see Editing User Accounts on page 180. 9. If you would like to limit the DirectLink account to specific devices or device types, see Setting Account Limitations on page 184.
504 Configuring Automatic Login
Appendix E
Troubleshooting
If you have problems with a SolarWinds product, the causes are usually related to an incorrect configuration or corrupted files. The suggestions listed in this section can often clear up these problems. Additionally, you can visit our knowledge base repository for articles to help remedy specific issues. The address is: http://knowledgebase.solarwinds.com/kb/ You can also talk to other users as well as the SolarWinds staff by logging on to thwack.com Back Up Your Data As a first step in any troubleshooting procedure, you should back up your SolarWinds database. For more information, see Creating Database Backups on page 452. Verify Program Operation SolarWinds runs many components at the same time to deliver a view of your network status. Confirm that the following components are running on your SolarWinds server:
Component Monitor Types 505
Services: Message Queuing Net.Tcp Port Sharing Service SNMP Trap Service SolarWinds Alerting Engine service SolarWinds Collector Data Processor, Management Agent, and Polling Controller services SolarWinds Information Service SolarWinds Job Engine and Job Engine v2 SolarWinds Job Scheduler SolarWinds Network Performance Monitor Service. All SolarWinds products use this service. It is not exclusive to SolarWinds SAM. SolarWinds Product services SolarWinds Information Service SolarWinds Module Engine SolarWinds Syslog and Trap Services
SQL Server Internet Information Service (IIS)
Stop and Restart Many problems disappear when programs are restarted. Stopping and restarting Internet Information Service (IIS) may eliminate web page problems. Problems with polling or data gathering may be eliminated by stopping and restarting the SolarWinds Network Performance Monitor Service using the available shutdown tool that you can locate as follows: Click Start > All Programs > SolarWinds > Advanced Features > Orion Service Manager. For a complete refresh of the system, reboot the computer. Run the Configuration Wizard Running the Configuration Wizard, which refreshes files on the web server and performs checks on the structure of your database, may solve many problems. Note: Before you run the Configuration Wizard, you should close all open applications and stop the SolarWinds Network Performance Monitor Service in
506 Component Monitor Types
the Windows Services Control Panel. It will be restarted by the Wizard at the end of its process. Using Full Variable Names If you are having difficulty acquiring expected values from a selected variable, using the ${VariableName}format, it may be helpful to include the database table name within the variable name, as in ${Nodes.IP_Address}.
Why do my SAM WMI Monitors Show Status Unknown?

To monitor SAM applications containing WMI component monitors, the following conditions must be true: WMI on the remote server is enabled and functioning properly. The remote server is accessible through a RPC connection in order to run the WMI queries.
If these conditions cannot be met, the WMI component monitors in SAM show an Unknown status. Examples of some issues that can prevent these conditions from being met include, but are not limited to: Trying to connect to a remote computer where you do not have local Administrator rights. A firewall blocking the WMI traffic. An operating system that is not configured for WMI. Mistyping the credential password in the SAM component monitor. To help diagnose and fix these issues and others, we can test the WMI services, the remote WMI connections, and the SolarWinds SAM component configuration to discover and correct the issues that can prevent your WMI component monitors from functioning correctly. The topics in this guide are as follows:
WMI Troubleshooting Flowchart for SolarWinds SAM. Provides a flowchart of the troubleshooting decisions described in this guide. Testing Local WMI Services. Ensures WMI is running correctly on the target computer. Testing Remote WMI Connections. Ensures the WMI connection to the target computer is not being blocked, ignored, or rejected. Testing SolarWinds SAM Component Configuration. Ensures you are properly configuring the WMI component credentials in SolarWinds SAM.
WMI Troubleshooting Flowchart for SolarWinds SAM
Testing Local WMI Services

Testing the local WMI services helps us isolate any faults on the target server we are trying to monitor. The testing program is a Microsoft program named WBEMTest that comes already installed on Microsoft Windows operating systems.
Test WMI on the Target Server

Complete the following procedure to check whether WMI on the target server is functioning correctly: 1. Log on to the target server with an administrator account. 2. Click Start > Run, enter wbemtest.exe and then click OK.
3. Click Connect on the Windows Management Instrumentation Tester window.
4. Enter root\cimv2 in the field at the top of the dialog box next to the Connect button.
5. Click Connect. 6. Click Enum Classes.
8. Select the Recursive radio button without entering a superclass name, and then click OK.
9. If the WMI class you are querying appears in this list, local WMI services are functioning correctly. Skip to the next topic and test remote WMI.
10. If the list does not appear or does not contain the desired WMI class, WMI is not functioning correctly. Continue reading this section for guidance on repairing WMI services on the target server. 11. Click the Close button, and then click Exit.
Reset the WMI Counters

At times, the WMI performance counters may not get transferred to WMI because services were delayed or started out of order (http://support.microsoft.com/kb/820847). To manually reset the WMI counters: 1. Stop the Windows Management Instrumentation service. 2. Click Start, click Run, type cmd, and then click OK. 3. At the command prompt, type winmgmt /resyncperf, and then press ENTER. 4. At the command prompt, type wmiadap.exe /f, and then press ENTER. 5. Type exit, and then press ENTER to close the command prompt. 6. Start the Windows Management Instrumentation service. After resetting the WMI counters, retest WMI. If resetting the WMI counters did not solve your problem, see WMI is Still Not Working, Now What?
Testing Remote WMI Connectivity

Testing the remote WMI connectivity of the target server helps us isolate faults that could prevent the target server from receiving or responding to our remote WMI requests. The testing program is a Microsoft program named WBEMTest that comes already installed on Microsoft Windows operating systems.
Remotely Test WMI on the Target Server

Complete the following procedure to check whether the target server is responding appropriately to remote WMI requests that originate from the SolarWinds SAM server: 1. Log on to the SolarWinds SAM server with an administrator account. 2. Click Start > Run, enter wbemtest.exe and then click OK.
3. Click Connect on the Windows Management Instrumentation Tester window.
4. Enter \\Target_Primary_IP_Address\root\cimv2 in the field at the top of the dialog box. Replace Target_Primary_IP_Address in the above example with the actual Hostname or Primary IP Address of the target server.
5. Enter the user name in the User field, the password in the Password field, and NTLMDOMAIN:NameOfDomain in the Authority field. Replace NameOfDomain with the domain of the user account specified in the User field. 6. Click Connect. 7. Click Enum Classes.
8. Select the Recursive radio button without entering a superclass name, and then click OK.
9. If the WMI class list appears, remote WMI is functioning correctly. Skip to the next topic and test your SAM credentials.
10. If the list does not appear, remote WMI is not functioning correctly. Continue reading this topic for guidance on restoring remote WMI connections on the target server, and retest remote WMI after completing each troubleshooting step. 11. Click the Close button, and then click Exit.
Verify Administrator Credentials

Only a credential that has administrator rights on the target server has the necessary permissions to access the target servers WMI services. Make sure that the username and password you are using belongs to an administrator on the target server. If the administrator credential is a domain member, be sure to specify both the user name and the domain in the standard Microsoft syntax. For example: DOMAIN\Administrator.
Enable Remote Procedure Call (RPC)

Remote WMI connections use RPC as a communications interface. If the RPC service is disabled on the target server, remote WMI connections cannot be established. To enable the RPC service:
1. Log on to the target server with an administrator account. 2. Click Start, click Run, type services.msc, and then press ENTER. 3. Scroll the list to Remote Procedure Call (RPC) 4. Right-click Remote Procedure Call (RPC), and then click Start on the shortcut menu.
Configure Distributed Component Object Model (DCOM) and User Account Control (UAC)
If the target computer is running Windows Vista or Windows Server 2008, you may be required to make settings changes to allow remote WMI requests (http://msdn.microsoft.com/en-us/library/aa822854(VS.85).aspx). Item Need 1. Default and Limits permissions edited to allow the following actions: 2. Local launch (default permission) 3. Remote launch (default permission) DCOM 4. Local activation (limits permission) 5. Remote activation (limits permission) 6. For more information, see Enabling DCOM 7. Modify the CIMV2 security to enable and remote enable the account used to access the server or workstation through WMI. You must ensure the security change applies to the current namespace and sub-namespaces. For more information, see Enabling Account Privileges in WMI 8. Remote UAC access token filtering must be disabled when monitoring within a workgroup environment. For more information, see Disabling Remote User Account Control for Workgroups
WMI Namespaces
User Account Control
Enabling DCOM
WMI uses DCOM to communicate with monitored target computers. Therefore, for Server & Application Monitor to use WMI, DCOM must be enabled and properly configured. To enable DCOM permissions for your Server & Application Monitor credentials: 1. Log on to the target server with an administrator account. 2. Navigate to Start > Control Panel > Administrative Tools > Component Services. You need to switch to the Classic View of the Control Panel to use this navigation path. You can also launch this console by double-clicking comexp.msc in the /windows/system32 directory. 3. Expand Component Services > Computers. 4. Right-click My Computer, and then select Properties. 5. Select the COM Security tab, and then click Edit Limits in the Access Permissions grouping. 6. Ensure the user account you want to use to collect WMI statistics has Local Access and Remote Access, and then click OK. 7. Click Edit Default, and then ensure the user account you want to use to collect WMI statistics has Local Access and Remote Access, 8. Click OK. 9. Click Edit Limits in the Launch and Activation Permissions grouping. 10. Ensure the user account you want to use to collect WMI statistics has Local Launch, Remote Launch, Local Activation, and Remote Activation, and then click OK. 11. Click Edit Default, and then ensure the user account you want to use to collect WMI statistics Local Launch, Remote Launch, Local Activation, and Remote Activation. 12. Click OK.
Enabling Account Privileges in WMI

The account you specify in the Credentials Library must possess security access to the namespace and sub-namespaces of the monitored target computer. To enable these privileges, complete the following procedure. To enable namespace and sub-namespaces privileges:
1. Log on to the computer you want to monitor with an administrator account. 2. Navigate to Start > Control Panel > Administrative Tools > Computer Management > Services and Applications. You need to switch to the Classic View of the Control Panel to use this navigation path. 3. Click WMI Control, and then right-click and select Properties. 4. Select the Security tab, and then expand Root and click CIMV2. 5. Click Security and then select the user account used to access this computer and ensure you grant the following permissions:
Enable Account Remote Enable
6. Click Advanced, and then select the user account used to access this computer. 7. Click Edit, select This namespace and subnamespaces in the Apply to field, and then click OK. 8. Click OK on the Advanced Security Settings for CIMV2 window. 9. Click OK on the Security for Root\CIMV2 window. 10. Click Services in the left navigation pane of Computer Management. 11. Select Windows Management Instrumentation in the Services result pane, and then click Restart.
Disabling Remote User Account Control for Workgroups

If you are monitoring a target in a workgroup, you need to disable remote User Account Control (UAC). This is not recommended, but it is necessary when monitoring a workgroup computer. Disabling remote user account control does not disable local user account control functionality. Warning: The following procedure requires the modification or creation of a registry key. Changing the registry can have adverse effects on your computer and may result in an unbootable system. Consider backing up your registry before making these changes. To disable remote UAC for a workgroup computer: 1. Log on to the computer you want to monitor with an administrator account. 2. Click Start > Accessories > Command Prompt. 3. Enter regedit.
4. Expand
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Po licies\System.
5. Locate or create a DWORD entry named LocalAccountTokenFilterPolicy and provide a DWORD value of 1. Note: To re-enable remote UAC, change this value to 0.
Add a Windows Firewall Exception for Remote WMI Connections

If the target computer has Windows Firewall enabled, it must have a Remote WMI exception to allow remote WMI traffic through (http://msdn.microsoft.com/en-us/library/aa389286(VS.85).aspx). To add this exception: 1. Click Start, click Run, type cmd and then press ENTER. 2. At the command prompt, type netsh firewall set service RemoteAdmin enable, and then press ENTER. 3. At the command prompt, type exit, and then press ENTER. If adding the firewall exception did not solve your problem, see WMI is Still Not Working, Now What?
Do You Need an Additional Polling Engine?

Symptoms that may indicate you need an additional polling engine include, but are not limited to, the following: Polling completion rates are lower than expected which leads to gaps in data. Sporadic component monitor timeouts usually resulting in component monitors showing an "Unknown" status, reporting the error, "Connection timeout. Job cancelled by scheduler." Resource exhaustion on the SQL server.
For more information, see "Additional Polling Engine and Web Console" on page 471.
Verify SAM Component Configuration

Make sure that the credential you are using for remote WMI is the same credential that you are using in the SAM component.
After you click Set Component Credentials to set the component credentials, you must also click Submit at the bottom of the page.
Service reporting, "Invalid Class."

There are various possibilities for this to occur. Read the following section to help troubleshoot this issue. In APM v4 and higher, services can be polled via RPC or WMI. Ensure the correct service is running by navigating to Edit Application > RPC or WMI.
Repair the WMI Repository according to this KB article: http://knowledgebase.solarwinds.com/kb/questions/633/Error+message+%22Inv alid+Class%22+when+using+WMI+monitors Note: Vista and Windows 2008 have a built-in method for repairing the WMI repository. Open an Administrator command prompt and run: winmgmt /salvagerepository If you are using APM prior to version 4 and using WMI, try the following: There are three required WMI queries for service monitoring to work: SELECT * FROM Win32_Service SELECT * FROM Win32_Process SELECT * FROM Win32_PerfRawData_PerfProc_Process You can test these by going to Start > Run > WBEMTEST on the SolarWinds server. 1. Click on Connect. 2. In the whitespace at the top, you should have \\ipaddress\root\CIMV2 3. For user and password, fill in the credentials used in APM. 4. For Authority, type in NTLMDOMAIN: and enter your domain. 5. Click Connect. 6. Click Query 7. Enter the above three queries, one at a time. More often than not, the culprit is the last query. If your problem still exists, try the following: 1. Re-sync the counters by opening a command prompt and typing: winmgmt /resyncperf 2. Check to make sure performance counters are not disabled: http://thwack.com/forums/68/application--servermanagement/21/application-performancemonitor/23124/win32perfrawdataperfprocpro/ Note: WMI is an operating system component. If the previous steps do no work, you may need to contact Microsoft for further information.
WMI is Still Not Working, Now What?

This guide depicts only the most common scenarios that can cause WMI services to fail. If you are unable to get WMI services to work by this point, it is time to consult the Microsoft articles on this topic. WMI Isnt Working!: Troubleshooting Problems with WMI Scripts and the WMI Service. Microsoft TechNet. http://www.microsoft.com/technet/scriptcenter/topics/help/wmi.mspx WMI Diagnosis Utility: A New Utility for Diagnosing and Repairing Problems with the WMI Service. Microsoft TechNet. http://www.microsoft.com/technet/scriptcenter/topics/help/wmidiag.mspx WMI Troubleshooting. Microsoft Developer Network. http://msdn.microsoft.com/en-us/library/aa394603.aspx
Working with Temporary Directories

The following sections provide procedures for moving Windows and SQL Server temporary directories to optimize SolarWinds server performance and resources.
Moving the SQL Server Temporary Directory

The SQL Server temporary directory, tempdb, where temporary database objects generated during table creation and sorting are stored, is typically created in the same location on your SolarWinds database server as the master, model, and msdb databases. Moving the tempdb database to a physical drive separate from your SolarWinds database can significantly improve overall system performance. For more information about moving the SQL Server 2005 temporary directory, tempdb, for see Moving System Databases Example A: Moving the tempdb Database. For more information about moving the SQL Server 2008 temporary directory, tempdb, for see Moving System Databases Example A: Moving the tempdb Database.
Redefining Windows System Temporary Directories

Following established Windows standards, the SolarWinds installer may use Windows User and System TEMP and TMP variable directories as temporary scratch spaces for file expansion and execution. If you do not have the required scratch space available in the default User or System TEMP and TMP directories, use the following procedure to redefine your default locations.
Note: Regardless of where you actually install SolarWinds, some common files may be installed where the operating system of your SolarWinds server are located. To redefine default system temporary directories: 1. Log on to your SolarWinds server as a user with administrative rights. 2. Right-click My Computer, and then click Properties. 3. Click Advanced, and then click Environment Variables. 4. Select the variable name representing the directory you want to redefine, click Edit, and then provide a new path as the Variable value for the selected temporary directory variable.
Slow Performance on Windows Server 2008

If SolarWinds is installed on Windows Server 2008 or Windows Vista and there are any devices on your network, between your SolarWinds server and your database server, that do not support RFC 1323, TCP Extensions for High Performance, the TCP window size auto-tuning feature of Windows Server 2008 and Windows Vista may prevent your SolarWinds server from successfully connecting with your SolarWinds database. This TCP auto-tuning feature is intended as a network-sensitive restriction, applied by the receiveryour SolarWinds serveron the amount of data it is allowed or able to receive. If any devices along the network path between your SolarWinds server and your SolarWinds database do not support the TCP window scaling detailed in RFC 1323, the allowed size of the TCP window in packets sent to your SolarWinds server may not match the TCP window size reported by packets sent from your SolarWinds server. This mismatch may lead to failed connections between your SolarWinds server and your SolarWinds database. The following procedure disables this TCP auto-tuning feature, resetting the TCP receive window to 64kB. To disable tcp auto-tuning: 1. Click Start > All Programs > Accessories. 2. Right-click Command Prompt, and then click Run as administrator. 3. If you are prompted by User Account Control, click Continue to open the elevated command prompt. Note: In some cases, having User Account Control (UAC) enabled on Windows Server 2008 and Windows Vista (evaluation-only) can lead to installation errors. For more information about disabling UAC, see the article, Disabling User Account Control (UAC) in the SolarWinds Knowledge Base. 4. At the prompt, enter the following:
Administrator Guide SolarWinds Server & Application Monitor netsh interface tcp set global autotuninglevel=disabled
5. Close the command prompt window, and then restart your SolarWinds server.
Appendix F
Component Monitor Types

The available component monitors are as follows: "DHCP User Experience Monitor" on page 529 "Directory Size Monitor" on page 532 "DNS Monitor - TCP" on page 534 "DNS Monitor - UDP" on page 535 "DNS User Experience Monitor" on page 536 "Download Speed Monitor" on page 538 "File Age Monitor" on page 540 "File Change Monitor" on page 542 "File Count Monitor" on page 544 "File Existence Monitor" on page 546 "File Size Monitor" on page 547 "FTP Monitor" on page 549 "FTP User Experience Monitor" on page 550 "HTTP Form Login Monitor" on page 553 "HTTP Monitor" on page 557 "HTTPS Monitor" on page 560 "IMAP4 Monitor" on page 563 "IMAP4 User Experience Monitor" on page 564 "JMX Monitor" on page 567. "LDAP User Experience Monitor" on page 569. "Linux/Unix Script Monitor" on page 571 "MAPI User Experience Monitor" on page 573 "Nagios Script Monitor" on page 576. "NNTP Monitor" on page 578.
"ODBC User Experience Monitor" on page 579 "Oracle User Experience Monitor" on page 582 "Performance Counter Monitor" on page 587 "POP3 Monitor" on page 590 "POP3 User Experience Monitor" on page 592 "Process Monitor - SNMP" on page 594 "Process Monitor - WMI" on page 596 "RADIUS User Experience Monitor" on page 598 "Service Status SNMP" on page 600 "SSL Certificate Expiration Monitor" on page 608. "SMTP Monitor" on page 602 "SNMP Monitor" on page 603 "SQL Server User Experience Monitor" on page 605 "TACACS+ User Experience Monitor" on page 610 "TCP Port Monitor" on page 612 "Tomcat Server Monitor" on page 614 "VMware Performance Counter Monitor" on page 617 "Web Link Monitor" on page 621 "Windows Event Log Monitor" on page 624 "Windows PowerShell Monitor" on page 628 "Windows Script Monitor" on page 631. "WMI Monitor" on page 635.
DHCP User Experience Monitor

This component monitor measures how long it takes to get a lease from a DHCP server. The monitor verifies that the DHCP responds with an IP address, but neither confirms nor accepts the lease. Statistic This component monitor does not compute a statistic. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see "Configuring SolarWinds SAM Alerts" on page 292. Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. UDP Request Port The UDP port used for the DHCP request. The default value is 67. UDP Response Port The UDP port used for the DHCP response. The default value is 68. Sender Adapter IP Address (optional) For SolarWinds servers with multiple network adapters configuration, this field specifies which of the multiple network adapters is used for the DHCP User Experience monitor. If this setting is not specified, the default (primary) network adapter is used. Note: This setting does not affect SolarWinds servers with only one network adapter. DHCP Discovery Request Type Select the DHCP Discovery Request Type:
Unicast This is the default DHCP Discovery Request Type. The broadcast flag is not set, the ciaddr (Client IP Address) is set to the local address, and the giaddr (Relay Agent IP Address) is not set. The DHCP client sends a unicast DHCP DISCOVER to the DHCP server IP address and the UDP Request Port (defaults to 67). The DHCP server then sends a unicast DHCP Offer to the ciaddr address and the UDP Response Port (defaults to 68). This option can be used to monitor DHCP servers on the same subnet as the SolarWinds SAM server or on a different subnet. Broadcast The broadcast flag is set, the ciaddr (Client IP Address) is set to the local address, and the giaddr (Relay Agent IP Address) is not set. The DHCP client sends a unicast DHCP DISCOVER to the DHCP server IP address and the UDP Request Port (defaults to 67). The DHCP server then sends a broadcast DHCP Offer to the UDP Response Port (defaults to 68). This option can be used to monitor DHCP servers on the same subnet as the SolarWinds SAM server Relay Agent The broadcast flag is not set, the ciaddr (Client IP Address) is set to the local address, and the giaddr (Relay Agent IP Address) is set to the local address. The DHCP client sends a unicast DHCP DISCOVER to the DHCP server IP address and the UDP Request Port (defaults to 67). The DHCP server then sends a unicast DHCP Offer to the giaddr (Relay Agent IP Address) and the UDP Request Port (defaults to 67). This option can be used to monitor DHCP servers on the same subnet as the SolarWinds SAM server or on a different subnet. Note: You can use the Broadcast or Relay Agent DHCP discovery request type to handle the issue with some DHCP servers (for example Internet Systems Consortium DHCP Server) that do not send a DHCP Offer back to the SolarWinds SAM Server IP address. They send it to the newly leased IP address (the IP address being offered) instead. To handle this issue, set the DHCP Discovery Request Type to either Broadcast or Relay Agent. Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data.
User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see "Configuring SolarWinds SAM Alerts" on page 292.
Directory Size Monitor

This component monitor determines the disk space used by the files in a directory, optionally including all subdirectories. Files that do not match the File Extensions Filter are not included in the disk space calculation. Note: It may be difficult to monitor the size of a folder containing hundreds or thousands of files, because the monitor timeout duration may lapse before the target computer can finish computing the file sizes and sending the response. Note: See Requirements for Component Monitors and Templates that use WMI, on page 218 for information about requirements for WMI access. Statistic The disk space used in bytes. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a credential that has read access to the file. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Full directory Path The path to the monitored directory. Specify the path in Universal Naming Convention (UNC) format. For example: \\computername\c$\logfiles\. The path can include the variable ${IP}, which represents the target node's IP address. File Extensions Filter Determines which file extensions are included in the disk space usage calculations for the directory size. It is a text matching filter, and * is a wildcard.
Include Subdirectories Determines whether the contents of subdirectories are included in the disk space usage calculations for the directory size. Convert Value Checking the Convert Value checkbox opens the formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. For more information, see Conversion Value." Statistic Warning Threshold This field allows you to specify when a threshold that indicates a warning level has been breached. Logical operators are in the dropdown followed by a blank field for you to enter the value of this threshold. For example: Less
than 15.
Statistic Critical Threshold This field allows you to specify when a threshold that indicates a critical level has been breached. Logical operators are in the dropdown followed by a blank field for you to enter the value of this threshold. For example: Less
than 5.
User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see "Configuring SolarWinds SAM Alerts"
DNS Monitor - TCP

This component monitor tests a DNS server's ability to respond to a record query and measures its response time. The record query is an A Name lookup for a.root-servers.net. The component monitor passes if it receives a valid DNS response (positive or negative). Statistic This component monitor does not compute a statistic. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Port Number The TCP port used for DNS queries. The default value is 53. Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
DNS Monitor - UDP

This component monitor tests a DNS server's ability to respond to a record query and measures its response time. The component monitor passes if it receives a valid DNS response (positive or negative) within the response time threshold. UDP is the primary method of communication for DNS servers. Statistic This component monitor does not compute a statistic. Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Port Number The UDP port used for DNS queries. The default value is 53. Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
DNS User Experience Monitor

This component monitor tests a DNS server's ability to respond to a record query, compares the query response against a list of IP addresses, and measures the response time. The component monitor passes if the DNS response matches the expected IP addresses. The DNS Monitor measures the time it takes the DNS get for the record query referenced in the component monitor to load. This response time is measured in milliseconds. Statistic This component monitor does not compute a statistic. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Port Number The port used for DNS queries. The default value is 53. Protocol The protocol to use for the DNS query. Name (IP Address) To Resolve The fully-qualified domain name (FQDN) or IP address to use for the DNS query. If you specify an IP address, the query result should be a FQDN. If you specify a FQDN, the query result should be one or more IP addresses. Expected DNS Query Results The IP addresses or FQDN you expect to result from the DNS query. Type each entry on a new line. If you do not care about the DNS query result, you can type the asterisk (*) as a wildcard character that successfully matches any DNS query result.
Expect All Matches Specifies that the result of the DNS query must include all expected entries to be considered a successful test. If this checkbox is not checked, a single match indicates a successful test. Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see "Configuring SolarWinds SAM Alerts"
Download Speed Monitor

This component monitor measures the time it takes to download data from the target node, and reports the speed in KB/s (1024 bytes per second). The target node must be running a Character Generator service. For information about installing a Character Generator service, see the template information for Download Speed Monitor on page 869. Statistic The statistic for this component monitor is the download speed in KB/s (1024 bytes per second). Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Port Number The port used for the character generator service. The default value is 19. Download Sample Size (kb) The amount of data in kilobytes (kb) you want to download from the node for testing the download speed. Convert Value Checking the Convert Value checkbox opens the formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. For more information, see Conversion Value."
Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Statistic Warning Threshold This field allows you to specify when a threshold that indicates a warning level has been breached. Logical operators are in the dropdown followed by a blank field for you to enter the value of this threshold. For example: Less
than 15.
than 5.
User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
File Age Monitor

This component monitor determines when a file was last modified. The statistic is the number of elapsed hours since the file modification date. This component monitor uses TCP/445 and UDP/445 ports. Statistic The number of elapsed hours since the file modification date. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a credential that has read access to the file. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. File Path This field is the path to the monitored file, including the file name. Specify the path in Universal Naming Convention (UNC) format. For example: \\computername\c$\logfile\errors.log. The path can include the variable ${IP} which represents the target node's IP address. Convert Value Checking the Convert Value checkbox opens the formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. For more information, see Conversion Value."
Statistic Warning Threshold This field allows you to specify when a threshold that indicates a warning level has been breached. Logical operators are in the dropdown followed by a blank field for you to enter the value of this threshold. For example: Less
than 15.
than 5.
File Change Monitor

This component monitor tests if a file has been modified and then reports the time in hours since the file was modified as a statistic. The component monitor performs an MD5 checksum comparison on the file to verify it was not modified. If SolarWinds SAM detects the monitored file was modified, the component monitor will remain in a Down state until you recalculate the checksum. This component monitor uses TCP/445 and UDP/445 ports. Statistic The number of elapsed hours since the file was modified. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a credential that has read access to the file. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. File Path This field is the path to the monitored file, including the file name. Specify the path in Universal Naming Convention (UNC) format. For example: \\computername\c$\logfile\errors.log. The path can include the variable ${IP} which represents the target node's IP address. Convert Value Checking the Convert Value checkbox opens the formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. For more information, see Conversion Value."
Current Snapshot Checksum This field is the calculated checksum against which SolarWinds SAM is comparing the monitored file. To calculate a new checksum, click Update Checksum. Select and upload a file for snapshot creation This field is the local path to a file on the user's computer (where the web browser is running) used to calculate the checksum against which the monitored file is compared. Click Browse to open a Windows Choose File dialog from which you can select the file directly. Click Update Checksum to calculate the new checksum. Statistic Warning Threshold This field allows you to specify when a threshold that indicates a warning level has been breached. Logical operators are in the dropdown followed by a blank field for you to enter the value of this threshold. For example: Less
than 15.
than 5.
File Count Monitor

This component monitor counts the number of files in a directory, optionally including its subdirectories. Files that do not match the file extension or file attribute type are ignored. This monitor may fail if you attempt to count more than 20,000 files in a directory using the wildcard * filter extension. To get an accurate count of the files in such large directories, you must instead create a Windows Script monitor that runs the File Count script located in the script examples folder C:\Program Files\SolarWinds\Orion\APM\SampleScriptMonitors\WindowsScripts. Note: See Requirements for Component Monitors and Templates that use WMI on page 218 for information about requirements for WMI access. Statistic The number of files in the directory that match the file extensions filter. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a credential that has read access to the file. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Full Directory Path This field is the path to the directory. Specify the path in Universal Naming Convention (UNC) format. For example: \\computername\c$\. The path can include the variable ${IP} which represents the target node's IP address. There is a limit of 260 characters for this field.
File Extensions Filter Specifies which files to include in the count based on the file extension. You can specify multiple file extensions separated by commas or spaces. To include all files, specify *. Example for counting all files regardless of file extension File Extensions Filter: * Example for counting files with .exe, .dll, and .bat extensions File Extensions Filter: exe, dll, bat File Attributes Filter Specifies which files to include in the count based on the file attributes. The default value is All Files. Include Subdirectories Specifies the file count should also include files located inside subdirectories Convert Value Checking the Convert Value checkbox opens the formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. For more information, see Conversion Value." Statistic Warning Threshold This field allows you to specify when a threshold that indicates a warning level has been breached. Logical operators are in the dropdown followed by a blank field for you to enter the value of this threshold. For example: Less
than 15.
than 5.
File Existence Monitor

This component monitor tests if a file exists at the given file path. This component monitor uses TCP/445 and UDP/445 ports. Statistic This component monitor does not compute a statistic. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a credential that has read access to the file. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. File Path This field is the path to the monitored file, including the file name. Specify the path in Universal Naming Convention (UNC) format. For example: \\computername\c$\logfile\errors.log. The path can include the variable ${IP} which represents the target node's IP address. File Exist Setting This field specifies whether the component monitor should test for whether the file must exist file or must not exist. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
File Size Monitor

This component monitor measures the size of a file at the given file path and then reports the file size in bytes as a statistic. This component monitor uses TCP/445 and UDP/445 ports. Statistic The statistic for the component monitor is the file size in bytes. Field Descriptions. Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a credential that has read access to the file. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. File Path This field is the path to the monitored file, including the file name. Specify the path in Universal Naming Convention (UNC) format. For example: \\computername\c$\logfile\errors.log. The path can include the variable ${IP} which represents the target node's IP address. Convert Value Checking the Convert Value checkbox opens the formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. For more information, see Conversion Value."
than 15.
than 5.
FTP Monitor
This component monitor tests the ability of an FTP server to accept incoming sessions and respond with the correct codes. Statistic This component monitor does not compute a statistic. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Port Number This field is the port number used for FTP sessions. The default value is 21. Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
FTP User Experience Monitor

This component monitor tests the ability of an FTP server to accept an incoming session, process the user login, and then transmit the specified file to the SolarWinds SAM server. After receiving the file, SolarWinds SAM performs a file integrity test comparing the MD5 checksum of the downloaded file against a previously generated checksum. If the checksums match, the component monitor reports its status as up. The FTP Monitor measures the time it takes the FTP get for the reference in the component monitor to load. This response time is measured in milliseconds. To configure the FTP User Experience Monitor and generate a snapshot checksum: 1. Provide a credential that can log on to the FTP server. 2. If the FTP server is on a different port than the default port of 21 , change the value in the Port Number field. 3. Upload a file named test.txt to the FTP server. The contents of the file do not matter. 4. Change the Url field to match the path of the test.txt file you uploaded to the FTP server. 5. Copy the same test.txt file to a local directory on the SolarWinds SAM server. 6. Click Browse next to the Select and upload a file for snapshot creation field, navigate to and select the local test.txt file, and then click Open. 7. Click Update Checksum to create a snapshot checksum of the local test.txt file. 8. Click Test. 9. If the test fails, correct the problem described in the error message and try again. Note: You must use the Update Checksum command to create a new snapshot checksum each time you update or modify the test.txt file on the FTP server. Statistic This component monitor does not compute a statistic.
Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a credential that can log on to the FTP server. For example, to monitor an anonymous FTP server, select or add a credential containing anonymous as the user name and your email address as the password. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Port Number This field is the port number used for FTP sessions. The default value is 21. Url Allows you to specify the URL of the file you want to monitor. The URL can include the variable ${IP} which represents the target node's IP address, and the variable ${PORT} which represents the value in the Port Number field. Use Proxy This checkbox allows you to use a web proxy to access the web site. Proxy Address This field allows you to specify the address of a web proxy to access the web site. Passive Mode This checkbox allows you to monitor the file using passive mode FTP. This mode is typically used to circumvent a firewall that would otherwise filter the incoming connection to the SolarWinds SAM server.
Current Snapshot Checksum This field is the calculated checksum against which SolarWinds SAM is comparing the monitored file. To calculate a new checksum, click Update Checksum. Select and upload a file for snapshot creation This field is the local path to a file on the SolarWinds SAM server that is used to calculate the checksum against which the monitored file is compared. Click Browse to open a Windows Choose File dialog from which you can select the file directly. Click Update Checksum to calculate the new checksum. Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
HTTP Form Login Monitor

This component monitor tests the ability of a web server to serve web pages secured behind a forms-based login page. The test is performed by using the credential as the user name and password for the login form, retrieving the page behind the login form, and then searching the retrieved page for keywords that indicate either a successful or a failed login attempt. Note: The HTTP Form Login Monitor does not work on any login screens that are pop up. Statistic This component monitor does not compute a statistic. Troubleshooting For most form-based login pages, this component monitor will function without any customizations. But, some form-based login pages use unconventional HTML form tag names or form input tag names, and you need to assist the component monitor in identifying the names of these tags before the component monitor can function correctly. Note: This monitor does not work if the login control is located within an IFRAME HTML control. If the component monitor cannot match the tag names in the login page against the list of expected keywords, you must add the actual tag name to the keywords list. SolarWinds SAM assists you with this by displaying an error status message if the component monitor is in a fail state: the error message lists all the form and form input names found in the HTML page, allowing you to identify the correct name so that you can type it in the appropriate Keywords field. For example, consider the following HTML snippet with tags defining a form and some form inputs:
<form name="login_form" method="post" action="Login.aspx"> <p>Status (optional): <input name="status" type="text" /></p> <p>Username: <input name="nick" type="text" /></p> <p>Password: <input name ="pswd" type="password" /></p> <input type="submit" value="Submit" /> </form>
In the example code, the actual login input tag name is "nick , but testing the component monitor results in an error similar to the following:
Response page matches login error keywords Page contains 1 form(s). Form 'login_form' inputs: ( 'cust_id' 'nick' 'pswd' );
Administrator Guide SolarWinds Server & Application Monitor Assumed form with name = login_form as login form Assumed login input: name = status, password input: name = pswd
The error status message informs you that the component monitor incorrectly assumed the input tag with the name "status" was the login input. Recognizing this error, you correct it by adding the correct tag name "nick" to the list of keywords in the Login Control Keywords field:
(login)|(name)|(email)|(nick)
Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a credential that can log on to the web site. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Port Number This field is the port number used for HTTP forms-based login sessions. The default value is 80. Url Allows you to specify the URL you want to monitor. The SolarWinds SAM variable ${IP} contained in the default value for this field attempts to monitor a web site at the IP address of the assigned node. Use Proxy This checkbox allows you to use a web proxy to access the web site. Proxy Address This field allows you to specify the address of a web proxy to access the web site.
Ignore CA Errors If checked, this indicates that Certificate Authorization (CA) errors will be ignored. Ignore CN Errors If checked, this indicates that Common Name (CN) errors will be ignored. Accept Compression If checked, indicates that compression is supported. Login Form Keywords This field lists the expected keywords that identify an HTML login form. The keywords are matched against the name attribute of the <form> tags found in the HTML of the login page. Each keyword in this list must be enclosed in parentheses '( )', and then separated from other keywords by a vertical bar '|'. The default keywords are: (login)|(auth)|(email). Login Control Keywords This field lists the expected keywords that identify the form's user name input element. The keywords are matched against the name attribute of the <input> tags found in the HTML of the login page. Each keyword in this list must be enclosed in parentheses '( )', and then separated from other keywords by a vertical bar '|'. The default keywords are (login)|(name)|(email). Password Control Keywords This field lists the expected keywords that identify the form's password input element. The keywords are matched against the name attribute of the <input> tags found in the HTML of the login page. Each keyword in this list must be enclosed in parentheses '( )', and then separated from other keywords by a vertical bar '|'. The default keywords are (password)|(pwd)|(passwd)|(psswd)|(pswd). Login Failed Regular Expression This field contains the regular expression for matching an unsuccessful login. This expression may appear anywhere in the HTML source of the page. Login Success Keywords This field contains the regular expression for matching a successful login. This expression may appear anywhere in the HTML source of the page.
Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
HTTP Monitor
This component monitor tests a web server's ability to accept incoming sessions and transmit the requested page. The component monitor can optionally search the delivered page for specific text strings and pass or fail the test based on that search. The HTTP Monitor measures the time it takes the HTTP get for the page referenced in the component monitor to load. This response time is measured in milliseconds. Note: If a web page redirects to another page, the response time measures the entire time from the original request until the last redirected page is loaded. Statistic This component monitor does not compute a statistic. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring If the web site is password-protected, select a credential that can access the web site. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. If the web site is not password protected, do not specify a credential. Port Number The port used for the web site. The default value is 80.
Url This field allows you to specify the URL you want to monitor. The SolarWinds SAM variables contained in the default value for this field attempt to monitor a web site at the IP address of the assigned node ${IP} and on the port specified in the Port Number field ${PORT}. Proxy Servers: To prevent proxy servers from caching the monitored URL, you can append a unique query string to the URL with the ${TimeStamp} variable. Example "cache buster" for simple URL:
http://${IP}:${Port}/?_cb=${TimeStamp}
Example "cache buster" for URL with existing query string:

http://${IP}:${Port}/?page.aspx?var=value&_cb=${TimeStamp}
Follow Redirect This checkbox allows you to specify the component monitor to automatically follow server-side redirects. Use Proxy This checkbox allows you to use a web proxy to access the web site. Proxy Address This field allows you to specify the address of a web proxy to access the web site. User Agent This field allows you to emulate a specific user agent or browser type when contacting the web site. For example, to emulate Internet Explorer version 7, type Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0). For more information about user agent strings, see http://www.useragentstring.com Search String This field contains the text string indicating successful page retrieval. If the specified string is found in the web page content, the monitor is considered up.
Note: The search string is not case-sensitive. Fail if Found This checkbox allows you to reverse the default behavior of the search string. If the search string is found in the web page content, the monitor is considered down instead of up. Head Request This field allows you to ensure the web site responds to the HTTP protocol, but without checking the validity of the web page content. Search strings are ignored if you select this option. Accept Compression If checked, indicates that compression is supported. Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
HTTPS Monitor
This component monitor tests a web server's ability to accept incoming sessions over a secure channel and then transmit the requested page. The component monitor can also test the security certificate. The HTTPS Monitor measures the time it takes the HTTPS get for the page referenced in the component monitor to load. This response time is measured in milliseconds. Note: If a web page redirects to another page, the response time measures the entire time from the original request until the last redirected page is loaded. Statistic This component monitor does not compute a statistic. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring If the web site is password-protected, select a credential that can access the web site. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Port Number The port used by the web site. The default value is 443.
Url This field allows you to specify the URL you want to monitor. The SolarWinds SAM variables contained in the default value for this field attempt to monitor a web site at the IP address of the assigned node ${IP} and on the port specified in the Port Number field ${PORT}. Proxy Servers: To prevent proxy servers from caching the monitored URL, you can append a unique query string to the URL with the ${TimeStamp} variable. Example "cache buster" for simple URL:
http://${IP}:${Port}/?_cb=${TimeStamp}
Example "cache buster" for URL with existing query string:

http://${IP}:${Port}/?page.aspx?var=value&_cb=${TimeStamp}
Follow Redirect This checkbox allows you to specify the component monitor to automatically follow server-side redirects. Use Proxy This checkbox allows you to use a web proxy to access the web site. Proxy Address This field allows you to specify the address of a web proxy to access the web site. Certificate Subject This field allows you to specify the X.509 certificate subject (DN). Use spaces ( ) or commas (,) to separate the different subject fields. Semicolons, commas with spaces after them, and newline or carriage returns are not acceptable separators. Ignore CA Errors This checkbox allows you to specify the component monitor to ignore the certificate authority (CA). Ignore CN Errors This checkbox allows you to specify the component monitor to ignore the certificate name (CN).
User Agent This field allows you to emulate a specific user agent or browser type when contacting the web site. For example, to emulate Internet Explorer version 7, type Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0). For more information about user agent strings, see http://www.useragentstring.com Search String This field contains the text string indicating successful page retrieval. If the specified string is found in the web page content, the monitor is considered up. Note: The search string is not case-sensitive. Fail if Found This checkbox allows you to reverse the default behavior of the search string. If the search string is found in the web page content, the monitor is considered down instead of up. Head Request This checkbox allows you to ensure the web site responds to the HTTPS protocol, but without checking the validity of the web page content. Search strings are ignored if you select this option. Accept Compression If checked, indicates that compression is supported. Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
IMAP4 Monitor
This component monitor tests the ability of an IMAP4 server to accept incoming connections and respond with the correct code. Statistic This component monitor does not compute a statistic. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Port Number This field is the port number used for IMAP4 sessions. The default value is 143. Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
IMAP4 User Experience Monitor

This component monitor tests an email round trip from your SMTP mail server to your IMAP4 server and measures the time it takes to complete the trip. This response time is measured in milliseconds. This component monitor uses the following ports when used with a Microsoft Exchange mail server: 102 X.400 MTA 110 POP3 119 NNTP 143 IMAP4 389 LDAP 563 POP3 over SSL. 636 LDAP over SSL. 993 IMAP4 over SSL. 995 POP3 over SSL.
Statistic This component monitor does not compute a statistic. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a credential that can retrieve email from an IMAP4 server. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential.
Send Email From This field allows you to specify the From address of the test email message. Send Email To This field allows you to specify the recipient of the test email message. The recipient should have a mailbox on the IMAP4 server you are monitoring. IMAP4 Port This field is the port number used for IMAP 4 sessions. The default value is 143. For Secure IMAP (IMAP4-SSL), use port 585. For IMAP4 over SSL (IMAPS), use port 993. IMAP4 Encryption This list allows you to select an encryption protocol to connect to IMAP4 servers that support SSL or TLS encryption. SMTP Server This field allows you to specify the SMTP server that sends the test email message. SMTP Port This field is the port number used for SMTP sessions. The default value is 25. Use Credentials for SMTP This checkbox allows you to use the user name and password from Credentials for Monitoring to connect to SMTP servers that support or require authentication. SMTP Encryption This list allows you to select an encryption protocol to connect to SMTP servers that support SSL or TLS encryption. Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data.
Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
JMX Monitor
This template tests the overall performance of a Java Application Server Prerequisites: The JMX connector must be enabled on the Java application server. Credentials: You may need either JMX credentials or none at all. This depends on the credentials required based on the configuration of your Java application server. For more information, see Configuring Java Applications Servers for " Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Component Type This describes the type of monitor you are using. Enable Component This option determines whether or not the component is enabled. Disabling this component leaves it in the application as deactivated and does not influence application availability or status. Credential for Monitoring This allows you to set JMX credentials for querying MBeans. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Port Number This field allows you to specify the port number used for JMX connections. Protocol This field allows you to choose between using Remote Method Invocation (RMI) and Invocation over Internet Inter-Orb Protocol (IIOP). Note: RMI should be correctly referred to as RMI/JRMP and IIOP as RMI/IIOP based on JMX Specifications.
URL Path This field is for the last part of the JMX service URL. This follows hostname:portnumber and begins with a slash. For example:
service:jmx:rmi:///jndi/rmi://HostName:portnumber/jmxrmi
Object Name This field is for the unique string identifier of an MBean in the form of
<domain-name>:<key property>.
Attribute Name This field is for the name of an MBean attribute. Key This is used for monitoring composite attributes, which consist of key:value pairs. Note: SAM only supports monitoring of numerical data type attributes. Count Statistic as Difference Changes the statistic to be the difference in query values between polling cycles. Convert Value Checking the Convert Value checkbox opens the formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. For more information, see Conversion Value." Statistic Warning Threshold This field allows you to specify when a threshold that indicates a warning level has been breached. Logical operators are in the dropdown followed by a blank field for you to enter the value of this threshold. For example: Less
than 15.
than 5.
LDAP User Experience Monitor

This component monitor tests the capabilities of a Lightweight Directory Access Protocol (LDAP) server, and measures the time it takes to perform an LDAP query. Statistic The number of entries returned by the LDAP query. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a credential that has administrator access to the LDAP server. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Port Number The port used for LDAP connections. The default value is 389. For LDAP over SSL, use port 636. Encryption Method Specifies an encryption method for the LDAP connection. The default setting is None. Authentication Method Specifies the authentication method for the LDAP connection. The default setting is Simple. Realm (user domain) Specifies the realm to use for LDAP authentication.
LDAP Search Root Specifies the LDAP root or suffix to use for the search. LDAP Filter Specifies the search parameters of the LDAP query. The default LDAP Filter value is (&(objectClass=Person)(cn=someuser)), and it searches for all
entries that have objectClass=Person and cn=someuser.
Convert Value Checking the Convert Value checkbox opens the formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. For more information, see Conversion Value." Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Statistic Warning Threshold This field allows you to specify when a threshold that indicates a warning level has been breached. Logical operators are in the dropdown followed by a blank field for you to enter the value of this threshold. For example: Less
than 15.
than 5.
Linux/Unix Script Monitor

This component monitor uses SSH to upload a script to a Linux/Unix server, runs the script on the server, and then processes the return value and text output. Note: A maximum of 10 output pairs can be returned. If you exceed the maximum allowed, remove the excess output pairs or they will simply be ignored. Statistic The statistic for this component monitor is the Statistic value returned by the script. For more information, see Creating a Linux/Unix Script Monitor on page 246. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a credential that can access the Linux or Unix server over SSH, and that has sufficient rights to run scripts. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Port Number This field allows you to specify the port number used for the SSH connection. The default value for this field is 22. Script Working Directory This field allows you to specify the working directory of the script process. Count Statistic as Difference Changes the statistic to be the difference in query values between polling cycles.
Command Line This field allows you to specify the shell command run after the SSH connection is established. The default command line value perl ${SCRIPT} arg1 arg2 attempts to run in a Perl interpreter the script defined in the Script Body field using the parameters arg1 arg2. Note: The length of the Command Line field is limited to 266 characters for Solaris systems, minus the length of the ${SCRIPT} variable after being resolved to a file name such as the following: APM_937467589.pl. Since the length of the file name will typically be around 16 characters, this means that the actual user Command Line input cannot be longer than 266 16, or about 250 characters (not including the length of the 9 characters for the ${SCRIPT} variable itself). If you need to pass a longer command line to the target node, you can create a shell script on the target node (for example myscript.sh) that contains the long command line, and place the call to this script in the Command Line field, for example:
/opt/sw/myscript.sh
Script Body This field allows you to specify the script you want to run on the Linux or Unix server. For more information, see Creating a Linux/Unix Script Monitor on page 246. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
MAPI User Experience Monitor

This component monitor sends an email from your SMTP mail server to your Microsoft Exchange Server Mailbox and measures the time it takes to complete the trip. You can use this component monitor to monitor the performance of Outlook. This response time is measured in milliseconds. The Exchange Server computer uses port 135 for client connections to the RPC endpoint mapper service. After a client connects to a socket, the Exchange Server computer allocates the client two random ports to use to communicate with the directory and the information store. For a complete list of network ports used by Microsoft Server Products, refer to the following article: http://technet.microsoft.com/en-us/library/cc875824.aspx Install the MAPI Client on Your SolarWinds SAM Server This component monitor requires you to install the Microsoft Exchange Server MAPI Client and Collaboration Data Objects on your SolarWinds SAM server. You can download the MAPI Client from: The Microsoft Download Center. http://www.microsoft.com/downloads/details.aspx?FamilyID=E17E7F31079A-43A9-BFF2-0A110307611E
Statistic This component monitor does not compute a statistic. The response time is the difference between the time SolarWinds SAM sends the email and the time it is received by the recipient. Notes 1. This component monitor waits for the email to arrive based on the default job timeout of 20 minutes. If the email does not arrive within this period, SolarWinds SAM marks the monitor as down. 2. The monitor goes through the following steps with respect to the mail flow:
a. Sends an email to the user mailbox via SMTP. The email has a unique temporary subject name that starts with APM_prefix. b. Connects to the user mailbox through MAPI, then searches the emails by Subject. c. If it does not find the email it is looking for, it waits and then searches again. It will stop when: it finds the email, the timeout is reached, or the maximum number of attempts is reached.
d. Once it finds the email, the monitor deletes it from the user inbox. e. The monitor collects the total round trip time for the email and compares it with the thresholds set. f. Once it knows the round trip time, status is given according to where it falls with regard to the thresholds set.
If the email is not found within the timeout or the maximum number of attempts, or SMTP or MAPI reported an error, SolarWinds SAM will mark the monitor as down. 3. Emails the monitor sends are deleted from user inboxes, but only if the monitor successfully connected via MAPI. If the SMTP call succeeded, but MAPI failed, the email remains in the user inbox. 4. It is not currently possible to use the monitor without SMTP and send the email from the same server the monitor is running on via MAPI. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a credential that is both a user who can log on to the SolarWinds SAM server, and that has an Exchange account on the MAPI server. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential.
Send Email From This field allows you to specify the From address of the test email message. Send Email To This field allows you to specify the recipient of the test email message. The recipient should have a mailbox on the MAPI server you are monitoring. MAPI Profile Name Allows you to specify the name of the MAPI profile SMTP Server This field allows you to specify the SMTP server that sends the test email message. SMTP Port This field is the port number used for SMTP sessions. The default value is 25. Use Credentials for SMTP This checkbox allows you to use the user name and password from Credentials for Monitoring to connect to SMTP servers that support or require authentication. SMTP Encryption This list allows you to select an encryption protocol to connect to SMTP servers that support SSL or TLS encryption. Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
Nagios Script Monitor

This component monitor runs the Nagios script on the SolarWinds SAM server and then processes the script's exit code and text output. This monitor has the ability to return multiple values. Note: A maximum of 10 output pairs can be returned. If you exceed the maximum allowed, remove the excess output pairs or they will simply be ignored. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Component Type This describes the type of monitor you are using. Enable Component This option determines whether or not the component is enabled. Disabling this component leaves it in the application as deactivated and does not influence application availability or status. Credential for Monitoring Select a Windows credential that is both a user who can log on to the SolarWinds SAM server, and has sufficient rights on the target node to do whatever the script needs to do. For example, if the script does something with WMI, the credentials also need WMI rights on the target node. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Port Number This field allows you to specify the port number used for the SSH connection. The default value is 22. Script Working Directory This field allows you to specify the working directory of the script process. Check Type This determines how the return code is evaluated.

Return Code 0 1 2 3 Service State Ok Warning Critical Unknown Host State Up Up or Down/Unreachable Down/Unreachable Down/Unreachable
If the Use Aggressive Host Checking option is enabled, return codes of 1 will result in a host state of DOWN, otherwise return codes of 1 will result in a host state of UP. Count Statistic as Difference Changes the statistic to be the difference in query values between polling cycles. Command Line This field is in the script editing window and allows you to specify the script you want to run on the target node followed by the arguments. To enter your script, click the Edit button that reveals the script editing window. For more information, see http://nagios.sourceforge.net/docs/3_0/pluginapi.html. Body This field is in the script editing window and allows you to enter your script via typing or pasting. Status Roll-Up This option allows you to choose how you would like the monitor to report based on the output provided by the script. The default selection is Show worst status. For more information, see "Managing the Display of Group Status" on page 172. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts". For more information, see Creating a Nagios Script Monitor" on page 258.
NNTP Monitor
This component monitor tests the ability of an NNTP server to accept incoming connections and respond with the correct code. Statistic This component monitor does not compute a statistic. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts". Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Port Number This field is the port number used for NNTP connections. The default value is 119. Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts".
ODBC User Experience Monitor

This component monitor uses synthetic transactions to test the abilities of an ODBC-accessible database such as MySQL. The component monitor connects to the database, performs a query, and then retrieves the data. ODBC drivers for your database type must be installed on the SolarWinds SAM server. The SQL statement you use for this query must return a numerical value, not a varchar. Statistic The statistic for this component monitor is the first row and column of the data retrieved by the query. It must be a numerical value. Install ODBC Drivers on the SolarWinds SAM Server. You must install on the SolarWinds SAM server the ODBC drivers for your database. For more information on acquiring or installing the ODBC drivers, consult your database documentation. TCP Ports This component monitor uses port TCP/1630. Oracle Connection Manager provides the listening port for Oracle client connections to Oracle Connection Manager. You can configure Oracle Connection Manager either through a custom installation, or configure it after installation using Net Configuration Assistant. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts". Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a database credential that can access the database. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential.
Connection String This field allows you to specify the ODBC connection string for the database. If you do not know the connection string to your ODBC-accessible database, you can look it up on http://www.connectionstrings.com. The connection string may include the variables ${IP}, ${USER}, and ${PASSWORD}, which are replaced respectively by the IP address of the database server, the credential user name, and the credential password. If you are using the ODBC User Experience Monitor instead of the SQL Server User Experience monitor for a SQL Server database that is not using the default port 1433, perform the following to create a connection string. To create the SQL Server connection string: 1. Using notepad, create an empty .udl file. 2. Double-click the .udl file to open the Data Link Properties dialog. Click Next to navigate from tab to tab and configure and test your ODBC connection. Note: Remember to select the desired database provider on the Provider tab, in this case the provider for SQL Server. 3. If the option is present for the provider, check the allow saving password option, as this will ensure that the connection string contains the password when you next retrieve it. 4. When you are finished, and have tested that the connection works, click Ok. 5. Open the .udl file again in Notepad, and retrieve the connection string. For additional information about creating and configuring Universal Data Link (.udl) Files, refer to the MSDN article. Sql Query This field allows you to specify the SQL query used to test the database. The retrieved data is then used as the component monitor statistic. You may enter up to 4,000 characters. Query Timeout The amount of time, in seconds, until the SQL query will timeout. Count Statistic as Difference Changes the statistic to be the difference in query values between polling cycles.
Convert Value Checking the Convert Value checkbox opens the formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. For more information, see Conversion Value." Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Statistic Warning Threshold This field allows you to specify when a threshold that indicates a warning level has been breached. Logical operators are in the dropdown followed by a blank field for you to enter the value of this threshold. For example: Less
than 15.
than 5.
Oracle User Experience Monitor

This component monitor uses synthetic transactions to test the abilities of an Oracle database. The component monitor connects to the database, performs a query, and then retrieves the data. Oracle Net Services from the Oracle Client must be installed on the SolarWinds SAM server. The SQL statement you use for this query must return a numerical value, not a varchar. Statistic The statistic for this component monitor is the first row and column of the data retrieved by the query. It must be a numerical value. Install Oracle Client on the SolarWinds SAM Server. This component monitor requires you to install the Oracle Net Services from the Oracle Client on your SolarWinds SAM server. You can download the Oracle Client from: The SolarWinds customer portal "Additional Components" section. http://www.solarwinds.com/customerportal/ The Oracle Database Software Downloads web site. http://www.oracle.com/technology/software/products/database/index.html
Note: For information about using this monitor without the ODBC connection, see the following SolarWinds knowledgebase article: http://knowledgebase.solarwinds.com/kb/questions/2067/ TCP Ports This component monitor uses ports TCP/1521 and TCP/1526. The Oracle SQL*Net Listener allows Oracle client connections to the database over Oracle's SQL*Net protocol. You can configure it during installation. To reconfigure this port, use Net Configuration Assistant. Monitoring Oracle Real Application Clusters You must monitor each cluster member separately. For example, if 1.1.1.1 is the address of the cluster, but 1.1.1.2 and 1.1.1.3 are the actual cluster members, you need to create separate applications for each member, and monitor the database instances individually.
Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a database credential that can access the database. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Port Number This field allows you to specify the port number used to communicate with the Oracle database. The default value for this field is 1521. Sql Query This field allows you to specify the SQL query used to test the database. The retrieved data is then used as the component monitor statistic. You may enter up to 4000 characters. Destination Point Type This option tells SolarWinds SAM whether you are accessing the database by its Oracle System ID (SID) or by its service name. SID Select this to access the database by its System ID. Service_Name Select this to access the database by its service name. Though we call this option 'net service name', do not enter the net service name. Destination Point Name This field allows you to specify either the service name or the SID to access the Oracle database over a network. Do not enter the net service name. To determine the name or SID of the database, refer to the tnsnames.ora Oracle configuration file or ask your database administrator.
Example of a service name as a destination point name Destination Point Name: sales.us.example.com Destination Point Type: SERVICE_NAME
tnsnames.ora: ORA11 = (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = 127.0.0.1)(PORT = 1521)) ) (CONNECT_DATA = (SERVICE_NAME = sales.us.example.com) ) )
Example of a SID as a destination point name Destination Point Name: ORA11DATABASE Destination Point Type: SID
tnsnames.ora: ORA11 = (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = 127.0.0.1)(PORT = 1521)) ) (CONNECT_DATA = (SID = ORA11DATABASE) ) )
Oracle Driver Type Allows you to select the driver from the dropdown list. Count Statistic as Difference Changes the statistic to be the difference in query values between polling cycles. Convert Value Checking the Convert Value checkbox opens the formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. For more information, see Conversion Value."
Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Statistic Warning Threshold This field allows you to specify when a threshold that indicates a warning level has been breached. Logical operators are in the dropdown followed by a blank field for you to enter the value of this threshold. For example: Less
than 15.
than 5.
User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts" Scenario: SAM requires two additional components in order to monitor Oracle databases: Oracle's Instant Client SolarWinds Oracle Plug-in.
The steps below should result in a successfully tested and monitored database. 1. The first item to install is the Oracle Instant Client Basic. (In this scenario, we will also install the Instant Client ODBC and SQLPlus packages). http://www.oracle.com/technetwork/database/features/instantclient/index-097480.html Download the version specific to your architecture: Instant Client Package - Basic (the core Instant Client).
Instant Client Package - ODBC (ODBC functionality, requires additional configuration). Instant Client Package - SQLPlus (SQLPlus functionality).
2. Create the directory where the products will be stored. (i.e.: c:\Oracle) 3. Unzip the files into the created directory and preserve the path. ( i.e.:
Instantclient_11_2).
4. Modify your path to reference the directory that the Instant Client files were extracted to:

Path: Add c:\oracle\instantclient_11_2 Tns_Admin: Create if necessary, c:\oracle\instantclient_11_2
5. 6.
Log out to ensure Windows identifies the variables you defined. Create a TNSNAMES.ora file and save it in to
c:\oracle\instantclient_11_2. (Note: An example of TNSNAMES.ora
can be found at: http://www.orafaq.com/wiki/Tnsnames.ora) 7. Install the SolarWinds Oracle Plug-in: Log in to the SolarWinds Customer Portal Click on Additional Components Click on Download Server & Application Monitor Components Click on the Oracle Client Run and install the OracleClientInstaller.exe file
Log in to SolarWinds and browse to the SAM Monitor: Each application item was set up using a SERVICE_NAME point type, with the database name as the Destination Port Name. The User ID to be used for this test cannot be limited or restricted, otherwise it will return errors. Test each component monitor.
Performance Counter Monitor

This component monitor reads Windows Performance Counter data using Remote Procedure Calls (RPC) instead of Windows Management Instrumentation (WMI). All performance counters are assumed to exist within the root/CIMV2 namespace. This monitor uses RPC, requiring the following ports: TCP/135; RPC/named pipes (NP) TCP 139, RPC/NP TCP 445, RPC/NP UDP 137, RPC/NP UDP 138 For information about troubleshooting Windows performance counters, refer to the KB article How can I troubleshoot SolarWinds SAM performance monitoring and Windows performance counters? http://knowledgebase.solarwinds.com/kb/questions/2139 Statistic The statistic for this component monitor is the performance counter value. Optionally, the statistic may be set as the difference in query values between polling cycles by checking the option for Count statistic as difference. Note: the Count statistic as difference option is applicable only for monitors whose counter value increases consistently during each polling interval. Examples of when this option is not applicable include cases such as the following: Counter values sometimes increase and sometimes decrease from one polling interval to another (typical behavior for many counters) Counter values consistently decrease from one polling interval to another
In these cases where the option is not applicable, negative statistic data values will be replaced with zero (0), and the counter monitor will show 0 as the statistic data value in resources and 0 as the value on statistic data charts for this interval. Field Description Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts"
Component Type Identifies the component type as a Performance Counter Monitor. Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a Windows credential that has RPC access to the target node. This is typically a Windows administrator-level credential. Count statistic as difference This option changes the statistic to be the difference in counter values between polling cycles. Counter Enter the name of the performance counter. For example: % Processor Time. Instance Enter the instance name of the performance counter. For example: _Total. If the performance counter has multiple instances, you can monitor each instance separately by creating a Performance Counter Monitor for each instance. For example, the performance counter % Processor Time has two instances if you have a dual-CPU system: 0 for the first CPU and 1 for the second CPU. You can create a separate Performance Counter Monitor to monitor each instance of the counter. Category Enter the category of the performance counter. All performance counters are assumed to exist within the root/CIMV2 namespace. For example: Processor. Convert Value Checking the Convert Value checkbox opens the formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. For more information, see Conversion Value."
than 15.
than 5.
POP3 Monitor
This component monitor tests the ability of a POP3 server to accept incoming connections and respond with the correct code. This component monitor uses the following ports when used with a Microsoft Exchange mail server: 102 X.400 MTA 110 POP3 119 NNTP 143 IMAP4 389 LDAP 563 POP3 over SSL. 636 LDAP over SSL. 993 IMAP4 over SSL. 995 POP3 over SSL.
Statistic This component monitor does not compute a statistic. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Port Number This field is the port number used for POP3 connections. The default value is 110. For Secure POP3 (SSL-POP) use port 995.
Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
POP3 User Experience Monitor

This component monitor tests an email round trip from your SMTP mail server to your POP3 mail server and measures the time it takes to complete the trip. This response time is measured in milliseconds. Statistic This component monitor does not compute a statistic. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a credential that has sufficient access rights to retrieve email from the POP3 server. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Send Email From This field allows you to specify the From address of the test email message. Send Email To This field allows you to specify the recipient of the test email message. The recipient should have a mailbox on the POP3 server you are monitoring. POP3 Port This field is the port number used for POP3 sessions. The default value is 110. For Secure POP3 (SSL-POP) use port 995. POP3 Encryption This list allows you to select an encryption protocol to connect to POP3 servers that support SSL or TLS encryption.
SMTP Server This field allows you to specify the SMTP server that sends the test email message. SMTP Port This field is the port number used for SMTP sessions. The default value is 25. Use Credentials for SMTP This checkbox allows you to use the user name and password from Credentials for Monitoring to connect to SMTP servers that support or require authentication. SMTP Encryption This list allows you to select an encryption protocol to connect to SMTP servers that support SSL or TLS encryption. Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
Process Monitor - SNMP

This component monitor uses SNMP communication to test if a specified process is running, and reports the CPU and physical memory used by all instances of the process. Statistic This component monitor does not compute a statistic. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Command Line Filter This optional field allows you to select which instances of a process you want to monitor, based on the command line arguments of the process. This is a text match, and partial matches are also valid. Example to monitor only instances launched with myOption=NorthAmerica Command Line Filter: myOption=NorthAmerica Example to monitor any instances launched with America in any argument Command Line Filter: America Process Name This field allows you to specify the process name you want to monitor. If you do not know the process name, SolarWinds SAM can help you find processes to monitor. For more information, see "Creating New Templates Using the Browsing Method. CPU Threshold These fields allow you to set warning and critical threshold conditions based on the percentage of CPU resources in use by the monitored process.
Physical Memory Threshold These fields allow you to set warning and critical threshold conditions based on the amount of physical memory in use by the monitored process. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
Process Monitor - WMI

This component monitor uses WMI or RPC communication to test if a specified Windows process is running, and reports the CPU, virtual memory, and physical memory used by all instances of the process. Statistic This component monitor does not compute a statistic. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a Windows credential that has WMI rights on the target node. This is typically a Windows administrator-level credential. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Fetching Method Select the Fetching Method (Communication Type): WMI (Windows Management Instrumentation) Use WMI communication to test if the specified Windows process is running. RPC (Remote Procedure Call) Use RPC communication to test if the specified Windows process is running.
Command Line Filter This optional field allows you to select which instances of a process you want to monitor, based on the command line arguments of the process. This is a text match and partial matches are also valid. Example to monitor only instances launched with myOption=NorthAmerica Command Line Filter: myOption=NorthAmerica Example to monitor any instances launched with America in any argument Command Line Filter: America Process Name This field allows you to specify the process name you want to monitor. If you do not know the process name, SolarWinds SAM can help you find processes to monitor using the Find Processes, Services, and Performance Counters wizard. For more information, see "Creating New Templates Using the Browsing Method. CPU Threshold These fields allow you to set warning and critical threshold conditions based on the percentage of CPU resources in use by the monitored process. Physical Memory Threshold These fields allow you to set warning and critical threshold conditions based on the amount of physical memory in use by the monitored process. Virtual Memory Threshold These fields allow you to set warning and critical threshold conditions based on the amount of virtual memory in use by the monitored process. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
RADIUS User Experience Monitor

This component monitor uses synthetic transactions to test user authentication through the RADIUS protocol. The synthetic transaction does the following: 1. Connect to server. 2. Send RADIUS credential and shared secret. 3. Validate response. 4. Measure response time. Statistic This component monitor does not compute a statistic. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a RADIUS credential or create one in the Quick Credentials section. Authentication Port Number This field is the RADIUS protocol authentication port. The default value is 1812. Cisco devices may require port 1645. Accounting Port Number This field is the RADIUS protocol accounting port. The default value is 1813. Cisco devices may require port 1646. Secret Key This field is the RADIUS protocol shared key.
Response Time Threshold These fields allow you to set warning and critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
Service Status SNMP

This component monitor tests and reports the status of a service using SNMP. Service statuses are: 1 Running 2 Continue Pending 3 Pause Pending 4 Paused
Statistic The statistic for this component monitor is the value for one of the reported statuses: 1-4. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Net Service Display Name This field is the Display name of the service to monitor. You can find the Display name on Windows systems by clicking Start > Administrative Tools > Services and then locating the desired service. The Display name for the service is the value in the Name column. Statistic Warning Threshold This field allows you to specify when a threshold that indicates a warning level has been breached. Logical operators are in the dropdown followed by a blank field for you to enter the value of this threshold. For example: Less
than 15.
than 5.
SMTP Monitor
This component monitor tests the ability of an SMTP server to accept incoming connections and respond with the correct code. Statistic This component monitor does not compute a statistic. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Port Number This field is the port number used for SMTP connections. The default value is 25. For Secure SMTP (SSMTP), use port 465. Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
SNMP Monitor
This component monitor uses the SNMP protocol to retrieve an entry in a Management Information Base (MIB) by its Object Identifier (OID), and returns the value of the entry as a statistic. Statistic Value of the entry retrieved from the MIB. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Object Identifier (OID) Specify the OID of the entry in the MIB you want to retrieve. Custom SNMP port (set to 0 to use default SNMP port) This field is the port number of the custom SNMP port. Set this field to 0 to use the default SNMP port defined in the Nodes properties. Count Statistic as Difference Changes the statistic to be the difference in query values between polling cycles. Convert Value Checking the Convert Value checkbox opens the formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. For more information, see Conversion Value."
than 15.
than 5.
SQL Server User Experience Monitor

This component monitor uses synthetic transactions to test the abilities of a Microsoft SQL Server database. The component monitor connects to the database, performs a query, and then retrieves the data. The SQL statement you use for this query must return a numerical value, not a varchar. Statistic The statistic for this component monitor is the first row and column of the data retrieved by the query. It must be a numerical value. This monitor uses SQL Server port 1433 This component monitor only works if Microsoft SQL Server is using the default port 1433. If you have a Microsoft SQL Server database that uses a nonstandard port, you cannot monitor it using the SQL Server User Experience monitor. You need to use the ODBC User Experience monitor instead to manually define a connection string that will allow you to talk to Microsoft SQL Server on its custom port. Refer to the Connection String field description in the ODBC User Experience Monitor section for details. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a Windows credential or SQL Server credential that can access the database. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Sql Query This field allows you to specify the SQL query used to test the database. The retrieved data is then used as the component monitor statistic. You may enter up to 4000 characters.
SQL Server Instance This field allows you to specify the SQL Server instance required to access the SQL Server database. Enter only the instance name. Do not prefix the instance name with the server name. To access the default instance, leave this field blank. Initial Catalog This field allows you to specify the initial database (catalog) for the connection. Use Windows Authentication first, then SQL authentication Select this checkbox to access a SQL Server that supports or requires Windows Authentication, and specifies that the credential is a Windows credential instead of a SQL Server credential. Query Timeout Allows you to specify when this query should timeout in seconds. The default timeout period is 30 seconds. Count Statistic as Difference Changes the statistic to be the difference in query values between polling cycles. Convert Value Checking the Convert Value checkbox opens the formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. For more information, see Conversion Value." Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data.
than 15.
than 5.
SSL Certificate Expiration Monitor

This component monitor tests a web server's ability to accept incoming sessions over a secure channel and then test the security certificate's expiration date. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Port Number The default value for this port is 443. Convert Value Checking the Convert Value checkbox opens the formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. For more information, see Conversion Value." Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data.
than 15.
than 5.
TACACS+ User Experience Monitor

This component monitor uses synthetic transactions to test user authentication through the TACACS+ protocol. The synthetic transaction does the following: 1. Connect to server. 2. Send TACACS+ credential and shared secret. 3. Validate response. 4. Measure response time. Statistic This component monitor does not compute a statistic. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a TACACS+ credential or create one in the Quick Credentials section. Port Number This field is the TACACS+ protocol connection port. The default value is 49. Secret Key This field is the TACACS+ protocol shared key. Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data.
Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
TCP Port Monitor

This component monitor tests the ability of a TCP/IP-based service to accept incoming sessions. The Monitor tries to establish a socket connection using the Connect method of System.Net.Sockets.TcpClient class in the .NET framework. The elapsed time for a connection is saved as Response Time in the result. More information can be found at http://msdn.microsoft.com/enus/library/8s2yca91.aspx). Statistic This component monitor does not compute a statistic. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Port Number This field is the TCP protocol connection port. The default value is 80. Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data.
Tomcat Server Monitor

This component monitor collects server resource information from Apache Tomcat servers by retrieving status information from http://{$IP}:{$PORT}/manager/status/?XML=true. Statistic One of the following Tomcat variables as specified in the Tomcat Variables Name field. Free Memory Amount of heap space currently available to the Java Virtual Machine. Total Memory Total memory currently allocated to the Java Virtual Machine heap space. Max Memory Maximum size of the heap space not including the permanent generation area. Total Processing Time Total processing time in milliseconds since server start. Total Request Count Total requests from server since server start. Total Bytes Sent Total bytes sent from server since server start. Total Bytes Received Total bytes sent to server since server start. Total Error Count Total error count from all request processors. Field Description Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts"
Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a credential that can access the password-protected portion of the web site. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Port Number This field allows you to specify the port number used by the web site. The default value for this field is 8080. Url Allows you to specify the URL you want to monitor. The SolarWinds SAM variables ${IP} and ${PORT} contained in the default value for this field attempts to monitor a web site at the IP address of the assigned node. Tomcat Variables Name Specifies the Tomcat server variable to monitor. Convert Value Checking the Convert Value checkbox opens the formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. For more information, see Conversion Value." Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data.
than 15.
than 5.
VMware Performance Counter Monitor

The VMware Performance Counter monitor reads VMware performance counter data using the VMware vSphere Web Services API. The currently used vSphere Web Services API version is 4.0, which supports vSphere 4.0 servers and also is compatible with previous releases of ESX/ESXi and VirtualCenter Server, including the following: ESX/ESXi 3.5.x or later VirtualCenter Server 2.5 and VirtualCenter Server 2.0.x.
The vSphere Web Services SDK package includes WSDL files for vSphere API 4.0, which is a superset of API versions starting with API 2.5, and for VI API 2.0. For an example of monitoring VMware performance counters, see Monitoring VMware Performance Counters on page 65. Statistic The statistic for this component monitor is the value of the performance counter data retrieved by the VMware API. Optionally, the statistic may be set as the difference in retrieved values between polling cycles by checking the option for Count statistic as difference. Note: the Count statistic as difference option is applicable only for monitors whose counter value increases consistently during each polling interval. Examples of when this option is not applicable include cases such as the following: Counter values sometimes increase and sometimes decrease from one polling interval to another (typical behavior for many counters) Counter values consistently decrease from one polling interval to another
Component Type Identifies the component type as a VMware Performance Counter Monitor. Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a VMware credential that can access the VMware API. This is typically a vCenter/ESX Server administrator-level credential. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Note: Read-Only credentials are sufficient since VMware objects are accessed solely in read-only mode. Port Number Port number to use for VMware API. The default is 443. Url URL to use for connecting to the VMware API. Count Statistic as Difference Changes the statistic to be the difference in query values between polling cycles. Entity Type Select one of the following: Cluster Compute Resource (only applicable if you are monitoring VirtualCenter Server) Data object that aggregates the computation resources of its associated Host System objects into one single computation resource for use by virtual machines. The cluster services such as HA (High Availability), DRS (Distributed Resource Scheduling), and EVC (Enhanced vMotion Compatibility), enhance the usefulness of this single computation resource. This Entity Type is specific to vCenter systems. Host System Managed object type that provides access to a virtualization host platform. Resource Pool Represents a set of physical resources which may be a single host, a subset of a host's resources, or resources spanning multiple hosts. You can subdivide Resource pools by creating child resource pools. In order to run, a virtual machine must be associated as
a child of a resource pool. In a parent/child hierarchy of resource pools and virtual machines, the root resource pool is the single resource pool that has no parent pool. Virtual Machine Managed object type for manipulating virtual machines, including templates that can be repeatedly deployed as new virtual machines. This object type provides methods for configuring and controlling a virtual machine.
Entity Name Specifies the VMware entity name to monitor, for example VirtualMachine1. For VMs, you can view these values using the VMware console. This field may contain the special ${VMWARE_ENTITY_NAME} variable. When the monitor runs, this variable will be resolved to the first available entity on a target host with the desired Entity Type (for example, the first Host System). For more information, refer to the Multiple systems case in step 11 of the section Monitoring VMware Performance Counters on page 65. Group Specifies the VMware group to which the counter belongs, for example: CPU, memory, and so forth. Counter Specifies the VMware counter to fetch, for example: coreUtilization, and so forth. Note: Click Find Processes, Services, and Performance Counters on the SAM Settings page to browse the counters available for monitoring, including their groups, rollup types, and instance names. Then select one of the following component monitor types, depending on what you want to monitor: VMware ESX Performance Counter Monitor monitors performance counters for ESX servers VMware vCenter Performance Counter Monitor monitors performance counters for vCenter servers Rollup Type Specifies the way to roll up the VMware counter data, for example: average, latest, summation, and so forth. Instance Specifies the instance to be fetched, for example: 0, 1, 2, and so forth.
Convert Value Checking the Convert Value checkbox opens the formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. For more information, see Conversion Value." Statistic Warning Threshold This field allows you to specify when a threshold that indicates a warning level has been breached. Logical operators are in the dropdown followed by a blank field for you to enter the value of this threshold. For example: Less
than 15.
than 5.
Web Link Monitor

This component monitor collects the number of broken or invalid links on a web page. Prerequisites: None Credentials: None Statistic The number of broken or invalid links collected. Field Description Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a credential that can access the password-protected portion of the web site. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Url Allows you to specify the URL you want to monitor. The SolarWinds SAM variable ${IP} contained in the default value for this field attempts to monitor a web site at the IP address of the assigned node. Accept Compression If checked, indicates that compression is supported.
Exclusion Filter Allows you to create an exclusion filter if there are links the component monitor should not attempt to validate. It is a text matching filter. Example that excludes any links to .png graphics files Exclusion Filter: png Ignore External Links This option excludes external links from validation. External links are links that do not link back to the same second-level domain as the original URL. Convert Value Checking the Convert Value checkbox opens the formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. For more information, see Conversion Value." Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Statistic Warning Threshold This field allows you to specify when a threshold that indicates a warning level has been breached. Logical operators are in the dropdown followed by a blank field for you to enter the value of this threshold. For example: Less
than 15.
than 5.
Windows Event Log Monitor

This component monitor uses WMI communication to scan Windows Event Logs for recent events matching your defined criteria. Events are considered recent based on the age of the event as compared to the application polling frequency. If a matching event is found, the component monitor changes status. The component monitor eventually returns to its original status as time passes so you may not notice a matching event unless you create an alert to email you when the component goes down. This component monitor uses the following ports: TCP/135; RPC/named pipes (NP) TCP 139, RPC/NP TCP 445, RPC/NP UDP 137, RPC/NP UDP 138 Statistic The number of recent events matching your defined criteria. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a Windows credential that has access to the Windows event logs on the target node. This is typically a Windows administrator-level credential. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Log to Monitor Select Any Log to match events found in any log or select a specific log to restrict your search. If the log you want is not listed, select Custom.
Custom Log to Monitor Enter the log names as they appear in the Windows event log viewer. Separate multiple log names with commas. Example: Internet Explorer, SolarWinds.net Match Definition Select Any error in log generates a match if that is sufficient for your needs, or select Custom to further restrict the match criteria. Log Source Enter a log source to further restrict the match criteria or leave the field blank to match all possible log sources. Event ID Select the desired option to further restrict the match criteria for event IDs or leave the field blank to find all possible event IDs: Find all IDs match all event IDs Match only specific IDs match all event IDs listed (separate multiple IDs with commas) Note: When you use multiple event IDs separated by commas, the logic used to combine these event IDs is OR, so all events that contain one of the event IDs listed are matched. Exclude specific IDs exclude all event IDs listed (separate multiple IDs with commas) Event Type Select Any Event to match any event type in the log, or select a specific event type to further restrict the match criteria. User who generated Events Enter a user name to further restrict the match criteria. Leave this field blank to match any users. Enter "N/A" to select only events with no specific user. Include events Select With Keywords Below to specify keywords or phrases as the match criteria. Select Matching Regular Expression Below to specify regular expressions that match text that appears in the events. For information about the regular expressions syntax, see .NET Framework Regular Expressions, http://msdn.microsoft.com/enus/library/hs600312%28VS.80%29.aspx.
Exclude events Select With Keywords Below to specify keywords or phrases as the match criteria. Select Matching Regular Expression Below to specify regular expressions that match text that appears in the events. For information about the regular expressions syntax, see .NET Framework Regular Expressions, http://msdn.microsoft.com/enus/library/hs600312%28VS.80%29.aspx. Number of past polling intervals to search for events: Enter the number of polling intervals worth of time you want to search the event logs. For example, to always search the past 20 minutes of event logs, you could set the application polling interval to five minutes and then set the Number of Past Polling Intervals to four (4 x 5mins = 20mins). Fractional values are valid. If a match is found in a polling period, component is: Select whether a found match should set the component status to Up or to Down. EntryID Application-specific event identifier for the current event entry. Convert Value Checking the Convert Value checkbox opens the formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. For more information, see Conversion Value." Statistic Warning Threshold This field allows you to specify when a threshold that indicates a warning level has been breached. Logical operators are in the dropdown followed by a blank field for you to enter the value of this threshold. For example: Less
than 15.
than 5.
Windows PowerShell Monitor

This component monitor runs a Windows PowerShell script on the SolarWinds SAM server or a remote target node and then processes the script's exit code and text output. The Windows PowerShell Monitor requires Windows PowerShell 2.0. It does not work with Windows PowerShell 1.0. For an example of creating a Windows PowerShell Monitor, see Creating a Windows PowerShell Monitor" on page 261. If you are having trouble using the Windows PowerShell Monitor, see the following KB article for some useful tips: http://knowledgebase.solarwinds.com/kb/questions/2203 Note: A maximum of 10 output pairs can be returned. If you exceed the maximum allowed, remove the excess output pairs or they will simply be ignored. Statistic The statistic for this component monitor is the Statistic value returned by the script. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a Windows credential that is both a user who can log on to the SolarWinds SAM server, and has sufficient rights on the target node to do whatever the script needs to do. For example, if the script does something with WMI, the credentials also need WMI rights on the target node. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential.
The PowerShell monitor handles requests from PowerShell for the credentials to run the script and resolves them using the selected Credential for Monitoring. However some PowerShell commands used in scripts require the use of the ${CREDENTIAL} variable. See the note in the Script Body section below regarding the use of the ${CREDENTIAL} variable. Execution Mode This field allows you to specify where to run the PowerShell script: Count Statistic as Difference Changes the statistic to be the difference in query values between polling cycles. Run the script under specified account Select this option to enable impersonation with the component's credentials. (This works only in local script execution mode.) Local Host can run scripts only locally, that is, on the SolarWinds SAM server. This is the default value. Remote Host can execute scripts remotely (on the selected target node) using the Windows Remote Management (WRM) system component. WRM should be configured separately to get it working with the Windows PowerShell monitor. If Remote Host is selected, the following options are available: Use HTTPS Protocol if checked, specifies that the secure HTTPS protocol should be used to send and receive WS-Management protocol requests and responses. Otherwise the HTTP protocol is used. URL Prefix specifies a URL prefix on which to accept HTTP or HTTPS requests. The default is wsman. Port Number specifies the TCP port for which this listener is created. For WinRM 1.1 and earlier, the default HTTP port is 80. For WinRM 2.0, the default HTTP port is 5985. Script Body This field allows you to specify the PowerShell script you want to run. For more information, see Creating a Windows PowerShell Monitor" on page 261. Note: You can use the ${CREDENTIAL} variable in the script where the credentials are required, as shown in the following example:
Administrator Guide SolarWinds Server & Application Monitor $avg = Get-WmiObject win32_process -ComputerName '${IP}' Credential '${CREDENTIAL}' | Where-Object {$_.Name -eq "lsass.exe" } | Measure-Object -property ReadOperationCount -Average;
Some PowerShell commands (such as Get-WmiObject as shown in the example above) require the use of this ${CREDENTIAL} variable. Therefore, the user name from the specified Credential for Monitoring is stored automatically in the ${CREDENTIAL} variable for you by the monitor. As a result, the ${CREDENTIAL} variable should not be placed in the Script Arguments field, since it is set automatically. When the script is run by PowerShell, since no password has been provided, it prompts for a password and the password from the specified Credential for Monitoring is provided automatically by the monitor. Script Arguments This field allows you to specify arguments to pass to the script. You may include the variable ${IP}, which is replaced by the IP address of the target node. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}.
Windows Script Monitor

This component monitor runs a Windows script on the SolarWinds SAM server and then processes the script's exit code and text output. Beginning in version 4.2, this monitor has the ability to return up to ten pairs, i.e.: 10 statistic values + 10 [optional] messages. For more information, see "Creating a Windows Script Monitor. Note: A maximum of 10 output pairs can be returned. If you exceed the maximum allowed, remove the excess output pairs or they will simply be ignored. Statistic The statistic for this component monitor is the value returned by the script. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Component Type This describes the type of monitor you are using. Enable Component This option determines whether or not the component is enabled. Disabling this component leaves it in the application as deactivated and does not influence application availability or status. Credential for Monitoring Select a Windows credential that is both a user who can log on to the SolarWinds SAM server, and has sufficient rights on the target node to do whatever the script needs to do. For example, if the script does something with WMI, the credentials also need WMI rights on the target node. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential.
Script Engine This field allows you to specify the scripting language to be used. The default value is vbscript. Below is a list of scripting engines that the Windows Script Host supports: Name VBScript JScript PerlScript ooRexxScript PythonScript TclScript ActivePHPScript RubyScript Object Rexx engine Delphi scripting engine Count Statistic as Difference Changes the statistic to be the difference in query values between polling cycles. Script This field allows you to enter the script you want to run on the target node. To enter your script, click the Edit button that reveals the script editing window. Script Arguments This field is in the script editing window and allows you to specify arguments to pass to the script. You may include the variables ${IP}, ${USER}, and ${PASSWORD}, which are replaced respectively by the IP address of the target node, the credential user name, and the credential password. Body This field is in the script editing window and allows you to enter your script via typing or pasting. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts" File Extensions .vbs .js .pls .rxs .pys .tcls .phps .rbs Availability Installed by default Installed by default Freeware Freeware Freeware Freeware Freeware Freeware Commercial Commercial
Windows Service Monitor

This component monitor uses WMI or RPC communication to test if a specified Windows service is running, and reports the CPU, virtual memory, and physical memory used by the service. Statistic This component monitor does not compute a statistic. Field Descriptions Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. For more information, see Configuring SolarWinds SAM Alerts" Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a Windows credential that has WMI rights on the target node. This is typically a Windows administrator-level credential. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Fetching Method Select the Fetching Method (Communication Type): WMI (Windows Management Instrumentation) Use WMI communication to test if the specified Windows process is running. RPC (Remote Procedure Call) Use RPC communication to test if the specified Windows process is running. SAM will poll the service state, and information about CPU/memory usage will be retrieved using performance counters.
Net Service Name This field is the Service name of the service to monitor. You can find the Service name on Windows systems by clicking Start > Administrative Tools > Services and then locating the desired service. Right-click the service and select Properties from the context menu. The Service name is the value of the Service name field in the Properties dialog. CPU Threshold These fields allow you to set warning and critical threshold conditions based on the percentage of CPU resources in use by the monitored process. Physical Memory Threshold These fields allow you to set warning and critical threshold conditions based on the amount of physical memory in use by the monitored process. Virtual Memory Threshold These fields allow you to set warning and critical threshold conditions based on the amount of virtual memory in use by the monitored process. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
WMI Monitor
Formerly known as the WMI Performance Counter Monitor, this component monitor uses WMI communication to obtain the result of a WMI Query Language (WQL) query. The typical result retrieves the performance data calculated by WMI providers such as the Windows operating system or Microsoft Exchange Server. All WQL queries are run within the root/CIMV2 namespace. Note: Named instances of SQL Server may have custom class names that do not match the built-in templates. You must manually change the class name in any WMI Monitor monitoring a named SQL Server instance. For example, if the named instance is "NAMED, you must change Win32_PerfFormattedData_MSSQLSERVER_SQLServerBufferManager to Win32_PerfFormattedData_MSSQLNAMED_SQLNAMEDServerBufferManager. Statistic The statistic for this component monitor is the value of the first row and column of the data retrieved by the query. Optionally, the statistic may be set as the difference in query values between polling cycles by checking the option for Count statistic as difference. Note: the Count statistic as difference option is applicable only for monitors whose counter value increases consistently during each polling interval. Examples of when this option is not applicable include cases such as the following: Counter values sometimes increase and sometimes decrease from one polling interval to another (typical behavior for many counters) Counter values consistently decrease from one polling interval to another
Enable Component Determines whether the component is enabled. Disabling the component leaves it in the application in a deactivated state not influencing either SolarWinds SAM application availability or status. Credential for Monitoring Select a Windows credential that has WMI rights on the target node. This is typically a Windows administrator-level credential. WMI Namespace Specifies the name of the namespace within which all WQL queries are run. The default value is root\CIMV2. WQL Query Type the WQL query you want to run on the target node. This is typically a performance counter Query, but it can be any WQL query. All WQL queries are run within the root/CIMV2 namespace. Count Statistic as Difference Changes the statistic to be the difference in query values between polling cycles. Convert Value Checking the Convert Value checkbox opens the formula box. From here, you have the ability to manipulate the returned value with a variety of mathematical possibilities. You can choose common functions from the dropdown lists to manipulate the returned value, or you can select the Custom Conversion option. For more information, see Conversion Value." Statistic Warning Threshold This field allows you to specify when a threshold that indicates a warning level has been breached. Logical operators are in the dropdown followed by a blank field for you to enter the value of this threshold. For example: Less
than 15.
than 5.
Appendix G
Filter Syntax Reference

Filters are optional database queries that you can add limit the Orion objects listed inside a resource. You can apply filters based on any Orion object property, be it custom or pre-defined within a resource, to help you better interpret the monitoring data shown in the resources. To apply a resource filter: 1. Click Edit in any resource that lists Orion objects. 2. Click Show Filter Examples > Show List of Properties to list the properties you can use for the filter criteria 3. Provide appropriate filter criteria in the Filter Nodes field and then click Submit.
Filter Syntax
There are two slightly different filter syntax types: Structured Query Language (SQL) syntax and SolarWinds Query Language (SWQL) syntax. The two main differences between SQL and SWQL are: The SWQL wildcard character is %. The SQL wildcard character is *. If the resource you are trying to filter creates its list by joining two tables together that contain properties that share the same name, you cannot filter on that property unless you attach a particular SQL table name to the beginning of the property name. The same is true also for SWQL queries, except you must look up the SWQL name and use that as a prefix insteadof a SQL table name.
SQL or SWQL? It is not always obvious whether a resource requires SQL syntax or SWQL syntax filters. Generally, the resources that have most recently been added to SolarWinds Orion use SWQL syntax, while the oldest ones require SQL syntax. Look for additional guidance at the bottom of the Edit Resource page in the form of words such as "SWQL query" or "SQL query".
Filter Syntax Reference 639
SWQL Filter Syntax Examples

Wildcards The wildcard character in SWQL syntax is: %. Example: Node.Caption Like 'AX3%' Filtering by Custom Property The property syntax to filter by custom property is: dataType.CustomProperties.propertyName Example filter to only show nodes with the custom property City that matches Atlanta:
Node.CustomProperties.City = 'Atlanta'
Filtering by Built-in Properties Use the SWQL table name for selecting properties for your queries. Examples Example filter to show data from Cisco devices:
Node.Vendor = 'Cisco'
Example filter to show data from Windows Server 2003-2008 applications:

Application.Name = 'Windows Server 2003-2008'

Example filter to show data from Process Monitor SNMP type component monitors:
Filtering by Status To filter by the status property, you must know the valid status levels.
Level 0 1 2 Status Unknown Up Down
640 Filter Syntax Reference

Level 3 14 Status Warning Critical

SQL Filter Syntax Examples

Wildcards The wildcard character in SQL syntax is: *. Example: Node.Caption Like 'AX3*' Filtering by Custom Property The property syntax to filter by custom property is: dataType.CustomProperty.propertyName Example filter to only show nodes with the custom property City that matches Atlanta:
Node.CustomProperty.City = 'Atlanta'
Examples Example filter to show only Cisco devices:

Vendor = 'Cisco'
Example filter to show data only from component monitors named Server Load Monitor:
Monitor.Name like 'Server Load Monitor'

Node.Caption Like 'AX3*'
Example filter to show only Nortel devices that are Down:

Vendor Like 'Nortel*' AND Status=2
Filtering by Status To filter by the status, you must know the valid status levels.
Level 0 1 2 3 14 Status Unknown Up Down Warning Critical

SWQL Resource Matrix

The resource matrix helps you find the SWQL table names you need to create filter criteria for your resources. The SQL table names are provided so that you know exactly how the SWQL name map to the SQL tables in your SolarWinds Orion database.
EOC Filters
All Enterprise Operations Console (EOC) resources use SWQL filtering. Alert Resource Filters
Resource Global Last XX Active Alerts SQL Table Name EOC.Alert2 EOC.Orion SWQL Name Alert Orion
Orion SAM Resource Filters

Resource SQL Table Name EOC.APM.Application EOC.APM.ApplicationTemplate EOC.APM.CurrentApplicationStatus EOC.Node EOC.Orion EOC.APM.CurrentApplicationStatus EOC.Orion EOC.APM.Application EOC.APM.ApplicationTemplate EOC.APM.CurrentApplicationStatus SWQL Name A AT CAS N Orion Status Orion A AT CASN.
Global All Applications
Global Application Health Overview Global Applications by Status

Resource SQL Table Name EOC.Node EOC.Orion Global Applications with High Process CPU Load EOC.APM.Application EOC.APM.ApplicationTemplate EOC.APM.CurrentApplicationStatus EOC.Node EOC.Orion EOC.APM.Application EOC.APM.ApplicationTemplate EOC.APM.CurrentApplicationStatus EOC.Node EOC.Orion EOC.APM.Application EOC.APM.ApplicationTemplate EOC.APM.CurrentApplicationStatus EOC.Node EOC.Orion EOC.APM.Application EOC.APM.CurrentApplicationStatus EOC.Node EOC.Orion EOC.APM.Application EOC.APM.ApplicationTemplate EOC.APM.CurrentApplicationStatus EOC.APM.CurrentStatistic EOC.Node EOC.Orion EOC.APM.Application EOC.APM.CurrentComponentStatus EOC.APM.CurrentStatistic EOC.Node EOC.Orion EOC.APM.Application EOC.APM.CurrentComponentStatus EOC.APM.CurrentStatistic EOC.Node EOC.Orion EOC.APM.Application EOC.APM.CurrentComponentStatus EOC.APM.CurrentStatistic EOC.Node EOC.Orion EOC.APM.ApplicationTemplate EOC.Orion SWQL Name N Orion A AT CAS N Orion A AT CAS N Orion A AT CAS N Orion A CAS N Orion A AT CAS CS N Orion A CCS CS N Orion A CCS CS N Orion A CCS CS N Orion AT O
Global Applications with High Process Memory Used
Global Applications with High Response Time
Global Down Applications
Global Top XX Monitors by Response Time
Global Top XX Process Monitors by CPU Load
Global Top XX Process Monitors by Physical Memory
Global Top XX Process Monitors by Virtual Memory Total Application by Type for Each Local Orion
Events Filters
Resource Global Events Summary SQL Table Name EOC.Event EOC.EventType EOC.Orion EOC.Event EOC.EventType EOC.Node EOC.Orion SWQL Name Event EventType Orion Event EventType Node Orion
Global Last XX Events
Inventory Filters
Resource Number of Interfaces by Type Number of Nodes by Device Type Number of Nodes by IOS/OS SQL Table Name EOC.Interface EOC.Node EOC.Orion EOC.Node EOC.Orion EOC.Node EOC.Orion SWQL Name I Node Orion Node Orion Node Orion
EOC Filters
Resource Global Top XX Errors & Discards This Hour Global Top XX Error & Discards Today Global Top XX Interfaces by percent utilization Global Top XX Interfaces by Relative Multicast Packet Rate Global Top XX Interfaces by Traffic Global Top XX Nodes by Average Response Time Global Top XX Nodes by CPU Load SQL Table Name EOC.Interface EOC.Node EOC.Orion EOC.Interface EOC.Node EOC.Orion EOC.Interface EOC.Node EOC.Orion EOC.Interface EOC.Node EOC.Orion EOC.Interface EOC.Node EOC.Orion EOC.Node EOC.Orion EOC.Node EOC.Orion SWQL Name I N Orion I N Orion I Node Orion I N Orion I Node Orion Node Orion Node Orion

Resource Global Top XX Nodes by Current Response Time Global Top XX Nodes by Percent Memory Used Global Top XX Nodes by Percent Packet Loss Global Top XX Volumes by Disk Space Used SQL Table Name EOC.Node EOC.Orion EOC.Node EOC.Orion EOC.Node EOC.Orion EOC.Node EOC.Orion EOC.Volume.Stats SWQL Name Node Orion Node Orion Node Orion N Orion VS
IP SLA Filters
Resource SQL Table Name EOC.AlertStatus EOC.AlertDefinition EOC.IpSla.Operation EOC.IpSla.OperationType EOC.Orion EOC.AlertStatus EOC.AlertDefinition EOC.IpSla.Operation EOC.IpSla.OperationStatus EOC.IpSla.OperationType EOC.IpSla.Site EOC.IpSla.Site EOC.Node EOC.Orion EOC.Node EOC.Node EOC.Orion EOC.Voip.Link EOC.Voip.Site EOC.Voip.Site EOC.Voip.UdpResultDetail EOC.Node EOC.Node EOC.Orion EOC.Voip.Link EOC.Voip.Site EOC.Voip.Site EOC.Voip.UdpResultDetail EOC.Node EOC.Node EOC.Orion EOC.Voip.Link SWQL Name AlertStatus AlertDefinition IpSlaOperation IpSlaOperationType Orion AlertStatus AlertDefinition IpSlaOperation ipSlaOperationStatus IpSlaOperationType SourceSite TargetSite Node Orion N1 N2 O L S1 S2 D N1 N2 O L S1 S2 D N1 N2 O L
Global Active IP SLA Operation Alerts
Global All IP SLA Operations
Global Top XX Call Paths by Jitter
Global Top XX Call Paths by Latency
Global Top XX Call Paths by MOS

Resource SQL Table Name EOC.Voip.Site EOC.Voip.Site EOC.Voip.UdpResultDetail EOC.Node EOC.Node EOC.Orion EOC.Voip.Link EOC.Voip.Site EOC.Voip.Site EOC.Voip.UdpResultDetail EOC.Node EOC.Orion EOC.Voip.CCMStatistic EOC.Node EOC.Node EOC.Orion EOC.Voip.Link EOC.Voip.Site EOC.Voip.Site EOC.Voip.UdpResultDetail EOC.Orion EOC.Voip.Engine EOC.Node EOC.Node EOC.Orion EOC.Voip.Link EOC.Voip.Site EOC.Voip.Site EOC.Voip.UdpResultDetail SWQL Name S1 S2 D N1 N2 O L S1 S2 D N O C N1 N2 O L S1 S2 D O S N1 N2 O L S1 S2 D
Global Top XX Call Paths by Packet Loss
Global VoIP Call Managers
Global VoIP Call Paths
Global VoIP Collector Services
Global VoIP Sites Overview
NCM Filters
Resource Global Configuration Manager Nodes SQL Table Name EOC.NCM.ConfigArchive EOC.NCM.Nodes EOC.Node EOC.Orion EOC.NCM.ConfigArchive EOC.NCM.Nodes EOC.Node EOC.Orion EOC.NCM.CacheDiffResults EOC.NCM.ComparisonCache EOC.NCM.Nodes EOC.Node EOC.Orion SWQL Name ConfigArchive NCMNode Node Orion ConfigArchive NCMNode Node Orion CacheDiffResults ComparisonCache NCMNode Node Orion
Global Devices Backed Up vs Not Backed Up
Global Last XX Config Changes
NTA Filters
Resource Global Last XX Traffic Analysis Events SQL Table Name EOC.Event EOC.EventType EOC.Node EOC.Orion EOC.Interface EOC.NetFlow.Source EOC.Node EOC.Orion EOC.NetFlow.Engine EOC.Orion SWQL Name EventType Event Node Orion I S N O S O
Global NetFlow Sources NetFlow Collector Services
Wireless Filters
Resource Global Wireless Clients SQL Table Name EOC.Node EOC.Orion EOC.Wireless.Interface EOC.Node EOC.Orion EOC.Wireless.Interface EOC.Node EOC.Orion EOC.Wireless.Client SWQL Name N O WI N O WI N O WC
Top XX Access Points by Number of Clients Top XX Wireless Clients by Traffic Rate
Summary Report Filters

Resource Global Down Interface SQL Table Name EOC.Interface EOC.Node EOC.Orion EOC.Node EOC.Orion EOC.Interface EOC.Node EOC.Orion EOC.Node EOC.Node.CustomProperty EOC.Orion EOC.Node EOC.Orion EOC.Node EOC.Orion EOC.Node SWQL Name I Node Orion Node Orion I Node Orion Node NodeCustomProperty Orion Node Orion N Orion Node
Global Down Nodes Global High Errors & Discards Today Global Node Status by Site Global Nodes with High CPU Load Global Nodes with High Memory Utilization Global Nodes with High

Resource Packet Loss Global Nodes with High Response Time Global Top XX Nodes with Problems Global Volumes with High Percent usage Orion Summary Statistics SQL Table Name EOC.Orion EOC.Node EOC.Orion EOC.Node EOC.Node.CustomProperty EOC.Orion EOC.Node EOC.Orion EOC.Volume EOC.Orion SWQL Name Orion Node Orion Node NodeCustomProperty Orion N Orion V O
SysLog Filters
Resource SysLog Summary SQL Table Name EOC.Orion EOC.SysLog SWQL Name Orion SysLog
Trap Filters
Resource Global Trap Resource SQL Table Name EOC.Orion EOC.Trap SWQL Name Orion Trap
IVIM Filters
All Integrated Virtual Infrastructure Management (IVIM) resources use SWQL filtering. Virtualization Summary
Resource Top 10 VMware Hosts by Percent Memory Used Top 10 VMware Hosts by Network Utilization Top 10 VMware Hosts by CPU Load Top 10 VMware Hosts by Number of Running VMs SQL Table Name Orion.VIM.Hosts Orion.Nodes Orion.VIM.Hosts Orion.Nodes Orion.VIM.Hosts Orion.Nodes Orion.VIM.Hosts Orion.Nodes SWQL Name h n hosts n h n hosts nodes
Datacenter Details
Resource Top 10 VMware Hosts by Percent Memory Used Top 10 VMware Hosts by Network Utilization Top 10 VMware Hosts by CPU Load Top 10 VMware Hosts by Number of Running VMs SQL Table Name Orion.VIM.Hosts Orion.Nodes Orion.VIM.Hosts Orion.Nodes Orion.VIM.Hosts Orion.Nodes Orion.VIM.Hosts Orion.Nodes SWQL Name hosts nodes hosts nodes hosts nodes hosts nodes
Cluster Details
Resource Top 10 Managed VMware Guests by Current Response Time Top 10 Managed VMware Guests by Percent Memory Used Top 10 Managed VMware Guests by CPU Load Top 10 Managed VMware Guests by Network Usage SQL Table Name Orion.VIM.VirtualMachines Orion.VIM.Hosts Orion.Nodes Orion.NodesStats Orion.VIM.VirtualMachines Orion.VIM.Hosts Orion.Nodes Orion.VIM.VirtualMachines Orion.VIM.Hosts Orion.Nodes Orion.VIM.VirtualMachines Orion.VIM.Hosts Orion.Nodes SWQL Name vms hosts nodes stats vms hosts n vms hosts n VM H n
SolarWinds SAM Filters

Resources for SolarWinds Server & Application Monitor (SAM) use a mix of SWQL and SQL filters. Orion SAM Resource Filters
Resource SQL Table Name Orion.APM.Application Orion.APM.ApplicationTemplate Orion.APM.CurrentApplicationStatus Orion.Nodes Orion.APM.Application SWQL Name Application ApplicationTemplate Status Nodes Application
All Applications Tree
Applications with

Resource Problems SQL Table Name Orion.APM.ApplicationTemplate Orion.APM.CurrentApplicationStatus Orion.Nodes APM_CurrentComponentStatus APM_PortEvidence APM_ComponentExt APM_Application APM_CurrentApplicationStatus APM_ThresholdsByComponent APM_ThresholdsByComponent APM_ErrorCode APM_StatusCodeType APM_StatusCode APM_CurrentComponentStatus APM_PortEvidence APM_ComponentExt APM_Application APM_CurrentApplicationStatus APM_ThresholdsByComponent APM_CurrentComponentStatus APM_PortEvidence APM_ComponentExt APM_Application APM_CurrentApplicationStatus APM_CurrentComponentStatus APM_PortEvidence APM_ComponentExt APM_Application APM_CurrentApplicationStatus APM_ThresholdsByComponent APM_CurrentComponentStatus APM_PortEvidence APM_ComponentExt APM_Application APM_CurrentApplicationStatus APM_ThresholdsByComponent SWQL Name Template Status Nodes MonitorStatus pe Monitor Application ApplicationStatus thresholdRT thresholdStat ec sct sc MonitorStatus pe Monitor Application ApplicationStatus Threshold MonitorStatus pe Monitor Application ApplicationStatus MonitorStatus pe Monitor Application ApplicationStatus Threshold MonitorStatus pe Monitor Application ApplicationStatus Threshold
Top XX Components by Statistic Data
Top XX Components by Response Time
Top XX Processes by CPU Load
Top XX Processes by Physical Memory
Top XX Processes by Virtual Memory
Appendix H
Configuring and Integrating

This appendix provides a basic introduction to technologies associated with SAM. It is designed to give system administrators an overview of how these technologies work, as well as how they integrate with SAM. For more detailed information on these technologies, explore resources outside of this appendix.
JMX
JMX is an acronym for Java Management Extensions and allows remote clients to connect to a Java Virtual Machine (JVM). Using JMX, you can manage and monitor running applications in a JVM environment. Using Java, management of applications in a virtual machine is done through the use of Managed Beans or MBeans. MBeans are the soul of JMX. MBeans are the controllable end-points of an application where remote clients can watch application activity as well as control them. The MBean represents a resource running in the JVM, such as an application. They can be used for collecting statistics like performance, resource usage, problems, and so on. To monitor a Java Virtual Machine through JMX, add the following argument into the java command that publishes the platform MBean server to your local environment for monitoring.
Dcom.sun.management.jmxremote
Your Java Virtual Machine can now be monitored.
Configuring and Integrating 651
JConsole
A common tool used to monitor a JVM is JConsole. JConsole is a free graphical monitoring tool used to monitor JVMs, which can be found here: http://sourceforge.net/projects/jconsole/ JConsole is not necessary to use the JMX component monitor within SAM. The information provided here concerning JConsole is an introduction to using Java as a means of monitoring. Detailed information on how to use JConsole can be found by navigating to the following link: http://java.sun.com/developer/technicalArticles/J2SE/jconsole.html Once you have downloaded and installed JConsole, you can run it by navigating to the folder where it was installed. Typically, the JConsole.exe is located at:
C:\Program Files\Java\jdk1.7.0_02\bin\JConsole.exe.
Double-click JConsole.exe to start the program. Following is a screenshot of JConsole running, before being logged in:
To login to JConsole: 1. Select either the Local Process option or the Remote Process option. 2. Highlight your option by clicking on it. 3. Complete the credential fields (Username & Password). 4. Click Connect.
652 Configuring and Integrating
After you are successfully logged in, click on the tab entitled MBeans. Clicking the MBeans tab brings you to this screen:
From here, you can drill down to any MBean you want by expanding the folder tree in the left pane of the window. Select any MBean (file in the tree) to have information about it displayed in the right pane. These MBeans are what SolarWinds SAM uses when polling information from the JVM.
Adding a JMX Component Monitor to SAM

Creating a standard template for this monitor is not practical because of the amount of variables in any one specific environment. However, adding a JMX monitor to your environment has been made simple with the use of a wizard driven interface. The JMX wizard will automatically reveal the MBeans available for monitoring.
To add a JMX Monitor to a node using the wizard: 1. From the web console, click SAM Settings. 2. Click Find Processes, Services and Performance Counters .
3. Select JMX Monitor from the dropdown list. 4. Click Browse to find the node you want to monitor. 5. Choose a credential from the Credential Library or create a new one using the Username and Password fields. Note: For step 6, the defaults are sufficient for most environments. If they are not, you can change them to suit your environment. 6. Add the Port number, Protocol type, URL path, and Credentials for the remaining fields.
7. Click Next. The following MBean selection screen appears: Note: Only values that return numerical data can be monitored. String data is not supported at this time. Non-numerical data will be shown without a check box when selecting MBeans to poll from within SAM, as illustrated below:
8. Expand the folders by clicking the arrows (or [+]) to expand the tree-view folder structure. From here you can drill down to select the attributes you want by checking them. 9. Click Next. Now you are able to edit the JMX Component Monitor properties. Following is an illustration of how polled MBeans will look when successfully added and implemented within SAM:
If you choose not to use the wizard, you must manually enter values for each JMX monitor, as shown in the illustration below. Entering the correct information can be complicated and cumbersome. This method is best suited for an administrator who is very familiar with the Java environment.
Configuring Java Applications Servers for JMX

The following sections discuss how to enable SNMP on JVM servers. Instructions are given for Apache Tomcat, JBoss, Glassfish, IBM Websphere, and Oracle Weblogic for both Linux and Microsoft Windows operating systems. Additional JMX configuration information can be found here: http://download.oracle.com/javase/1.5.0/docs/guide/management/agent.html. Configuring Apache Tomcat (tested on version 7.0) Windows Service 1. Open Tomcat configuration: Start > All Programs > Apache Tomcat > Configure Tomcat. 2. Open the Java tab, and then add the following lines to the Java Options box: -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=6969 -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=false 3. Click Apply. 4. Go to the Windows Services console. 5. Right-click the Apache Tomcat service, and then click Properties. 6. Click the Log On tab, and then select Log on as this account. 7. Click Browse and find the user Administrator and type the Administrator password twice. 8. Click Ok. 9. In the Tomcat Configuration window, return to the General tab, and then start the service.
Windows Command Line 1. Open the file %TOMCAT_HOME%\bin\catalina.bat and add the following lines into the Debug, Run and Start sections where %TOMCAT_HOME% is the path of your Tomcat installation:
set "JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.jmxremote" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.port=8686" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.ssl=false" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.authenticate=false" :doDebug set "JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.jmxremote" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.port=8686" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.ssl=false" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.authenticate=false" shift :doRun set "JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.jmxremote" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.port=8686" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.ssl=false" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.authenticate=false" shift :doStart set "JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.jmxremote" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.port=8686" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.ssl=false" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.authenticate=false" shift
2. Run %TOMCAT_HOME%\bin\startup.bat to start Tomcat.
Linux 1. Open $TOMCAT_HOME/bin/catalina.sh and then add the following lines into the Debug, Run and Start sections, where %TOMCAT_HOME% is the path to your Tomcat installation:
JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote" JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote.port=8686" JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote.ssl=false" JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.jmxremote.authenticate=false " if [ "$1" = "debug" ] ; then JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote" JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.jmxremote.port=8686" JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.jmxremote.ssl=false" JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.jmxremote.authenticate=false " if $os400; then elif [ "$1" = "run" ]; then JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote" JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.jmxremote.port=8686" JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.jmxremote.ssl=false" JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.jmxremote.authenticate=false " shift elif [ "$1" = "start" ] ; then JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote" JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.jmxremote.port=8686" JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.jmxremote.ssl=false" JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.jmxremote.authenticate=false " if [ ! -z "$CATALINA_PID" ]; then
2.
Run the $TOMCAT_HOME/bin/startup.sh command to start Tomcat.
For more information, see "JMX" on page 651.
Configuring JBoss (tested on versions 5.0.1, 5.1, and 6.0) Windows Service 1. Edit %JBOSS_HOME%\bin\run.bat by adding the following lines, where %JBOSS_HOME% is the path to your JBoss installation:
set "JAVA_OPTS=%JAVA_OPTS% Djavax.management.builder.initial=org.jboss.system.server.jmx.M BeanServerBuilderImpl" set "JAVA_OPTS=%JAVA_OPTS% -Djboss.platform.mbeanserver" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.port=8686" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.ssl=false" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.authenticate=false" rem Setup JBoss specific properties set JAVA_OPTS=-Dprogram.name=%PROGNAME% %JAVA_OPTS% set "JAVA_OPTS=%JAVA_OPTS% Djavax.management.builder.initial=org.jboss.system.server.jmx.M BeanServerBuilderImpl" set "JAVA_OPTS=%JAVA_OPTS% -Djboss.platform.mbeanserver" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.port=8686" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.ssl=false" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.authenticate=false"
2. Register JBoss as a service by running: %JBOSS_HOME%\bin\service.bat

install
3. Go to the Windows Services console. 4. Right-click JBoss Application Server service. 5. Click Properties. 6. Click the Log On tab and then select Log on as this account. 7. Click Browse, find the user Administrator, and then type the Administrator password twice. 8. Click Ok.
9. Start the JBoss service. Windows Command Line 1. Edit %JBOSS_HOME%\bin\run.bat by adding the following lines, where %JBOSS_HOME% is the path to your JBoss installation:
set "JAVA_OPTS=%JAVA_OPTS% Djavax.management.builder.initial=org.jboss.system.server.jmx.M BeanServerBuilderImpl" set "JAVA_OPTS=%JAVA_OPTS% -Djboss.platform.mbeanserver" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.port=8686" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.ssl=false" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.authenticate=false" rem Setup JBoss specific properties set JAVA_OPTS=-Dprogram.name=%PROGNAME% %JAVA_OPTS% set "JAVA_OPTS=%JAVA_OPTS% Djavax.management.builder.initial=org.jboss.system.server.jmx.M BeanServerBuilderImpl" set "JAVA_OPTS=%JAVA_OPTS% -Djboss.platform.mbeanserver" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.port=8686" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.ssl=false" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.jmxremote.authenticate=false"
2. Start JBoss by running %JBOSS_HOME%\bin\run.bat.
Linux 1. Edit $JBOSS_HOME/bin/run.sh by adding the following lines, where $JBOSS_HOME$ is the path to your JBoss installation:
JAVA_OPTS="$JAVA_OPTS Djavax.management.builder.initial=org.jboss.system.server.jmx.M BeanServerBuilderImpl" JAVA_OPTS="$JAVA_OPTS -Djboss.platform.mbeanserver " JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote.port=8686" JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote.ssl=false" JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.jmxremote.authenticate=false " # Setup JBoss specific properties JAVA_OPTS="${JAVA_OPTS:+$JAVA_OPTS -Dprogram.name=$PROGNAME}" JAVA_OPTS="${JAVA_OPTS:--Dprogram.name=$PROGNAME}" JAVA_OPTS="$JAVA_OPTS Djavax.management.builder.initial=org.jboss.system.server.jmx.M BeanServerBuilderImpl" JAVA_OPTS="$JAVA_OPTS -Djboss.platform.mbeanserver " JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote.port=8686" JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote.ssl=false" JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.jmxremote.authenticate=false "
2. Run JBoss by running $JBOSS_HOME/bin/run.sh. For more information, see "JMX" on page 651.
Configuring GlassFish (tested on version 3.1) 1. Run the GlassFish Application Server. 2. Open a web browser and then navigate to: http://hostname:4848, where hostname is the name of your GlassFish server. 3. In the left panel, click Configurations: server-config. 4. In the main window, click JVM settings. 5. Click the JVM Options tab. 6. Click Add JVM Option and then type Djava.rmi.server.hostname=yourhostname.com in the blank field, where yourhostname.com is the hostname of your GlassFish server. 7. Click Add JVM Option and then type Dcom.sun.management.jmxremote.ssl=false in the blank field. 8. Click Add JVM Option and then type Dcom.sun.management.jmxremote.authenticate=false in the blank field. 9. Click Save. 10. Restart the GlassFish server. By default, GlassFish uses JMX on port 8686. To change the JMX port you should find the jmx-connector section in: %GLASSFISH_HOME%\glassfish\domains\<your_domain>\config\dom ain.xml, where %GLASSFISH_HOME% is the path where GlassFish is installed, then change the port value. For more information, see "JMX" on page 651.
Configuring IBM WebSphere (tested on version 7.0) IBM WebSphere uses its own JDK installed at %WEBSHERE_HOME%\java, where %WEBSHERE_HOME% is the path of your WebSphere installation. Configure the IBM JDK in the following manner: 1. Go to the $JAVA_HOME/jre/lib/management folder. 2. Edit management.properties by adding the following: com.sun.management.jmxremote.port=8686 com.sun.management.jmxremote.ssl=false com.sun.management.jmxremote.authenticate=false 3. Run the IBM WebSphere Application Server. 4. Open a web browser and then navigate to: https://hostname:9043, where hostname is the name of the IBM WebSphere server. 5. In the left pane, click Applications and WebSphere Enterprise Applications. 6. Check to see if PerfServletApp.ear is in the list. If it is, skip to step 12. If not, continue to step 7. 7. In the left pane, click Applications and New Application. 8. Click New Enterprise Application. 9. Select Local File System and then click Browse. 10. Find the WebSphere directory here: AppServer > InstallableApps > PerfServerletApp.ear. 11. Click Next multiple times until you installation is complete. 12. In the left pane, click Monitoring and Tuning and Performance Monitoring Infrastructure(PMI). 13. Select your server. In the Configuration tab, enable the PMI and set All Statistics. 14. Set All Statistics in the Run time Tab. 15. Save all changes. 16. In the left panel, click Expand Servers and Server types. 17. Click WebSphere Application Servers.
18. In the main window, click your server. 19. In the Server Infrastructure section, expand Java and Process Management. 20. Click Process Definition. 21. In the Additional Properties section, click Java Virtual Machine. 22. In Generic JVM Arguments, add the following:
-Djavax.management.builder.initial= Dcom.sun.management.jmxremote
23. Save all changes. 24. Go to the Windows Services console. 25. Right click the IBM Websphere service. 26. Click Properties. 27. Click the Log On tab and then select Log on as this account. 28. Click Browse, find the user Administrator, and then type the Administrator password twice. 29. Click Ok. 30. Restart the IBM WebSphere Application Server. For more information, see "JMX" on page 651.
Configuring Oracle WebLogic (tested on version 10.3.4.0) Note: To add support for a WebLogic server, please refer to this KB article: http://knowledgebase.solarwinds.com/kb/questions/2687/Adding+support+for+a+ WebLogic+server+to+poll+MBeans. Windows 1. Edit the following file, where %MIDDLEWARE_HOME% is the path of your WebLogic installation:
%MIDDLEWARE_HOME%\C:\Oracle\Middleware\user_projects\domains\<y our_domain>\bin\setDomainEnv.cmd
Add the following lines to the end of the file:

set "JAVA_OPIONTS=%JAVA_OPTIONS% Dcom.sun.management.jmxremote" set "JAVA_OPTIONS=%JAVA_OPTIONS% Dcom.sun.management.jmxremote.port=8686" set "JAVA_OPTIONS=%JAVA_OPTIONS% Dcom.sun.management.jmxremote.ssl=false" set "JAVA_OPTIONS=%JAVA_OPTIONS% Dcom.sun.management.jmxremote.authenticate=false"
Warning: This file is created by the Configuration Wizard. Your changes to this script will be lost the next time you use the configuration wizard. 2. Restart WebLogic Server. Linux 1. Edit the following file, where %MIDDLEWARE_HOME% is the path of your WebLogic installation:
$MIDDLEWARE_HOME/user_projects/domains/<your_domain>/bin/setDom ainEnv.sh
Add the following lines to the end of the file:

JAVA_OPTIONS="$JAVA_OPTIONS -Dcom.sun.management.jmxremote" JAVA_OPTIONS="$JAVA_OPTIONS Dcom.sun.management.jmxremote.port=8686" JAVA_OPTIONS="$JAVA_OPTIONS Dcom.sun.management.jmxremote.ssl=false" JAVA_OPTIONS="$JAVA_OPTIONS Dcom.sun.management.jmxremote.authenticate=false"
Warning: This file is created by the Configuration Wizard. Your changes to this script will be lost the next time you use the configuration wizard. 2. Restart the WebLogic Server.
Note: If you are having difficulty configuring Weblogic to work with Java and/or SNMP, the JMX Java options may not be set in the proper place for your setup of Weblogic. Some implementations of Weblogic, under Windows, require the Java JMX options to be placed in a registry key, as opposed to the setDomainEnv.cmd file. For information on this method of configuration , refer to the following knowledge base article: http://knowledgebase.solarwinds.com/kb/questions/3264/Cannot+get+Java+Web logic+APM+template+to+work+in+APM+4.2 For more information, see "JMX" on page 651.
Configuring Java Virtual Machines for SNMP

The following sections discuss how to configure JVM servers for SNMP monitoring including those that are embedded with Apace Tomcat, JBoss, Glassfish, IBM Websphere, and Oracle Weblogic. Configuration instructions are given for both Linux and Microsoft Windows operating systems. Configuring a Standalone Java Virtual Machine Windows 1. Download the JDK from the Oracle website: http://www.oracle.com/technetwork/java/javase/downloads/index.html (tested on JDK SE 6, update version 24). 2. Install the JDK. 3. On the license agreement page, read and accept the license and the click Next. 4. Click Change to change the installation directory to C:\Program Files\Java\jdk1.6.0_24, and then click Ok. 5. Click Next. 6. Click Finish to exit from the installer. 7. Add a variable to the system with its path pointing to the JDK installation folder. For example: Variable name: JAVA_HOME Variable value: C:\Program Files\Java\jdk1.6.0_24 Note: If you want to run Java commands from the command line, you should add the JDK installation path to the PATH variable. 8. Navigate to the %JAVA_HOME%\jre\lib\management folder. 9. Rename the snmp.acl.template file to snmp.acl. Edit snmp.acl by replacing its content with the following:
acl = { { communities = public, private access = read-only managers = localhost, sam-server } }
Where sam-server is the hostname of your SAM server.
10. Grant access to the snmp.acl file only for the Administrator. To grant access only for the Administrator, refer to this topic at the following location: http://download.oracle.com/javase/6/docs/technotes/guides/management/sec urity-windows.html Linux 1. Download the JDK from the Oracle website: http://www.oracle.com/technetwork/java/javase/downloads/index.html (tested on JDK SE 6, update version 24). 2. Unpack and run the JDK. In this case, the JDK was installed into the /usr/java/jdk1.6.0_24 folder. 3. Move this folder to /usr/local. 4. In the /usr/local/ directory, create a symbolic link to jdk1.6.0_24 named Java. Now the JDK is installed in /usr/local/jdk1.6.0_24 and linked to /usr/local/java. 5. Add the /usr/local/java/bin folder to the system path. (If it is only for your account, add it in .bash_profile file in your home directory). In Slackware, it should be in the .profile file. To make it a system wide environment, add it in the /etc/profile. 6. Edit a line in .bash_profile to be similar to:
PATH=$PATH:$HOME/bin:/usr/local/java/bin. The path will be
automatically set at boot time. To set the path immediately, use the command:
$ export PATH=$PATH:/usr/local/java/bin
7. You can call java directly in your shell:

$ java version java version "1.6.0_24" Java(TM) SE Runtime Environment (build 1.6.0_24-b04) Java HotSpot(TM) 64-Bit Server VM (build 14.3-b01, mixed mode)
8. Add a variable to the system with the path pointing to the JDK installation folder. 9. Add the following lines to the /etc/profile file. Syntax dependencies may be different in various Linux distributions. This example is shown for the CentOS system:
export JAVA_HOME=/usr/java/jdk1.6.0_24 export PATH=$PATH:/usr/java/jdk1.6.0_24
To set this immediately, run the export commands in your shell. Or, logout then log back in to your system. 10. Go to the $JAVA_HOME/jre/lib/management folder and rename the snmp.acl.template file to snmp.acl.
11. Edit snmp.acl by removing all lines and writing the following:
acl = { { communities = public, private access = read-only managers = localhost, SAM-server } }
Where SAM-server is the hostname of your SAM server. 12. Grant access to the snmp.acl file only for the root user. Run the following commands as the root user in your shell:
# chown root.root $JAVA_HOME/jre/lib/management/snmp.acl # chmod 600 $JAVA_HOME/jre/lib/management/snmp.acl
Testing a Standalone JVM in Linux You can test that your JVM can respond to SNMP queries by adding
-Dcom.sun.management.snmp.port=1161 Dcom.sun.management.snmp.interface=0.0.0.0 to the java command line.
Example:
java -Dcom.sun.management.snmp.port=1161 Dcom.sun.management.snmp.interface=0.0.0.0 some_java_applet
In another window/shell, run the following command to test SNMP and the JDK configurations:
snmpwalk -v 2c -c public 127.0.0.1:1161 1.3.6.1.4.1.42.2.145.3.163.1.1.2.11
The command should return a value similar to this:

SNMPv2-SMI::enterprises.42.2.145.3.163.1.1.2.11.0 = Counter64: 4803352
For more information, see "JMX" on page 651. Configuring Apache Tomcat (tested on version 7.0) Windows Service 1. Open Tomcat configuration: Start > All Programs > Apache Tomcat > Configure Tomcat. 2. Open the Java tab, and then add the following lines to the Java Options box: -Dcom.sun.management.snmp.port=1161 -Dcom.sun.management.snmp.interface=0.0.0.0 3. Click Apply. 4. Go to the Windows Services console. 5. Right-click the Apache Tomcat service.
6. Click Properties. 7. Click the Log On tab, and then select Log on as this account. 8. Click Browse, find the user Administrator and type the Administrator password twice. 9. Click Ok. 10. In the Tomcat Configuration window, return to the General tab, and then start the service. Windows Command Line 1. Open the file %TOMCAT_HOME%\bin\catalina.bat and add the following lines into the Debug, Run and Start sections (where %TOMCAT_HOME% is the path to your Tomcat installation):
set "JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.snmp.port=1161" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.snmp.interface=0.0.0.0" :doDebug set "JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.snmp.port=1161" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.snmp.interface=0.0.0.0" shift :doRun set "JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.snmp.port=1161" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.snmp.interface=0.0.0.0" shift :doStart set "JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.snmp.port=1161" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.snmp.interface=0.0.0.0" shift
2. Run %TOMCAT_HOME%\bin\startup.bat to start Tomcat. Linux
1. Open $TOMCAT_HOME/bin/catalina.sh and then add the following lines into Debug, Run and Start sections (where %TOMCAT_HOME% is the path to your Tomcat installation):
JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.snmp.port=1161" JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.snmp.interface=0.0.0.0" if [ "$1" = "debug" ] ; then JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.snmp.port=1161" JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.snmp.interface=0.0.0.0" if $os400; then elif [ "$1" = "run" ]; then JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.snmp.port=1161" JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.snmp.interface=0.0.0.0" shift elif [ "$1" = "start" ] ; then JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.snmp.port=1161" JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.snmp.interface=0.0.0.0" if [ ! -z "$CATALINA_PID" ]; then
3. Run $TOMCAT_HOME/bin/startup.sh command to start Tomcat. For more information, see "JMX" on page 651. Configuring JBoss (tested on versions 5.0.1, 5.1, and 6.0) Windows Service 1. Edit %JBOSS_HOME%\bin\run.bat by adding the following lines (where %JBOSS_HOME% is the path to your JBoss installation):
set "JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.snmp.port=1161" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.snmp.interface=0.0.0.0" rem Setup JBoss specific properties set JAVA_OPTS=-Dprogram.name=%PROGNAME% %JAVA_OPTS% set "JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.snmp.port=1161" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.snmp.interface=0.0.0.0"
4. Register JBoss as a service by running: %JBOSS_HOME%\bin\service.bat

install 672 Configuring and Integrating
5. Go to the Windows Services console 6. Right-click JBoss Application Server service. 7. Click Properties. 8. Click the Log On tab and then select Log on as this account. 9. Click Browse, find the user Administrator, and then type the Administrator password twice. 10. Click Ok. 11. Start the JBoss service. Windows Command Line 2. Edit %JBOSS_HOME%\bin\run.bat by adding the following lines (where %JBOSS_HOME% is the path to your JBoss installation):
set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.snmp.port=1161"set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.snmp.interface=0.0.0.0" rem Setup JBoss specific properties set JAVA_OPTS=-Dprogram.name=%PROGNAME% %JAVA_OPTS% set "JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.snmp.port=1161" set "JAVA_OPTS=%JAVA_OPTS% Dcom.sun.management.snmp.interface=0.0.0.0"
2. Start JBoss by running %JBOSS_HOME%\bin\run.bat. Linux 1. Edit $JBOSS_HOME/bin/run.sh by adding the following lines (where $JBOSS_HOME$ is the path to your JBoss installation):
JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.snmp.port=1161" JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.snmp.interface=0.0.0.0" # Setup JBoss specific properties JAVA_OPTS="${JAVA_OPTS:+$JAVA_OPTS -Dprogram.name=$PROGNAME}" JAVA_OPTS="${JAVA_OPTS:--Dprogram.name=$PROGNAME}" JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.snmp.port=1161" JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.snmp.interface=0.0.0.0"
2. Run JBoss by running $JBOSS_HOME/bin/run.sh. For more information, see "JMX" on page 651.
Configuring GlassFish (tested on version 3.1) 1. Run the GlassFish Application Server. 2. Open a web browser and then navigate to: http://hostname:4848 where hostname is the name of your GlassFish server. 3. In the left panel, click Configurations: server-config. 4. In the main window, click JVM settings. 5. Click the JVM Options tab. 6. Click Add JVM Option and then type Dcom.sun.management.snmp.port=1161 in the blank field. 7. Click Add JVM Option and then type Dcom.sun.management.snmp.interface=0.0.0.0 in the blank field. 8. Click Save. 9. Restart the GlassFish server. For more information, see "JMX" on page 651. Configuring IBM WebSphere (tested on version 7.0) IBM WebSphere uses its own JDK, installed at %WEBSHERE_HOME%\java (where %WEBSHERE_HOME% is the path to your WebSphere installation).Configure the IBM JDK in the following manner: 1. Go to the $JAVA_HOME/jre/lib/management folder. 2. Rename the snmp.acl.template file to snmp.acl. Edit snmp.acl by replacing its content with the following: acl = { { communities = public, private access = read-only managers = localhost, SAM-server } } 3. WhereSAM-server is the hostname of your SAM server. 4. Grant access to the snmp.acl file only for the root user. Run the following commands as the root user in your shell:
5. Run the IBM WebSphere Application Server.
6. Open a web browser and then navigate to: https://hostname:9043 where hostname is the name of the IBM WebSphere server. 7. In the left panel, click Expand Servers and Server types. 8. Click WebSphere Application Servers. 9. In the main window, click your server. 10. In the Server Infrastructure section, expand Java and Process Management. 11. Click Process Definition. 12. In the Additional Properties section, click Java Virtual Machine. 13. In Generic JVM Arguments, add the following:
-Dcom.sun.management.snmp.port=1161 Dcom.sun.management.snmp.interface=0.0.0.0
14. Click Ok. 15. Click, Save and then click Ok. 16. Click Save. 17. Go to the Windows Services console. 18. Right click the IBM Websphere service. 19. Click Properties. 20. Click the Log On tab and then select Log on as this account. 21. Click Browse, find the user Administrator, and then type the Administrator password twice. 22. Click Ok. 23. Restart the IBM WebSphere Application Server. For more information, see "JMX" on page 651. Configuring Oracle WebLogic (tested on version 10.3.4.0) Windows Oracle WebLogic uses its own JDK installed in %MIDDLEWARE_HOME%\jdk* (where %MIDDLEWARE_HOME% is the path to your WebLogic installation). 1. Go to the $JAVA_HOME/jre/lib/management folder 2. Rename the snmp.acl.template file to snmp.acl.
3. Edit snmp.acl by replacing its content with the following:

acl = { { communities = public, private access = read-only managers = localhost, SAM-server } } Where SAM-server is the hostname of your SAM server.
4. Grant access to the snmp.acl file only for the Administrator. To grant access only for the Administrator,see: http://download.oracle.com/javase/6/docs/technotes/guides/management/sec urity-windows.html 5. Edit the following file:
%MIDDLEWARE_HOME%\C:\Oracle\Middleware\user_projects\domains\<y our_domain>\bin\startWebLogic.cmd
by adding the lines:

set "JAVA_OPTIONS=%JAVA_OPTIONS% Dcom.sun.management.snmp.port=1161" set "JAVA_OPTIONS=%JAVA_OPTIONS% Dcom.sun.management.snmp.interface=0.0.0.0"
The result should resemble:

call "%DOMAIN_HOME%\bin\setDomainEnv.cmd" %* set "JAVA_OPTIONS=%JAVA_OPTIONS% Dcom.sun.management.snmp.port=1161" set "JAVA_OPTIONS=%JAVA_OPTIONS% Dcom.sun.management.snmp.interface=0.0.0.0" set SAVE_JAVA_OPTIONS=%JAVA_OPTIONS%
WARNING: This file is created by the Configuration Wizard. Your changes to this script will be lost the next time you use the configuration wizard. 6. Restart WebLogic Server. Linux Oracle WebLogic uses its own JDK which in $MIDDLEWARE_HOME/jdk* (where $MIDDLEWARE_HOME is the path to your WebLogic installation). 1. Go to the $JAVA_HOME/jre/lib/management folder. 2. Rename the snmp.acl.template file to snmp.acl. 3. Edit snmp.acl by replacing its content with the following:
Administrator Guide SolarWinds Server & Application Monitor acl = { { communities = public, private access = read-only managers = localhost, SAM-server } }
Where SAM-server is the hostname of your SAM server. 4. Grant access to the snmp.acl file only for the root user. Run the following commands as the root user in your shell:
5. Edit the following file:

$MIDDLEWARE_HOME/user_projects/domains/<your_domain>/bin/startW ebLogic.sh
by adding the lines:

JAVA_OPTIONS="$JAVA_OPTIONS Dcom.sun.management.snmp.port=1161" JAVA_OPTIONS="$JAVA_OPTIONS Dcom.sun.management.snmp.interface=0.0.0.0"
The result should resemble:

. ${DOMAIN_HOME}/bin/setDomainEnv.sh $* JAVA_OPTIONS="$JAVA_OPTIONS Dcom.sun.management.snmp.port=1161" JAVA_OPTIONS="$JAVA_OPTIONS Dcom.sun.management.snmp.interface=0.0.0.0" SAVE_JAVA_OPTIONS="${JAVA_OPTIONS}"
WARNING: This file is created by the Configuration Wizard. Your changes to this script will be lost the next time you use the configuration wizard. 6. Restart the WebLogic Server.
MAPI
Messaging Application Programming Interface (MAPI) is a Microsoft Windows program that enables you to send email from within a program. Programs that use MAPI include word processors, spreadsheets, and graphics applications.. Programmers who are using Microsoft's Active Server Page (ASP) technology access MAPI by using Microsoft's Collaboration Data Objects (CDO). The CDO library comes with Microsoft's Internet Information Server (IIS). MAPI functions can be accessed by Visual Basic programmers. CDO - http://www.microsoft.com/download/en/details.aspx?id=1004 A "session" is a specific connection between the client and the MAPI program. MAPI defines the following three services: Address book: A database that contains addressing information. Transport: Supports communication between different devices. Message store: Stores messages that consists folders and subfolders.
Simple MAPI is a subset of 12 functions which enable developers to add basic messaging functionality. Extended MAPI allows complete control over the email system. Note: With regard to the SAM monitor, this document will concentrate only on the mail function.
The MAPI User Experience Monitor in SAM

This component monitor sends an email from your SMTP mail server to your Microsoft Exchange Server Mailbox and measures the time it takes to complete the trip. You can use this component monitor to measure the performance of Outlook. This response time is measured in milliseconds. The Exchange Server computer uses port 135 for client connections to the RPC endpoint mapper service. After a client connects to a socket, the Exchange Server allocates the client two random TCP ports above 1024 used to communicate with the directory and the information store. For a complete list of network ports used by Microsoft Server Products, refer to the following article: http://technet.microsoft.com/en-us/library/bb331973.aspx What credentials should a user use? User credentials must be valid for both the Exchange server mailbox and the SAM server. This means that the SAM server and Exchange server must be in the same domain and the probe must use domain credentials. Why does the profile have to be able to log in to the SAM server? Because the probe uses an external .exe module SolarWinds.APM.MAPI.exe. Meaning, user impersonation on the SAM server is needed to have ability to run external process.
Install the MAPI Client on the SolarWinds SAM Server

This component monitor requires you to install the Microsoft Exchange Server MAPI Client and Collaboration Data Objects on your SolarWinds SAM server. You can download the MAPI Client from: The Microsoft Download Center. http://www.microsoft.com/downloads/details.aspx?FamilyID=E17E7F31-079A43A9-BFF2-0A110307611E This component monitor does not compute a statistic. The response time is the difference between the time SolarWinds SAM sends the email and the time that it is received by the recipient. Following is an illustration of the MAPI monitor. To expose the fields, as illustrated below, click the [+] to the left of the component monitor name.
What the MAPI monitor does: 1. This component monitor waits for the email to arrive based on the default job timeout of 20 minutes. If the email does not arrive within this period, SolarWinds SAM marks the monitor as Down. 2. The monitor goes through the following steps with respect to the mail flow: g. Sends an email to the user mailbox via SMTP. The email has a unique temporary subject name that starts with APM_prefix. h. Connects to the user mailbox through MAPI, then searches the emails by Subject. i. If it does not find the email it is looking for, it waits and then searches again. It will stop when: 1. It finds the email; 2. The timeout is reached; 3. The maximum number of attempts is reached. Once it finds the email, the monitor deletes it from the user inbox. The monitor collects the total round trip time for the email and compares it with the thresholds set. Once it knows the round trip time, status is given according to where it falls with regard to the thresholds set.
j. k. l.
If the email is not found within the timeout or the maximum number of attempts, or SMTP or MAPI reported an error, SolarWinds SAM will mark the monitor as down. 3. Emails are posted using SMTP. If the MAPI probe works, emails will be deleted successfully, if not, emails will accumulate. 4. It is not currently possible to use the monitor without SMTP and send the email from the same server the monitor is running on via MAPI. Field Descriptions of the MAPI Monitor: Description This field provides a default description of the monitor. You have the ability to override the default description by adding to or replacing the text, which will then be automatically saved. The variable to access this field is ${UserDescription}. Enable Component Determines whether the component is enabled.
Credential for Monitoring Select a credential that is both a user who can log on to the SolarWinds SAM server, and that has an Exchange account on the MAPI server. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Send Email From This field allows you to specify the From address of the test email message. Send Email To This field allows you to specify the recipient of the test email message. The recipient should have a mailbox on the MAPI server you are monitoring. MAPI Profile Name Allows you to specify the name of the MAPI profile SMTP Server This field allows you to specify the SMTP server that sends the test email message. SMTP Port This field is the port number used for SMTP sessions. The default value is 25. Use Credentials for SMTP This checkbox allows you to use the user name and password from Credentials for Monitoring to connect to SMTP servers that support or require authentication. SMTP Encryption This list allows you to select an encryption protocol to connect to SMTP servers that support SSL or TLS encryption. Response Time Warning Threshold This field allows you to set the warning threshold conditions based on the response time. The response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. Response Time Critical Threshold This field allows you to set critical threshold conditions based on the response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve any statistical data. User Notes This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}.
Troubleshooting MAPI
The following procedures will help you troubleshoot MAPI issues relating to SAM. MAPI Probe Diagnostic Checklist Install CDO or Outlook CDO can be found here: http://www.microsoft.com/download/en/details.aspx?id=1004. If you would like to install CDO, uninstall your entire MS Office installation. Uninstalling Outlook only is not sufficient. The MAPI probe may be unstable when running with Outlook installed. If this is the case, uninstall Office then download and install CDO.
Check the MAPI profile The MAPI profile does not need to exist. The probe should create it and also update the existing profile with the required settings. However, there may be issues with an existing or created profile. The default Outlook profile is called Outlook. If this profile does not work, create a profile with the MFCMapi free tool, availabe at: http://mfcmapi.codeplex.com/. 1. In the MFCMapi tool, navigate to Profile > Advanced Profile > Launch Profile Wizard, keeping the defaults on the first dialog. 2. Set the profile as default. 3. Update the profile name of the newly created profile in the MAPI probe. Use MFCMapi to find the profile name: Navigate to Profile > Show Profiles for verification.
Check probe settings Check that Send Email To: is correctly filled out in the component settings. The Mapi Profile Name must match the actual profile name. Use the MFCMapi tool if you are not sure about the name. Credentials used for the probe must be eligible to open the mailbox. It is required to add the user to the local Administrators group, otherwise the probe can fail with insufficient privileges.
Mailbox recommendations Use a clean mailbox created for monitoring purposes. A mailbox full of email is problematic as it takes a lot more time for the probe to search through all of the emails. The MAPI probe deletes obsolete, undeleted messages sent by the probe in the past to keep the mailbox clean.
Advanced Troubleshooting
SolarWinds.APM.MAPI.exe Command Line Arguments To analyze issues with the MAPI probe more closely, run the MAPI executable from the command line. The following arguments can be used: Command
-s <subject>
Explanation The subject text of searched in an email. Use quotes for a subject containing spaces. Server hostname / IP address.
-server <server_name> -t <timeout> -p <profile_name> -u <user_name> -attempts <count> -debug -removeall
Timeout in ms for watchdog. Exchange profile name. Exchange user name Maximum number of search attempts. Turns on debug logging. Remove all historical messages from the MAPI probe. Messages from the MAPI probe get stuck in the mailbox if the probe fails to delete them. Wait time between search attempts.
-w
New in SAM 5.0:

-subjectmatchsubstring: This enables a substring subject match. The target
mail subject is expected to match the substring of the subject setting. An exact match is expected by default. This is useful for matching emails returned by bouncers, which can add Re: to the mail subject. Note: This command is not listed in the configuration file.
For example:
SolarWinds.APM.MAPI.exe -debug -s "test subject" -u domain\user.name -server exchange -p Outlook -t 10000
Important: Run the executable as the user owning the mailbox. To do this, start a new cmd.exe and run the following command.
runas /user:domain\user.name cmd.exe
This will ask for a password and start a new cmd.exe with that user account. Test the MAPI executable from this console. The MAPI probe is also configurable via the SolarWinds.APM.MAPI.exe.xml file. Settings in this file take precedence over any command line arguments. See the following:
<settings>  <logdirectory>c:\logs</logdirectory> <logenable>false</logenable> <logkeepall>true</logkeepall> <enablewatchdog>true</enablewatchdog> <mapimaxwaitlogoff>2500</mapimaxwaitlogoff> <dologoff>true</dologoff> <!-<debug>false</debug> <removeall>true</removeall> <subjectpattern>ÂPM_MAPITestEmail__GUID:[0-9a-fA-F]{8}-[09a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fAF]{12}$</subjectpattern> <delaybetweenattempts>500</delaybetweenattempts> --> </settings>
Command
Logdirectory
Explanation Path to the directory where logs from the MAPI executable will be written. This directory must exist otherwise no logs will be written. Enable log file logging. Set false for deleting the log file after a successful run, (i.e. email was found and deleted; all log files are preserved by default
Logenable Logkeepall
Command
Explanation (true).)
Enablewatchdog
Enable or disable watchdog which kills the MAPI processing thread if it does not finish in a given time. Prevents processing for a long time. Number of milliseconds to wait for logoff before the MAPI process ends. This setting is used after an error during MAPI processing and between attempts to retrieve probe mail. Set to false to skip logoff and closing the MAPI session. True for debugging information and detailed logging to the log file or console. Remove all obsolete messages from the mailbox matching the subjectpattern regular expression. The SAM probe always tries to enable this setting from the command line. Regular expression pattern for deleting obsolete probe messages. Use together with
removeall =true
Mapimaxwaitlogoff
Dologoff
Debug
Removeall
Subjectpattern
Delaybetweenattempts
Delay in milliseconds.
New in SAM 5.0 (not listed in the configuration file):

subjectmatchsubstring true/false setting (false by default) to match just the
substring of the subject. This is useful for matching emails returned by bouncers, which can add Re: to the mail subject. During initial analysis, it is typically required to update logdirectory (or create C:\logs) and set logenable to true. Other arguments are passed from the command line.
Oracle
This section is designed to give you a basic introduction to the Oracle database model and its use with SolarWinds SAM. For more detailed information on Oracle, seek resources outside of this guide.
Physical and Logical Structures

An Oracle database system is made up of at least one instance of the application, along with data storage. An instance, identified by an instantiation number (or activation id: SYS.V_$DATABASE.ACTIVATION#), is made up of a set of operating system processes and memory-structures that work with the storage. If an Oracle database administrator has employed Oracle RAC (Real Application Clusters), then multiple instances attach to a storage array. This implementation offers advantages such as better performance, scalability, and redundancy. The Oracle DBMS can store and execute procedures and functions within itself. PL/SQL or the object-oriented language, Java, can use such code objects and/or provide the programming structures for writing them.
Storage
The Oracle RDBMS stores data in the form of tablespaces and physically in the form of ("datafiles"). Tablespaces can contain various types of memory segments, such as Data Segments, Index Segments, etc. Segments are made up of one or more extents. Extents make up groups of continuous data blocks. Data blocks are the basic units of data storage. Newer versions of the database include a partitioning feature , which allows tables to be partitioned based on different sets of keys. Oracle tracks its data storage using the information stored in the System tablespace. The System tablespace contains the data dictionary, indexes and clusters. A data dictionary consists of a collection of tables that has information about all user objects. Beginning with version 8i, the Oracle RDBMS also supports locally managed tablespaces which can store space management information in their own headers rather than in the System tablespace.
Disk files
Disk files primarily consist of the following types:
Data and index files: These files are necessary for the physical storage, which can be made up of the data dictionary, user data, or index data. These files may be managed manually or by Oracle itself, Note: A datafile has to belong to exactly one tablespace, whereas a tablespace can consist of multiple datafiles. Redo log files: These consist of all changes to the database used to recover from an instance failure. Note: These files are stored multiple times for security in case of a catastrophic failure. The identical redo log files are part of the same group. Undo files: These are datafiles which contain undo information and are used for recovery. Archive log files: These files are copies of the redo log files and stored at different locations. These files are necessary. Tempfiles: These datafiles are used for temporary storage data. Control file: This file is necessary for database startup. This file records the physical structure of a database and holds the names and locations of redo log files, the time stamp of the database creation, the current log sequence number, checkpoint information, and so forth.
Configuring SAM to Monitor an Oracle Database Server

SAM provides an application template for monitoring Oracle databases. This is called the Oracle Database Template. However, unlike most applications, this requires additional drivers to be downloaded and installed on the computers where SAM and any additional pollers are running.
Prerequisites for Oracle Server Monitoring

There are two Oracle data providers which can be used with SAM: Oracle Data Provider for .NET (ODP.Net) Installer package Basic Lite Oracle Client
Note: Some required settings information will be needed. See Getting the Required Settings, on page 22.
Installing ODP.Net
The following instructions describe the recommended method for monitoring Oracle databases using ODP. Net.
Uninstall any other version of the Oracle Client before proceeding. Ensure that SolarWinds Basic Lite Oracle Client is not installed. Verify that the following directory does not exisit or is empty: C:\Program Files (x86)\Solarwinds\Orion\APM\OracleClient\. If it is not empty, stop all Orion services and remove this directory before you continue with your installation. Note: ODP. Net is not part of SolarWinds SAM and may need to be downloaded from the Oracle website, which requires free registration. Download the 32-bit version of ODP.Net, even if SAM is installed on a 64-bit version of Windows. 1. You can use the following link to download ODP.Net: http://www.oracle.com/technetwork/topics/dotnet/index-085163.html If you do not want to register with Oracle, you can use the Basic Lite Client which can be downloaded by logging in to your SolarWinds customer portal. Location and installation instructions can be found at, "Installing the Basic Lite Oracle Client" on page 697.
Following is a screenshot of Oracle's website with the both the 32 and 64-bit versions highlighted. Download the 32-bit version. Note: You can download the 64-bit version. Installing this version will require you to poll jobs using the 64-bit option within SAM.
2. Next, download ODAC with Oracle Developer Tools for Visual Studio, as shown below. This installation package comes with its own installer:
3. Accept the License Agreement and then select the latest version when prompted. You will be asked for your Oracle username and password. If you have not already done so, register for free with Oracle to obtain these needed credentials.
4. Login to SAM using an administrator account. 5. Copy the downloaded file to the SAM computer then extract the contents and run setup.exe. 6. When setup.exe runs, go to the next step and select the first option as shown below. (This option contains what is necessary for SAM to be able to monitor an Oracle database server.) Note: If the Oracle server is being polled from an additional poller, then this software needs to be installed on that additional poller as well.
7. Enter the path where the files should be installed.
8.
Either install everything or select the following two components: Oracle Data Provider for .Net Oracle Instant Client
9. Start the installation.
10. When the installation finishes successfully, click Exit.
Restart all Orion services by navigating to: Start > SolarWinds Orion > Orion Service Manager. Note: Restarting of the services is necessary because the Oracle installer added its installation directory (c:\app\Administrator\... by default) to the Path variable. 11. From the Service Manager, click Shutdown Everything. 12. When all services have stopped, click Start Everything and wait for the services to begin.
Installing the Basic Lite Oracle Client

Follow these steps only if you cannot use the full Oracle Data Provider. Note: The Basic Lite Oracle Client may not support the latest versions of Oracle database servers. Therefore, this version may not support all data types used in monitoring your queries. 1. Ensure that the SolarWinds Basic Lite Oracle Client is not currently installed. If it is installed, the following is the default path and must be deleted before proceeding: c:\Program Files (x86)\Solarwinds\Orion\APM\OracleClient\. If this folder is not empty, stop all Orion services and remove this directory before continuing with the Oracle Client installation. 2. Log in to your customer portal. Once logged in, navigate to SolarWinds customer portal > Additional Components > Oracle Client . From here you can download the needed files.
3. Use the Oracle Client link to download the installation package.
4. Copy the downloaded file to the SAM computer and extract OracleClientInstaller.exe from the zip archive. 5. Run the installer under an administrator account.
6. After the installer window closes, navigate to the SAM installation directory, typically: C:\Program Files\SolarWinds\Orion, and ensure that the subfolder, APM\OracleClient was created successfully and contains the five files as shown below:
7. Check the file properties of each .dll file to ensure that the account under which the SolarWinds JobEngine v2 service runs has high enough privileges to load these libraries.
8. Restart all Orion services by navigating to Start > SolarWinds Orion > Orion Service Manager. Note: Restarting of the services is necessary because the Oracle installer added its installation directory (c:\app\Administrator\... by default) to the Path variable. 9. From the Service Manager, click Shutdown Everything. 10. When all services are stopped, click Start Everything and wait for the services to begin.
Adding an Oracle Database Server to SAM

1. Navigate to Start > SolarWinds Orion > Orion Web Console to open the SAM website. 2. Log in to the SAM web console. 3. If the node you want to monitor is not currently monitored by SAM, navigate to Settings > Add Node and follow the wizard to start monitoring the Oracle computer as a node in SAM. Note: The Oracle server can be added as any type of node (ICMP, SNMP, WMI).
4. At the Add Application Monitors step, select the Oracle Database Template. Do not test it. At this stage the application template requires further configuration which cannot be done from this page. Testing at this point will result in a failure.
5. Go to the last step of the wizard and click OK, ADD NODE.
6. You will be redirected to the Manage Nodes page. Search for the newly added Oracle server and click on it to go to its Node Details view.
7. Search for the Applications resource on this view and click on the Oracle Application to go to its Application Details View.
8. On the Application Details View, notice the Oracle Database is in an Unknown state. This is because it is not properly configured. Click on Edit Application Monitor to begin configuring these settings.
9. Expand each monitor by clicking the [+] icon to the left of each component monitor in the list.
10. The correct settings for the fields, Destination Point Type and Destionation Point Name (highlighted above) should be provided by the administrator of the Oracle server. This example is testing against the Oracle 10g Express Edition, which is configured to have the name "XE."
11. Repeat steps 9-10 for each monitor in this template. The Oracle driver type must correspond with the installed Oracle Client software (as described earlier in the Prerequisites for Oracle Server Monitoring section on page 4). The following table shows which combinations work together. Oracle Client package Oracle Driver Type setting in Web UI Microsoft .NET Data Oracle Data Provider Provider for .NET (MS_ORACLECLIENT) (ODP.NET) Works Works
Full Oracle Data Provider for .NET (ODP.NET) Basic Lite Oracle Client (from SolarWinds Customer Portal)
Works
Does not work
Monitoring an Oracle Database on an Existing Node

If an Oracle database server is already being monitored by SAM as a node, perform the following steps to configure the node: 1. In the SAM web console, navigate to Settings > SAM Settings > Manage Templates
2. Search for the Oracle Database Template, select it by checking the box next to the name. 3. Click Assign to Node.
4. Next, search for Oracle. 5. Once found, check the nodes you want to add. 6. Click the green arrow to add it to the Selected Nodes column..
7. The Oracle node will be moved to the Selected Nodes column.
8. Click Next. 9. Select the credentials to be used and then click Assign Application Monitors. Note: Do not test the application now. This application is not properly configured. There are settings specific to the Oracle server which will be set later.
10. Click Edit to go to the Edit Application page.
11. Expand each monitor by clicking the [+] icon to the left of each component monitor in the list.
12. The correct settings for the fields Destination Point Type and Destination Point Name (highlighted above) should be provided by the administrator of the Oracle server. This example is testing against the Oracle 10g Express Edition, which is configured to have the name "XE."
13. Repeat steps 11-12 for each monitor in this template. Use the following table for reference: Oracle Client package Oracle Driver Type setting in Web UI Microsoft .NET Data Oracle Data Provider Provider for .NET (MS_ORACLECLIENT) (ODP.NET) Works Works
Full Oracle Data Provider for .NET (ODP.Net Basic Lite Oracle Client (from SolarWinds Customer Portal)
Works
Does not work
Getting the Required Settings

The Oracle User Experience Monitors settings must match the settings on the Oracle Server. Database Administrators usually provide a file with connection details (tnsnames.ora) to database users and users add this file to their Oracle Client directory. SAM does not use the tnsnames.ora file directly. The user needs to input all of the settings to the Oracle User Experience Monitor in the SAM web interface. If you were not given tnsnames.ora file by your database administrator, but have access to Oracle Server system, follow these steps to locate the tnsnames.ora file: 1. Log in to the Oracle Server using an administrator account. 2. The Tnsnames.ora file should be located at
$ORACLE_HOME/network/admin/tnsnames.ora, where $ORACLE_HOME is the
directory where the Oracle Server was installed.
3. Once you have located this file, open the file and follow these steps to extract the required information. a. Locate the section in the file that describes the options for the database instance you want to monitor. For the most part, this section will contain the settings for Protocol, Host, and Port as shown in the examples bulleted below. b. Once you locate this section, extract the following settings and use them in the Oracle User Experience Monitor: Protocol Must be TCP. This how SAM connects to the remote Oracle Server. Host Must match the IP address (or hostname, which resolves to that IP) of the Oracle server node in SAM. Port Use this setting for the Port Number field of Oracle User Experience Monitor.
Service_Name If this is present in the tnsnames.ora configuration section, then select the value for the Service_Name for the Destination Point Type field of the Oracle User Experience Monitor. SID If this is present in the tnsnames.ora configuration section, then select the SID value for for the the Destination Point Type field of the Oracle User Experience Monitor. Service_Name or SID settings in tnsnames.ora also defines a connection point name (after the "=" character), which needs to be used for the Destination Point Name field of the Oracle User Experience Monitor. Example 1: Following is a sample tnsnames.ora file from the Oracle Server 10g Express Edition. Highlighted are the settings mentioned previously.
Example 2:
Here is what the configuration of the Oracle User Experience Monitor should look like when completed correctly using Example 1:
Here is what the configuration of the Oracle User Experience Monitor should look like when completed correctly using Example 2:
Troubleshooting
If the Oracle User Experience Monitor does not work properly, explore the following troubleshooting sections. Oracle Client Driver and Server Compatibility SAM is Unable to Load the Oracle Client Driver Using Process Explorer to Determine if SAM is Loading the Correct Oracle Client Library Using Process Monitor to Determine Why the Oracle Client fails Oracle User Experience Monitor is Unable to Connect to the Oracle Server Using the Oracle SQL*Plus Tool to Troubleshoot Connectivity Issues:
Note: Many of these troubleshooting procedures are used by SolarWinds support technicians.
Oracle Client Driver and Server Compatibility Notes: Oracle Client drivers are not forward and backwards compatible with all Oracle database servers. Oracle Data Provider for .NET (ODP.NET) 11.2.0.3.0 is compatible only with Oracle Server 9.2 and higher.
Monitoring two different versions of Oracle Server might not be possible if there is no appropriate driver which would be able to connect to both server versions. If this is the case, have the second version of the Oracle Client on an additional poller and assign the nodes there.
SAM is Unable to Load the Oracle Client Driver Following is a screenshot of this error:
Troubleshooting Steps: Make sure that the Oracle Client was installed on the SAM computer or on the appropriate additional poller. Do not deploy two different Oracle Client Driver versions on the SAM computer. If the above was unsuccessful, follow these troubleshooting steps:
1. Download Process Explorer and install it on the SAM computer. 2. Run Process Explorer and look for the JobEngineWorker2.exe processes, (which belongs to SAM). This can be identified by the command line argument, "SolarWinds.APM.Probes."
3. Display the JobEngineWorker2.exe properties to ensure that the environment variable ORACLE_HOME exists and points to the correct location where the Oracle Client is installed.
The example below shows ORACLE_HOME set to the APM\OracleClient directory. This computer has the Basic Light Oracle Client installed (not the full ODP.NET version).
Using Process Explorer to Determine if SAM is Loading the Correct Oracle Client Library To determine if SAM is loading the correct Oracle Client Library, follow these steps: 1. In Process Explorer, navigate to View > Show Lower Pane. Then, navigate to View > Lower Pane View > DLLs.
2. Locate the JobEngineWorker2.exe (which belongs to SAM) and see if the oci.dll file is displayed in the DLL list in the lower pane. 3. Verify that the path is set to the correct directory.
This step needs to be done for each JobEngineWorker2.exe instance that belongs to SAM. This can be identified by the command line argument, "SolarWinds.APM.Probes."
Using Process Monitor to Determine Why the Oracle Client Fails If the Oracle Client is not visible in Process Explorer, perform the following steps to determine from which directory SAM is trying to load the Oracle Client: 1. Download Process Monitor from the following link: http://technet.microsoft.com/en-us/sysinternals/bb896645. 2. Start Process Monitor and define Filter.
3. Add the following conditions:

Process Name equals SWJobEngineWorker2.exe. Path contains oci.dll.
4. Click OK. 5. Restart the JobEngine v2 service and wait for it to fully restart. 6. Go to the Oracle Database Edit page and test one of the components. 7. Wait until the test is finished and then stop the trace (File > Capture Events). 8. Analyze the results. There will be information about SWJobEngineWorker2.exe trying to find the oci.dll file, (which is part of the Oracle Client), revealing a list of directories it was searching for and whether or not it was successful. The Load Image event indicates whether or not SAM was able to load that library successfully. This may fail if the architecture of this library does not match the architecture of the polling job (as defined on the Application Edit page in SAM).
9. See the following illustration:
Below is sample output when the Oracle Client is not installed and therefore not found:
Here you can see which directories are being searched to locate the file. Below you can see that the full Oracle Client was installed:
Here you can see SAM was not able to load the Oracle Client because it does not match the platform of the polling job. In this case, the Oracle Database application is set to run as 64-bit, but the 32-bit version of the Oracle Client was installed. You can also see that SAM finds the oci.dll and opens it to read from it, but it detects that this is the wrong platform. Consequently, there is no Image Load operation:
Oracle User Experience Monitor is Unable to Connect to the Oracle Server Following is a screenshot of this error:
Troubleshooting steps: 1. Make sure a firewall is not blocking communication between SAM and Oracle computers. 2. Verify the configuration of the Oracle User Experience Monitor.
Use a third party tool, SQL*Plus, to try and connect to the Oracle Server using the same settings that SAM is using. Refer to the section, "Using the Oracle SQL*Plus Tool to Troubleshoot Connectivity Issues." Using the Oracle SQL*Plus Tool to Troubleshoot Connectivity Issues: The following steps demonstrate how to use SQL*Plus to check the following: Connectivity issues to the Oracle Server from the SAM computer. You are using the correct and valid Oracle endpoint, ( i.e. Service_Name or SID). You are using correct and valid Oracle credentials. You have credentials with enough permission to query Oracle system views. Note: This is required for troubleshooting the Oracle Database default template. The Oracle SQL*Plus tool is included in the Oracle Data Provider for .NET (ODP.NET) package. This package should be installed first as described in the, Installing ODP.N, section. Once installed, navigate to the installation directory and ensure that the sqlplus.exe file exists.
Connecting to an Oracle Server Using Simple Syntax 1. Run cmd.exe and navigate to the directory where sqlplus.exe is located. 2. Run the following command to test simple syntax:
sqlplus <UserName>/<Password>@<OracleServerNameOrIP>/<Servi ceNameOrSid>
where
<UserName> is the username of the account used by the Oracle User
Experience Monitor in SAM.

<Password> is the valid password for this account as defined in the
SAM Credential Library.

<OracleServerNameOrIP> is the Oracle Server hostname or IP
address.
<ServiceNameOrSid> is the Oracle endpoint Service_Name or SID
value as defined in the Oracle User Experience Monitor settings. For example:
sqlplus SYSTEM/Password1@10.199.1.219/XE
This is used to connect to the XE instance on the Oracle Server running on 10.199.2.219 under the System account using Password1 as the password.
SqlPlus will show information on whether or not the connection was successful. If the connection was unsuccessful, the error message should contain the reason why it failed. If the connection was successfully established, then the prompt, SQL>, is shown.
Connecting to the Oracle Server Using Full Oracle Connection Syntax To more accurately simulate how SAM is connecting to the Oracle Server, run SQL*Plus using the full Oracle connection syntax , which is the equivalent of using the tnsnames.ora syntax:
sqlplus <UserName>/<Password>@(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(H OST=< OracleServerNameOrIP>)(PORT=<PortNumber>)))(CONNECT_DATA=(<EndPointType>=< ServiceNameOrSid>)))
where
<UserName> is the username of the account used by the Oracle User
Experience Monitor in SAM.

<Password> is the valid password for this account as defined in the SAM
Credential Library.
<OracleServerNameOrIP> is the Oracle Server hostname or IP address. <PortNumber> is the specified TCP port where the Oracle endpoint
listens.
<EndPointType> specifies the type of Oracle endpoint. This value must
be either Service_Name or SID. This should match the Oracle User Experience Monitor settings in SAM.
<ServiceNameOrSid> is the Oracle endpoint Service_Name or SID value
as defined in the Oracle User Experience Monitor settings.
For Example:
sqlplus SYSTEM/Password1@(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP) (HOST=10.199.1.219)(PORT=1521)))(CONNECT_DATA=(SERVICE_NAME=XE)))
Note: This example is used without specifying the password on the command line (Sqlplus will prompt for a password.)
sqlplus SYSTEM @(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=10.199.1.2 19)(PORT=1521)))(CONNECT_DATA=(SERVICE_NAME=XE)))
See the following illustration:
Using SQL*Plus to connect using this method must be tried if SAM is unable to connect to the Oracle Server. If the connection does not work from SQL*Plus, then it will not work from SAM. Executing queries using SQL*Plus 1. Connect to the Oracle Server as described in previous sections. Ensure SQL*Plus shows the SQL> prompt.
2. Verify that it is possible to execute simple queries by typing, Select 1 from

dual;
Note the semicolon at the end.
If this query is successful, the next step is to try the same query as used in the Oracle User Experience Monitor in SAM. 3. Type the SQL query used by the Oracle User Experience Monitor and put a semicolon at the end. Note: Semicolons are required in SQL*Plus. 4. Press Enter to run the query.
This query may fail if you do not have privileges to access these SQL tables or views. If this is the case, you should connect to the Oracle Server using the Oracle administrator account (System) and execute the query under this account. If this works, then the issue is permissions related and needs to be changed or a different account should be used in SAM for monitoring.
PowerShell
The ability to employ PowerShell scripts within SAM is a powerful advantage for system administrators. This document merely provides an introduction to PowerShell, as well as its role with SAM. Windows PowerShell is a command-line shell created for system administrators. PowerShell includes an interactive prompt and a scripting environment that can be used independently or in combination. PowerShell is built on top of the .NET Framework Common Language Runtime (CLR) and the .NET Framework, and accepts and returns .NET Framework objects. PowerShell also introduces the cmdlet. A cmdlet is a simple command that can manipulate objects in PowerShell. Cmdlets have a unique format -- a verb and noun separated by a dash (-), such as Get-Help. You can use each cmdlet separately or in combination to perform complex tasks. PowerShell includes more than one hundred cmdlets, and you can write your own. PowerShell gives you access to the file system on the computer. In addition, PowerShell providers enable you to access other data stores, such as the registry, for example. Things you should know about PowerShell: PowerShell does not process text. Instead, it processes objects based on the .NET Framework. PowerShell comes with a set of built-in commands with a consistent interface.
PowerShell and SAM: Configuration and Usage

In order to use PowerShell with SAM you must have PowerShell 2.0 installed on the SAM and target servers. PowerShell 2.0 can be found here: http://support.microsoft.com/kb/968930 Once PowerShell is installed on the SAM and target servers, ensure that Windows Remote Management (WinRM) is properly configured and enabled on the SAM and target servers. To do this, follow these steps: 1. On the SAM server, open a command prompt as an Administrator. To do this, go to the Start menu and right-click the Cmd.exe and then select Run as Administrator. 2. Enter the following in the command prompt:
winrm quickconfig q winrm set winrm/config/client @{TrustedHosts="*"}
3. On the target server, open a command prompt as an Administrator and enter the following:
winrm quickconfig winrm set winrm/config/client @{TrustedHosts="IP_ADDRESS"}
where IP address is the IP address of your SAM server. Once you have successfully completed these steps, PowerShell will be able to properly communicate with SAM. Exchange 2010 Management Tools Many SAM PowerShell components rely on Exchange Management Tools. Both the 2007 and 2010 editions are acceptable. If you plan to monitor Exchange 2007 then you must use the Exchange 2007 Management Tools. If you plan to monitor Exchange 2010 then you will need to install the Exchange 2010 Management Tools. Exchange Management Tools must be installed on the SAM server and any additional poller that will poll using PowerShell scripts. Any snap-ins that PowerShell may require must also be installed in the same location. To ease PowerShell plug-in management in a multi-poller environment, you may prefer to assign nodes with PowerShell templates to a single polling engine. Exchange 2010 Management Tools will be used for the following instructions:
Installation of Exchange Management Tools To install Exchange Management Tools on your Windows computer, you first need to configure the pre-requisite components. 1. Open the Control Panel, click on Programs and then click Turn Windows Features On or Off. 2. Enable the features shown below:
3. Download the Exchange Server 2010 SP1 installation files and extract them to a temporary folder on your computer. 4. From that folder launch Setup.exe. (If your computer is missing the .NET Framework, visit Microsoft.com to download and install it. Additionally, Steps 1 and 2 of the Exchange Server 2010 SP1 installation will prompt you to install pre-requisites if they are missing, as shown in the following illustration.)
5. If needed, install the pre-requisites for Exchange Server 2010 SP1. If not, click on Step 3 from the install screen and choose Install only languages from the DVD.
6. Choose language options for installing Exchange Server 2010 SP1 on Windows.
7. Next, click on Step 4 from the install screen to begin the installation.
8. Begin the installation of Exchange Server 2010 SP1 on Windows. 9. Click Next at the introduction page, then Accept the license agreement. 10. Click Next, then choose your preference for Error Reporting. 11. Click Next. 12. At the Installation Type page, select Custom Exchange Server Installation, and also check the box to Automatically install Windows Server roles and features required for Exchange Server. 13. Click Next.
14. Select the Management Tools role and then click Next.
64-bit vs. 32-bit Using the 64-bit (x64) or 32-bit (x86) version of PowerShell depends on how your target server and applications are configured. Ideally, both machines should be running on the same platform to get the most out of PowerShell. Platform Scenarios For the most part, you will not encounter any differences between the 64-bit and 32-bit versions of PowerShell; however, each version of the shell, in some cases, can only load matching snap-ins. This means you should use the correct 64-bit or 32-bit version of any snap-ins you plan to use. Below are some guidelines to help you determine which version of PowerShell you should use for your particular monitoring environment: If SAM is installed on a 64-bit sever and polling a 64-bit machine, you should poll using the 64-bit version of PowerShell. If SAM is installed on a 64-bit sever and polling a 32-bit machine, you should poll using the 32-bit version of PowerShell. If SAM is installed on a 32-bit sever and polling a 32-bit machine, you should poll using the 32-bit version of PowerShell. If SAM is installed on a 32-bit server and polling a 64-bit machine, you may encounter some errors. You should install SAM on a 64-bit server if you need to poll 64-bit machines.
Note: There may be instances where installed software on a 64-bit machine may have added its own cmdlets into the 32-bit version of PowerShell. If this is the case, you should use 32-bit polling. On Windows machines, you can determine the platform you are using by rightclicking My Computer and clicking Properties. Troubleshooting PowerShell Snap-In Compatibility The most common issue with PowerShell is the incompatibility of the snap-ins with the platform of PowerShell being used; meaning both PowerShell and its snap-ins should both be either 64-bit or 32-bit. When running your script in SAM, typical errors of this type resemble the following:
However, no evidence of a snap-in problem exists in PowerShell itself:
In order to diagnose and correct this problem, verify that the snap-ins are properly registered by doing the following. 1. Find the following registry path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShe llSnapIns
Notice the ApplicationBase path is C:\Program Files\Microsoft\Exchange Server\bin not C:\Program Files (x86). The C:\Program Files (x86) path would suggest 32-bit PowerShell extensions are registered.
2. Open PowerShell though the GUI and check to see if the process is running in 32-bit mode. This is denoted b y the *32 next to the process name. Since this is a 64-bit server with the 64-bit Exchange Management installed, PowerShell should not have a "*32" next to the process name. It should look similar to the image below.
3. Open your 64-bit PowerShell session and run the following:

Administrator Guide SolarWinds Server & Application Monitor add-pssnapin microsoft.exchange.management.powershell.admin
4. Run get-PSSnapin registered. You should see the snap-in listed as shown below:
5. Now you should be able to execute a PowerShell command such as Get-MailboxDatabase -Server {exchange server hostname} and have it return results similar to the following:
6. Your snap-in module has properly been registered. SAM templates that use PowerShell will now work properly.
PowerShell Templates and Monitors

Many SAM templates contain component monitors that allow for the use of PowerShell scripts. An easy way to find a list of these templates is to navigate to the Manage Application Monitor Templates page and search for the word, "PowerShell." This can be done from the SAM web console by navigating to Settings > SAM Settings > Manage Templates. The search text box is at the top-right of the screen. Below is a sample list of the templates found when "PowerShell" is searched. To examine and edit a template, check the box next to the template name. Once a template is checked, the Edit button will become enabled. Click Edit at the top of the list to open the selected template.
In this example, the Exchange 2007-2010 Mailbox Send and Receive Statistics with PowerShell template is used. This template tracks Exchange Mailbox Send/Receive statistics of Exchange 2007-2010 servers with the Mailbox role using PowerShell scripts.
The following screen appears once you have selected a template to edit, revealing the individual component monitors as well as details about the template:
The following documentation accompanies this template: Prerequisites: PowerShell 2.0 and Exchange Management Tools 2007 or 2010 installed on the SAM server. The Exchange server must have an Exchange Mailbox role. The SAM server and the Exchange server must be in the same domain. Credentials: The credentials must be an Exchange Administrator (Organization Manager) account with at least view-only permissions. Note: Before using this template, under the Advanced tree collapse [+], you should set the correct platform; either 32-bit or 64-bit, from the dropdown menu. The default it set to 32-bit. For all PowerShell component monitors: You must specify the correct name of your Exchange user and server in the Script Arguments field of the corresponding PowerShell Monitor. If you fail to do this, the counter will return with an error of "Undefined" status. For example: If the name of your Exchange server is exchange.mydomain.com, and the user you want to monitor is some.user@domain.sw, the value in the Script Arguments field should be the following: some.user@domain.sw,exchange.mydomain.com. To see the names of your Exchange servers, run the following PowerShell command in the Exchange Management Shell: Get-ExchangeServer To see the names of the users, run the following PowerShell command in Exchange Management Shell: Get-Mailbox To examine and edit an individual PowerShell component monitor within the template, click the plus sign [+] to the left of the monitor. For example: Number of items received by specific user during last month.
The following details about the selected component monitor are revealed:
Using a PowerShell script, the monitor in this example is designed to return the number of items received by a specific user during the last month. In order to use this monitor, you will need to change the Script Arguments field from the default example of, user@domain.sw,server.domain.sw to something that will suit your needs for your particular environment. You can do this by clicking the Edit button (highlighted above).You also have the ability to alter the pre-defined script that comes with PowerShell component monitors. Note: Unless otherwise directed by the documentation, you should not need to edit pre-defined scripts.
Once you have changed the Script Arguments field, click Submit to begin using the component monitor within the template. The output for this script using the SAM monitor, Number of items received by specific user during last month, should be similar to the following illustration:
The output for the script using only PowerShell should be similar to the following illustration:
PowerShell Code with SAM

SolarWinds does not provide customer support for any scripting language. For scripting support with SAM, the SolarWinds public community on thwack.com may be of assistance. Note: Unless otherwise directed by the documentation, you should not need to edit pre-defined scripts. To edit the default script for the Number of items received by specific user during last month monitor, click the Edit button for that monitor. Below is the default PowerShell script for this component monitor: Note: Each statistic and message output pair of your script requires a unique identifier. A maximum of 10 output pairs can be monitored per script.
$ErrorActionPreference = "silentlycontinue"; add-pssnapin Microsoft.Exchange.Management.PowerShell.E2010; add-pssnapin Microsoft.Exchange.Management.PowerShell.Admin; $address = $args.get(0); $server = $args.get(1); $Error.Clear(); if ( !$address ) { Write-Host "Message: Can't find "user_mailbox" argument. Check documentation."; exit 1; } if ( !$server ) { Write-Host "Message: Can't find "server" argument. Check documentation."; exit 1; } $t1 = Get-Date; $t2 = $t1.AddMonths(-1); $stat = (Get-MessageTrackingLog -Server $server -Recipients $address -EventID "Receive" -ResultSize "Unlimited" -Start $t2 End $t1 | Measure-Object).Count; if ($Error.Count -eq 0) { Write-Host "Message: User $address received: $stat items during last month"; Write-Host "Statistic: $stat"; Exit 0; } Write-Host "Message: $($Error[0])"; Exit 1;
Variables are used for storing information. In SAM, variables are prefixed with "$", as highlighted below. The following code snippet from the above code calculates a numerical value and then stores it in the variable $stat. In the illustration below, the variable's value is reported as 9356, as highlighted in the Statistic column's output.
Text and variables within quotes indicate information that may be visible to the user. When made visible, the variables in the message will be replaced with the values the variables store. The variables are highlighted below in both the code and the output:
With these same lines of code, Message: and Statistic: refer to the columns where the information will be placed:
Scripts Must Report Status Through Exit Codes Scripts must report their status by exiting with the appropriate exit code. The exit code is used to report the status of the monitor, which is seen by the user through the interface. The following table explains the exit codes and their values:
The following code snippet shows proper usage of exit codes.
The two exit codes in this example are conditional, meaning either one or the other will be triggered based on a certain outcome. When Exit 0; (status of Up) is reported, the message and statistic are displayed and the monitor shows a status of Up. When Exit 1; (status of Down) is reported, the message and statistic are not displayed and a status of Down is reported. If you want to inform SolarWinds SAM that a PowerShell script reports an Up status, you would exit the script using Exit 0; Scripts with Text Output Scripts report additional details by sending text to the scripts standard output. SAM supports multiple values returned by a script using the following format. There is a limit of 10 Statistic and Message pairs for the script. These can be placed anywhere in the script output. The Statistic and Message names you give must contain valid letters and/or numbers.
Detail Type Required Meaning A numeric value used to determine how the monitor compares to its set thresholds. This must be an integer value, (negative numbers are supported).
Statistic
Yes
Statistic.Name1: 123 Statistic.Name2: 456 748 Configuring and Integrating

An error or information message to be displayed in the monitor status details. Note: Multi-line messages are supported. To use this functionality, print each line using a separate command. For example:
Message
No
For more information, refer to the following sections: "Creating a Windows PowerShell Monitor" on page 261. For more information about Windows PowerShell, visit: http://technet.microsoft.com/en-us/library/bb978526.aspx. For a complete list of available PowerShell cmdlets, visit: http://technet.microsoft.com/en-us/library/ee692945.aspx
Execute Scripts Remotely via Secure WinRM

Note: The steps outlined below are only for advanced users. Following the steps outlined in the section, " PowerShell 2.0 Remoting Configuration" on page 751 should be sufficient for most users and environments. Aside from new remoting specific cmdlets with enhanced capabilities, PowerShell 2.0 also ships with full remoting functionality. It is possible to connect your local PowerShell session to a remote computer and execute commands just as if you were sitting in front of the server console. The technology to make this happen relies on WinRM 2.0, which is Microsofts latest implementation of the WSManagement Protocol, a SOAP-based protocol used to manage a variety of hardware devices. The theory behind this is that it will provide a shared way for differing systems to communicate with each other. WinRM 2.0 communicates via HTTP, and so is likely to be firewall-friendly; it also listens on ports 5985 (default) and 5986 (encrypted), avoiding issues with locally installed IIS. Even though it uses HTTP for communication, security has still been considered; either NTLM or Kerberos are used for authentication, and if you wish to configure WinRM 2.0 to use SSL, that is possible too. A lot of the configuration can be carried out via new PowerShell cmdlets shipped with version 2.0. Since PowerShell 2.0 and WinRM 2.0 go hand in hand, Microsoft has bundled them up together along with a new version of BITS (Background Intelligent Transfer Service) 4.0, making a single package known as the Windows Management Framework. Although this collection makes some sense if you know the background, there can be some confusion if an administrator is searching for the download of PowerShell 2.0, ends up at the homepage for the Windows Management Framework (http://support.microsoft.com/kb/968929) and wonders what the heck that is. Well, now you know! The components of the Windows Management Framework are already installed with both Windows Server 2008 R2 and Windows 7, although WinRM 2.0 is not enabled by default on Windows 7. The components have also been made available for older OS versions, and you can download all of those from the homepage of the Windows Management Framework. Essentially, it is available for the various flavors of Windows Server 2008 and 2003, as well as the Windows Vista and XP client operating systems although BITS 4.0 is not available for Windows Server 2003 or XP. This might sound like a muddle, but in short, it is possible to run remote PowerShell 2.0 sessions both to and from all these different operating systems.
PowerShell 2.0 Remoting Requirements

To enable PowerShell remoting, all computers participating in remote management should have the following software:
Windows PowerShell 2.0 NET framework 2.0 SP1 or later Windows Remote Management (WinRM) 2.0
All of the above are installed by default on Windows 7 and Windows Server 2008 R2. However, earlier versions of Windows will require you to download the updates from Microsoft website and install them yourself. PowerShell 2.0 and WinRM 2.0 are included as a part of Windows Management Framework download and are available for Windows XP, Windows Server 2003, Windows Vista and Windows Server 2008. To be able run scripts and commands on remote computers, the user performing remote script execution must be: a member of the administrators group on the remote machine or should be able to provide administrator credentials at the time of remote execution or should have access the PS session configuration on the remote system
Also, on client OS versions of Windows such as Windows Vista and Windows 7, network location must be set either to Home or Work. WS-Management may not function properly if the network location for any of the network adapters is set to public.
PowerShell 2.0 Remoting Configuration

To get PowerShell remoting working we need to configure Remoting Client and Remoting Server. In this document Remoting Client is a SAM box (including additional pollers if there are any); The Remoting Server is any target node, which we are going to monitor with the use of the PowerShell monitor configured to execute scripts remotely via WinRM. As an example, we will discuss the remoting configuration procedure against Windows Server 2008 R2. Note: Some commands (or steps) may be different if Windows Server 2003 is used. Configuration of the Remoting Server To turn your computer in to a Remoting Server that is accessible from other machines, the prerequisites for Remoting Server need to be in place:
SSL Certificate: This is required if we are going to secure our WinRM connection. Listener: Inside WinRM, a listener needs to be set up that listens on the network port Windows PowerShell the Remoting Server uses to communicate. Firewall Exception: A firewall exception is needed that allows outside requests to reach the WinRM service; WinRM Service: This service receives requests from other computers and needs to be running.
Create a Self-signed Certificate You will need an SSL certificate to use a secure WinRM connection. WinRM HTTPS requires a local computer Server Authentication Certificate with a CN matching the IP address that is not expired or revoked to be installed. There are two well-known tools available to create self-signed certificates; MakeCert.exe and SelfSSL.exe. MakeCert.exe is for testing purposes only and comes with Visual Studio. SelfSSL.exe is a part of the Internet Information Services (IIS) 6.0 Resource Kit Tools. SelfSSL.exe will be used in this example. The following commands should be executed on the Remoting Server computer. This is the target node to be used with the SAM PowerShell monitor.
1. Download Internet Information Services (IIS) 6.0 Resource Kit and start setup:
2. Choose the Custom Setup option:
3. Select only the SelfSSL.exe tool (if you have no need for the additional components):
4. Open a Command Prompt as an administrator from the Start menu, (right-click):
5. Change the current location on SelfSSL install path. Typically the path is C:\Program Files (x86)\IIS Resources\SelfSSL:
6. Enter the following command to create a self-signed certificate. Replace the parameters with actual values, as explained below. Note: Ignore the following possible error message: Error opening metabase: 0x80040154. This indicates that IIS 6.0 compatibility mode may not be installed.
selfssl.exe /N:CN=<Local Server IP Address> /V:<Certificate time to live in days> /P:<WinRM listener port> /T /Q
<Local Server IP Address> This is the IP address of the Remoting Server node. Use the IP address and not the computer name. SAM uses this IP address when the probes are run; <Certificate time to live in days> This is the time interval, in days, for which the certificate remains valid; <WinRM listener port> This is the port on which the HTTPS listener will be created. The default value for the WinRM HTTPS listener port is 5986; /T This option adds the self-signed certificate to the Trusted Root Certificates list; /Q Quiet mode. This will prevent you from be prompted when SSL settings are overwritten. For example:
selfssl.exe /N:CN=192.168.0.198 /V:3600 /P:5986 /T /Q
7. Verify that certificate was created properly. Start the Management Console (MMC.exe):
8. Add the Certificates snap-in and verify that the recently created selfsigned certificate is listed in both the Personal and Trusted Root Certificate Authorities storages.
9. Follow the red steps in the graphic, 1 through 4, to select the Certificates: snap-in
10. Once complete, you should have the following:
11. Verify that the certificate is in the Personal storage:
12. Verify that the certificate is in Trusted Root Certificate Authorities storage:
13. Open the created certificate by double-clicking it. 14. On the Details page, select and copy the Thumbprint field value:
15. Copy the values highlighted above to the clipboard. These copied values will be used in creating a Listener in the following section.
Create a WinRM HTTPS Listener Create the Windows Remote Management Listener and bind it to the certificate using the following steps: 1. Open a Command Prompt as an administrator from the Start menu, (right-click):
2. The following command should be executed on the Remoting Server computer. This is the target node which will be used with the SAM PowerShell monitor. It is also the computer where the self-signed certificate was created in the previous section. 3. Enter the following command with the parameters replaced with actual values, as explained below:
winrm create winrm/config/Listener?Address=<IP Address used to bind listener>+Transport=HTTPS @{Hostname=<The name or IP of your remoting server>;CertificateThumbprint=<Paste from the previous step and remove the spaces>;Port=<Port number>}
<IP Address used to bind listener> - To bind the certificate to the Listener, specify the Remoting Server's local IP address. You can use the wildcard, (*), symbol to allow listening on all available local addresses; <The name or IP of your remoting server> - The Remoting Server's node name or IP address; <Paste from the previous step and remove the spaces> Paste the self-signed certificate thumbprint created in steps 13-14 of the previous section; <Port number> - This is the port number for the Listener. You can specify the default WinRM HTTPS port of 5986. For example:
Administrator Guide SolarWinds Server & Application Monitor winrm create winrm/config/Listener?Address=IP:192.168.0.171+Transport= HTTPS @{Hostname="192.168.0.198";CertificateThumbprint="6aa47ed 7356fb0f1e3b434850a7bb51ed40b0d3a";Port="5986"}
4. Once the command has been successfully executed, the output will look similar to the following illustration:
Adding a Firewall Exception The following steps will create a in-bound exception for the Windows firewall using WinRM HTTPS port 5986. 1. Open a Command Prompt as an administrator from the Start menu, (right-click):
2. Enter the following command with the parameters replaced with actual values, as explained below:
netsh advfirewall firewall add rule name="<Rule name>" protocol=TCP dir=in localport=<Port number> action=allow
<Rule name> - This is the name of the rule shown in the Windows Firewall under Advanced Security > Inbound Rules; <Port number> - This is the port number in use for the Listener that was created in the previous section. For example:
netsh advfirewall firewall add rule name="WinRM via HTTPS - Open Port 5986" protocol=TCP dir=in localport=5986 action=allow
Remoting Client/SAM Computer Configuration

Import the self-signed certificate from the Remoting Server with the following steps: 1. On the Remoting Server, open the management console;
2. Add the Certificates snap-in;
3. Locate the created certificate and right-click on it then select All Tasks > Export
4. The Certificate Export Wizard will be launched: 5. Select, No, do not export the private key, the click Next.
6. Select, DER binary X.509 (.CER), and then click Next.
7. Specify the file, and then click Next.
8. Click Finish.
Transferring the Certificate 1. Now you need to transfer the certificate. On the Remoting Client, open the Management Console.
2. Add the Certificates snap-in.
3. Follow the red steps in the graphic, 1 through 4, to select the Certificates snap-in:
4. Click OK when done.
5. Locate Trusted Root Cetrification Authorities, right click on it, then navigate to All Tasks > Import.
6. The Certificate Import Wizard will be launched. Find the file to import and then click Next.
7. Select, Place all Certificates in the following Store. The store is "Trusted Root Certification Authorities."
8. Complete the wizard by clicking Finish.
9. Verify that certificate was imported successfully:
Communicate with Remoting Host

If your machine is only acting as a client in a domain environment, meaning it is accessing other systems but not being accessed itself, you do not need to configure anything out of the ordinary. The following minimum setup will only allow access to other systems that have enabled remoting. You will not be able to test remoting on your own computer. To set up TrustedHosts without calling Enable-PSRemoting, you need to add a registry key and then temporarily run the WinRM service. The following steps address will set up TrustedHosts: 1. Run a Windows PowerShell console as an administrator (right-click):
2. Execute the following commands:
PS> Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Sy stem LocalAccountTokenFilterPolicy 1 -Type DWord PS> Start-Service WinRM
3. Add the TrustedHosts entry:

PS> Set-Item WSMan:\localhost\Client\TrustedHosts Value * -Force 770 Configuring and Integrating
4. Turn off the WinRM service and revert the value of the LocalAccountTokenFilterPolicy registry entry:
PS> Stop-Service WinRM PS> Set-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Sy stem LocalAccountTokenFilterPolicy 0 -Type DWord
Your client is now able to access other systems remotely using Windows PowerShell remoting and is no longer limited to Kerberos and machines inside a domain.
Setup Windows PowerShell Monitor in SAM

Create and test the SAM PowerShell monitor using the following steps: From the SAM web console, navigate to: Settings > SAM Settings > Manage Templates. Search for "PowerShell." Select a template by checking the box next to the template name, an then clicking Edit. Click the [+] to the left of a monitor name to reveal its details: You must choose Remote Host as the execution mode. Check the Use HTTPS Protocol setting. The Port Number value, (the default value is 5986 for WinRM secure connection), should correlate with the port on which the Listener was created on the Remoting Server.
Enter a simple script in the monitor for testing by clicking Edit, for example:
write "Statistic.RemoteMachineName: 0"; write "Message.RemoteMachineName: $env:computername"; exit 0;
Note: This script is printing the computer name (the machine on which this is executed).
Define the output columns for the script:
View the script output:
Create an application based on our template and assign it to the Remoting Server target node:
Examine the script output. Done correctly, you should see the name of the Remote Server node in the output, not the SAM server, ( i.e. the script was executed remotely).
You now have a PowerShell monitor configured to execute scripts remotely via secure WinRM connection.
Appendix I
Templates Reference
SolarWinds SAM contains pre-defined Application Monitor templates to help get you started monitoring applications. For instructions on how to assign templates to nodes, see Manually Assign Application Monitors on page 143. Templates shipped with this version of SAM Active Directory 2003-2008 Services and Counters on page 782. Active Directory 2008 R2 Services and Counters on page 788. AIX LPD on page 794. Apache on page 795. Bind (Linux) on page 797. BizTalk Server 2010 Adapters Performance Counters on page 799. BizTalk Server 2010 Host Throttling Performance Counters on page 803. BizTalk Server 2010 Message Box and Orchestrations Performance Counters on page 811. Blackberry Delivery Confirmation on page 817. Cisco CallManager on page 821. CiscoSecure ACS (via SNMP) on page 823. Citrix XenApp 5.0 Core Counters on page 824. Citrix XenApp 5.0 ICA Session Counters on page 828. Citrix XenApp 5.0 Presentation Server Counters on page 834. Citrix XenApp 5.0 Services on page 839. Citrix XenApp 6.0 Core Counters on page 842 Citrix XenApp 6.0 ICA Session on page 845. Citrix XenApp 6.0 Presentation Server on page 850.
776 Templates Reference
Citrix XenApp 6.0 Services on page 855. CUPS on page 858. DHCP User Experience Monitor on page 860. Distributed File System (DFS) on page 861. DNS User Experience on page 868. Download Speed Monitor on page 869. Errors in Application Event Log on page 871. Exchange 2007 Edge Transport Role Counters (Advanced) on page 930. Exchange 2007-2010 Client Access Role Services and Counters (Basic) on page 874. Exchange 2007-2010 Mailbox Role Services and Counters (Basic) on page 876. Exchange 2007-2010 Edge Transport Role Services and Counters (Basic) on page 883. Exchange 2007-2010 Unified Messaging Role Services and Counters (Basic) on page 886. Exchange 2007-2010 Common Performance Counters on page 888. Exchange 2007-2010 Statistics with PowerShell on page 891. Exchange 2007-2010 PowerShell Scripts Statistics Counters on page 896. Exchange 2010 Client Access Role Counters (Advanced) on page 901. Exchange 2010 Mailbox Role Counters (Advanced) on page 903. Exchange 2010 Hub Transport Role Counters (Advanced) on page 908. Exchange 2010 Edge Transport Role Counters (Advanced) on page 912. Exchange 2010 Unified Messaging Role Counters (Advanced) on page 916. Exchange 2010 OWA Form Login (PowerShell) on page 918.
Templates Reference 777
Exchange 2007 Client Access Role Counters (Advanced) on page 919. Exchange 2007 Mailbox Role Counters (Advanced) on page 921. Exchange 2007 Hub Transport Role Counters (Advanced) on page 926. Exchange 2007 Unified Messaging Role Counters (Advanced) on page 934. Exchange 2007 Outlook Web Access (OWA) Form Login on page 936. Exchange Server (via SNMP) on page 937. File Age Monitor on page 938. File Change Monitor on page 939. File Count Script on page 940. File Existence Monitor on page 941. File Size Monitor on page 942. File Modified (Vbscript) on page 943. Finger Port Monitor on page 944. FTP User Experience on page 945. Generic DNS on page 946. Generic Mail Server on page 947. Generic Web Server on page 948. Gopher Port Monitor on page 949. Group Policy Object (System and Application Logs) on page 950. Helix Universal Media Server (Linux/Unix) on page 955. Helix Universal Media Server (Windows) on page 965. HTTP on page 975. HTTP Form Login on page 976. IBM DB2 on page 977.
IBM Informix on page 981. IMAP4 Round Trip Email on page 990. Internet Information Services and Counters (IIS) on page 991. IRC Port Monitor on page 993. ISC DHCP Server (Linux) on page 994. Java Application Server (SNMP) on page 996. LDAP Connection Monitor on page 1003. LDAP User Experience Monitor on page 1004. Linux CPU Monitoring Perl on page 1005. Linux Disk Monitoring Perl on page 1008. Linux Memory Monitoring Perl on page 1011. Linux Sendmail Monitoring Perl on page 1015. Log Parser (Perl) on page 1017. Log Parser (PowerShell) on page 1019. Lotus Domino Server on page 1022. Lotus Domino Server Statistics on page 1024. MAPI Round Trip Email on page 1028. Microsoft Forefront Threat Management Gateway 2010 on page 1029. Microsoft Lync Server (Edge Role) on page 1035. Microsoft Lync Server (Front-End Role) on page 1040. Microsoft Lync Server (Mediation Role) on page 1045. Microsoft Network Policy Server Events on page 1047. Microsoft Network Policy Server RADIUS Proxy on page 1053. Microsoft Network Policy Server RADIUS Server on page 1056. Microsoft Windows Server 2003 Failover Cluster on page 1059.
Microsoft Windows Server 2008 Failover Cluster on page 1070. MySQL on page 1082. Nagios Linux File & Directory Count Script on page 1089. OpenLDAP on page 1093. Oracle Database on page 1096. POP3 Round Trip Email on page 1100. Postfix on page 1101. PostgreSQL on page 1105. RADIUS User Experience on page 1108. Run 3rd Party Application on page 1109. RWHOIS Port Monitor on page 1111. SharePoint Server 2007 on page 1112. SharePoint Server 2010 on page 1115. SharePoint Services (WSS) 3.0 on page 1118. SNPP Port Monitor on page 1120. Solaris LPD on page 1121. SolarWinds (Orion) Server on page 1123. SolarWinds NetFlow Traffic Analyzer Database on page 1124. SolarWinds NetFlow Traffic Analyzer on page 1128. SQL Server (via SNMP) on page 1134. SQL Server 2005 2008 Performance (WMI) on page 1135. SQL Server 2005-2008 Performance (SQL) on page 1141. SQL Server Query on page 1147. Streaming Media Services 2008 on page 1148. Sybase ASE on page 1153.
TACACS+ User Experience on page 1157. Thwack.com - User Experience Monitor on page 1158. Unix CPU Monitoring Perl on page 1161. Unix Disk Monitoring Perl on page 1164. Unix Memory Monitoring Perl on page 1166. VMware ESX Host on page 1169. Web Link on page 1171. Windows 2003-2008 FTP Service on page 1172. Windows 2008 R2 FTP Service on page 1174. Windows DHCP Server on page 1176. Windows DNS Server on page 1181. Windows DNS Server (via SNMP) on page 1185. Windows Event Log Count on page 1186. Windows FTP Server (via WMI) on page 1188. Windows Network Load Balancing on page 1189. Windows Print Services on page 1198. Windows Remote Desktop Services (Session Host Role) on page 1199. Windows Server 2003 Domain Controller Security on page 1208. Windows Server 2003-2008 on page 1213. Windows Server 2008 Domain Controller Security on page 1216. Windows Update Monitoring on page 1222
Active Directory 2003-2008 Services and Counters

This template assesses the overall health of Active Directory 2003-2008 services and counters on a domain controller. It is recommended to use this template in conjunction with the Windows Server 2003-2008 Services and Counters template. Prerequisites: RPC and WMI access to the domain controller. Credentials: Windows Administrator on the domain controller. Monitored Components Note: Components without predetermined threshold values have guidance such as "use the lowest threshold possible" or "use the highest threshold possible" to help you find a threshold appropriate for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Service: Distributed File System Enables you to group shared folders located on different servers into one or more logically structured namespaces. Each namespace appears to users as a single shared folder with a series of subfolders. Service: DNS Server Enables DNS clients to resolve DNS names by answering DNS queries and dynamic DNS update requests. If this service is stopped, DNS updates will not occur. If this service is disabled, any services that explicitly depend on it will fail to start. Service: File Replication Synchronizes folders with file servers that use File Replication Service (FRS) instead of the newer DFS Replication technology. Service: Intersite Messaging Enables messages to be exchanged between computers running Windows Server sites. If this service is stopped, messages will not be exchanged, nor will site routing information be calculated for other services. If this service is disabled, any services that explicitly depend on it will fail to start. Service: Kerberos Key Distribution Center On domain controllers, this service enables users to log on to the network using the Kerberos authentication protocol. If this service is stopped on a domain controller, users will be unable to log on to the network. If this service is disabled, any services that explicitly depend on it will fail to start.
Service: Windows Time Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Service: DNS Client The DNS Client service (dnscache) caches Domain Name System (DNS) names and registers the full computer name for this computer. If the service is stopped, DNS names will continue to be resolved. However, the results of DNS name queries will not be cached and the computer's name will not be registered. If the service is disabled, any services that explicitly depend on it will fail to start. Service: Security Accounts Manager The startup of this service signals other services that the Security Accounts Manager (SAM) is ready to accept requests. Disabling this service will prevent other services in the system from being notified when the SAM is ready, which may in turn cause those services to fail to start correctly. This service should not be disabled. Service: Server Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Service: Workstation Creates and maintains client network connections to remote servers using the SMB protocol. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Service: Remote Procedure Call (RPC) The RPCSS service is the Service Control Manager for COM and DCOM servers. It performs object activation requests, object exporter resolutions, and distributed garbage collection for COM and DCOM servers. If this service is stopped or disabled, programs using COM or DCOM will not function properly. It is strongly recommended that you have the RPCSS service running
Service: Net Logon Maintains a secure channel between this computer and the domain controller for authenticating users and services. If this service is stopped, the computer may not authenticate users and services, and the domain controller cannot register DNS records. If this service is disabled, any services that explicitly depend on it will fail to start. LDAP Active Threads The current number of threads in use by the LDAP subsystem of the local directory service. Note: You can provide a value for the warning and critical thresholds based on your current environment and your requirements. LDAP Bind Time The time (in milliseconds) required for the completion of the last successful LDAP binding. This counter should be as low as possible. If it is not, it usually indicates that hardware or network-related problems are occurring. LDAP Client Sessions The number of currently connected LDAP client sessions. This counter should show activity over time. If it does not, it usually indicates that network-related problems are occurring. Note: You can provide a value for the warning and critical thresholds based on your current environment and your requirements. Directory Service Threads in Use The current number of threads in use by the directory service. This counter should show activity over time. If it does not, it usually indicates that network problems are hindering client requests. Note: You can provide a value for the warning and critical thresholds based on your current environment and your requirements. Address Book Client Sessions The number of connected Address Book client sessions. Directory Service Notify Queue Size The number of pending update notifications that have been queued, but not yet transmitted to clients.
Note: This counter should be as low as possible. DRA Inbound Full Sync Objects Remaining The number of objects remaining until the full synchronization is completed (while replication is done). Note: This counter should be as low as possible. DRA Inbound Values (DNs only)/sec The number of object property values received from inbound replication partners that are distinguished names (DNs) that reference other objects. DN values, such as group or distribution list memberships, are generally more expensive to apply than other types of values. DRA Outbound Values (DNs only)/sec The number of object property values containing DNs sent to outbound replication partners. DN values, such as group or distribution list memberships, are generally more expensive to read than other kinds of values. LDAP Successful Binds/sec The number of LDAP bindings (per second) that occurred successfully. This counter should show activity over time. If it does not, it usually indicates that network-related problems are occurring. LDAP Searches/sec The number of search operations per second performed by LDAP clients. This counter should show activity over time. If it does not, it usually indicates that network problems are hindering client requests. DS Directory Reads/sec The number of directory reads per second. DS Directory Writes/sec The number of directory writes per second. DRA Pending Replication Synchronizations The number of directory synchronizations that are queued for this server but not yet processed.
Replication: Change Orders Received The number of change orders received. In an idle state this counter should be zero. Replication: Change Orders Sent The number of change orders sent. In an idle state this counter should be zero. Replication: Usn Records Accepted The number of USN records accepted. Replication is triggered by entries to the NTFS USN journal. A high value on this counter, such as one every five seconds, indicates heavy replication traffic and may result in replication latency. System: Context Switches/sec Used to determine whether or not the processor must handle too many applications. Interpret the data cautiously. A thread that is heavily using the processor lowers the rate of context switches, because it does not allow much processor time for other processes' threads. A high rate of context switching means that the processor is being shared repeatedlyfor example, by many threads of equal priority. It is a good practice to minimize the context switching rate by reducing the number of active threads on the system. The use of thread pooling, I/O completion ports, and asynchronous I/O can reduce the number of active threads. Consult your in-house developers or application vendors to determine if the applications you are running provide tuning features that include limiting the number of threads. A context switching rate of 300 per second per processor is a moderate amount; a rate of 1000 per second or more is high. Values at this high level may be a problem. Note: You can provide a value for the warning and critical thresholds based on your current environment and your requirements. System: Processor Queue Length Indicates whether or not the system is able to handle processing requests.
This counter is a rough indicator of the number of threads each processor is servicing. The processor queue length, sometimes called processor queue depth, reported by this counter is an instantaneous value that is representative only of a current snapshot of the processor, so it is necessary to observe this counter over a long period of time. Also this counter is reporting a total queue length for all processors, not a length per processor. For additional information on how to monitor this counter, refer to the following article: http://technet.microsoft.com/en-us/library/cc938643.aspx.
Active Directory 2008 R2 Services and Counters

This template assesses the overall health of Active Directory 2008 R2 services and counters on a domain controller. It is recommended to use this template in conjunction with the Windows Server 2003-2008 Services and Counters template. Prerequisites: RPC and WMI access to the domain controller. Credentials: Windows Administrator on the domain controller. Monitored Components Note: Components without predetermined threshold values provide guidance such as "use the lowest threshold possible" or "use the highest threshold possible" to help you find a threshold appropriate for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Service: Distributed File System Enables you to group shared folders located on different servers into one or more logically structured namespaces. Each namespace appears to users as a single shared folder with a series of subfolders. Service: DNS Server Enables DNS clients to resolve DNS names by answering DNS queries and dynamic DNS update requests. If this service is stopped, DNS updates will not occur. If this service is disabled, any services that explicitly depend on it will fail to start. Service: DFS Replication Enables you to synchronize folders on multiple servers across local or wide area network (WAN) network connections. This service uses the Remote Differential Compression (RDC) protocol to update only the portions of files that have changed since the last replication. Service: Intersite Messaging Enables messages to be exchanged between computers running Windows Server sites. If this service is stopped, messages will not be exchanged, nor will site routing information be calculated for other services. If this service is disabled, any services that explicitly depend on it will fail to start.
Service: Kerberos Key Distribution Center On domain controllers, this service enables users to log on to the network using the Kerberos authentication protocol. If this service is stopped on a domain controller, users will be unable to log on to the network. If this service is disabled, any services that explicitly depend on it will fail to start. Service: Windows Time Maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Service: DNS Client The DNS Client service (dnscache) caches Domain Name System (DNS) names and registers the full computer name for this computer. If the service is stopped, DNS names will continue to be resolved. However, the results of DNS name queries will not be cached and the computer's name will not be registered. If the service is disabled, any services that explicitly depend on it will fail to start. Service: Security Accounts Manager The startup of this service signals other services that the Security Accounts Manager (SAM) is ready to accept requests. Disabling this service will prevent other services in the system from being notified when the SAM is ready, which may in turn cause those services to fail to start correctly. This service should not be disabled. Service: Server Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Service: Workstation Creates and maintains client network connections to remote servers using the SMB protocol. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
Service: Remote Procedure Call (RPC) The RPCSS service is the Service Control Manager for COM and DCOM servers. It performs object activation requests, object exporter resolutions, and distributed garbage collection for COM and DCOM servers. If this service is stopped or disabled, programs using COM or DCOM will not function properly. It is strongly recommended that you have the RPCSS service running Service: Net Logon Maintains a secure channel between this computer and the domain controller for authenticating users and services. If this service is stopped, the computer may not authenticate users and services, and the domain controller cannot register DNS records. If this service is disabled, any services that explicitly depend on it will fail to start. LDAP Active Threads The current number of threads in use by the LDAP subsystem of the local directory service. Note: You can provide a value for the warning and critical thresholds based on your current environment and your requirements. LDAP Bind Time The time (in milliseconds) required for the completion of the last successful LDAP binding. This counter should be as low as possible. If it is not, it usually indicates that hardware or network-related problems are occurring. LDAP Client Sessions The number of currently connected LDAP client sessions. This counter should show activity over time. If it does not, it usually indicates that network-related problems are occurring. Note: You can provide a value for the warning and critical thresholds based on your current environment and your requirements. Directory Service Threads in Use The current number of threads in use by the directory service.
This counter should show activity over time. If it does not, it usually indicates that network problems are hindering client requests. Note: You can provide a value for the warning and critical thresholds based on your current environment and your requirements. Address Book Client Sessions The number of connected Address Book client sessions. Directory Service Notify Queue Size The number of pending update notifications that have been queued, but not yet transmitted to clients. Note: This counter should be as low as possible. DRA Inbound Full Sync Objects Remaining The number of objects remaining until the full synchronization is completed (while replication is done). Note: This counter should be as low as possible. DRA Inbound Values (DNs only)/sec The number of object property values received from inbound replication partners that are distinguished names (DNs) that reference other objects. DN values, such as group or distribution list memberships, are generally more expensive to apply than other types of values. DRA Outbound Values (DNs only)/sec The number of object property values containing DNs sent to outbound replication partners. DN values, such as group or distribution list memberships, are generally more expensive to read than other kinds of values. LDAP Successful Binds/sec The number of LDAP bindings (per second) that occurred successfully. This counter should show activity over time. If it does not, it usually indicates that network-related problems are occurring. LDAP Searches/sec The number of search operations per second performed by LDAP clients.
This counter should show activity over time. If it does not, it usually indicates that network problems are hindering client requests. DS Directory Reads/sec The number of directory reads per second. DS Directory Writes/sec The number of directory writes per second. DRA Pending Replication Synchronizations The number of directory synchronizations that are queued for this server but not yet processed. System: Context Switches/sec Used to determine whether or not the processor must handle an excessive amount of applications. Interpret this data cautiously. A thread that is heavily using the processor lowers the rate of context switches because it does not allow much processor time for other process threads. A high rate of context switching means that the processor is being shared repeatedlyfor example, by many threads of equal priority. It is a good practice to minimize the context switching rate by reducing the number of active threads on the system. The use of thread pooling, I/O completion ports, and asynchronous I/O can reduce the number of active threads. Consult your in-house developers or application vendors to determine if the applications you are running provide tuning features that include limiting the number of threads. A context switching rate of 300 per second per processor is a moderate amount; a rate of 1000 per second or more is high. Values at this high level may be a problem. Note: You can provide a value for the warning and critical thresholds based on your current environment and your requirements. System: Processor Queue Length Indicates whether or not the system is able to handle processing requests.
This counter is a rough indicator of the number of threads each processor is servicing. The processor queue length, sometimes called processor queue depth, reported by this counter is an instantaneous value that is representative only of a current snapshot of the processor, so it is necessary to observe this counter over a long period of time. Also this counter is reporting a total queue length for all processors, not a length per processor. For additional information on how to monitor this counter, refer to the following article: http://technet.microsoft.com/enus/library/cc938643.aspx.
AIX LPD
This template assesses the status and performance of an AIX LPD print service. Perl scripts are used for retrieving performance data. Prerequisites: SSH and Perl installed on the target server. Credentials: Root credentials on the target server. Monitored Components: Daemon: lpd This monitor returns the status of an AIX LPD print server daemon. Possible values: 0 Print server daemon is stopped. 1 Print server daemon is running. Print queue This monitor returns the current length of the default print queue. Print Server Listening TCP Port This component monitor tests the ability of an LP print service to accept incoming sessions. Note: By default, it monitors the TCP 515 port. If your print server listens on another port, you should manually change it.
Apache
This template retrieves Apache server statistics from the built-in Apache server-status web page using Perl scripts. Prerequisites: Perl, access to the Apache server-status page. Credentials: SSH account on the web server. Configuring Apache to allow access to the server-status page: 1. Log on to your Apache server using an SSH or telnet client. 2. Grant yourself root permissions (su root). 3. Locate the Apache configuration file, typically in /usr/local/apache/conf. 4. Append the following lines to your httpd.conf Apache configuration file, substituting the IP address or host name of your Apache server for localhost. Use localhost only if the Apache server services the loopback interface.
<Location /server-status> SetHandler server-status Order Deny,Allow Deny from all Allow from "localhost" </Location> ExtendedStatus On
5. Restart the Apache server (apachectl graceful). If the event a counter returns the following error, you will need to install libwww-perl.
Can't locate LWP/UserAgent.pm in @INC ... error:
To install libwww-perl., enter the following commands:

wget http://www.cpan.org/modules/by-module/LWP/libwww-perl5.837.tar.gz tar xvzf libwww-perl-5.837.tar.gz cd libwww-perl-5.837 perl Makefile.PL make make install
Monitored Components ServerUptime This counter returns the time that the server has been up. Format of time: (hours)h (minutes)m (seconds)s. IdleWorkers This counter returns the number of free workers ready to handle client connections. This counter should be as high as possible. If you have no idle workers, or very few, Apache may be using all the processes it is allowed and new incoming requests must wait for older requests to finish before they can be handled. If this is the case, increasing the maximum allowed processes in your configuration file might help with performance. TotalAccess This counter returns the total number of accesses. TotalTraffic This counter returns the total number of kilobytes this server has served. ServerRequestPerSecond This counter returns the average rate of all requests per second. Note: The result is calculated as the total number of requests throughout the life of the server (count) and divided by the total uptime in seconds (up_time). ServerKbytesPerSec This counter returns the average rate of kilobytes served per second. ServerKbytesPerRequest This counter returns the average number of bytes per request. BusyWorkers This counter returns the number of busy workers serving requests. This counter should be as low as possible.
Bind (Linux)
This template assesses the performance of a Bind service on Linux machines. It uses Perl scripts for monitoring the performance of queries. Prerequisites: SSH and Perl installed on the target server. SNMP installed on the target server and permission to monitor named processes. If Perl is installed in a location different from /usr/bin/perl, you should correct all components in the first line of the Script Body field (#!/usr/bin/perl), or you can create a symbolic link to Perl (refer to documentation for the ln command). You can find where Perl is installed by using the following command: which
perl
Credentials: Root credentials on the target server. Note: Tested on CentOS 5.5 and Bind 9.3.6 version. Monitored Components: Note: You need to set thresholds for counters according to your environment. It is recommended to monitor counters for some period of time to understand potential value ranges and then set the thresholds accordingly. For more information, see "Using the Orion APM MIN/MAX Average Statistic Data historical charts for creating threshold settings based on 95th percentile line". Queries Rate per Sec This monitor returns rates per second of different queries. All rates are calculated as the number of specific queries for 20 seconds and then divided by 20. (Note: It is possible that scripts will return non-integer values. If this monitor is unavailable, it may be that this service is not running.) Returned values: Success This component returns the number of successful queries per second that the name server handled. Successful queries are those that did not result in referrals or errors. Referral This component returns the number of queries per second that the name server handled and resulted in referrals.
Nxrrset This component returns the number of queries per second that the name server handled and resulted in responses saying that the type of record the client requested did not exist for the domain name it specified. Nxdomain This component returns the number of queries per second that the name server handled that resulted in responses saying that the domain name specified did not exist. Recursion This component returns the number of queries that the name server received that required recursive processing to answer. Failure This component returns the number of queries the name server received that resulted in errors other than those covered by nxrrset and nxdomain. Total This component returns the total number of queries per second. SNMP Process Monitor: Named This component returns CPU and memory usage of the named daemon. If these counters are unavailable, there may be problems with SNMP configuration or the named service has stopped.
BizTalk Server 2010 Adapters Performance Counters

This template assesses the status and overall of performance of BizTalk adapters of default Microsoft BizTalk Server 2010 installation. It monitors next adapters: Microsoft Message Queue (MSMQ), files from file system (FILE), FTP, HTTP, POP3, SMTP, SOAP and SQL. Prerequisites: RPC access to the target server. Credentials: Windows Administrator on the target server. Note: For monitoring a SharePoint server, you can also use Internet Information Service (IIS) Services and Counters, Windows Server 2003 -2008 Services and Counters and SQL Server 2005-2008 Performance templates. Monitored Components FILE Receive Adapter: Bytes received/Sec This component monitor returns number of bytes received by the file receive adapter per second. The counter applies only to messages that have been completely read by the file adapter from the file system. FILE Receive Adapter: Lock failures/sec This component monitor returns number of times the file receive adapter failed to lock the file per second. FILE Receive Adapter: Messages received/Sec This component monitor returns number of messages received by the file receive adapter per second. The counter applies only to messages that have been completely read by the file receive adapter from the file system. FILE Receive Adapter: Time to build batch This component monitor returns average time taken by file receive adapter to build a batch. FILE Send Adapter: Bytes sent/Sec This component monitor returns number of bytes sent by the file send adapter per second. The counter applies only to messages that have been completely written to file system.
FILE Send Adapter: Messages sent/Sec This component monitor returns number of messages sent by the file send adapter per second. The counter applies only to messages that have been completely written to file system. FTP Receive Adapter: Bytes received/Sec This component monitor returns number of bytes received by the FTP receive adapter per second. The counter applies only to messages that have been completely read by the FTP receive adapter from the FTP server. FTP Receive Adapter: Messages received/Sec This component monitor returns number of messages received by the FTP receive adapter per second. The counter applies only to messages that have been completely read by the FTP receive adapter from the FTP server. FTP Send Adapter: Bytes sent/Sec This component monitor returns number of bytes sent by the FTP send adapter per second. The counter applies only to messages that have been written to the destination FTP server. FTP Send Adapter: Messages sent/Sec This component monitor returns number of messages sent by the FTP send adapter per second. The counter applies only to messages that have been written to destination FTP server. HTTP Receive Adapter: Memory queue size This component monitor returns number of incoming messages in the HTTP receive adapter's internal memory queue. HTTP Receive Adapter: Messages received/Sec This component monitor returns number of HTTP requests received by the HTTP receive adapter per second. The counter applies only to request messages that have been completely read by the HTTP receive adapter from the HTTP client. HTTP Receive Adapter: Messages sent/Sec This component monitor returns number of HTTP responses sent by the HTTP receive adapter per second. The counter applies only to response messages that have been successfully sent to HTTP clients.
HTTP Receive Adapter: Time to build batch This component monitor returns average time taken by the HTTP receive adapter to build a message batch. HTTP Send Adapter: Memory queue size This component monitor returns number of outgoing messages in the HTTP send adapter's internal memory queue. HTTP Send Adapter: Messages received/Sec This component monitor returns number of HTTP responses received by the HTTP send adapter per second. The counter applies only to response messages that have been completely read by the HTTP send adapter from HTTP servers. HTTP Send Adapter: Messages sent/Sec This component monitor returns number of HTTP requests sent by the HTTP send adapter per second. The counter applies only to request messages that have reached the destination URL. MSMQ Receive Adapter: Bytes received/Sec This component monitor returns number of bytes received by the MSMQ receive adapter per second. The counter applies only to messages that have been completely read by the MSMQ receive adapter from the source queue. MSMQ Receive Adapter: Messages received/Sec This component monitor returns number of messages received by the MSMQ receive adapter per second. The counter applies only to messages that have been completely read by the MSMQ receive adapter from the source queue. MSMQ Send Adapter: Bytes sent/Sec This component monitor returns number of bytes sent by the MSMQ send adapter per second. The counter applies only to messages that have reached the destination queue. MSMQ Send Adapter: Messages sent/Sec This component monitor returns number of messages sent by the MSMQ send adapter per second. The counter applies only to messages that have reached the destination queue.
POP3 Receive Adapter: Active sessions This component monitor returns number of open POP3 connections the POP3 adapter is managing at a time. POP3 Receive Adapter: Bytes received/Sec This component monitor returns number of bytes downloaded by the POP3 adapter from a mail server per second. POP3 Receive Adapter: Messages received/Sec This component monitor returns number of email messages downloaded by the POP3 adapter from mail server per second. SMTP Send Adapter: Messages sent/Sec This component monitor returns number of messages sent by the SMTP adapter per second. The counter applies only to messages that have been transmitted to the SMTP server. SOAP Receive Adapter: Messages received/Sec This component monitor returns number of messages received by the SOAP receive adapter per second. The counter applies only to request messages that have been completely read by the adapter from the SOAP client. SOAP Send Adapter: Messages sent/Sec This component monitor returns number of messages sent by the SOAP send adapter per second. The counter applies only to messages that have reached the destination URL. SQL Receive Adapter: Messages received/Sec This component monitor returns number of messages read by the SQL receive adapter from a SQL server per second. SQL Send Adapter: Messages sent/Sec This component monitor returns number of messages sent by the SQL send adapter per second. The counter applies only to messages that have been written to the destination SQL table.
BizTalk Server 2010 Host Throttling Performance Counters

This template assesses the status and overall of performance of host throttling of default Microsoft BizTalk Server 2010 installation. Prerequisites: RPC access to the target server. Credentials: Windows Administrator on the target server. For more information about BizTalk, see: http://msdn.microsoft.com/en-us/library/aa559591(v=bts.70).aspx; http://msdn.microsoft.com/en-us/library/aa559893(v=bts.20).aspx. Note: For monitoring a SharePoint server, you can also use Internet Information Service (IIS) Services and Counters, Windows Server 200 3-2008 Services and Counters and SQL Server 2005-2008 Performance templates. Monitored Components Note: The BizTalk:Message Agent performance counters are provided for the explicit purpose of analyzing the throttling behavior of a host and therefore will not capture data unless the specified host is actively processing documents. This behavior is by design to prevent consuming system threads with performance monitor when throttling activities are not occurring. Note: BizTalk Server uses in-build host throttling thresholds. Information how to change default Host Throttling settings and thresholds can be found here: http://msdn.microsoft.com/en-us/library/aa559628(v=bts.20).aspx. Active instance count This component monitor returns number of service instances active in memory. For the orchestration engine, a service instance refers to each running instance of an orchestration schedule. For the End Point Manager, a service instance may either correspond to a single stateless message, or to a collection of stateful messages. Note: Stateful instances are those that maintain certain state information about the messages associated with the instance. Messages belonging to a stateful instance are co-related in some form or the other. For example an ordered send port that maintains information about the ordering are considered stateful instances. Most messaging scenarios involve stateless instances where messages are processed completely independent of each other. Each such stateless instance corresponds to a single message within the EPM.
Database size This component monitor returns number of messages in the database queues that this process has published. This value is measured by the number of items in the queue tables for all hosts and the number of items in the spool and tracking tables. If a process is publishing to multiple queues, this counter reflects the weighted average of all the queues. Note: If the host is restarted, statistics held in memory are lost. Since there is some overhead involved, BizTalk Server will resume gathering statistics only when there are at least 100 publishes with 5% of the total publishes within the restarted host process. Database session This component monitor returns number of concurrent Message Box database connections being used. High database session This component monitor returns a flag indicating whether the number of currently opened database sessions exceeds the threshold. Possible values: 0 Normal 1 Database session count exceeds threshold. Threshold value is controlled by the Database connection per CPU value in the BizTalk Host Throttling settings. Database connection per CPU is the maximum number of concurrent database sessions (per CPU) allowed before throttling begins. High database size This component monitor returns a flag indicating whether the destination queue depth of all message box databases exceeds the threshold. If the host publishes to multiple queues, the weighted average across all destination queues is computed (based on recent publish statistics) and compared with the threshold. Possible values: 0 Normal; 1 Database size has grown beyond threshold.
By default the host message count in database throttling threshold is set to a value of 50,000, which will trigger a throttling condition under the following circumstances: The total number of messages published by the host instance to the work, state, and suspended queues of the subscribing hosts exceeds 50,000. The number of messages in the spool table or the tracking table exceeds 500,000 messages.
If this occurs, then consider a course of action that will reduce the number of messages in the database. For example, ensure the SQL Server jobs in BizTalk Server are running without error and use the Group Hub page in the BizTalk Server Administration console to determine whether message build up is caused by large numbers of suspended messages. High in-process message count This component monitor returns a flag indicating whether the number of inprocess messages exceeds the threshold. Possible values: 0 Normal; 1 In-process message count exceeds limit. If throttling is occurring, consider adjusting the In-Process messages per CPU setting. This parameter only affects outbound message throttling. Enter a value of 0 in the In-Process messages per CPU setting to disable throttling based on the number of in-process messages per CPU. The default value for the In-Process messages per CPU setting is 1,000. Note that modifying this value can also have an impact on low latency of messages and/or the efficiency of BizTalk resources. High message delivery rate This component monitor returns a flag indicating whether the message delivery rate is higher than the message processing rate. Possible values: 0 Normal; 1 Message delivery rate exceeds the message processing rate.
High message delivery rates can be caused by high processing complexity, slow outbound adapters, or a momentary shortage of system resources. High message publishing rate This component monitor returns a flag indicating whether the message publishing request rate is higher than the message publishing completion rate. Possible values: 0 Normal; 1 Publishing request rate exceeds completion rate. If this occurs, then the database cannot keep up with the publishing rate of messages to the BizTalk Message Box database. High process memory This component monitor returns a flag indicating whether the process memory consumption exceeds the threshold. Possible values: 0 Normal; 1 Process memory exceeds threshold. The BizTalk Process Memory usage throttling threshold setting is the percentage of memory used compared to the sum of the working set size and total available virtual memory for the process if a value from 1 through 100 is entered. When a percentage value is specified the process memory threshold is recalculated at regular intervals. High system memory This component monitor returns a flag indicating whether the system-wide physical memory consumption exceeds the threshold. Possible values: 0 Normal; 1 System memory exceeds threshold. The BizTalk Physical Memory usage throttling threshold setting is the percentage of memory consumption compared to the total amount of available physical memory if a value from 1 through 100 is entered. This setting can also be the total amount of available physical memory in megabytes if a value greater than 100 is entered. The default value is 0.
High thread count This component monitor returns a flag indicating whether the thread count exceeds the threshold. Possible values: 0 Normal; 1 Thread count exceeds threshold. Threads Per CPU is the total number of threads in the host process including threads used by adapters. If this threshold is exceeded, BizTalk Server will try to reduce the size of the EPM thread pool and message agent thread pool. Thread based throttling should be enabled in scenarios where high load can lead to the creation of a large number of threads. This parameter affects both inbound and outbound throttling. Thread based throttling is disabled by default. Message delivery incoming rate This component monitor returns number of messages per second that are being delivered to the Orchestration engine or the Messaging engine in the given sample interval. High message delivery rates can be caused by high processing complexity, slow outbound adapters, or a momentary shortage of system resources. Message delivery outgoing rate This component monitor returns number of messages per second that are being processed by the Orchestration engine or the Messaging engine in the given sample interval. High message delivery rates can be caused by high processing complexity, slow outbound adapters, or a momentary shortage of system resources.
Message delivery throttling state This component monitor returns a flag indicating whether the system is throttling message delivery (affecting XLANG message processing and outbound transports). Possible values: 0: Not throttling; 1: Throttling due to imbalanced message delivery rate (input rate exceeds output rate); 3: Throttling due to high in-process message count; 4: Throttling due to process memory pressure; 5: Throttling due to system memory pressure; 9: Throttling due to high thread count; 10: Throttling due to user override on delivery. Message delivery delay (ms) This component monitor returns the current delay in ms imposed on each message delivery batch (applicable if the message delivery is being throttled). In regards to throttling, a delay is applied in the publishing or processing of the message, depending on whether the message is inbound or outbound. The delay period is proportional to the severity of the throttling condition. Higher severity throttling conditions will initiate a longer throttling period than lower severity throttling conditions. This delay period is adjusted up and down within certain ranges by the throttling mechanism as conditions change. Long message delivery delays may indicate heavy throttling due to high load. This counter should be less than 5000 ms. Message delivery throttling state duration This component monitor returns seconds since the system entered this state. If the host is throttling, how long it has been throttling; if it is not throttling, how long since throttling was applied. Message publishing incoming rate This component monitor returns number of messages per second that are being sent to the database for publishing in the given sample interval. Message publishing outgoing rate This component monitor returns number of messages per second that are actually published in the database in the given sample interval.
Message publishing throttling state This component monitor returns a flag indicating whether the system is throttling message publishing (affecting XLANG message processing and inbound transports). Possible values: 0: Not throttling; 2: Throttling due to imbalanced message publishing rate (input rate exceeds output rate); 4: Throttling due to process memory pressure; 5: Throttling due to system memory pressure; 6: Throttling due to database growth; 8: Throttling due to high session count; 9: Throttling due to high thread count; 11: Throttling due to user override on publishing. Message publishing delay (ms) This component monitor returns the current delay in ms imposed on each message publishing batch (applicable if the message publishing is being throttled and if the batch is not exempted from throttling). In regards to throttling, a delay is applied in the publishing or processing of the message, depending on whether the message is inbound or outbound. The delay period is proportional to the severity of the throttling condition. Higher severity throttling conditions will initiate a longer throttling period than lower severity throttling conditions. This delay period is adjusted up and down within certain ranges by the throttling mechanism as conditions change. Long message delivery delays may indicate heavy throttling due to high load. This counter should be less than 5000 ms. Message publishing throttling state duration This component monitor returns seconds since the system entered this state. If the host is throttling, how long it has been throttling; if it is not throttling, how long since throttling was applied. Process memory usage (MB) This component monitor returns the process memory consumption in MB. This is the maximum of the processs working set size and the total space allocated for the page file for the process.
BizTalk process memory throttling can occur if the batch to be published has steep memory requirements, or if too many threads are processing messages. Thread count This component monitor returns number of threads being used within the process.
BizTalk Server 2010 Message Box and Orchestrations Performance Counters

This template assesses the status and overall performance of Message Box and Orchestrations of the default Microsoft BizTalk Server 2010 installation. Prerequisites: RPC access to the target server. Credentials: Windows Administrator on the target server. For more information about BizTalk orchestration, see: http://www.microsoft.com/biztalk/en/us/orchestration.aspx; http://msdn.microsoft.com/en-us/library/dd800372.aspx. Note: For monitoring a BizTalk server, you can also use Internet Information Service (IIS) Services and Counters, Windows Server 2003-2008 Services and Counters, and SQL Server 2005-2008 Performance templates. Monitored Components Service: BizTalk Server Application This component monitor shows the status of the BizTalk Server Service. Note: If this service is stopped, all performance counters related with BizTalk become unavailable. Message Box (General): Instances - Total Number This component monitor tracks the sum of all the instances of each host which exist within a particular Message Box. Note: The instance field is installation-specific. Open windows perfmon utility, find BizTalk:Message Box:General Counters category and check what instance this counter uses (for example: biztalkmsgboxdb:emily). Message Box (General): Spool Size This component monitor tracks the size of the spool on a particular message box on a particular server. Note: The instance field is installation-specific. Open windows perfmon utility, find BizTalk:Message Box:General Counters category and check what instance this counter uses (for example: biztalkmsgboxdb:emily).
Message Box (General): Tracking data size This component monitor tracks the size of the tracking data table on a particular message box on a particular server. Note: The instance field is installation-specific. Open windows perfmon utility, find BizTalk:Message Box:General Counters category and check what instance this counter uses (for example: biztalkmsgboxdb:emily). Message Box (Host Queue): Instance State Msg Refs Length This component monitor tracks the number of message references in the Instance State Queue for this particular host. Note: The instance field is installation-specific. Open windows perfmon utility, find BizTalk:Message Box:Host Counters category and check what instance this counter uses (for example: biztalkserverapplication:biztalkmsgboxdb:emily). Message Box (Host Queue): Length This component monitor tracks the total number of messages in the particular host queue. Note: The instance field is installation-specific. Open windows perfmon utility, find BizTalk:Message Box:Host Counters category and check what instance this counter uses (for example: biztalkserverapplication:biztalkmsgboxdb:emily). This counter can be useful in determining if a specific host is bottlenecked. Assuming unique hosts are used for each transport, this can be helpful in determining potential transport bottlenecks. Host Queue Length is a weighted Queue length by aggregating the record count of all the Queues (Work Q, State Q, Suspended Q) of the target host. This counter should be near zero. Message Box (Host Queue): Number of Instances This component monitor tracks the number of instances of this particular host. Note: The instance field is installation-specific. Open windows perfmon utility, find BizTalk:Message Box:Host Counters category and check what instance this counter uses (for example: biztalkserverapplication:biztalkmsgboxdb:emily).
Message Box (Host Queue): Suspended Msgs Length This component monitor tracks the total number of suspended messages for the particular host. Note: The instance field is installation-specific. Open windows perfmon utility, find BizTalk:Message Box:Host Counters category and check what instance this counter uses (for example: biztalkserverapplication:biztalkmsgboxdb:emily). The suspended message queue is a queue that contains work items for which an error or failure was encountered during processing. A suspended queue stores the messages until they can be corrected and reprocessed, or deleted. An increasing trend could indicate severe processing errors. Orchestrations: Average batch factor This component monitor returns the current ratio between the number of persistence points committed and underlying database transactions committed. This metric is beneficial where the Orchestration engine merges multiple atomic transactions into a single transaction. Assuming that a "persistence point" is really a segment boundary, this metric provides some substantial facts about the effect of batching atomic transactions. The greater the number, the greater the effect of "transaction batching" (that is, the less underlying transactions are being created). Orchestrations: Database transactions This component monitor returns number of underlying database transactions used to commit orchestrations work. Orchestrations: Database transactions/sec This component monitor returns number of underlying database transactions used per second.
Orchestrations: Dehydrating orchestrations This component monitor returns total number of dehydratable orchestrations which are currently in the process of dehydrating. When many long-running business processes are running at the same time, memory and performance issues are possible. The orchestration engine addresses these issues by "dehydrating" and "rehydrating" orchestration instances. Dehydration is used to minimize the use of system resources by reducing the number of orchestrations that have to be instantiated in memory at one time. Therefore, dehydrations save memory consumption, but are relatively expensive operations to perform. If there is a high number of dehydrations, the BizTalk Server may be running out of memory (either virtual or physical), a high number of orchestrations are waiting on messages, or the dehydration settings are not set properly. This counter should be less than 10. Orchestrations: Dehydration cycles This component monitor returns number of dehydration cycles completed. Orchestrations: Megabytes allocated private memory This component monitor returns megabytes of allocated private memory for the host instance. Private Bytes is the current size, in bytes, of memory that a process has allocated that cannot be shared with other processes. A host instance consuming large portions of memory is fine as long as it returns the memory to the system. Look for increasing trends in the chart. An increasing trend over a long period of time could indicate a memory leak. Orchestrations: Megabytes allocated virtual memory This component monitor returns megabytes reserved for virtual memory for the host instance. A host instance consuming large portions of memory is fine as long as it returns the memory to the system. Look for increasing trends in the chart. An increasing trend over a long period of time could indicate a memory leak.
Orchestrations: Message Box databases connection failures This component monitor returns number of attempted database connections that failed since the host instance started. If the SQL Server service hosting the BizTalk databases becomes unavailable for any reason, the database cluster transfers resources from the active computer to the passive computer. During this failover process, the BizTalk Server service instances experience database connection failures and automatically restart to reconnect to the databases. The functioning database computer (previously the passive computer) begins processing the database connections after assuming the resources during failover. Orchestrations: Online Message Box databases This component monitor returns number of Message Box databases currently available to the application. Orchestrations: Orchestrations completed/sec This component monitor returns number of orchestrations completed per second. This is a good indicator as to how much throughput BizTalk is processing. Orchestrations: Orchestrations created/sec This component monitor returns number of orchestrations created per second. Orchestrations: Orchestrations dehydrated/sec This component monitor returns number of orchestrations dehydrated per second. Orchestrations: Orchestrations discarded/sec This component monitor returns number of orchestrations discarded per second. An orchestration can be discarded if the engine fails to persist its state. This counter should always be zero. Orchestrations: Orchestrations suspended/sec This component monitor returns number of orchestrations suspended per second.
Generally, suspended instances caused by system errors are resumable upon resolution of the system issue. Often, suspended instances due to a message problem are not resumable, and the message itself must be fixed and resubmitted to the BizTalk Server system. This counter should always be zero. Orchestrations: Pending work items This component monitor returns number of basic code blocks that are scheduled to run. Orchestrations: Running orchestrations This component monitor returns number of orchestration instances currently executing.
Blackberry Delivery Confirmation

This template tests the ability of a Blackberry handheld device to receive messages using the built-in delivery confirmation function. The script in this template sends a specially formed test email to the blackberry device, and then the script checks an email account for the confirmation reply from the Blackberry device. Note: The script in this template requires you to customize variables before it can be run. Prerequisites: Access to an SMTP Server, MAPI access to a Microsoft Exchange server, MAPI Client and CDO Objects installed on SolarWinds SAM server. Credentials: Windows credential valid on both the SolarWinds SAM server and the Microsoft Exchange server. Customizing Script Variables You must substitute your own values for many of the following variables in the script body:
const SenderMailbox = "SAM.test"
Replace SAM.test with the Exchange mailbox for sending and receiving the delivery confirmation messages.
const SenderEmailAddress = SAM.test@example.com
Replace SAM.test@example.com with the email address for sending and receiving the test and the confirmation messages.
const BlackberryAddress = test.blackberry@example.com
Replace test.blackberry@example.com with the email address of the user with the Blackberry handheld device.
const ExchangeServer = "exchange.example.com"
Replace exchange.example.com with the Microsoft Exchange server hosting the Exchange mailbox.
const SenderSmtpServer = "smtp.example.com"
Replace smtp.example.com with the SMTP Server for sending the test email.
const SenderSmtpPort = 25
The script uses port 25 on the SMTP server for sending the test email. If the SMTP server uses a different port, change this value.
Administrator Guide SolarWinds Server & Application Monitor const MaxInboxScans = 300
The script will scan for the confirmation message on the Exchange mailbox 300 times. If this is too many or too few, change this value.
const MaxMessagesPerScan = 100
The script will scan the most recent 100 messages in the Exchange mailbox for the confirmation message. If this is too many or too few, change this value.
const MillisecondsBetweenScans = 1000
The script will wait 1000 milliseconds between Exchange mailbox scans. If this is too long or too short, change this value. Monitored Components BlackBerry Delivery Confirmation
Blackberry Enterprise Server

This template monitors the status of services and server statistics related to the operation of Blackberry Enterprise Servers. Prerequisites: WMI access to target server. Note: See Requirements for Component Monitors and Templates that use WMI on page 218 for information about requirements for WMI access. Credentials: Windows Administrator on target server. Monitored Components Blackberry Router Service Net Service Name: Blackberry Router Blackberry Alert Service Net Service Name: Blackberry Alert Blackberry Attachment Service Net Service Name:Blackberry Attachment Service Blackberry Collaboration Service Net Service Name:Blackberry Collaboration Service Blackberry Controller Service Net Service Name:Blackberry Controller Blackberry MDS Connection Service Net Service Name:Blackberry MDS Connection Service Blackberry Policy Service Net Service Name:Blackberry Policy Service Blackberry Synchronization Service Net Service Name:Blackberry Synchronization Service Blackberry Convert Process Process name: BBConvert.exe Connection State 0 is disconnected, 1 is connected.
Messages Expired The total number of expired messages. Messages Queued for Delivery The number of pending messages queued for handheld device delivery. Messages Received per Minute The average number of messages per minute received by handheld device. Messages Sent per Minute The average number of messages per minute sent by handheld device.
Cisco CallManager
This template monitors critical events generated by Cisco CallManager indicating possible service outages or configuration problems. Alerts are set to display the descriptions of events and the host name. Prerequisites: SNMP access to target server. Credentials: None Monitored Components CallManager Status The current status of the CallManager. Status 1 is unknown, 2 is up, 3 is down. Registered Phones The number of phones registered with the local call manager. Unregistered Phones The number of phones not registered with the local call manager. Rejected Phones The number of phones refused registration by the local call manager. Registered Gateways The number of gateways registered with the local call manager. Unregistered Gateways The number of gateways not registered with the local call manager. Rejected Gateways The number of gateways refused registration by the local call manager. Registered Media Devices The number of media devices registered with the local call manager. Unregistered Media Devices The number of media devices not registered with the local call manager. Rejected Media Devices The number of media devices refused registration by the local call manager.
Registered CTI Devices The number of CTI devices registered with the local call manager. Unregistered CTI Devices The number of CTI devices not registered with the local call manager. Rejected CTI Devices The number of CTI devices refused registration by the local call manager. Registered Voice Messaging Devices The number of voice messaging devices registered with the local call manager. Unregistered Voice Messaging Devices The number of voice messaging devices not registered with the local call manager. Rejected Voice Messaging Devices The number of voice messaging devices refused registration by the local call manager. Citrix Licensing Net Service Name: lmgrd
CiscoSecure ACS (via SNMP)

This template assesses the overall performance of a CiscoSecure ACS server by monitoring its key processes. Prerequisites: SNMP access to target server. Credentials: None. Monitored Components CS Admin - SNMP Process Name: CSAdmin.exe CS Auth - SNMP Process Name: CSAuth.exe CS Tacacs - SNMP Process Name: CSTacacs.exe CS Radius - SNMP Process Name: CSRadius.exe CS DBSync - SNMP Process Name: CSDBSync.exe CS Log - SNMP Process Name: CSLog.exe CS Mon - SNMP Process Name: CSMon.exe
Citrix XenApp 5.0 Core Counters

This template monitors critical events generated by Citrix XenApp 5.0 which may indicate possible service outages or configuration problems. Alerts are set to display descriptions of events as well as the host name. Prerequisites: RPC access to the target server. For more information, see Requirements for Component Monitors and Templates that use WMI on page 218. Credentials: Windows Administrator on target server. Note: If you find that the SolarWinds SAM Citrix XenApp 5.0 Core WMI Counters template is failing because some of the counter names on the Citrix server include (ms) at the end of the counter name, whereas the counter names in the template do not, refer to the following KB article for assistance: http://knowledgebase.solarwinds.com/kb/questions/2192. The following component monitors reads Windows Performance Counter data using Remote Procedure Calls (RPC) instead of Windows Management Instrumentation (WMI). Monitored Components Citrix CPU Utilization Mgmt: CPU Entitlement This component monitor returns the percentage of CPU availability the Citrix CPU Utilization Management feature has made to the user. When this resource is fully utilized, the Citrix CPU Utilization Mgmt feature uses the share/reservation assignment and recent CPU consumption of each user to determine the CPU entitlement of that user. On multi-processor machines, the maximum value of the counter is 100% multiplied by the number of logical processors. Citrix CPU Utilization Mgmt: CPU Reservation This component monitor returns the percentage of the CPU that is reserved for users using the Citrix CPU Utilization Management feature, if needed. A value in the range 1-99 indicates that a CPU reservation is applied. A value of zero indicates that no CPU reservation is being used. When the CPU resource is fully utilized, Citrix CPU Utilization Mgmt uses the reservation when calculating the CPU entitlement of a user. Citrix CPU Utilization Mgmt: CPU Shares
This component monitor returns the percentage of the CPU assigned to a user. A value of zero indicates that no CPU shares value is being used. When the CPU resource is fully utilized, Citrix CPU Utilization Mgmt uses the shares value when calculating the CPU entitlement of a user. Citrix CPU Utilization Mgmt: CPU Usage This component monitor returns the percentage of the CPU being used by a user, averaged over a short period of time. This may be used to identify users who consume significant amounts of CPU resources and to provide CPU usage accounting data. On multi-processor machines, the maximum value of the counter is 100% multiplied by the number of logical processors. Citrix CPU Utilization Mgmt: Long-term CPU Usage This component monitor returns the percentage of the CPU used by a user averaged over a long period of time. On multi-processor machines, the maximum value of the counter is 100% multiplied by the number of logical processors. Citrix IMA Networking: Bytes Received/sec This component monitor returns the data rate of incoming IMA network traffic. Citrix IMA Networking: Bytes Sent/sec This component monitor returns the data rate of outgoing IMA network traffic. Citrix IMA Networking: Network Connections This component monitor returns the number of active network IMA connections to IMA servers. Citrix Licensing: Average License Check-In Response Time (ms) This component monitor returns the average response time for a license check-in operation. Citrix Licensing: Average License Check-Out Response Time (ms) This component monitor returns the average response time for a license check-out operation. Citrix Licensing: Last Recorded License Check-In Response Time (ms) This component monitor returns the last response time for a license check-in operation.
Citrix Licensing: Last Recorded License Check-Out Response Time (ms) This component monitor returns the last response time for a license checkout operation. Citrix Licensing: License Server Connection Failure This component monitor returns the time, in minutes, that the Citrix XenApp server has been without a connection to the license server. The time returned should be less than 30 minutes. Ideally, the returned time should be zero. Citrix Licensing: Maximum License Check-In Response Time (ms) This component monitor returns the maximum response time for a license check-in operation. Citrix Licensing: Maximum License Check-Out Response Time (ms) This component monitor returns the maximum response time for a license check-out operation. Secure Ticket Authority: STA Bad Data Request Count This component monitor returns the number of unsuccessful ticket validation and data requests over the lifetime of the STA. Secure Ticket Authority: STA Bad Refresh Request Count This component monitor returns the number of unsuccessful ticket refresh requests over the lifetime of the STA. Secure Ticket Authority: STA Bad Ticket Request Count This component monitor returns the number of unsuccessful ticket creation requests over the lifetime of the STA. Secure Ticket Authority: STA Count of Active Tickets This component monitor returns the number of tickets currently in the STA. Secure Ticket Authority: STA Good Data Request Count This component monitor returns the number of successful ticket validation and data requests over the lifetime of the STA. Secure Ticket Authority: STA Good Refresh Request Count This component monitor returns the number of successful ticket refresh requests over the lifetime of the STA.
Secure Ticket Authority: STA Good Ticket Request Count This component monitor returns the number of successful ticket creation requests over the lifetime of the STA. Secure Ticket Authority: STA Peak All Request Rate This component monitor returns the highest activities per second recorded for all activities over the lifetime of the STA. Secure Ticket Authority: STA Peak Data Request Rate This component monitor returns the highest data requests per second recorded over the lifetime of the STA. Secure Ticket Authority: STA Peak Ticket Refresh Rate This component monitor returns the highest ticket refresh requests per second recorded over the lifetime of the STA. Secure Ticket Authority: STA Peak Ticket Request Rate This component monitor returns the highest ticket creation requests per second recorded over the lifetime of the STA. Secure Ticket Authority: STA Ticket Timeout Count This component monitor returns the number of ticket request timeouts recorded over the lifetime of the STA.
Citrix XenApp 5.0 ICA Session Counters

This template monitors critical events generated by Citrix XenApp 5.0 which may indicate possible service outages or configuration problems. Alerts are set to display the descriptions of events as well as the host name. Prerequisites: RPC access to the target server. For more information, see Requirements for Component Monitors and Templates that use WMI on page 218. Credentials: Windows Administrator on target server. Note: The following component monitors reads Windows Performance Counter data using Remote Procedure Calls (RPC) instead of Windows Management Instrumentation (WMI). Monitored Components Input Audio Bandwidth This component monitor returns the client-to-server bandwidth used for audio in ICA sessions in bits per second. Input Clipboard Bandwidth This component monitor returns the bandwidth used for clipboard operations between ICA sessions and local windows in bits per second. Input COM 1 Bandwidth This component monitor returns the bandwidth used for printing to the client port, COM 1, through an ICA session without print spooler support. The bandwidth reported is in bits per second. Input COM 2 Bandwidth This component monitor returns the bandwidth used for printing to the client port, COM 2, through an ICA session without print spooler support. The bandwidth reported is in bits per second. Input COM Bandwidth This component monitor returns the client-to-server bandwidth used in receiving data from the client COM port in bits per second. Input Control Channel Bandwidth
This component monitor returns the client-to-server bandwidth used to execute the LongCommandLine parameters of published applications. The bandwidth reported is in bits per second. Input Drive Bandwidth This component monitor returns the client-to-server bandwidth used to perform file operations during ICA sessions in bits per second. Input Font Data Bandwidth This component monitor returns the bandwidth used to initiate the font changes in ICA sessions with SpeedScreen in bits per second. Input Licensing Bandwidth This component monitor returns the bandwidth used to negotiate session licensing in bits per second. This counter normally does not contain any data. Input LPT1 Bandwidth This component monitor returns the virtual channel bandwidth used for printing to the client port, LPT1, through an ICA session without print spooler support. The bandwidth reported is in bits per second. Input LPT2 Bandwidth This component monitor returns the virtual channel bandwidth used for printing to the client port, LPT2, through an ICA session without print spooler support. The bandwidth reported is in bits per second. Input Management Bandwidth This component monitor returns the bandwidth used to perform management tasks in bits per second. Input PN Bandwidth This component monitor returns the Program Neighborhood bandwidth used to obtain details about application sets. The bandwidth reported is in bits per second. Input Printer Bandwidth This component monitor returns the bandwidth used for printing to a client printer through a client with print spooler support. The bandwidth reported is in bits per second. Input Seamless Bandwidth
This component monitor returns the bandwidth used for published applications not embedded in a session window. The bandwidth reported is in bits per second. Input Session Bandwidth This component monitor returns the client-to-server bandwidth used for a session. The bandwidth reported is in bits per second. Input Session Compression This component monitor returns the client-to-server compression ratio used for a session. Input Session Line Speed This component monitor returns the client-to-server line speed for a session. The bandwidth reported is in bits per second. Input SpeedScreen Data Channel Bandwidth This component monitor returns the client-to-server bandwidth used for data channel traffic. The bandwidth reported is in bits per second. Input Text Echo Bandwidth This component monitor returns the client-to-server bandwidth used for text echo. The bandwidth reported is in bits per second. Input ThinWire Bandwidth This component monitor returns the client-to-server bandwidth used for ThinWire traffic. The bandwidth reported is in bits per second. Input VideoFrame Bandwidth This component monitor returns the client-to-server bandwidth used for traffic over virtual channels. The bandwidth reported is in bits per second. Latency - Last Recorded This component monitor returns the last recorded latency value of the session. Latency - Session Average This component monitor returns the average latency over the session lifetime. This value should be as low as possible. Latency - Session Deviation
This component monitor returns the difference between the minimum and the maximum session latency values. This value should be as low as possible. Output Audio Bandwidth This component monitor returns the server-to-client bandwidth used for audio in ICA sessions. The bandwidth reported is in bits per second. Output Clipboard Bandwidth This component monitor returns the bandwidth used for clipboard operations between ICA sessions and local windows. The bandwidth reported is in bits per second. Output COM 1 Bandwidth This component monitor returns the bandwidth used for printing to the client port, COM 1, through an ICA session without print spooler support. The bandwidth reported is in bits per second. Output COM 2 Bandwidth This component monitor returns the bandwidth used for printing to the client port, COM 2, through an ICA session without print spooler support. The bandwidth reported is in bits per second. Output COM Bandwidth This component monitor returns the server-to-client bandwidth used receiving data from the client COM port. The bandwidth reported is in bits per second. Output Control Channel Bandwidth This component monitor returns the server-to-client bandwidth used to execute the LongCommandLine parameters of published applications. The bandwidth reported is in bits per second. Output Drive Bandwidth This component monitor returns the server-to-client bandwidth used to perform file operations during ICA sessions. The bandwidth reported is in bits per second. Output Font Data Bandwidth This component monitor returns the bandwidth used to initiate the font changes in ICA sessions with SpeedScreen. The bandwidth reported is in bits per second.
Output Licensing Bandwidth This component monitor returns the bandwidth used to negotiate session licensing. The bandwidth reported is in bits per second. Normally, this contains no data. Output LPT1 Bandwidth This component monitor returns the bandwidth used for printing to the client pot, LPT1, through an ICA session without print spooler support. The bandwidth reported is in bits per second. Output LPT2 Bandwidth This component monitor returns the bandwidth used for printing to the client pot, LPT2, through an ICA session without print spooler support. The bandwidth reported is in bits per second. Output Management Bandwidth This component monitor returns the bandwidth used to perform management tasks. The bandwidth reported is in bits per second. Output PN Bandwidth This component monitor returns the Program Neighborhood bandwidth used to obtain details about application sets. The bandwidth reported is in bits per second. Output Printer Bandwidth This component monitor returns the bandwidth used for printing to a client printer through a client with print spooler support. The bandwidth reported is in bits per second. Output Seamless Bandwidth This component monitor returns the bandwidth used for published applications not embedded in a session window. The bandwidth reported is in bits per second. Output Session Bandwidth This component monitor returns the server-to-client bandwidth used for a session. The bandwidth reported is in bits per second. Output Session Compression This component monitor returns the server-to-client compression ratio used for a session.
Output Session Line speed This component monitor returns the server-to-client line speed used for a session. The bandwidth reported is in bits per second. Output SpeedScreen Data Channel Bandwidth This component monitor returns the server-to-client bandwidth used for data channel traffic. The bandwidth reported is in bits per second. Output Text Echo Bandwidth This component monitor returns the bandwidth used for text echo. The bandwidth reported is in bits per second. Output ThinWire Bandwidth This component monitor returns the server-to-client bandwidth used for ThinWire traffic. The bandwidth reported is in bits per second. Output VideoFrame Bandwidth This component monitor returns the server-to-client bandwidth used for traffic on virtual channels. The bandwidth reported is in bits per second.
Citrix XenApp 5.0 Presentation Server Counters

This template monitors critical events generated by Citrix XenApp 5.0 which may indicate possible service outages or configuration problems. Alerts are set to display the descriptions of events and the host name. Prerequisites: RPC access to the target server. For more information, see Requirements for Component Monitors and Templates that use WMI on page 218. Credentials: Windows Administrator on target server. Note: The following component monitors reads Windows Performance Counter data using Remote Procedure Calls (RPC) instead of Windows Management Instrumentation (WMI). Monitored Components Application Enumeration/sec This component monitor returns the number of non-XML-based enumerations (requests for application lists) per second. Application Resolution Time (ms) This component monitor measures the time required to resolve the LeastLoaded Server during an application in milliseconds. A baseline would be needed in order to establish increases during peak logon times before an accurate threshold can be defined. Application Resolutions Failed/sec This component monitor returns the number of application resolutions failed per second. This value should be zero at all times. Application Resolutions/sec This component monitor returns the number of resolutions (application launch requests) per second. DataStore Connection Failure This component monitor returns the number of minutes that the XenApp server has been disconnected from the data store. This value should be zero at all times. DataStore bytes read
This component monitor returns the number of bytes read from the data store. DataStore bytes read/sec This component monitor returns the number of bytes read from the data store per second. DataStore bytes written/sec This component monitor returns the number of bytes written to the data store per second. DataStore reads This component monitor returns the number of times data was read from the data store. DataStore reads/sec This component monitor returns the number of times data was read from the data store per second. DataStore writes/sec This component monitor returns the number of times data was written to the data store per second. DynamicStore bytes read/sec This component monitor returns the number of dynamic data store bytes read per second. DynamicStore bytes written/sec This component monitor returns the number of dynamic data store bytes written per second. DynamicStore Gateway Update Count This component monitor returns the number of dynamic store update packets sent to remote data collectors. DynamicStore Gateway Update Bytes Sent This component monitor returns the number of bytes of data sent across gateways to remote data collectors. DynamicStore Query Count
This component monitor returns the number of performed dynamic store queries. DynamicStore Query Request Bytes Received This component monitor returns the number of bytes of data received in dynamic store query request packets. DynamicStore Query Response Bytes Sent This component monitor returns the number of bytes of data sent in response to dynamic store queries. DynamicStore reads/sec This component monitor returns the number of times data was read from the dynamic store per second. DynamicStore Update Bytes Received This component monitor returns the number of bytes of data received in dynamic store update packets. DynamicStore Update Packets Received This component monitor returns the number of update packets received by the dynamic store. DynamicStore Update Response Bytes Sent This component monitor returns the number of bytes of data sent in response to dynamic store update packets. DynamicStore writes/sec This component monitor returns the number of times data was written to the dynamic store per second. Filtered Application Enumerations/sec This component monitor returns the number of XML-based enumerations (requests for application lists) per second. LocalHostCache bytes read/sec This component monitor returns the number of bytes of IMA local host cache data read per second. LocalHostCache bytes written/sec
This component monitor returns the number of bytes of IMA local host cache data written per second. LocalHostCache reads/sec This component monitor returns the number of times data was read from the IMA local host cache per second. LocalHostCache writes/sec This component monitor returns the number of times data was written to the IMA local host cache per second. Maximum number of XML threads This component monitor returns the maximum number of threads allocated to service Web-based sessions since the server last restarted. Number of busy XML threads This component monitor returns the number of XML requests that are currently being processed. This value should be less than 12. The maximum number of requests that the XML service can process at any one time is 16. Number of XML threads This component monitor returns the number of threads allocated to service web-based sessions. Resolution WorkItem Queue Executing Count This component monitor returns the number of work items (related to application launches) that are waiting to be processed by IMA. Resolution WorkItem Queue Ready Count This component monitor returns the number of resolution work items that are ready to be executed. This value should be zero at all times. WorkItem Queue Executing Count This component monitor returns the number of work items that are currently being executed. WorkItem Queue Pending Count This component monitor returns the number of work items that are not yet ready to be executed.
WorkItem Queue Ready Count This component monitor returns the number of work items that are ready and waiting to be processed by IMA. This value should be zero at all times. Zone Elections This component monitor returns the number of zone elections that occurred. This value starts at zero each time the IMA Service starts and is incremented each time a zone election takes place. Zone Elections Won This component monitor returns the number of times the server won a zone election.
Citrix XenApp 5.0 Services

This template monitors critical events generated by Citrix XenApp 5.0 which may indicate possible service outages or configuration problems. Alerts are set to display the descriptions of events and the host name. Prerequisites: RPC access to the target server. For more information, see Requirements for Component Monitors and Templates that use WMI on page 218. Credentials: Windows Administrator on target server. Note: The following component monitors use WMI or RPC communication to test if a specified Windows service is running and reports the CPU, virtual memory, and physical memory used by the service. Monitored Components Citrix ActiveSync Service This component monitor supports ActiveSync in ICA sessions. Citrix ADF Installer Service This component monitor is used by Installation Manager in the Enterprise and Platinum versions to install packages onto Presentation Servers. Citrix Client Network This component monitor handles the mapping of client drives and peripherals within ICA sessions. Citrix CPU Utilization Mgmt/CPU Rebalancer (requires multiple CPUs) This component monitor enhances resource management across multiple CPUs. Citrix CPU Utilization Mgmt/Resource Mgmt This component monitor is used in the Enterprise and Platinum versions to manage resource consumption. Citrix CPU Utilization Mgmt/User-Session Sync This component monitor is used in the Enterprise version to synchronize user IDs of processes with their respective owner. Citrix Diagnostic Facility COM Server
This component monitor manages Diagnostic Facility tracing when used to diagnose problems with the Citrix Server. Citrix Encryption Service This component monitor handles encryption between the client device and the Citrix Server. Citrix Health Monitoring and Recovery This component monitor provides health monitoring and recovery services if event problems occur. Citrix Independent Management Architecture This component monitor provides management services within the Citrix farm. Citrix License Management Console (License server only) This component monitor provides the web-based interface for licensing administration. Citrix Licensing WMI (License server only) This component monitor provides information and notification regarding licensing events on the license server. Citrix MFCOM Service (MetaFrame COM Server) This component monitor provides COM services which allow remote connections of the management consoles. Citrix Print Manager Service This component monitor handles the creation of printers and driver usage within Citrix sessions. Citrix Resource Manager Mail This component monitor is used in the Enterprise and Platinum versions to send email alerts when thresholds in the server farm have been met or exceeded. Citrix Services Manager This component monitor allows the components of the presentation server to interface with the operating system. Citrix SMA Service
This component monitor watches the event log and Citrix WMI to raise alerts in the Access Suite Console or Access Management Console. Citrix Streaming Service This component monitor is used in the Enterprise and Platinum versions to manage the Citrix Streaming Client when streaming applications. Citrix Virtual Memory Optimization This component monitor is used in the Enterprise and Platinum versions to release .dlls in order to free up server memory. Citrix WMI Service This component monitor is used by the Citrix WMI classes for information and management purposes. Citrix XTE Server This component monitor handles SSL Relay and Session Reliability functionality. CitrixLicensing (License server only) This component monitor handles allocation of licenses on the license server. Citrix End User Experiencing Monitoring This component monitor handles the Net Service Name: Citrix EUEM. If you have trouble with this service, refer to this article: http://support.citrix.com/article/CTX120846.
Citrix XenApp 6.0 Core Counters

This template monitors critical events generated by Citrix XenApp 6.0 which may indicate possible service outages or configuration problems. Alerts are set to display descriptions of events as well as the host name. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on target server. Monitored Components Note: You need to set thresholds for counters according to your environment. It is recommended to monitor counters for some period of time to understand potential value ranges and then set the thresholds accordingly. For more information, see "Using the Orion APM MIN/MAX Average Statistic Data historical charts for creating threshold settings based on 95th percentile line." Citrix IMA Networking: Bytes Received/sec This component monitor returns the data rate of incoming IMA network traffic. Citrix IMA Networking: Bytes Sent/sec This component monitor returns the data rate of outgoing IMA network traffic. Citrix IMA Networking: Network Connections This component monitor returns the number of active network IMA connections to IMA servers. Citrix Licensing: Average License Check-In Response Time (ms) This component monitor returns the average response time for a license check-in operation. Citrix Licensing: Average License Check-Out Response Time (ms) This component monitor returns the average response time for a license check-out operation. Citrix Licensing: Last Recorded License Check-In Response Time (ms) This component monitor returns the last response time for a license check-in operation. Citrix Licensing: Last Recorded License Check-Out Response Time (ms)
This component monitor returns the last response time for a license checkout operation. Citrix Licensing: License Server Connection Failure This component monitor returns the time, in minutes, that the Citrix XenApp server has been without a connection to the license server. The time returned should be less than 30 minutes. Ideally, the returned time should be zero. Citrix Licensing: Maximum License Check-In Response Time (ms) This component monitor returns the maximum response time for a license check-in operation. Citrix Licensing: Maximum License Check-Out Response Time (ms) This component monitor returns the maximum response time for a license check-out operation. Secure Ticket Authority: STA Bad Data Request Count This component monitor returns the number of unsuccessful ticket validation and data requests over the lifetime of the STA. Secure Ticket Authority: STA Bad Refresh Request Count This component monitor returns the number of unsuccessful ticket refresh requests over the lifetime of the STA. Secure Ticket Authority: STA Bad Ticket Request Count This component monitor returns the number of unsuccessful ticket creation requests over the lifetime of the STA. Secure Ticket Authority: STA Count of Active Tickets This component monitor returns the number of tickets currently in the STA. Secure Ticket Authority: STA Good Data Request Count This component monitor returns the number of successful ticket validation and data requests over the lifetime of the STA. Secure Ticket Authority: STA Good Refresh Request Count This component monitor returns the number of successful ticket refresh requests over the lifetime of the STA. Secure Ticket Authority: STA Good Ticket Request Count
This component monitor returns the number of successful ticket creation requests over the lifetime of the STA. Secure Ticket Authority: STA Peak All Request Rate This component monitor returns the highest activities per second recorded for all activities over the lifetime of the STA. Secure Ticket Authority: STA Peak Data Request Rate This component monitor returns the highest data requests per second recorded over the lifetime of the STA. Secure Ticket Authority: STA Peak Ticket Refresh Rate This component monitor returns the highest ticket refresh requests per second recorded over the lifetime of the STA. Secure Ticket Authority: STA Peak Ticket Request Rate This component monitor returns the highest ticket creation requests per second recorded over the lifetime of the STA. Secure Ticket Authority: STA Ticket Timeout Count This component monitor returns the number of ticket request timeouts recorded over the lifetime of the STA.
Citrix XenApp 6.0 ICA Session

This template monitors critical events generated by Citrix XenApp 6.0 which may indicate possible service outages or configuration problems. Alerts are set to display the descriptions of events as well as the host name. Prerequisites: WMI access to target server. Credentials: Windows Administrator on target server. Monitored Components Note: You need to set thresholds for counters according to your environment. It is recommended to monitor counters for some period of time to understand potential value ranges and then set the thresholds accordingly. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Input Audio Bandwidth This component monitor returns the client-to-server bandwidth used for audio in ICA sessions in bits per second. Input COM 1 Bandwidth This component monitor returns the bandwidth used for printing to the client port, COM 1, through an ICA session without print spooler support. The bandwidth reported is in bits per second. Input COM 2 Bandwidth This component monitor returns the bandwidth used for printing to the client port, COM 2, through an ICA session without print spooler support. The bandwidth reported is in bits per second. Input COM Bandwidth This component monitor returns the client-to-server bandwidth used in receiving data from the client COM port in bits per second. Input Control Channel Bandwidth This component monitor returns the client-to-server bandwidth used to execute the LongCommandLine parameters of published applications. The bandwidth reported is in bits per second. Input Drive Bandwidth This component monitor returns the client-to-server bandwidth used to perform file operations during ICA sessions in bits per second.
Input Font Data Bandwidth This component monitor returns the bandwidth used to initiate the font changes in ICA sessions with SpeedScreen in bits per second. Input Licensing Bandwidth This component monitor returns the bandwidth used to negotiate session licensing in bits per second. This counter normally does not contain any data. Input LPT1 Bandwidth This component monitor returns the virtual channel bandwidth used for printing to the client port, LPT1, through an ICA session without print spooler support. The bandwidth reported is in bits per second. Input LPT2 Bandwidth This component monitor returns the virtual channel bandwidth used for printing to the client port, LPT2, through an ICA session without print spooler support. The bandwidth reported is in bits per second. Input PN Bandwidth This component monitor returns the Program Neighborhood bandwidth used to obtain details about application sets. The bandwidth reported is in bits per second. Input Printer Bandwidth This component monitor returns the bandwidth used for printing to a client printer through a client with print spooler support. The bandwidth reported is in bits per second. Input Seamless Bandwidth This component monitor returns the bandwidth used for published applications not embedded in a session window. The bandwidth reported is in bits per second. Input Session Bandwidth This component monitor returns the client-to-server bandwidth used for a session. The bandwidth reported is in bits per second. Input Session Compression This component monitor returns the client-to-server compression ratio used for a session.
Input Session Line Speed This component monitor returns the client-to-server line speed for a session. The bandwidth reported is in bits per second. Input SpeedScreen Data Channel Bandwidth This component monitor returns the client-to-server bandwidth used for data channel traffic. The bandwidth reported is in bits per second. Input Text Echo Bandwidth This component monitor returns the client-to-server bandwidth used for text echo. The bandwidth reported is in bits per second. Input ThinWire Bandwidth This component monitor returns the client-to-server bandwidth used for ThinWire traffic. The bandwidth reported is in bits per second. Latency - Last Recorded This component monitor returns the last recorded latency value of the session. Latency - Session Average This component monitor returns the average latency over the session lifetime. This value should be as low as possible. Latency - Session Deviation This component monitor returns the difference between the minimum and the maximum session latency values. This value should be as low as possible. Output Audio Bandwidth This component monitor returns the server-to-client bandwidth used for audio in ICA sessions. The bandwidth reported is in bits per second. Output Clipboard Bandwidth This component monitor returns the bandwidth used for clipboard operations between ICA sessions and local windows. The bandwidth reported is in bits per second. Output COM 1 Bandwidth
This component monitor returns the bandwidth used for printing to the client port, COM 1, through an ICA session without print spooler support. The bandwidth reported is in bits per second. Output COM 2 Bandwidth This component monitor returns the bandwidth used for printing to the client port, COM 2, through an ICA session without print spooler support. The bandwidth reported is in bits per second. Output COM Bandwidth This component monitor returns the server-to-client bandwidth used receiving data from the client COM port. The bandwidth reported is in bits per second. Output Control Channel Bandwidth This component monitor returns the server-to-client bandwidth used to execute the LongCommandLine parameters of published applications. The bandwidth reported is in bits per second. Output Drive Bandwidth This component monitor returns the server-to-client bandwidth used to perform file operations during ICA sessions. The bandwidth reported is in bits per second. Output Font Data Bandwidth This component monitor returns the bandwidth used to initiate the font changes in ICA sessions with SpeedScreen. The bandwidth reported is in bits per second. Output Licensing Bandwidth This component monitor returns the bandwidth used to negotiate session licensing. The bandwidth reported is in bits per second. Normally, this contains no data. Output LPT1 Bandwidth This component monitor returns the bandwidth used for printing to the client pot, LPT1, through an ICA session without print spooler support. The bandwidth reported is in bits per second. Output LPT2 Bandwidth
This component monitor returns the bandwidth used for printing to the client port, LPT2, through an ICA session without print spooler support. The bandwidth reported is in bits per second. Output PN Bandwidth This component monitor returns the Program Neighborhood bandwidth used to obtain details about application sets. The bandwidth reported is in bits per second. Output Printer Bandwidth This component monitor returns the bandwidth used for printing to a client printer through a client with print spooler support. The bandwidth reported is in bits per second. Output Seamless Bandwidth This component monitor returns the bandwidth used for published applications not embedded in a session window. The bandwidth reported is in bits per second. Output Session Bandwidth This component monitor returns the server-to-client bandwidth used for a session. The bandwidth reported is in bits per second. Output Session Compression This component monitor returns the server-to-client compression ratio used for a session. Output Session Line speed This component monitor returns the server-to-client line speed used for a session. The bandwidth reported is in bits per second. Output SpeedScreen Data Channel Bandwidth This component monitor returns the server-to-client bandwidth used for data channel traffic. The bandwidth reported is in bits per second. Output Text Echo Bandwidth This component monitor returns the bandwidth used for text echo. The bandwidth reported is in bits per second. Output ThinWire Bandwidth
This component monitor returns the server-to-client bandwidth used for ThinWire traffic. The bandwidth reported is in bits per second. Output VideoFrame Bandwidth This component monitor returns the server-to-client bandwidth used for traffic on virtual channels. The bandwidth reported is in bits per second.
Citrix XenApp 6.0 Presentation Server

This template monitors critical events generated by Citrix XenApp 6.0 which may indicate possible service outages or configuration problems. Alerts are set to display the descriptions of events and the host name. Prerequisites: RPC access to the target server. Credentials: Windows Administrator on target server. Monitored Components Note: You need to set thresholds for counters according to your environment. It is recommended to monitor counters for some period of time to understand the potential value ranges and then set the thresholds accordingly. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Application Enumeration/sec This component monitor returns the number of non-XML-based enumerations (requests for application lists) per second. Application Resolution Time (ms) This component monitor measures the time required to resolve the LeastLoaded Server during an application in milliseconds. A baseline would be needed in order to establish increases during peak logon times before an accurate threshold can be defined. Application Resolutions Failed/sec This component monitor returns the number of application resolutions failed per second. This value should be zero at all times. Application Resolutions/sec This component monitor returns the number of resolutions (application launch requests) per second. DataStore Connection Failure
This component monitor returns the number of minutes that have elapsed since the XenApp server has been disconnected from the data store. This value should be zero at all times. DataStore bytes read This component monitor returns the number of bytes read from the data store. DataStore bytes read/sec This component monitor returns the number of bytes read from the data store per second. DataStore bytes written/sec This component monitor returns the number of bytes written to the data store per second. DataStore reads This component monitor returns the number of times data was read from the data store. DataStore reads/sec This component monitor returns the number of times data was read from the data store per second. DataStore writes/sec This component monitor returns the number of times data was written to the data store per second. DynamicStore bytes read/sec This component monitor returns the number of dynamic data store bytes read per second. DynamicStore bytes written/sec This component monitor returns the number of dynamic data store bytes written per second. DynamicStore Gateway Update Count This component monitor returns the number of dynamic store update packets sent to remote data collectors. DynamicStore Gateway Update Bytes Sent
This component monitor returns the number of bytes of data sent across gateways to remote data collectors. DynamicStore Query Count This component monitor returns the number of dynamic store queries performed. DynamicStore Query Request Bytes Received This component monitor returns the number of bytes of data received in dynamic store query request packets. DynamicStore Query Response Bytes Sent This component monitor returns the number of bytes of data sent in response to dynamic store queries. DynamicStore reads/sec This component monitor returns the number of times data was read from the dynamic store per second. DynamicStore Update Bytes Received This component monitor returns the number of bytes of data received in dynamic store update packets. DynamicStore Update Packets Received This component monitor returns the number of update packets received by the dynamic store. DynamicStore Update Response Bytes Sent This component monitor returns the number of bytes of data sent in response to dynamic store update packets. DynamicStore writes/sec This component monitor returns the number of times data was written to the dynamic store per second. Filtered Application Enumerations/sec This component monitor returns the number of XML-based enumerations (requests for application lists) per second. LocalHostCache bytes read/sec
This component monitor returns the number of bytes of IMA local host cache data read per second. LocalHostCache bytes written/sec This component monitor returns the number of bytes of IMA local host cache data written per second. LocalHostCache reads/sec This component monitor returns the number of times data was read from the IMA local host cache per second. LocalHostCache writes/sec This component monitor returns the number of times data was written to the IMA local host cache per second. Maximum number of XML threads This component monitor returns the maximum number of threads allocated to service Web-based sessions since the server last restarted. Number of busy XML threads This component monitor returns the number of XML requests that are currently being processed. This value should be less than 12. The maximum number of requests that the XML service can process at any one time is 16. Number of XML threads This component monitor returns the number of threads allocated to service web-based sessions. Resolution WorkItem Queue Executing Count This component monitor returns the number of work items (related to application launches) that are waiting to be processed by IMA. Resolution WorkItem Queue Ready Count This component monitor returns the number of resolution work items that are ready to be executed. This value should be zero at all times. WorkItem Queue Executing Count This component monitor returns the number of work items that are currently being executed.
WorkItem Queue Pending Count This component monitor returns the number of work items that are not yet ready to be executed. WorkItem Queue Ready Count This component monitor returns the number of work items that are ready and waiting to be processed by IMA. This value should be zero at all times. Zone Elections This component monitor returns the number of zone elections that occurred. This value starts at zero each time the IMA service starts and is incremented each time a zone election takes place. Zone Elections Won This component monitor returns the number of times the server won a zone election. Number of Active Sessions This component monitor returns the number of currently active connections to the Citrix server. Number of Disconnected Sessions This component monitor returns the number of currently disconnected connections to the Citrix server.
Citrix XenApp 6.0 Services

This template monitors critical events generated by Citrix XenApp 6.0 which may indicate possible service outages or configuration problems. Alerts are set to display the descriptions of events and the host name. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on target server. Monitored Components Citrix Diagnostic Facility COM Server This component monitors the service which manages and controls Citrix diagnostic trace sessions on the system. Citrix Encryption Service This component monitors the service which enables secure communication with RC5 128-bit encryption between Citrix Delivery Clients and this Citrix XenApp server. Citrix Health Monitoring and Recovery This component monitors the service which provides Health Monitoring and Recovery services for Citrix XenApp Server. Citrix Independent Management Architecture This component monitors the service which provides management services for Citrix products. Citrix Licensing WMI (License server only) This component monitors the service which enables Citrix Licensing using WMI. Citrix MFCOM Service (MetaFrame COM Server) This component monitors the service which provides COM access to a Citrix farm. Citrix Print Manager Service This component monitors the service which supports the Citrix Advanced Universal Printing Architecture. Citrix Services Manager
This component monitors the service which provides a Citrix Presentation Server with an interface to the operating system. Citrix Streaming Service This component monitors the service which manages the Citrix offline plugin. Citrix Virtual Memory Optimization This component monitors the service which dynamically optimizes applications running on this machine. Citrix WMI Service This component monitors the service which provides the Citrix WMI classes. Citrix XTE Server This component monitors the service which requests for session reliability and SSL from Citrix components. Citrix Licensing (License server only) This component monitors the service which provides licensing services for Citrix products. Citrix End User Experiencing Monitoring This component monitors the service which collects and collates end user experience measurements. Citrix Audio Redirection Service This component monitors the service which provides audio redirection between the endpoint device and the virtual desktop. Citrix Group Policy Engine This component monitors the service which is responsible for applying settings configured by Citrix administrators for the computer and users through the Group Policy component. Citrix HDX MediaStream for Flash Service This component monitors the service which provides the HDX MediaStream for the Flash feature to published applications and virtual desktops. HDX MediaStream for Flash allows the Adobe Flash Player to run on the client user device instead of within the server session.
Citrix Licensing Support Service This component monitors the service which allow controls reading the license files and updating strings with license trailers (data dictionary functionality). Citrix Smart Card Service This component monitors the service which provides Smart Card redirection between the endpoint device and the virtual desktop. Citrix Streaming Helper Service This component monitors the service which manages the Citrix offline plugin.
CUPS
This template assesses the status and performance of a CUPS service installed on a Linux/Unix system. Perl scripts are used for retrieving performance data. Prerequisites: SSH and Perl installed on the target server. Credentials: Root credentials on the target server. Monitored Components: Daemon CUPS status This monitor returns the status of a Linux/Unix print server daemon. Possible values: 0 CUPS daemon is stopped. 1 CUPS daemon is running. Print queue This monitor returns the current length of the default print queue. Total pages printed This monitor returns the number of printed pages by retrieving data from the CUPS page_log file. Note: By default, the script retrieves this information from the /var/log/cups/page_log file. If this file has another location on the target server, you should correct the path in the script argument box. New emergency messages in CUPS error log This monitor returns the number of new emergency messages by retrieving data from the CUPS error_log file. All emergency events begin with the X symbol. This monitor should be zero all times. If it is not, you should manually examine this log file. Note: By default, the script retrieves this information from the /var/log/cups/error_log file. If this file has another location on the target server, you should correct the path in the script argument box. New warning messages in CUPS error log This monitor returns the number of new warning messages by retrieving data from the CUPS error_log file. All emergency events begin with the W symbol.
This monitor should be zero all times. If it is not, you should manually examine this log file. Note: By default, the script retrieves this information from the /var/log/cups/error_log file. If this file has another location on the target server, you should correct the path in the script argument box. New alert messages in CUPS error log This monitor returns the number of new alert messages by retrieving data from the CUPS error_log file. All emergency events begin with the A symbol. This monitor should be zero all times. If it is not, you should manually examine this log file. Note: By default, the script retrieves this information from the /var/log/cups/error_log file. If this file has another location on the target server, you should correct the path in the script argument box. New critical error messages in CUPS error log This monitor returns the number of new critical error messages by retrieving data from the CUPS error_log file. All emergency events begin with the C symbol. This monitor should be zero all times. If it is not, you should manually examine this log file. Note: By default, the script retrieves this information from the /var/log/cups/error_log file. If this file has another location on the target server, you should correct the path in the script argument box. CUPS listening TCP port This component monitor tests the ability of a CUPS service to accept incoming sessions. By default, it monitors the TCP 631 port. If your CUPS server listens on another port, you should manually change it.
DHCP User Experience Monitor

This template tests the availability of DHCP services for end users by performing typical DHCP request operations and measuring how long it takes to complete these operations. Prerequisites: None. Credentials: None. Monitored Components DHCP User Experience Monitor
Distributed File System (DFS)

This template assesses the status and overall performance of a Microsoft Distributed File System (DFS) service. This template uses Windows Performance Counters, WMI Monitors and Windows DFS Replication Event Log. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on the target server. Monitored Components Note: You need to set thresholds for counters according to your environment. It is recommended to monitor counters for some period of time to understand potential value ranges and then set the thresholds accordingly. All Windows Event Log monitors (beginning with Warning or Error) should return zero values. Returned values other than zero indicate an abnormality. Examining the Windows DFS Replication log file should provide information pertaining to the issue. Service: DFS Namespace This counter monitors DFS Namespace service which enables you to group shared folders located on different servers into one or more logically structured namespaces. Each namespace appears to users as a single shared folder with a series of subfolders. Service: DFS Replication This counter monitors DFS Replication service which enables you to synchronize folders on multiple servers across local or wide area network connections. This service uses the Remote Differential Compression (RDC) protocol to update only the portions of files that have changed since the last replication. Replication Folders: Conflict Space In Use (B) This counter returns the total size (in bytes) of the conflict loser files and folders currently in the Conflict and Deleted folder used by the DFS Replication service. The DFS Replication service automatically detects and resolves conflicts encountered in replicated folders and moves the losing version to the Conflict and Deleted folder. The service automatically cleans up the Conflict and Deleted folder when it exceeds a pre-configured threshold of the quota. Note: The instance field is installation-specific. Open perfmon find the DFS Replicated Folders object. After that, choose any counter in this object and you will see available instances (for example: test-{79E95064-B701-449D9B3C-32F58932B96B}).
Replication Folders: Deleted Space In Use (B) This counter returns the total size (in bytes) of the deleted files and folders currently in the Conflict and Deleted folder used by the DFS Replication service. The DFS Replication service detects remote deletes from its sending partner and moves the file or folder to the Conflict and Deleted folder. The service automatically cleans up the Conflict and Deleted folder when it exceeds a pre-configured threshold of the quota. Note: The instance field is installation-specific. Open perfmon and find the DFS Replicated Folders object. After that, choose any counter in this object and you will see available instances (for example: test-{79E95064-B701449D-9B3C-32F58932B96B}). Replication Folders: Staging Space In Use (B) This counter returns the total size (in bytes) of the files and folders currently in the staging folder used by the DFS Replication service. This counter will fluctuate as staging space is reclaimed. The DFS Replication service stages files and folders in the staging folder before they are replicated, and automatically cleans up the staging folder when it exceeds a pre-configured threshold of the quota. Note: The instance field is installation-specific. Open perfmon and find the DFS Replicated Folders object. After that, choose any counter in this object and you will see available instances (for example: test-{79E95064-B701449D-9B3C-32F58932B96B}). Replication Folders: Updates Dropped This counter returns the number of redundant file replication update records that were ignored by the DFS Replication service because they did not change the replicated file or folder. For example, dropped updates can occur when access control lists (ACLs) are overwritten with identical ACLs on a file or folder. Note: The instance field is installation-specific. Open perfmon and find the DFS Replicated Folders object. After that, choose any counter in this object and you will see available instances (for example: test-{79E95064-B701449D-9B3C-32F58932B96B}). Replication Folders: File Installs Retried This counter returns the number of file installs that are being retried due to sharing violations or other errors encountered when installing the files. The DFS Replication service replicates staged files into the staging folder, decompresses them in the installing folder and renames them to the target location. The second and third steps of this process are known as installing the file.
This returned value should be as low as possible. Note: The instance field is installation-specific. Open perfmon and find the DFS Replicated Folders object. After that, choose any counter in this object and you will see available instances (for example: test-{79E95064-B701449D-9B3C-32F58932B96B}). DFS Replication State This counter shows the current state of DFS Replication service. Possible values: 0 Service Starting. 1 Service Running. 2 Service Degraded. 3 Service Shutting Down. DFS Volume State This counter shows the current DFS volume state. Possible values: 0 Initialized. 1 Shutting Down. 2 In Error. 3 Auto Recovery. Warning: Failed to Contact Configuration on DC This monitor returns the number of events when the DFS Replication service failed to contact the domain controller to access configuration information. Type of event: Warning. Event ID: 1204. You should check your network connection. Warning: Staging Space above High Watermark This monitor returns the number of events when the DFS Replication service detected that the staging space usage exceeds the staging quota for the replicated folder. The service might fail to replicate some large files and the replicated folder might get out of sync. The service will attempt to clean up the staging space automatically. Type of event: Warning. Event ID: 4202. Staging files might be purged prematurely because the replicated folder contains files that are larger than the configured staging quota, or because the configured maximum staging size has been exceeded. This purging can cause excessive hard drive activity and CPU usage.
To avoid this error, increase the quota of the staging folder. Warning: Failed to Clean Old Staging Data This monitor returns the number of events when the DFS Replication service failed to clean up old staging files for the replicated folder at the local path. The service might fail to replicate some large files and the replicated folder might get out of sync. The service will automatically retry staging space cleanup in 30 minute intervals. The service may start cleanup earlier if it detects some staging files have been unlocked. Type of event: Warning. Event ID: 4206. It is recommended to increase the quota of the staging folder. Warning: Staging Space above Staging Quota This monitor returns the number of events when the DFS Replication service detected that the staging space usage is above the staging quota for the replicated folder at the local path. The service might fail to replicate some large files and the replicated folder might get out of sync. The service will attempt to clean up the staging space automatically. Type of event: Warning. Event ID: 4208. It is recommended to increase the quota of the staging folder. Warning: File Prevented from Replication This monitor returns the number of events when the DFS Replication service has been repeatedly prevented from replicating a file due to consistent sharing violations encountered on the file. Type of events: Warning. Event ID: 4302 or 4304. Event 4302: A local sharing violation occurs when the service cannot receive and update the file because the local file is being used. This occurs on the "receive" side of the file change. The file is already replicated. However, it cannot be moved from the installing directory to the final destination. Event 4304: The service cannot stage a file for replication because of a sharing violation. This occurs on the "send" side of the file change. DFSR wants to stage or copy the file for replication; however, an exclusive lock prevents this. Warning: No Configured Connections for Replication Folder This monitor returns the number of events when the DFS Replication service has detected that no connections are configured for replication group. No data is being replicated for this replication group.
Type of event: Warning. Event ID: 6804. If the data replicates through DFS Replication without any issues, ignore this event. If problems with replication exist, you should closely look at the replication folder configuration. Error: Failed to Contact DC This monitor returns the number of events when the DFS Replication service failed to contact the domain controller to access configuration information. Replication is stopped. The service will try again during the next configuration polling cycle. Type of event: Error. Event ID: 1202. The DFS Replication service could not contact the domain controller to obtain new configuration information. If replication was previously working and this error is reported, the service will use cached configuration, stored locally, but will not respond to any configuration changes until the issue is resolved. This event can be caused by TCP/IP connectivity, firewall, Active Directory, or DNS errors or misconfigurations. Error: Replication Stopped This monitor returns the number of events when the DFS Replication service stopped replication on the replicated folder on the local path. Type of event: Error. Event ID: 4004. When the DFS Replication service initializes the replicated folders for the replication process, it traverses all related paths to check whether the replicated folders are reparse points that act as symbolic links or that act as mount points. The DFS Replication service expects to open synchronous handles to access these paths. However, it uses the asynchronous handles incorrectly. The DFS Replication service cannot handle the I/O requests that are held by a filter driver. Therefore, the DFS Replication service stops responding. If the DFS Replication service stops responding, you may need to install the following HotFix: http://support.microsoft.com/kb/977381/EN-US. Error: File Changed on Multiple Servers This monitor returns the number of events when the DFS Replication service detected that a file was changed on multiple servers. A conflict resolution algorithm was used to determine the winning file. The losing file was moved to the Conflict and Deleted folder.
Type of event: Error. Event ID: 4412. Error: Communication with Partner This monitor returns the number of events when the DFS Replication service encountered an error communicating with a partner for the listed replication group. Type of event: Error. Event ID: 5002. This error usually appears when the DFS Replication service is unable to set up a Remote Procedure Call (RPC) binding to communicate with the partner. It may also be caused by RPC blocking at a firewall between partners, or a DNS error. Finally, this error may appear when the two partner computers are running different versions of Dfsr.exe. Verify that normal communication between the two computers is working. Ensure that the same version of DFSR.exe is running on both partner computers. The file is located at %system32%\DFSR.exe. You might need to install service packs, downloads or hotfixes on one or both computers in order to run matching versions of the service. Error: Host Unreachable This monitor returns the number of events when the DFS Replication service failed to communicate with a partner for the replication group. This error can occur if the host is unreachable or if the DFS Replication service is not running on the server. Type of event: Error. Event ID: 5008. Check network connectivity. Error: Partner Didn't Recognize the Connection This monitor returns the number of events when the DFS Replication service failed to communicate with a partner for the replication group. The partner did not recognize the connection or the replication group configuration. Type of event: Error. Event ID: 5012. This error usually occurs when one partner attempts to establish an RPC connection with another member, but is unable to. The problem may be intermittent and resolve itself automatically. If the two members obtain configuration data from different domain controllers, they may have mismatched configuration data due to Active Directory replication reaching one domain controller before the other.
The service will retry the connection periodically. If this problem persists, please verify that Active Directory replication is working and that the service is able to reach a domain controller. Error: Connection with Partner Removed or Disabled This monitor returns the number of events when the DFS Replication service detected that the connection with a partner for the replication group has been removed or disabled. Type of event: Error. Event ID: 5016. Check network connectivity. Error: Invalid Local Path to Replication Folder This monitor returns the number of events when the replicated folder has an invalid local path. Type of event: Error. Event ID: 6404. DFS Replication cannot replicate the replicated folder because the configured local path is not the fully qualified path name of an existing, accessible local folder. This replicated folder is not replicating to or from this server. Fix this problem by configuring the replicated folder with a valid local path using the DFS Management snap-in or the Dfsradmin.exe command-line tool. Warning: No Free Space for Replication This monitor returns the number of events when DFS Replication service encountered errors replicating one or more files because adequate free space was not available on volume. This volume contains the replicated folder, the staging folder, or both. The service will retry replication periodically. Type of event: Error. Event ID: 4502. Please make sure that enough free space is available on this volume for replication to proceed.
DNS User Experience

This template tests the ability of a DNS server to respond to a record query, and measures its responsiveness. Prerequisites: None. Credentials: None. Monitored Components DNS User Experience Monitor
Download Speed Monitor

This template tests the available bandwidth between the SolarWinds SAM server and another node on the network. Prerequisites: A character generator service running on target server. Credentials: None. Installing the Microsoft Windows Character Generator Service The Character Generator service is part of the Microsoft Windows Simple TCP/IP Services component. To install the Simple TCP/IP Services component on Windows 2003 computers: 1. Log in to target server with an administrator-level account. 2. Open Add or Remove Programs in the Control Panel. 3. Click Add/Remove Windows Components. 4. Click Networking Services. 5. Click Details. 6. Select Simple TCP/IP Services. 7. Click Ok, Next, and then click Finish to complete the wizard. To install the Simple TCP/IP Services component on Windows 2008 (including R2) computers: 1. Log in to target server with an administrator-level account. 2. Open Server Manager by clicking Start > Server Manager. 3. In the left panel of the Server Manager, click Features. 4. In the right panel of the Server Manager, click Add Features. 5. In the Add Features Wizard, check the box for Simple TCP/IP Services. 6. Click Next, and then click Install. 7. When installation is finished, click Close. 8. The Simple TCP/IP Services will be started when the system is rebooted. 9. If you want to start the services immediately, click Start > Administrative Tools > Services. 10. Right-click Simple TCP/IP Services, and then select Start from the context menu.
Enabling the Unix/Linux Character Generator Service The character generator service chargen is built into the standard Unix/Linux inetd daemon. If the service is not enabled, add the following lines to the /etc/inetd.conf configuration file, and then restart inetd.
chargen stream tcp nowait root internal chargen dgram udp wait root internal
Monitored Components Download Speed Monitor
Errors in Application Event Log

This template sets the state of the application to Down if there are any errors in the last five minutes of the Windows Application event log. Prerequisites: WMI access to target server. For more information, see Requirements for Component Monitors and Templates that use WMI on page 218. Credentials: Windows Administrator on target server. Monitored Components Windows Event Log Monitor.
Exchange 2007 and 2010

These templates allow you to monitor all necessary counters and services for Exchange 2007 and Exchange 2010.
Basic versus Advanced Templates

These templates are divided into two categories: Basic Services and Performance Counters Advanced
The templates in the Basic Services and Performance Counters category contain templates with basic counters and services for monitoring both versions of Exchange: Exchange 2007 and Exchange 2010. These templates should work out of the box. Counters in this category have well documented thresholds and do not require any additional configuration. The templates in the Advanced category contain other performance and statistics counters. You can use these templates in addition to the basic templates if the information from the basic templates is not sufficient to monitor the server. The advanced templates are provided for a specific Exchange version, as indicated by the template name. For example, the Exchange 2007 Mailbox Role Counters (Advanced) template applies to Exchange 2007 only. Some of the counters will require manual configuration, such as specific instances, correcting thresholds for your environment, and so forth. There is also the Exchange 2007-2010 Common Performance Counters template. This template contains general counters (CPU usage, available memory, LDAP times, and so forth) that can be used in all server roles. This template will require manual configuration similar to that required by the advanced templates.
Typical Usage Scenario

Assume that you need to monitor an Exchange 2010 installation with Mailbox Role. First you should apply the Exchange 2007-2010 Mailbox Role Services and Counters (Basic) template. As a result, you will have the statuses for critical Exchange services (up or down) and information from general performance counters for this role. If you need system level general performance counters (CPU usage, available memory, and so forth) you can also apply the Exchange 2007-2010 Common Performance Counters template, but you will need to correct some counters manually according to your - environment (see the documentation for the Exchange 2007-2010 Common Performance Counters template).
If the information provided by the basic template is not enough, you need to additionally apply the Exchange 2010 Mailbox Role Counters (Advanced) template. After applying this template, you may need to modify some thresholds and instances according to your environment. Then you should receive full performance and statistics information for this Exchange role.
Exchange 2007-2010 Client Access Role Services and Counters (Basic)

This template contains basic performance counters and services for monitoring the Exchange 2007 and 2010 Client Access Role. This template is designed to work out of the box and does not require any additional configuration. If you need more detailed monitoring, you should use it in combination with the Exchange 2007 (or 2010) Client Access Role Counters (Advanced) template. Prerequisites: RPC and WMI access to the Exchange server. Credentials: Windows Administrator on target server. Monitored Components These performance counters and services are based on the following information: Monitoring Client Access Server: Exchange 2007 Help: "Microsoft TechNet": http://technet.microsoft.com/en-us/library/bb201674(EXCHG.80).aspx Client Access Server Counters: Exchange 2010 Help: "Microsoft TechNet": http://technet.microsoft.com/en-us/library/ff367877.aspx. Service: Exchange Active Directory Topology Provides Active Directory topology information to Exchange services. If this service is stopped, most Exchange services are unable to start. This service has no dependencies. Service: Exchange File Distribution Service Distributes offline address book (OAB) and custom Unified Messaging prompts. This service is dependent on the Microsoft Exchange Active Directory Topology and Workstation services. Service: Exchange IMAP4 Provides IMAP4 service to clients. If this service is stopped, clients will not be able to connect to this computer using the IMAP4 protocol. This service is dependent upon the Microsoft Exchange Active Directory Topology service. Service: Exchange Monitoring Allows applications to call the Exchange diagnostic cmdlets. This service has no dependencies.
Service: Exchange POP3 Provides POP3 service to clients. If this service is stopped, clients cannot connect to this computer using the POP3 protocol. This service is dependent on the Microsoft Exchange Active Directory Topology service. Service: Exchange Service Host Provides a host for several Exchange services. On internal server roles, this service is dependent on the Microsoft Exchange Active Directory Topology service. On Edge Transport servers, this service is dependent upon the Microsoft Exchange ADAM service. Average Search Time Shows the average time that elapsed while waiting for a search to complete. Should be less than 5,000 milliseconds (ms) at all times. Average Time to Process a Free Busy Request Shows the average time to process a free/busy request in seconds. One request may contain multiple mailboxes. Free/busy responses do not have meeting suggestions. Should always be less than 5. Requests Queued Shows the number of HTTP requests waiting to be assigned to a thread. Average of 50100. Download Task Queued Shows the number of OAB download tasks queued since the File Distribution service started. Should be 0 at all times. Values greater than 0 indicate a failure to copy OAB data files from Mailbox servers.
Exchange 2007-2010 Mailbox Role Services and Counters (Basic)

This template contains basic performance counters and services for monitoring Exchange 2007 and 2010 Mailbox Role. This template is designed to work out of the box and does not require any additional configuration. If you need more detailed monitoring you should use it in combination with the Exchange 2007 (2010) Mailbox Role Counters (Advanced) template. Prerequisites: RPC and WMI access to the Exchange server. Credentials: Windows Administrator on the target server. Monitored Components These performance counters and services are based on the following information: Monitoring Mailbox Servers: Exchange 2007 Help, "Microsoft TechNet": http://technet.microsoft.com/en-us/library/bb201689(EXCHG.80).aspx Mailbox Server Counters: Exchange 2010 Help, "Microsoft TechNet": http://technet.microsoft.com/en-us/library/ff367871.aspx Service: Exchange Active Directory Topology Provides Active Directory topology information to Exchange services. If this service is stopped, most Exchange services are unable to start. This service has no dependencies. Service: Exchange Information Store Manages the Exchange Information Store. This includes mailbox databases and public folder databases. If this service is stopped, mailbox databases and public folder databases on this computer are unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. This service is dependent on the RPC, Server, Windows Event Log, and Workstation services. Service: Exchange Mail Submission Service Submits messages from the Mailbox server to Exchange Hub Transport servers. This service is dependent on the Microsoft Exchange Active Directory Topology service. Service: Exchange Mailbox Assistants Performs background processing of mailboxes in the Exchange store. This service is dependent on the Microsoft Exchange Active Directory Topology service.
By default this service is stopped. Service: Exchange Monitoring Allows applications to call the Exchange diagnostic cmdlets. This service has no dependencies. By default this service is stopped. Service: Exchange Service Host Provides a host for several Exchange services. On internal server roles, this service is dependent on the Microsoft Exchange Active Directory Topology service. On Edge Transport servers, this service is dependent on the Microsoft Exchange ADAM service. Service: Exchange System Attendant Forwards directory lookups to a global catalog server for legacy Outlook clients, generates e-mail addresses and OABs, updates free/busy information for legacy clients, and maintains permissions and group memberships for the server. If this service is disabled, any services that explicitly depend on it will fail to start. This service is dependent on the RPC, Server, Windows Event Log, and Workstation services. Service: Exchange Replication Service Provides replication functionality for mailbox databases on Mailbox servers in a database availability group (DAG). This service is dependent on the Microsoft Exchange Active Directory Topology service. RPC Averaged Latency Indicates the RPC latency, in ms, averaged for all operations in the last 1,024 packets. For information about how clients are affected when overall server RPC averaged latencies increase, see Understanding Client Throttling Policies at http://technet.microsoft.com/en-us/library/dd297964.aspx. Should not be higher than 10 ms on average. To determine if certain protocols are causing overall RPC latencies, monitor MSExchangeIS Client (*)\RPC Average Latency to separate latencies based on client protocol. Messages Queued for Submission Shows the current number of submitted messages not yet processed by the transport layer. Should be below 50 at all times. Should not be sustained for more than 15 minutes.
This may indicate connectivity issues to the transport server. Database: Log Threads Waiting Shows the number of threads waiting for their data to be written to the log to complete an update of the database. If this number is too high, the log may be a bottleneck. Should be less than 10 on average. Regular spikes concurrent with log record stall spikes indicate that the transaction log disks are a bottleneck. If the value for log threads waiting is more than the spindles available for the logs, there is a bottleneck on the log disks. Slow Findrow Rate Shows the rate at which the slower FindRow needs to be used in the mailbox store. Should be no more than 10 for any specific mailbox store. Higher values indicate applications are crawling or searching mailboxes, which is affecting server performance. These include desktop search engines, customer relationship management (CRM), or other third-party applications. RPC Latency average (msec) Shows the average latency, in ms, of RPC requests. The average is calculated over all RPCs since exrpc32 was loaded. Should be less than 100 ms at all times. Replication Receive Queue Size Shows the number of replication messages waiting to be processed. Should be less than 100 at all times. This value should return to a minimum value between replication intervals. Client: RPCs Failed:Server Too Busy The client reported a number of failed RPCs (since the store was started) due to the server too busy ROC error. Should be 0 at all times.
RPC Requests Indicates the overall RPC requests currently executing within the information store process. Should be below 70 at all times. Database: I/O Database Reads Average Latency Shows the average length of time, in milliseconds, per database read operation. Should be 20 ms on average. Should show 50 ms spikes. Database: I/O Database Writes Average Latency Shows the average length of time, in milliseconds, per database write operation. Should be 50 ms on average. Spikes of up to 100 ms are acceptable if not accompanied by database page fault stalls.
Exchange 2007-2010 Hub Transport Role Services and Counters (Basic)

This template contains basic performance counters and services for monitoring Exchange 2007 and 2010 Hub Transport Role. This template is designed to work out of the box and does not require any additional configuration. If you need more detailed monitoring, you should use it in combination with the Exchange 2007 (2010) Hub Transport Role Counters (Advanced) template. Prerequisites: RPC and WMI access to the Exchange server. Credentials: Windows Administrator on target server. Monitored Components These performance counters and services are based on the following information: Monitoring Hub Transport Server: Exchange 2007 Help, "Microsoft TechNet": http://technet.microsoft.com/en-us/library/bb201704(EXCHG.80).aspx Transport Server Counters: Exchange 2010 Help, "Microsoft TechNet": http://technet.microsoft.com/en-us/library/ff367923.aspx Service: Exchange Active Directory Topology Provides Active Directory topology information to Exchange services. If this service is stopped, most Exchange services are unable to start. This service has no dependencies. Service: Exchange EdgeSync Connects to an AD LDS instance on subscribed Edge Transport servers over a secure LDAP channel to synchronize data between a Hub Transport server and an Edge Transport server. This service is dependent on the Microsoft Exchange Active Directory Topology service. If Edge Subscription is not configured, this service can be disabled. Service: Exchange Anti-spam Update Provides the Microsoft Forefront Protection 2010 for Exchange Server antispam update service. On Hub Transport servers, this service is dependent on the Microsoft Exchange Active Directory Topology service. On Edge Transport servers, this service is dependent on the Microsoft Exchange ADAM service. Service: Exchange Monitoring Allows applications to call the Exchange diagnostic cmdlets. This service has no dependencies.
Service: Exchange Transport Provides SMTP server and transport stack. On Hub Transport servers, this service is dependent on the Microsoft Exchange Active Directory Topology service. On Edge Transport servers, this service is dependent on the Microsoft Exchange ADAM service. Service: Exchange Transport Log Search Provides remote search capability for Microsoft Exchange Transport log files. On Hub Transport servers, this service is dependent on the Microsoft Exchange Active Directory Topology service. On Edge Transport servers, this service is dependent on the Microsoft Exchange ADAM service. Aggregate Delivery Queue Length (All Queues) Shows the number of messages queued for delivery in all queues. Should be less than 3,000 and not more than 5,000. Active Remote Delivery Queue Length Shows the number of messages in the active remote delivery queues. Should be less than 250 at all times. Active Mailbox Delivery Queue Length Shows the number of messages in the active mailbox queues. Should be less than 250 at all times. Submission Queue Length Shows the number of messages in the submission queue. Should not exceed 100. If sustained high values are occurring, investigate Active Directory and Mailbox servers for bottlenecks or performance-related issues. Active Non-Smtp Delivery Queue Length Shows the number of messages in the drop directory used by a Foreign connector. Should be less than 250 at all times. Retry Mailbox Delivery Queue Length Shows the number of messages in a retry state attempting to deliver a message to a remote mailbox.
Should be less than 100 at all times. Retry Remote Delivery Queue Length Shows the number of messages in a retry state in the remote delivery queues. Should not exceed 100. We recommend that you check the next hop to determine the causes for queuing. Unreachable Queue Length Shows the number of messages in the Unreachable queue. Should not exceed 100. Poison Queue Length Shows the number of messages in the poison message queue. Should be 0 at all times
Exchange 2007-2010 Edge Transport Role Services and Counters (Basic)

This template contains basic performance counters and services for monitoring Exchange 2007 and 2010 Edge Transport Role. This template is designed to work out of the box and does not require any additional configuration. If you need more detailed monitoring, you should use it in combination with the Exchange 2007 (2010) Edge Transport Role Counters (Advanced) template. Prerequisites: RPC and WMI access to the Exchange server. Credentials: Windows Administrator on target server. Monitored Components These performance counters and services are based on the following information: Monitoring Edge Transport Server: Exchange 2007 Help, "Microsoft TechNet": http://technet.microsoft.com/en-us/library/ee532088(EXCHG.80).aspx Transport Server Counters: Exchange 2010 Help, "Microsoft TechNet": http://technet.microsoft.com/en-us/library/ff367923.aspx Service: Exchange ADAM Stores configuration data and recipient data on the Edge Transport server. This service represents the named instance of Active Directory Lightweight Directory Service (AD LDS) that is automatically created by Setup during Edge Transport server installation. This service is dependent on the COM+ Event System service. Service: Exchange Anti-spam Update Provides the Microsoft Forefront Protection 2010 for Exchange Server antispam update service. On Hub Transport servers, this service is dependent on the Microsoft Exchange Active Directory Topology service. On Edge Transport servers, this service is dependent on the Microsoft Exchange ADAM service. Service: Exchange Monitoring Allows applications to call the Exchange diagnostic cmdlets. This service has no dependencies.
Service: Exchange Transport Provides SMTP server and transport stack. On Hub Transport servers, this service is dependent on the Microsoft Exchange Active Directory Topology service. On Edge Transport servers, this service is dependent on the Microsoft Exchange ADAM service. Service: Exchange Transport Log Search Provides remote search capability for Microsoft Exchange Transport log files. On Hub Transport servers, this service is dependent on the Microsoft Exchange Active Directory Topology service. On Edge Transport servers, this service is dependent on the Microsoft Exchange ADAM service. Aggregate Delivery Queue Length (All Queues) Shows the number of messages queued for delivery in all queues. Should be less than 3,000 and not more than 5,000. Active Remote Delivery Queue Length Shows the number of messages in the active remote delivery queues. Should be less than 250 at all times. Active Mailbox Delivery Queue Length Shows the number of messages in the active mailbox queues. Should be less than 250 at all times. Submission Queue Length Shows the number of messages in the submission queue. Should not exceed 100. If sustained high values are occurring, investigate Active Directory and Mailbox servers for bottlenecks or performance-related issues. Active Non-Smtp Delivery Queue Length Shows the number of messages in the drop directory used by a Foreign connector. Should be less than 250 at all times. Retry Mailbox Delivery Queue Length Shows the number of messages in a retry state attempting to deliver a message to a remote mailbox.
Should be less than 100 at all times. Retry Remote Delivery Queue Length Shows the number of messages in a retry state in the remote delivery queues. Should not exceed 100. We recommend that you check the next hop to determine the causes for queuing. Unreachable Queue Length Shows the number of messages in the Unreachable queue. Should not exceed 100. Poison Queue Length Shows the number of messages in the poison message queue. Should be 0 at all times.
Exchange 2007-2010 Unified Messaging Role Services and Counters (Basic)

This template contains basic performance counters and services for monitoring Exchange 2007 and 2010 Unified Messaging Role. This template is designed to work out of the box and does not require any additional configuration. If you need more detailed monitoring, you should use it in combination with the Exchange 2007 (2010) Unified Messaging Role Counters (Advanced) template. Prerequisites: RPC and WMI access to the Exchange server. Credentials: Windows Administrator on target server. Monitored Components These performance counters and services are based on the following information: Monitoring Unified Messaging Server: Exchange 2007 Help, "Microsoft TechNet: http://technet.microsoft.com/en-us/library/bb201671(EXCHG.80).aspx Unified Messaging Server Counters: Exchange 2010 Help, "Microsoft TechNet": http://technet.microsoft.com/en-us/library/ff367900.aspx Service: Exchange Active Directory Topology Provides Active Directory topology information to Exchange services. If this service is stopped, most Exchange services are unable to start. This service has no dependencies. Service: Exchange File Distribution Service Distributes offline address book (OAB) and custom Unified Messaging prompts. This service is dependent on the Microsoft Exchange Active Directory Topology and Workstation services. Service: Exchange Monitoring Allows applications to call the Exchange diagnostic cmdlets. This service has no dependencies. Service: Exchange Speech Engine Provides speech processing services for Unified Messaging (UM). This service is dependent on the Windows Management Instrumentation (WMI) service.
Service: Exchange Unified Messaging Enables Microsoft Exchange Unified Messaging features. This allows voice and fax messages to be stored in Exchange and gives users telephone access to e-mail, voice mail, calendar, contacts, or an auto attendant. If this service is stopped, Unified Messaging is not available. This service is dependent on the Microsoft Exchange Active Directory Topology and the Microsoft Exchange Speech Engine service. Directory Access Failures Shows the number of times that attempts to access Active Directory failed. Should be 0 at all times. Operations over Six Seconds Shows the number of all UM operations that took more than six seconds to complete. This is the time during which a caller was waiting for UM to respond. Should be 0 at all times. Calls Disconnected by Callers During UM Audio Hourglass Shows the number of calls during which the caller disconnected while Unified Messaging was playing the audio hourglass tones. Should be 0 at all times. A nonzero value suggests excessive latency between a Unified Messaging server and targeted domain controller.
Exchange 2007-2010 Common Performance Counters

This template contains common Exchange and OS performance counters (CPU usage, available memory, LDAP times, and so forth) that can be monitored for all Exchange 2007 and 2010 roles. This template requires additional configuration. You can use this template together with other Exchange 2007 and 2010 templates. Prerequisites: RPC and WMI access to the Exchange server. Credentials: Windows Administrator on target server. Monitored Components These performance counters are based on the following information: Monitoring Common Counters: Exchange 2007 Help, "Microsoft TechNet": http://technet.microsoft.com/en-us/library/cc671175(EXCHG.80).aspx Common Counters: Exchange 2010 Help, "Microsoft TechNet": http://technet.microsoft.com/en-us/library/ff367896.aspx % Processor Time Shows the percentage of time that the processor is executing application or operating system processes. This is when the processor is not idle. Should be less than 75% on average. Available Mbytes (memory) Shows the amount of physical memory, in megabytes (MB), immediately available for allocation to a process or for system use. It is equal to the sum of memory assigned to the standby (cached), free, and zero page lists. For a full explanation of the memory manager, refer to Microsoft Developer Network (MSDN) or "System Performance and Troubleshooting Guide" in the Windows Server 2003 Resource Kit. Should remain above 100 MB at all times. .NET CLR Memory: % Time in GC Shows when garbage collection has occurred. When the counter exceeds the threshold, it indicates that the CPU is cleaning up and is not being used efficiently for load. Adding memory to the server would improve this situation. Should be below 10% on average.
If this counter increases to a high value, there might be some objects that are surviving Gen 1 garbage collections and being promoted to Gen 2. Gen 2 collections require a full global catalog for clean up. Add other .NET Framework memory counters to determine if this is the case. .NET CLR Exceptions: # of Excepts Thrown / sec Displays the number of exceptions thrown per second. These include both .NET Framework exceptions and unmanaged exceptions that get converted into .NET Framework exceptions. For example, the null pointer reference exception in unmanaged code would get thrown again in managed code as a .NET Framework System.NullReferenceException. This counter includes both handled and unhandled exceptions. Should be less than 5% of total requests per second Exceptions should only occur in rare situations and not in the normal control flow of the program. This counter was designed as an indicator of potential performance problems due to a large (greater than 100 sec) rate of exceptions thrown. This counter is not an average over time. It displays the difference between the values observed in the last two samples divided by the duration of the sample interval. LDAP Search Time Shows the time (in ms) to send an LDAP search request and receive a response. Should be below 50 ms on average. Spikes (maximum values) should not be higher than 100 ms. Note: The instance field is installation-specific. You need to specify the full DNS name of the Domain Controller (for example: dc.example.com). LDAP Read Time Shows the time in milliseconds (ms) to send an LDAP read request to the specified domain controller and receive a response. Should be below 50 ms on average. Spikes (maximum values) should not be higher than 100 ms. Note: The instance field is installation-specific. You need to specify the full DNS name of the Domain Controller (for example: dc.example.com). LDAP Searches timed out per minute Shows the number of LDAP searches that returned LDAP_Timeout during the last minute.
Should be below 10 at all times for all roles. Higher values may indicate issues with Active Directory resources. Note: The instance field is installation-specific. You need to specify the full DNS name of the Domain Controller (for example: dc.example.com). Long running LDAP operations/Min Shows the number of LDAP operations on this domain controller that took longer than the specified threshold per minute. (Default threshold is 15 seconds.) Should be less than 50 at all times. Higher values may indicate issues with Active Directory resources. Note: The instance field is installation-specific. You need to specify the full DNS name of the Domain Controller (for example: dc.example.com). Page Reads/sec (memory) Indicates data must be read from the disk instead of memory. Indicates there is not enough memory and paging is beginning. A value of more than 30 per second means the server is no longer keeping up with the load. Should be less than 100 on average.
Exchange 2007-2010 Statistics with PowerShell

This template tracks the statistics of Exchange mailboxes and the mailbox databases of Exchange 2007-2010 servers with the Mailbox role using PowerShell scripts. Prerequisites: PowerShell 2.0 and Exchange Management Tools 2007 or 2010 installed on the APM server. The Exchange server must have an Exchange Mailbox role. The APM server and the Exchange server must be in the same domain. Credentials: The credentials must be that of an Exchange Administrator (Organization Manager) account with at least view-only permissions. Monitored Components These component monitors are based on the following information: Exchange 2007: Database Statistics in PowerShell: http://exchangeshare.wordpress.com/2009/07/27/exchange-2007database-statistics-in-powershell/ Getting Mailbox Statistics in Exchange 2007: http://www.msexchange.org/articles_tutorials/exchange-server2007/management-administration/getting-mailbox-statistics-exchange2007.html. Note: Before using this template, under the Advanced tree collapse [+], you should set the correct platform; either 32 bit or 64 bit, from the dropdown menu. The default it set to 32 bit. Total mail size (MB) This component monitor returns the total mail size on the server in MB. Note: You must specify the correct name of your Exchange server in the Script Arguments field of the corresponding PowerShell Monitor. If you fail to do this, the counter will return with an error of "Undefined" status. For example: If the name of your Exchange server is mailserver.mydomain.com, the value of the Script Arguments field should be the following: mailserver.mydomain.com To see the names of your Exchange servers, run the following command in the Exchange Management Shell: Get-ExchangeServer
Total mailboxes This component monitor returns the total number of mailboxes on the server. Note: You must specify the correct name of your Exchange server in the Script Arguments field of the corresponding PowerShell Monitor. If you fail to do this, the counter will return with an error of "Undefined" status. For example: If the name of your Exchange server is mailserver.mydomain.com, the value of the Script Arguments field should be: mailserver.mydomain.com To see the names of your Exchange servers, run the following command in the Exchange Management Shell: Get-ExchangeServer Total items in mailboxes This component monitor returns the total number of emails on the server. Note: You must specify the correct name of your Exchange server in the Script Arguments field of the corresponding PowerShell Monitor. If you fail to do this, the counter will return with an error of "Undefined" status. For example: If the name of your Exchange server is mailserver.mydomain.com, the value of the Script Arguments field should be the following: mailserver.mydomain.com To see the names of your Exchange servers, run the following command in the Exchange Management Shell: Get-ExchangeServer Total size of specified database file (MB) This component monitor returns the total size of all mailboxes in the specified database in MB. Note: You must specify the correct name of your mailbox database in the Script Arguments field of the corresponding PowerShell Monitor. If you fail to do this, the counter will return with an error of "Undefined" status. For example: If the name of your mailbox database is Mailbox Database, the value of the Script Arguments field should be: Mailbox Database To see the names of your mailbox databases, run the following command in the Exchange Management Shell: Mailbox Database Total mailboxes in specified database file This component monitor returns the number of mailboxes in the specified database.
Note: You must specify the correct name of your mailbox database in the Script Arguments field of the corresponding PowerShell Monitor. If you fail to do this, the counter will return with an error of "Undefined" status. For example: If the name of your mailbox database is Mailbox Database, the value of the Script Arguments field should be: Mailbox Database To see the names of your mailbox databases, run the following command in the Exchange Management Shell: Mailbox Database Items in mailbox of specified user This component monitor returns the number of emails for the specified user. Note: You must specify the correct user name to monitor in the Script Arguments field of the corresponding PowerShell Monitor. If you fail to do this, the counter will return with an error of "Undefined" status. For example: If the user name is Paul Denton, the value of the Script Arguments field should be:
Paul Denton
To see the names of the users, run the following command in Exchange Management Shell: Get-Mailbox Mailbox size of specified user (MB) This component monitor returns the mailbox size for the specified user in MB. Note: You must specify the correct user name to monitor in the Script Arguments field of the corresponding PowerShell Monitor. If you fail to do this, the counter will return with an error of "Undefined" status. For example: If the user name is Paul Denton, the value of the Script Arguments field should be:
Paul Denton
To see the names of the users, run the following command in Exchange Management Shell: Get-Mailbox Average items per mailbox This component monitor returns the average number of emails per mailbox based on a mathematical count. Note: You must specify the correct user name to monitor in the Script Arguments field of the corresponding PowerShell Monitor. If you fail to do this, the counter will return with an error of "Undefined" status.
For example: If the name of your Exchange server is mailserver.mydomain.com, the value of the Script Arguments field should be the following: mailserver.mydomain.com To see the names of your Exchange servers, run the following command in the Exchange Management Shell: Get-ExchangeServer Size of largest user mailbox (MB) This component monitor returns the size of the largest mailbox. You can see the user name for the assigned mailbox in the message field. Note: You must specify the correct user name to monitor in the Script Arguments field of the corresponding PowerShell Monitor. If you fail to do this, the counter will return with an error of "Undefined" status. For example: If the name of your Exchange server is mailserver.mydomain.com, the value of the Script Arguments field should be the following: mailserver.mydomain.com To see the names of your Exchange servers, run the following command in the Exchange Management Shell: Get-ExchangeServer Dismounted mailbox databases This component monitor returns the number of dismounted mailbox databases. The last mailbox database to be dismounted is displayed in the message field. The name of the last dismounted database is taken from the list of databases and is not based on the actual time the database was dismounted. There is no database attribute that records the time it was dismounted. Note: You must specify the correct user name to monitor in the Script Arguments field of the corresponding PowerShell Monitor. If you fail to do this, the counter will return with an error of "Undefined" status. For example: If the name of your Exchange server is mailserver.mydomain.com, the value of the Script Arguments field should be the following: mailserver.mydomain.com To see the names of your Exchange servers, run the following command in the Exchange Management Shell: Get-ExchangeServer
Mounted mailbox databases This component monitor returns the number of mounted mailbox databases. Note: You must specify the correct name of your Exchange server in the Script Arguments field of the corresponding PowerShell Monitor. If you fail to do this, the counter will return with an error of "Undefined" status. For example: If the name of your Exchange server is mailserver.mydomain.com, the value of the Script Arguments field should be the following: mailserver.mydomain.com To see the names of your Exchange servers, run the following command in the Exchange Management Shell: Get-ExchangeServer
Exchange 2007-2010 PowerShell Scripts Statistics Counters

This template tracks statistics of Exchange mailboxes and mailbox databases of Exchange 2007-2010 servers with the Mailbox role. Note: This template uses the Windows Script monitor (with a vbscript) to create and execute PowerShell scripts dynamically due to a problem of running PowerShell scripts in 64-bit mode. See the following KB article for details: http://knowledgebase.solarwinds.com/kb/questions/2374. Prerequisites: PowerShell 2.0 and Exchange Management Tools 2007 or 2010 installed on the Orion APM server. For Windows 2003 x64, the following Microsoft Hotfix must also be installed: http://support.microsoft.com/kb/942589/en-gb. The Exchange server must have an Exchange Mailbox role. The SAM server and the Exchange server should be in the same domain. Credentials: The credential must be an Exchange Administrator account with at least read-only permissions. Monitored Components These component monitors are based on the following information: Exchange 2007: Database Statistics in PowerShell: http://exchangeshare.wordpress.com/2009/07/27/exchange-2007-databasestatistics-in-powershell/ Getting Mailbox Statistics in Exchange 2007: http://www.msexchange.org/articles_tutorials/exchange-server2007/management-administration/getting-mailbox-statistics-exchange-2007.html. Note: All component monitors use the following argument: /IpAddr:${IP}. Do not change this argument. It is used within the script for generating unique filenames of PowerShell scripts. Total mail size (MB) This component monitor returns the total mail size on the server in MB. Note: You must specify the correct name of your Exchange server in the Script Arguments field of the corresponding Windows Script Monitor. If you fail to do this, the counter returns an error and "Undefined" status.
For example, if the name of your Exchange server is mailserver.mydomain.com, the value of the Script Arguments field should be the following: /ServerName:"mailserver.mydomain.com" /IpAddr:${IP} To see the names of your Exchange servers, run the following command in the Exchange Management Shell: Get-ExchangeServer Total mailboxes This component monitor returns the total number of mailboxes on the server. Note: You must specify the correct name of your Exchange server in the Script Arguments field of the corresponding Windows Script Monitor. If you fail to do this, the counter returns an error and "Undefined" status. For example, if the name of your Exchange server is mailserver.mydomain.com, the value of the Script Arguments field would be: /ServerName:"mailserver.mydomain.com" /IpAddr:${IP} To see the names of your Exchange servers, run the following command in the Exchange Management Shell: Get-ExchangeServer Total items in mailboxes This component monitor returns the total number of emails on the server. Note: You must specify the correct name of your Exchange server in the Script Arguments field of the corresponding Windows Script Monitor. If you fail to do this, the counter returns an error and "Undefined" status. For example, if the name of your Exchange server is mailserver.mydomain.com, the value of the Script Arguments field would be: /ServerName:"mailserver.mydomain.com" /IpAddr:${IP} To see the names of your Exchange servers, run the following command in the Exchange Management Shell: Get-ExchangeServer Total size of database file (MB) This component monitor returns the total size of all mailboxes in the specified database in MB. Note: You must specify the correct name of your mailbox database in the Script Arguments field of the corresponding Windows Script Monitor. If you fail to do this, the counter returns an error and "Undefined" status.
For example, if the name of your mailbox database is mymaildb, the value of the Script Arguments field would be: /DatabaseName:"mymaildb" /IpAddr:${IP} To see the names of your mailbox databases, run the following command in the Exchange Management Shell: Get-MailboxDatabase Total mailboxes in database file This component monitor returns the number of mailboxes in the specified database. Note: You must specify the correct name of your mailbox database in the Script Arguments field of the corresponding Windows Script Monitor. If you fail to do this, the counter returns an error and "Undefined" status. For example, if the name of your mailbox database is mymaildb, the value of the Script Arguments field would be: /DatabaseName:"mymaildb" /IpAddr:${IP} To see the names of your mailbox databases, run the following command in the Exchange Management Shell: Get-MailboxDatabase Items in mailbox of specified user This component monitor returns the number of emails for the specified user. Note: You must specify the correct user name to monitor in the Script Arguments field of the corresponding Windows Script Monitor. If you fail to do this, the counter returns an error and "Undefined" status. For example, if the user name is PDenton, the value of the Script Arguments field would be: /Username:"Pdenton" /IpAddr:${IP} To see the names of the users, run the following command in Exchange Management Shell: Get-Mailbox Mailbox size of specified user (MB) This component monitor returns the mailbox size for the specified user in MB. Note: You must specify the correct user name to monitor in the Script Arguments field of the corresponding Windows Script Monitor. If you fail to do this, the counter returns an error and "Undefined" status. For example, if the user name is PDenton, the value of the Script Arguments field would be: /Username:"Pdenton" /IpAddr:${IP}
To see the names of the users, run the following command in Exchange Management Shell: Get-Mailbox Average items per mailbox This component monitor returns the average number of emails per mailbox based on a mathematical count. Note: You must specify the correct name of your Exchange server in the Script Arguments field of the corresponding Windows Script Monitor. If you fail to do this, the counter returns an error and "Undefined" status. For example, if the name of your Exchange server is mailserver.mydomain.com, the value of the Script Arguments field would be: /ServerName:"mailserver.mydomain.com" /IpAddr:${IP} To see the names of your Exchange servers, run the following command in the Exchange Management Shell: Get-ExchangeServer Size of largest user mailbox (MB) This component monitor returns the size of the largest mailbox. You can see the user name for the assigned mailbox in the message field. Note: You must specify the correct name of your Exchange server in the Script Arguments field of the corresponding Windows Script Monitor. If you fail to do this, the counter returns an error and "Undefined" status. For example, if the name of your Exchange server is mailserver.mydomain.com, the value of the Script Arguments field would be: /ServerName:"mailserver.mydomain.com" /IpAddr:${IP} To see the names of your Exchange servers, run the following command in the Exchange Management Shell: Get-ExchangeServer Dismounted mailbox databases This component monitor returns the number of dismounted mailbox databases. The last mailbox database to be dismounted is displayed in the message field. The name of the last dismounted database is taken from the list of databases and is not based on the actual time the database was dismounted. There is no database attribute that records the time it was dismounted. Note: You must specify the correct name of your Exchange server in the Script Arguments field of the corresponding Windows Script Monitor. If you fail to do this, the counter returns an error and "Undefined" status.
For example, if the name of your Exchange server is mailserver.mydomain.com, the value of the Script Arguments field would be: /ServerName:"mailserver.mydomain.com" /IpAddr:${IP} To see the names of your Exchange servers, run the following command in the Exchange Management Shell: Get-ExchangeServer Mounted mailbox databases This component monitor returns the number of mounted mailbox databases. Note: You must specify the correct name of your Exchange server in the Script Arguments field of the corresponding Windows Script Monitor. If you fail to do this, the counter returns an error and "Undefined" status. For example, if the name of your Exchange server is mailserver.mydomain.com, the value of the Script Arguments field would be: /ServerName:"mailserver.mydomain.com" /IpAddr:${IP} To see the names of your Exchange servers, run the following command in the Exchange Management Shell: Get-ExchangeServer
Exchange 2010 Client Access Role Counters (Advanced)

This template contains advanced performance and statistics counters for monitoring Exchange 2010 Client Access Role. Some of the counters may require manual configuration, such as setting up installation-specific instances, correcting thresholds for the clients environment, and so forth. Use this template in addition to the Exchange 2007-2010 Client Access Role Services and Counters (Basic) template. Prerequisites: RPC and WMI access to the Exchange server. Credentials: Windows Administrator on target server. Monitored Components These performance counters are based on the following information: Client Access Server Counters: Exchange 2010 Help, "Microsoft TechNet": http://technet.microsoft.com/en-us/library/ff367877.aspx RPC Operations/sec Shows the rate at which RPC operations occur, per second. Referral RPC Requests Average Latency This is Exchange 2010 address book service counter. Shows the average time, in ms, that referral requests took to complete during the sampling period. Should be below 1,000 ms. Requests - Average Response Time Shows the average time (in ms) the Exchange Control Panel took to respond to a request during the sampling period. The average should be under 6,000 ms. ActiveSync: Requests/sec Shows the number of HTTP requests received from the client via ASP.NET per second. Determines the current Exchange ActiveSync request rate.
OWA: Current Unique Users Shows the number of unique users currently logged on to Outlook Web App. This value monitors the number of unique active user sessions, so that users are only removed from this counter after they log off or their session times out. Determines current user load. OWA: Requests/sec Shows the number of requests handled by Outlook Web App per second. Determines current user load. Web Service: Current Connections Shows the current number of connections established with the Web service. Determines current user load. Requests - Activations/sec Shows the number of requests activated per second in the Exchange Control Panel. Connection Count This is RPC Client Access load counter. Shows the total number of client connections maintained. NSPI Connections Current This is Exchange Address Book load counter. Shows the number of NSPI clients currently connected to the server. NSPI RPC Requests/sec This is Exchange Address Book load counter. Shows the rate at which NSPI requests occur each second.
Exchange 2010 Mailbox Role Counters (Advanced)

This template contains advanced performance and statistics counters for monitoring Exchange 2010 Mailbox Role. Some of the counters may require manual configuration, such as setting up installation-specific instances, correcting thresholds for the clients environment, and so forth. Use this template in addition to the Exchange 2007-2010 Mailbox Role Services and Counters (Basic) template. Prerequisites: RPC and WMI access to the Exchange server. Credentials: Windows Administrator on the target server. Monitored Components These performance counters are based on the following information: Mailbox Server Counters: Exchange 2010 Help, "Microsoft TechNet": http://technet.microsoft.com/en-us/library/ff367871.aspx % Processor Time (Exchange Search) Shows the amount of processor time currently being consumed by the Exchange Search service. Should be less than 1% of overall CPU typically and not sustained above 5%. Should be less than 10% of what the store process is during steady state. % Processor Time (Mailbox Assistant) Shows the amount of processor time being consumed by mailbox assistants. Should be less than 5% of overall CPU capacity. Note: If service Exchange Mailbox Assistant is down, this counter should be ignored. Requests Failed (Resource Booking Attendant) Shows the total number of failures that occurred while the Resource Booking Attendant was processing events. Should be 0 at all times. Requests Failed (Calendar Attendant) Shows the total number of failures that occurred while the Calendar Attendant was processing events. Should be 0 at all times.
RPC Requests outstanding Shows the current number of outstanding RPC requests. Should be 0 at all times. RPC Requests failed (%) Shows the percentage of failed requests in the total number of RPC requests. Failed means the sum of failed with error code plus failed with exception. Should be 0 at all times. Hub Servers In Retry Shows the number of Hub Transport servers in retry mode. Should be 0 at all times. RPC Client Backoff/sec Indicates the rate at which client backoffs are occurring. Higher values may indicate that the server may be incurring a higher load resulting in an increase in overall averaged RPC latencies, causing client throttling to occur. This can also occur when certain client user actions are being performed. Depending on what the client is doing and the rate at which RPC operations are occurring, it may be normal to see backoffs occurring. Messages Delivered/sec Shows the rate that messages are delivered to all recipients. Indicates current message delivery rate to the store. Note: In the instance field, you can specify your own mailbox database or use the default value. Use perfmon.exe to determine the name of the instance. Default value: instance=_Total. Messages Sent/sec Shows the rate that messages are sent to transport. Used to determine current messages sent to transport. Note: In the instance field, you can specify your own mailbox database or use the default value. Use perfmon.exe to determine the name of the instance. Default value: instance=_Total. User Count Shows the number of users connected to the information store. Used to determine current user load.
Mailboxes Processed/sec Shows the rate of mailboxes processed by time-based assistants per second. Determines current load statistics for this counter. Note: In the instance field, you can specify your own mailbox database or use the default value. Use perfmon.exe to determine the name of instance. Default value: instance= msexchangemailboxassistants-total. Events Polled/sec Shows the number of events polled per second. Determines current load statistics for this counter. Note: In the instance field, you can specify your own mailbox database or use the default value. Use perfmon.exe to determine the name of instance. Default value: instance= msexchangemailboxassistants-total. Database: Database Page Fault Stalls/sec Shows the rate that database file page requests require of the database cache manager to allocate a new page from the database cache. Should be 0 at all times. If this value is nonzero, this indicates that the database is not able to flush dirty pages to the database file fast enough to make pages free for new page allocations. Database: Log Record Stalls/sec Shows the number of log records that cannot be added to the log buffers per second because the log buffers are full. If this counter is nonzero for a long period of time, the log buffer size may be a bottleneck. The average value should be below 10 per second. Spikes (maximum values) should not be higher than 100 per second. If I/O log write latencies are high, check for RAID5 or synchronize replication on log devices. Database: Version buckets allocated Shows the total number of version buckets allocated. Should be less than 12,000 at all times.
The maximum default version is 16,384. If version buckets reach 70% of maximum, the server is at risk of running out of the version store. Database Cache Size (MB) Shows the amount of system memory, in megabytes (MB), used by the database cache manager to hold commonly used information from the database files to prevent file operations. Maximum value is RAM-2GB (RAM-3GB for servers with sync replication enabled). This and Database Cache Hit % are useful counters for gauging whether a server's performance problems might be resolved by adding more physical memory. Use this counter along with store private bytes to determine if there are store memory leaks. If the database cache size seems too small for optimal performance and there is little available memory on the system (check the value of Memory/Available Bytes), adding more memory to the system may increase performance. If there is ample memory on the system and the database cache size is not growing beyond a certain point, the database cache size may be capped at an artificially low limit. Increasing this limit may increase performance. Note: Set the thresholds as appropriate for your environment. Average Document Indexing Time Shows the average, in milliseconds, of how long it takes to index documents. Should be less than 30 seconds at all times. Note: In the instance field, you can specify your own mailbox database or use the default value. Use perfmon.exe to determine the name of the instance. Default value: instance=_Total. Events in queue Shows the number of events in the in-memory queue waiting to be processed by the assistants. Should be a low value at all times. High values may indicate a performance bottleneck. Note: In the instance field, you can specify your own mailbox database or use the default value. Use perfmon.exe to determine the name of the instance. Default value: instance= msexchangemailboxassistants-total.
Average Event Processing Time in Seconds Shows the average processing time of the events chosen. Should be less than 2 at all times. Note: In the instance field, you can specify your own mailbox database or use the default value. Use perfmon.exe to determine the name of the instance. Default value: instance= msexchangemailboxassistants-total. Average Resource Booking Processing Time Shows the average time to process an event in the Resource Booking Attendant. Should be a low value at all times. High values may indicate a performance bottleneck. Average Calendar Attendant Processing time Shows the average time to process an event in the Calendar Attendant. Should be a low value at all times. High values may indicate a performance bottleneck. Client: RPCs Failed:Server Too Busy/sec Shows the client-reported rate of failed RPCs (since the store was started) due to the server too busy ROC error. Should be 0 at all times. Higher values may indicate RPC threads are exhausted or client throttling is occurring for clients running versions of Outlook earlier than Office Outlook 2007.
Exchange 2010 Hub Transport Role Counters (Advanced)

This template contains advanced performance and statistics counters for monitoring Exchange 2010 Hub Transport Role. Some of the counters may require manual configuration, such as setting up installation-specific instances, correcting thresholds for the clients environment, and so forth. Use this template in addition to the Exchange 2007-2010 Hub Transport Role Services and Counters (Basic) template. Prerequisites: RPC and WMI access to the Exchange server. Credentials: Windows Administrator on target server. Monitored Components These performance counters are based on the following information: Transport Server Counters: Exchange 2010 Help, "Microsoft TechNet": http://technet.microsoft.com/en-us/library/ff367923.aspx Dumpster Size Shows the total size (in bytes) of mail items currently in the transport dumpster on this server. Dumpster Inserts/sec Shows the rate at which items are inserted into the transport dumpster on this server. Determines the current rate of transport dumpster inserts. Dumpster Item Count Shows the total number of mail items currently in the transport dumpster on this server. Shows the current number of items being held in the transport dumpster. Dumpster Deletes/sec Shows the rate at which items are deleted from the transport dumpster on this server. Determines the current rate of transport dumpster deletions. I/O Log Writes/sec (database) Shows the rate of log file write operations completed. Determines the current load. Compare values to historical baselines. I/O Log Reads/sec (database) Shows the rate of log file read operations completed. Determines the current load. Compare values to historical baselines.
Log Generation Checkpoint Depth (database) Represents the amount of work (in count of log files) that needs to be redone or undone to the database files if the process fails. Should be less than 1,000 at all times. I/O Database Reads/sec (database) Shows the rate of database read operations completed. Determines the current load. Compare values to historical baselines. I/O Database Writes/sec Shows the rate of database write operations completed. Determines the current load. Compare values to historical baselines. Messages Submitted Per Second Shows the number of messages queued in the Submission queue per second. Determines current load. Compare values to historical baselines. Messages Received/sec Shows the number of messages received by the SMTP server each second. Determines current load. Compare values to historical baselines. Messages Sent/sec Shows the number of messages sent by the SMTP send connector each second. Determines current load. Compare values to historical baselines. Messages Queued for Delivery Per Second Shows the number of messages queued for delivery per second. Determines current load. Compare values to historical baselines. Messages Completed Delivery Per Second Shows the number of messages delivered per second. Determines current load. Compare values to historical baselines. Avg. Disk sec/Read (Physical Disk) Shows the average time, in seconds, of a read of data from the disk. Should be less than 20 milliseconds (ms) on average. Spikes (maximum values) should not be higher than 50 ms. Note: When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at.
Avg. Disk sec/Write (Physical Disk) Shows the average time, in seconds, of a write of data to the disk. Should be less than 20 milliseconds (ms) on average. Spikes (maximum values) should not be higher than 50 ms. When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at. Avg. Disk sec/Read (Logical Disk) Shows the average time, in seconds, of a read of data from the disk. Should be less than 20 milliseconds (ms) on average. Spikes (maximum values) should not be higher than 50 ms. Note: When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at. Avg. Disk sec/Write (Logical Disk) Shows the average time, in seconds, of a write of data to the disk. Should be less than 20 milliseconds (ms) on average. Spikes (maximum values) shouldn't be higher than 50 ms. Note: When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at. Retry Non-Smtp Delivery Queue Length Shows the number of messages in a retry state in the non-SMTP gateway delivery queues. Should not exceed 100. Largest Delivery Queue Length Shows the number of messages in the largest delivery queues. Should be less than 200 for the Edge Transport and Hub Transport server roles. Version buckets allocated (database) Total number of version buckets allocated. Shows the default backpressure values as listed in the edgetransport.exe.config file.
Should be less than 200 at all times. Log Record Stalls/sec (database) Shows the number of log records that cannot be added to the log buffers per second because they are full. If this counter is nonzero most of the time, the log buffer size may be a bottleneck. Should be less than 10 per second on average. Spikes (maximum values) should not be greater than 100 per second. Log Threads Waiting (database) Shows the number of threads waiting for their data to be written to the log to complete an update of the database. If this number is too high, the log may be a bottleneck. Should be less than 10 threads waiting on average.
Exchange 2010 Edge Transport Role Counters (Advanced)

This template contains advanced performance and statistics counters for monitoring Exchange 2010 Edge Transport Role. Some of the counters may require manual configuration, such as setting up installation-specific instances, correcting thresholds for the clients environment, and so forth. Use this template in addition to the Exchange 2007-2010 Edge Transport Role Services and Counters (Basic) template. Prerequisites: RPC and WMI access to the Exchange server. Credentials: Windows Administrator on the target server. Monitored Components These performance counters are based on the following information: Transport Server Counters: Exchange 2010 Help, "Microsoft TechNet": http://technet.microsoft.com/en-us/library/ff367923.aspx Dumpster Size Shows the total size (in bytes) of mail items currently in the transport dumpster on this server. Dumpster Inserts/sec Shows the rate at which items are inserted into the transport dumpster on this server. Determines the current rate of transport dumpster inserts. Dumpster Item Count Shows the total number of mail items currently in the transport dumpster on this server. Shows the current number of items being held in the transport dumpster. Dumpster Deletes/sec Shows the rate at which items are deleted from the transport dumpster on this server. Determines the current rate of transport dumpster deletions. I/O Log Writes/sec (database) Shows the rate of log file write operations completed. Determines the current load. Compare values to historical baselines. I/O Log Reads/sec (database) Shows the rate of log file read operations completed. Determines the current load. Compare values to historical baselines.
Log Generation Checkpoint Depth (database) Represents the amount of work (in count of log files) that needs to be redone or undone to the database files if the process fails. Should be less than 1,000 at all times. I/O Database Reads/sec (database) Shows the rate of database read operations completed. Determines the current load. Compare values to historical baselines. I/O Database Writes/sec Shows the rate of database write operations completed. Determines the current load. Compare values to historical baselines. Messages Submitted Per Second Shows the number of messages queued in the Submission queue per second. Determines current load. Compare values to historical baselines. Messages Received/sec Shows the number of messages received by the SMTP server each second. Determines current load. Compare values to historical baselines. Messages Queued for Delivery Per Second Shows the number of messages queued for delivery per second. Determines current load. Compare values to historical baselines. Messages Completed Delivery Per Second Shows the number of messages delivered per second. Determines current load. Compare values to historical baselines. Avg. Disk sec/Read (Physical Disk) Shows the average time, in seconds, of a read of data from the disk. Should be less than 20 milliseconds (ms) on average. Spikes (maximum values) should not be higher than 50 ms. Note: When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at. Avg. Disk sec/Write (Physical Disk) Shows the average time, in seconds, of a write of data to the disk.
Should be less than 20 milliseconds (ms) on average. Spikes (maximum values) should not be higher than 50 ms. Note: When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at. Avg. Disk sec/Read (Logical Disk) Shows the average time, in seconds, of a read of data from the disk. Should be less than 20 milliseconds (ms) on average. Spikes (maximum values) shouldn't be higher than 50 ms. Note: When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at. Avg. Disk sec/Write (Logical Disk) Shows the average time, in seconds, of a write of data to the disk. Should be less than 20 milliseconds (ms) on average. Spikes (maximum values) shouldn't be higher than 50 ms. Note: When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at. Retry Non-Smtp Delivery Queue Length Shows the number of messages in a retry state in the non-SMTP gateway delivery queues. Should not exceed 100. Largest Delivery Queue Length Shows the number of messages in the largest delivery queues. Should be less than 200 for the Edge Transport and Hub Transport server roles. Version buckets allocated (database) Total number of version buckets allocated. Shows the default backpressure values as listed in the edgetransport.exe.config file. Should be less than 200 at all times.
Log Record Stalls/sec (database) Shows the number of log records that cannot be added to the log buffers per second because they are full. If this counter is nonzero most of the time, the log buffer size may be a bottleneck. Should be less than 10 per second on average. Spikes (maximum values) should not be greater than 100 per second. Log Threads Waiting (database) Shows the number of threads waiting for their data to be written to the log to complete an update of the database. If this number is too high, the log may be a bottleneck. Should be less than 10 threads waiting on average.
Exchange 2010 Unified Messaging Role Counters (Advanced)

This template contains advanced performance and statistics counters for monitoring Exchange 2010 Unified Messaging Role. Some of the counters may require manual configuration, such as setting up installation-specific instances, correcting thresholds for the clients environment, and so forth. Use this template in addition to the Exchange 2007-2010 Unified Messaging Role Services and Counters (Basic) template. Prerequisites: RPC and WMI access to the Exchange server. Credentials: Windows Administrator on the target server. Monitored Components These performance counters are based on the following information: Unified Messaging Server Counters: Exchange 2010 Help, "Microsoft TechNet": http://technet.microsoft.com/en-us/library/ff367900.aspx Average Call Duration Average Call Duration is the average duration, in seconds, of calls since the service was started. Total Calls Total Calls is the number of calls answered or placed since the service was started. Transfers are not included. User Response Latency User Response Latency is the average response time, in milliseconds, for the system to respond to a user request. This average is calculated over the last 25 calls. This counter is limited to calls that require significant processing. Call Answering Calls Call Answering Calls is the number of diverted calls that were answered on behalf of subscribers. Percentage of Successful Valid Fax Calls Percentage of Successful Valid Fax Calls is the percentage of successful valid fax call requests.
% of Failed Mailbox Connection Attempts Over the Last Hour Shows the percentage of mailbox connection attempts that failed in the last hour. Should be less than 5%. % of Inbound Calls Rejected by the UM Service Over the Last Hour Shows the percentage of inbound calls that were rejected by the Microsoft Exchange Unified Messaging (UM) service over the last hour. Should be less than 5%. % of Inbound Calls Rejected by the UM Worker Process Over the Last Hour Shows the percentage of inbound calls that were rejected by the UM worker process over the last hour. Should be less than 5%. % of Messages Successfully Processed Over the Last Hour Shows the percentage of messages that were successfully processed by the Microsoft Exchange Unified Messaging service over the last hour. Should be greater than or equal to 95%. % of Partner Voice Message Transcription Failures Over the Last Hour Shows the percentage of voice messages for which transcription failed in the last hour. Should be less than 5%. Calls Disconnected on Irrecoverable Internal Error Shows the number of calls disconnected after an internal system error occurred. Should be 0 at all times. Total Inbound Calls Rejected by the UM Service Shows the total number of inbound calls that were rejected by the Microsoft Exchange Unified Messaging Service since the service was started. Should be 0 at all times.
Exchange 2010 OWA Form Login (PowerShell)

This template assesses the availability of the Outlook Web Access service for users by performing a user login procedure and returns the length of time it takes to log in. Exchange 2010 OWA Form Login Monitor Performs a user login procedure and returns the length of time it takes to log in.
Exchange 2007 Client Access Role Counters (Advanced)

This template contains advanced performance and statistics counters for monitoring Exchange 2007 Client Access Role. Some of counters may require manual configuration, such as setting up installation-specific instances, correcting thresholds for the clients environment, and so forth. Use this template in addition to the 2007-2010 Client Access Role Services and Counters (Basic) template. Prerequisites: RPC and WMI access to the Exchange server. Credentials: Windows Administrator on the target server. Monitored Components These performance counters are based on the following information: Monitoring Client Access Server: Exchange 2007 Help, "Microsoft TechNet": http://technet.microsoft.com/en-us/library/bb201674(EXCHG.80).aspx Availability Requests (sec) Shows the number of requests serviced per second. The request can be only for free/busy or include suggestions. One request may contain multiple mailboxes. Determines the rate at which Availability service requests are occurring. Average Request Time (Active Sync) Shows the average time that elapsed while waiting for a request to complete. Includes Ping Request Time, which can increase the general response time of this counter. Adding ping counters helps clarify where performance is being impacted. Determines the rate at which Availability service requests are occurring. Requests/sec (Active Sync) Shows the number of HTTP requests that are received from the client via ASP.NET per second. Determines the current Exchange ActiveSync request rate. OWA: Requests/sec Shows the number of requests handled by Outlook Web Access per second. Determines current user load.
Current Connections Shows the current number of connections established with the Web service. Determines current user load. ASP.NET: Requests Current Shows the current number of requests, including those that are queued, currently executing, or waiting to be written to the client. Under the ASP.NET process model, when this counter exceeds the requestQueueLimit defined in the processModel configuration section, ASP.NET will begin rejecting requests. Should be less than 5,000 at all times. The maximum value is 5,000. The server will return a 503 error if this value is exceeded. This value can be increased in the machine.config file to allow for Client Access server scalability. ASP.NET: Request Wait Time Shows the number of milliseconds the most recent request was waiting in the queue. Should be less than 1,000 milliseconds (ms) at all times. Disk Reads/sec Indicates that a paging situation may exist because data was read from disk instead of memory. Should be less than 50 at all times. Disk Writes/sec Indicates that a paging situation may exist because data was written to disk instead of being stored in memory. Should be less than 50 at all times. Average Response Time Shows the average time (in milliseconds) that elapsed between the beginning and end of an OEH or ASPX request. Should be less than 100 ms at all times. Used to determine the latency that a client is experiencing. Higher values may indicate high user load or higher than normal CPU time.
Exchange 2007 Mailbox Role Counters (Advanced)

This template contains advanced performance and statistics counters for monitoring Exchange 2007 Mailbox Role. Some of the counters may require manual configuration, such as setting up installation-specific instances, correcting thresholds for the clients environment, and so forth. Use this template in addition to the Exchange 2007-2010 Mailbox Role Services and Counters (Basic) template. Prerequisites: RPC and WMI access to the Exchange server. Credentials: Windows Administrator on the target server. Monitored Components These performance counters are based on the following information: Monitoring Mailbox Servers: Exchange 2007 Help, "Microsoft TechNet": http://technet.microsoft.com/en-us/library/bb201689(EXCHG.80).aspx Messages Sent/sec Shows the rate that messages are sent to transport. Used to determine current messages sent to transport. Directory Access: LDAP Reads/sec Shows the current rate that the Lightweight Directory Access Protocol (LDAP) reads occur while processing requests for the client. Used to determine the current LDAP read rate per protocol. Directory Access: LDAP Searches/sec Shows the current rate that the LDAP searches occur while processing requests for the client. Used to determine the current LDAP search rate per protocol. User Count (Information Store) Shows the number of users connected to the information store. Used to determine current user load. % Processor time (Exchange Search) Shows the amount of processor time that is currently being consumed by the Exchange Search service.
Should be less than 1% of overall CPU typically and not sustained above 5%. % Processor Time (msftefd) Shows the amount of processor time that is being consumed to update content indexing within the store process. Should be less than 10% of what the store process is during steady state. Full crawls will increase overall processing time, but should never exceed overall store CPU capacity. Check throttling counters to determine if throttling is occurring due to server performance bottlenecks. Throttling Delay Value Shows the total time, in milliseconds, a worker thread sleeps before it retrieves a document from the Microsoft Exchange Information Store service. This is set by the throttling monitor thread. Indicates the current throttling delay value. If this value is nonzero, this indicates a potential server bottleneck causing delay values to be introduced to throttle the rate at which indexing is occurring. Note: In the instance field, you can specify your own mailbox database or use the default value. Use perfmon.exe to determine the name of the instance. Default value: instance=_total. % Processor Time (Mailbox Assistants) Shows the amount of processor time that is being consumed by mailbox assistants. Should be less than 5% of overall CPU capacity. Average Event Processing Time in Seconds Shows the average processing time of the events chosen. Should be less than 2 at all times. Note: In the instance field, you can specify your own mailbox database or use the default value. Use perfmon.exe to determine the name of the instance. Default value: instance=msexchangemailboxassistants-total. Average Resource Booking Processing Time Shows the average time to process an event in the Resource Booking Attendant.
Should be a low value at all times. High values may indicate a performance bottleneck. Requests Failed (resource booking) Shows the total number of failures that occurred while the Resource Booking Attendant was processing events. Should be 0 at all times. Average Calendar Attendant Processing time Shows the average time to process an event in the Calendar Attendant. Should be a low value at all times. High values may indicate a performance bottleneck. Requests Failed (calendar attendant) Shows the total number of failures that occurred while the Calendar Attendant was processing events. Should be 0 at all times. Information Store: RPC Requests Indicates the overall RPC requests that are currently executing within the information store process. Should be below 70 at all times. The maximum value in Exchange 2007 is 500 RPC requests that can execute at any designated time before the information store starts rejecting any new connections from clients. Information Store: RPC Averaged Latency Indicates the RPC latency, in milliseconds, averaged for all operations in the last 1,024 packets. For information about how clients are affected when overall server RPC averaged latencies increase, see Understanding Client Throttling at: http://go.microsoft.com/fwlink/?LinkId=116695. Should not be higher than 25 ms on average. To determine if certain protocols are causing overall RPC latencies, monitor MSExchangeIS Client (*)\RPC Average Latency to separate latencies based on client protocol. Cross-reference MSExchangeIS\RPC Client Backoff/sec to ensure higher latencies are not causing client throttling.
Information Store: RPC Client Backoff/sec Shows the rate that the server notifies the client to back off. Indicates the rate at which client backoffs are occurring. Higher values may indicate that the server may be incurring a higher load resulting in an increase in overall averaged RPC latencies, causing client throttling to occur. This can also occur when certain client user actions are being performed. Depending on what the client is doing and the rate at which RPC operations are occurring, it may be normal to see backoffs occurring. Database: Database Page Fault Stalls/sec Shows the rate that database file page requests require of the database cache manager to allocate a new page from the database cache. This should be 0 at all times. If this value is nonzero, this indicates that the database is not able to flush dirty pages to the database file fast enough to make pages free for new page allocations. Database: Log Record Stalls/sec Shows the number of log records that cannot be added to the log buffers per second because the log buffers are full. If this counter is nonzero most of the time, the log buffer size may be a bottleneck. The average value should be below 10 per second. Spikes (maximum values) should not be higher than 100 per second. Database: Version buckets allocated Shows the total number of version buckets allocated. Should be less than 12,000 at all times. The maximum default version is 16,384. If version buckets reach 70 percent of maximum, the server is at risk of running out of the version store. Database Cache Size (MB) Shows the amount of system memory, in megabytes, used by the database cache manager to hold commonly used information from the database files to prevent file operations. If the database cache size seems too small for optimal performance and there is little available memory on the system (check the value of Memory/Available Bytes), adding more memory to the system may increase performance. If there is ample memory on the system and the database cache size is not growing beyond a certain point, the database cache size may be capped at an artificially low limit. Increasing this limit may increase performance.
Maximum value is RAM-2GB (RAM-3GB for servers with sync replication enabled). This and Database Cache Hit % are extremely useful counters for gauging whether a server's performance problems might be resolved by adding more physical memory. Use this counter along with store private bytes to determine if there are store memory leaks. Note: Set the thresholds as appropriate for your environment. Average Document Indexing Time Shows the average, in milliseconds, of how long it takes to index documents. Should be less than 30 seconds at all time. Note: In the instance field, you can specify your own mailbox database or use the default value. Use perfmon.exe to determine the name of the instance. Default value: instance=_total. Events in queue Shows the number of events in the in-memory queue waiting to be processed by the assistants. Should be a low value at all times. High values may indicate a performance bottleneck. Note: In the instance field, you can specify your own mailbox database or use the default value. Use perfmon.exe to determine the name of the instance. Default value: instance=msexchangemailboxassistants-total. RPC Latency average (msec) Shows the average latency, in milliseconds, of RPC requests. The average is calculated over all RPCs since exrpc32 was loaded. Should be less than 100 ms at all times. Failed Submissions Per Second Shows the number of failed submissions per second. Should be 0 at all times.
Exchange 2007 Hub Transport Role Counters (Advanced)

This template contains advanced performance and statistics counters for monitoring Exchange 2007 Hub Transport Role. Some of the counters may require manual configuration, such as setting up installation-specific instances, correcting thresholds for the clients environment, and so forth. Use this template in addition to the Exchange 2007-2010 Hub Transport Role Services and Counters (Basic) template. Prerequisites: RPC and WMI access to the Exchange server. Credentials: Windows Administrator on the target server. Monitored Components These performance counters are based on the following information: Monitoring Hub Transport Server: Exchange 2007 Help, "Microsoft TechNet": http://technet.microsoft.com/en-us/library/bb201704(EXCHG.80).aspx Dumpster Size Shows the total size (in bytes) of mail items currently in the transport dumpster on this server. Dumpster Inserts/sec Shows the rate at which items are inserted into the transport dumpster on this server. Determines the current rate of transport dumpster inserts. Dumpster Item Count Shows the total number of mail items currently in the transport dumpster on this server. Shows the current number of items being held in the transport dumpster. Dumpster Deletes/sec Shows the rate at which items are deleted from the transport dumpster on this server. Determines the current rate of transport dumpster deletions. I/O Log Writes/sec (database) Shows the rate of log file write operations completed. Determines the current load. Compare values to historical baselines. I/O Log Reads/sec (database) Shows the rate of log file read operations completed. Determines the current load. Compare values to historical baselines.
Log Generation Checkpoint Depth (database) Represents the amount of work (in count of log files) that needs to be redone or undone to the database files if the process fails. Should be less than 1,000 at all times. I/O Database Reads/sec (database) Shows the rate of database read operations completed. Determines the current load. Compare values to historical baselines. I/O Database Writes/sec Shows the rate of database write operations completed. Determines the current load. Compare values to historical baselines. Messages Submitted Per Second Shows the number of messages queued in the Submission queue per second. Determines the current load. Compare values to historical baselines. Messages Received/sec Shows the number of messages received by the SMTP server each second. Determines the current load. Compare values to historical baselines. Messages Sent/sec Shows the number of messages sent by the SMTP send connector each second. Determines the current load. Compare values to historical baselines. Messages Queued for Delivery Per Second Shows the number of messages queued for delivery per second. Determines the current load. Compare values to historical baselines. Messages Completed Delivery Per Second Shows the number of messages delivered per second. Determines the current load. Compare values to historical baselines. Avg. Disk sec/Read (Physical Disk) Shows the average time, in seconds, of a read of data from the disk. Should be less than 20 milliseconds (ms) on average. Spikes (maximum values) should not be higher than 50 ms. Note: When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at.
Avg. Disk sec/Write (Physical Disk) Shows the average time, in seconds, of a write of data to the disk. Should be less than 20 milliseconds (ms) on average. Spikes (maximum values) should not be higher than 50 ms. Note: When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at. Avg. Disk sec/Read (Logical Disk) Shows the average time, in seconds, of a read of data from the disk. Should be less than 20 milliseconds (ms) on average. Spikes (maximum values) should not be higher than 50 ms. Note: When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at. Avg. Disk sec/Write (Logical Disk) Shows the average time, in seconds, of a write of data to the disk. Should be less than 20 milliseconds (ms) on average. Spikes (maximum values) should not be higher than 50 ms. Note: When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at. Retry Non-Smtp Delivery Queue Length Shows the number of messages in a retry state in the non-SMTP gateway delivery queues. Should not exceed 100. Largest Delivery Queue Length Shows the number of messages in the largest delivery queues. Should be less than 200 for the Edge Transport and Hub Transport server roles. Version buckets allocated (database) Total number of version buckets allocated. Shows the default backpressure values as listed in the edgetransport.exe.config file.
Should be less than 200 at all times. Log Record Stalls/sec (database) Shows the number of log records that cannot be added to the log buffers per second because they are full. If this counter is nonzero most of the time, the log buffer size may be a bottleneck. Should be less than 10 per second on average. Spikes (maximum values) should not be greater than 100 per second. Log Threads Waiting (database) Shows the number of threads waiting for their data to be written to the log to complete an update of the database. If this number is too high, the log may be a bottleneck. Should be less than 10 threads waiting on average.
Exchange 2007 Edge Transport Role Counters (Advanced)

This template contains advanced performance and statistics counters for monitoring Exchange 2007 Edge Transport Role. Some of the counters may require manual configuration, such as setting up installation-specific instances, correcting thresholds for the clients environment, and so forth. Use this template in addition to the Exchange 2007-2010 Edge Transport Role Services and Counters (Basic) template. Prerequisites: RPC and WMI access to the Exchange server. Credentials: Windows Administrator on target server. Monitored Components These performance counters are based on the following information: Monitoring Edge Transport Server: Exchange 2007 Help, "Microsoft TechNet": http://technet.microsoft.com/en-us/library/ee532088(EXCHG.80).aspx Dumpster Size Shows the total size (in bytes) of mail items currently in the transport dumpster on this server. Dumpster Inserts/sec Shows the rate at which items are inserted into the transport dumpster on this server. Determines the current rate of transport dumpster inserts. Dumpster Item Count Shows the total number of mail items currently in the transport dumpster on this server. Shows the current number of items being held in the transport dumpster. Dumpster Deletes/sec Shows the rate at which items are deleted from the transport dumpster on this server. Determines the current rate of transport dumpster deletions. I/O Log Writes/sec (database) Shows the rate of log file write operations completed. Determines the current load. Compare values to historical baselines. I/O Log Reads/sec (database) Shows the rate of log file read operations completed. Determines the current load. Compare values to historical baselines.
Log Generation Checkpoint Depth (database) Represents the amount of work (in count of log files) that needs to be redone or undone to the database files if the process fails. Should be less than 1,000 at all times. I/O Database Reads/sec (database) Shows the rate of database read operations completed. Determines the current load. Compare values to historical baselines. I/O Database Writes/sec Shows the rate of database write operations completed. Determines the current load. Compare values to historical baselines. Messages Submitted Per Second Shows the number of messages queued in the Submission queue per second. Determines the current load. Compare values to historical baselines. Messages Received/sec Shows the number of messages received by the SMTP server each second. Determines the current load. Compare values to historical baselines. Messages Queued for Delivery Per Second Shows the number of messages queued for delivery per second. Determines the current load. Compare values to historical baselines. Messages Completed Delivery Per Second Shows the number of messages delivered per second. Determines the current load. Compare values to historical baselines. Avg. Disk sec/Read (Physical Disk) Shows the average time, in seconds, of a read of data from the disk. Should be less than 20 milliseconds (ms) on average. Spikes (maximum values) should not be higher than 50 ms. Note: When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at. Avg. Disk sec/Write (Physical Disk) Shows the average time, in seconds, of a write of data to the disk.
Should be less than 20 milliseconds (ms) on average. Spikes (maximum values) should not be higher than 50 ms. Note: When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at. Avg. Disk sec/Read (Logical Disk) Shows the average time, in seconds, of a read of data from the disk. Should be less than 20 milliseconds (ms) on average. Spikes (maximum values) should not be higher than 50 ms. Note: When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at. Avg. Disk sec/Write (Logical Disk) Shows the average time, in seconds, of a write of data to the disk. Should be less than 20 milliseconds (ms) on average. Spikes (maximum values) should not be higher than 50 ms. Note: When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at. Retry Non-Smtp Delivery Queue Length Shows the number of messages in a retry state in the non-SMTP gateway delivery queues. Should not exceed 100. Largest Delivery Queue Length Shows the number of messages in the largest delivery queues. Should be less than 200 for the Edge Transport and Hub Transport server roles. Version buckets allocated (database) Total number of version buckets allocated. Shows the default backpressure values as listed in the edgetransport.exe.config file. Should be less than 200 at all times.
Log Record Stalls/sec (database) Shows the number of log records that cannot be added to the log buffers per second because they are full. If this counter is nonzero most of the time, the log buffer size may be a bottleneck. Should be less than 10 per second on average. Spikes (maximum values) should not be greater than 100 per second. Log Threads Waiting (database) Shows the number of threads waiting for their data to be written to the log to complete an update of the database. If this number is too high, the log may be a bottleneck. Should be less than 10 threads waiting on average.
Exchange 2007 Unified Messaging Role Counters (Advanced)

This template contains advanced performance and statistics counters for monitoring Exchange 2007 Unified Messaging Role. Some of the counters may require manual configuration, such as setting up installation-specific instances, correcting thresholds for the clients environment, and so forth. Use this template in addition to the Exchange 2007-2010 Unified Messaging Role Service and Counters (Basic) template. Prerequisites: RPC and WMI access to the Exchange server. Credentials: Windows Administrator on the target server. Monitored Components These performance counters are based on the following information: Monitoring Unified Messaging Server: Exchange 2007 Help, "Microsoft TechNet: http://technet.microsoft.com/en-us/library/bb201671(EXCHG.80).aspx Queued OCS User Event Notifications Shows the number of notifications that have been created and not yet submitted for delivery. Should be 0 at all times. Represents the number of missed call notifications that have been generated in the Office Communications Server environment and have not been submitted for delivery. Unhandled Exceptions/sec Shows the number of calls that were disconnected after an internal system error occurred in the last second. Should be 0 at all times. Mailbox Server Access Failures Shows the number of times the system did not access a Mailbox server. Should be 0 at all times. A non-zero value indicates that Unified Messaging is having problems with MAPI connectivity to mbx servers. Call Answer Queued Messages Shows the number of messages created and not yet submitted for delivery.
Should be less than 50 at all times. Hub Transport Access Failures Shows the number of times that attempts to access a Hub Transport server failed. This number is only incremented if all Hub Transport servers were unavailable. Should be 0 at all times.
Exchange 2007 Outlook Web Access (OWA) Form Login

This template helps you check the availability of the OWA service for end-users by performing the user login procedure. The template collects response times for login procedure. Prerequisites: A functioning Exchange OWA server. Credentials: Valid Exchange OWA user name and password. Monitored Components HTTP Form Login Monitor Performs a user login procedure and returns the length of time it takes to log in.
Exchange Server (via SNMP)

Monitors process up/down status, CPU, memory on the following processes: MS Exchange Event MS Exchange IMAP4 MS Exchange Information Store MS Exchange Management MS Exchange MTA Stack MS Exchange Routing Engine MS Exchange Site Replication MS Exchange System Attendant
Monitors availability and network responsiveness for the following mail services: MS SMTP MS POP3 MS IMAP4
File Age Monitor

This template determines when a file was last modified. The statistic is the number of elapsed hours since the file modification date. Prerequisites: None. Credentials: Windows credential with read access to the network share and file. Monitored Components File Age Monitor
File Change Monitor

This template tests if the contents of a file has changed. The component monitor performs an MD5 checksum comparison on the file to verify it matches a previously known state. The statistic is the number of hours since the file was modified. Prerequisites: None. Credentials: Windows credential with read access to the network share and file. Monitored Components File Change Monitor
File Count Script

This template monitors the number of files in a directory. Specify the path as the script argument. The statistic is the number of files in the directory. Prerequisites: None. Credentials: Windows credential valid on both SolarWinds SAM and target server. Monitored Components File Count
File Existence Monitor

This template tests if a file exists at the given file path. Requirement: None. Credentials: Windows credential with read access to the network share. Monitored Components File Existence Monitor
File Size Monitor

This template measures the size of a file at the given file path. The statistic is the file size in bytes. Prerequisites: None. Credentials: Windows credential with read access to the network share. Monitored Components File Size Monitor
File Modified (Vbscript)

This template tests if a file has been modified. This template has been superseded by the File Change Monitor template. Prerequisites: None. Credentials: Windows credential valid on both SolarWinds SAM and target server. Monitored Components FileModified
Finger Port Monitor

This template tests the ability of the Finger service to accept incoming sessions on port 79. Prerequisites: None. Credentials: None. Monitored Components Finger Port Monitor
FTP User Experience

This template tests the ability of an FTP server to accept incoming sessions, process user logins, and then transmit the requested file. The component monitor performs an MD5 checksum comparison on the downloaded file to verify content integrity Prerequisites: None. Credentials: FTP account with read permissions on target server. Monitored Components FTP User Experience Monitor
Generic DNS
This template tests a DNS server's ability to respond to a record query and measures its response time. The component monitor passes if it receives a valid DNS response (positive or negative) within the response time threshold. Prerequisites: None. Credentials: None. Monitored Components DNS Monitor UDP
Generic Mail Server

This template tests the ability of a mail server to accept incoming SMTP, NNTP, POP3, and IMAP4 connections and respond with the correct codes. Prerequisites: None. Credentials: None. Monitored Components SMTP Monitor NNTP Monitor POP3 Monitor IMPA4 Monitor
Generic Web Server

This template tests the ability of a web server to respond to HTTP and HTTPS requests. Prerequisites: None. Credentials: None. Monitored Components HTTP Monitor HTTPS Monitor
Gopher Port Monitor

This template tests the ability of a Gopher server to accept incoming sessions on port 70. Prerequisites: None. Credentials: None. Monitored Components Gopher Port Monitor
Group Policy Object (System and Application Logs)

This template assesses the status and overall performance of a Windows Group Policy Object by checking Windows logs for critical events. This template sets the state of the application to Down if there are any errors or warnings related with the Group Policy Object within the last five minutes. In Windows Server 2003, the Group Policy Object writes events to the application log. In Windows Server 2008, the Group Policy Object writes events to the system log. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on the target server. This template is based on the following information: http://technet.microsoft.com/en-us/library/cc749336(WS.10).aspx. Group Policy troubleshooting tips can be found here: http://www.chicagotech.net/Security/gp10checklist.htm. Monitored Components Note: All monitors should return zero values. Returned values other than zero indicate an abnormality. Examining the Windows system and application log files should provide information pertaining to the issue. Failed Allocation This monitor returns the number of memory allocation fails. Type of event: Error. Event ID: 1002. DS Bind Failure This monitor returns the number of failed authentication attempts of the Active Directory. Type of event: Error. Event ID: 1006. Site Query Failure This monitor returns the number of failed attempts to query the Active Directory Site using the credentials of the user or computer. Type of event: Error. Event ID: 1007. GPO Query Failure This monitor returns the number of failed attempts to query Group Policy Objects. Type of event: Error. Event ID: 1030.
Computer Role Failure This monitor returns the number of failed attempts to determine the role of the computer, (i.e.: workgroup, domain member, or domain controller). Type of event: Error. Event ID: 1052. User Name Resolution Failure This monitor returns the number of failed attempts to resolve a user name. Type of event: Error. Event ID: 1053. DC Resolution Failure This monitor returns the number of failed attempts to obtain the name of a domain controller. Type of event: Error. Event ID: 1054. Computer Name Resolution Failure This monitor returns the number of failed attempts to resolve a computer name. Type of event: Error. Event ID: 1055. Policy Read Failure This monitor returns the number of failed attempts to read the GPT.INI of a Group Policy Object. Type of event: Error. Event ID: 1058. WMI Evaluation Failure This monitor returns the number of failed attempts to evaluate a WMI filter. Type of event: Error. Event ID: 1065. GPO Search Failure This monitor returns the number of failed attempts to obtain a list of Group Policy Objects. Type of event: Error. Event ID: 1079. OU Search Failure This monitor returns the number of failed attempts to search the Active Directory Organizational Unit hierarchy. Type of event: Error. Event ID: 1080.
CSE Failure Warning This monitor returns the number of events when the Group Policy client side extension fails. Type of event: Warning. Event ID: 1085. Excessive GPO Failure This monitor returns the number of events for when the scope of Group Policy Objects, for a computer or user, exceeds 999. Type of event: Error. Event ID: 1088. RSOP Session Failure This monitor returns the number of events when a Resultant Set of Policy session fails. Type of event: Warning. Event ID: 1089. WMI Failure This monitor returns the number of events the Group Policy service encounters caused by errors with the WMI service. Type of event: Warning. Event ID: 1090. RSOP CSE Failure This monitor returns the number of events the Group Policy client side extension has due to failed attempts to record Resultant Set of Policy information. Type of event: warning. Event ID: 1091. RSOP Failure This monitor returns the number of errors that occur while recording Resultant Set of Policy information. Type of event: warning. Event ID: 1095. The Group Policy service logs this event when an error occurs while recording Resultant Set of Policy information. Registry.pol Failure This monitor returns the number of failed attempts to read registry.pol. Type of event: Error. Event ID: 1096.
Computer Token Failure This monitor returns the number of failed attempts to read the computer's authentication token. Type of event: Error. Event ID: 1097. Object Not Found Failure This monitor returns the number of failed attempts to locate an Active Directory object. Type of event: Error. Event ID: 1101. WMI Filter Not Found Warning This monitor returns the number of failed attempts to locate an associated WMI filter. Type of event: Warning. Event ID: 1104. Cross Forest Discovery Failure This monitor returns the number of failed attempts to determine if the user and computer belong to the same forest. Type of event: Error. Event ID: 1110. CSE Synchronous Warning This monitor returns the number of events when a Group Policy client side extension requires synchronous policy processing to apply one or more policy settings. Type of event: warning. Event ID: 1112. Time Skew Failure This monitor returns the number of events that indicate the time on the local computer is not synchronized with the time on the domain controller. Type of event: Error. Event ID: 1126. DC Connectivity Failure This monitor returns the number of events when there is an absence of authenticated connectivity from the computer to the domain controller. Type of event: error. Event ID: 1129. Script Failure This monitor returns the number of failed attempts to run a script.
Type of event: Error. Event ID: 1130.
Helix Universal Media Server (Linux/Unix)

This template assesses the performance of the Real Helix Universal Media Server on Linux/Unix machines. It uses Perl scripts to get statistics from RSS log files and an SNMP process monitor for monitoring Universal Media Server process. Prerequisites: SSH and Perl installed on the target server. SNMP installed on the target server and permission to monitor rmserver processes. Credentials: Root credentials on the target server. Monitored Components: Note: You need to set thresholds for counters according to your environment. It is recommended that you monitor counters for some length of time to understand potential value ranges and then set the thresholds accordingly. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Note: All Linux/Unix monitors retrieve statistical information from RSS log files which can be found here:
<Path_To_Helix_Folder>/Logs/rss/.
Each RSS configuration varies as to how many log files will be stored and how often this statistic will be updated. By default, the RSS interval is set to one minute in the following folder. (rmserver.cfg file, RSS Logging section) Before using this template, the correct arguments should be set to all Linux/Unix monitors. Following is an example using the arguments field:
perl ${SCRIPT} /usr/Helix/Logs/rss/rsslogs.* rsslogs.* should be put at the end of the RSS folder path. The entire argument
should be within in double brackets. The script in monitors automatically determine which log file is the most recent and will retrieve statistical information from it. CPU usage This component monitor returns the overall use of system processor time. For machines with up to 4 CPUs, these statistics provide an accurate guide to the server processing load. For machines with more processors, the number may fall short in representing the actual server load. Returned values are as follows: User This monitor returns the percentage of time used by the server itself, not counting operating system time and kernel time.
Kernel This monitor returns the percentage of time used by the operating system kernel on behalf of the server. System This monitor returns the total system CPU load, including CPU used by other applications. This includes both user and kernel time. Memory Statistic and Allocations This component monitor returns statistics about actual server memory usage, memory allocation according to the operating system, and allocated memory, in Kilobytes, divided by the number of currently connected media players at the time the RSS report was written. Returned values are as follows: Used This monitor returns the amount of memory, in units defined by a script, in use by the server when the RSS report was written. This may be less than the amount of application memory reported by the operating system. The difference represents memory that the server has reserved for use, but that is currently idle. Cache_Hit_Ratio This monitor returns the percentage of memory operations during this RSS period that were carried out using the servers memory cache. (This cache is internal to the server and unrelated to L1/L2 system memory cache.) Because these operations occur faster with less resource contention than non-cached memory functions, a higher percentage indicates greater server efficiency. Used_High_Watermark This monitor returns the high-water mark for the amount of memory used, in units defined by a script. This should be close to the amount of application memory in use as reported by the operating system. This number, which may have been reached in a preceding RSS period, never falls until the server is restarted. The maximum value is set by the -m command option. Pages This monitor returns the high-water mark for the amount of memory used, in pages. Memory_Mapped_IO This monitor returns the amount of memory, in units defined by a script, used for memory-mapped I/O when this report was written. This memory is not included in the application memory allocation. It is not limited by the -m option. Memory_Per_Player This monitor returns the allocated memory, in kB, divided by the number of currently connected media players. Keep in mind that this is only an average and the amount of memory allocated to each player can vary widely depending on the type of player and the type of media streamed.
Players statistic This component monitor returns general statistics about how many new players are connected or disconnected. Returned values are as follows: Total This monitor returns the total number of players connected when the RSS report was written. New This monitor returns the number of new player connections since the start of this RSS interval. Leaving This monitor returns the number of players disconnected since the start of this RSS interval. Players by Protocol This component monitor returns the percentage of media players using each of the supported control protocols in their streaming sessions. This breakdown includes the total number of players connected when the RSS report was generated. Returned values are as follows: RTSP This monitor returns the percentage of players connected through RTSP and RTSP cloaked as HTTP. RTMP This monitor returns the percentage of players connected through RTMP and RTMP cloaked as HTTP. MMS This monitor returns the percentage of players connected through MMS and MMS cloaked as HTTP. HTTP This monitor returns the percentage of players using HTTP as the control protocol. This does not include players using RTSP or MMS cloaked as HTTP. Players by Transport This component monitor returns the percentage of media players using each of the supported transports in their streaming sessions. This breakdown includes the total number of players that have connected since the start of this RSS interval. The total number of players connected in a scalable multicast is unknown during the broadcast. Players may report connection statistics to a Web server after the broadcast ends. Returned values are as follows: TCP This monitor returns the percentage of players receiving data by TCP. UDP This monitor returns the percentage of players receiving data by UDP. Multicast This monitor returns the percentage of players connected through a back-channel multicast.
HTTP Connections This component monitor returns the percentage of persistent, secure and cloaked, connections to the server. Returned values are as follows: Persistent This monitor returns the percentage of persistent HTTP connections. Secure This monitor returns the percentage of secure HTTP connections. Cloaked This monitor returns the percentage of cloaked HTTP connections. Bandwidth Statistic This component monitor provides a guide to how well the server fulfills the requirements for streaming rates of requested media. These statistics can help you determine if the servers outgoing bandwidth is suffic ient to meet your streaming media needs. Returned values are as follows: Output This monitor returns the average amount of bandwidth, in units defined by a script, that the server delivered to the network over the RSS period. Bandwidth_Per_Player This monitor returns the average amount of bandwidth per media player during the RSS period, in units defined by a script. This is equal to the Output value divided by the number of players connected when the RSS report was written. Subscribed This monitor returns the percentage value that indicates the total output bandwidth divided by the cumulative bandwidth for all media player Subscribe requests. An RTSP Subscribe request indicates the encoded rate of a clip or broadcast requested by the media player. For example: To receive a 512 Kbps encoding of a SureStream clip, a player sends a Subscribe request for the 512 Kbps stream. The returned value should be as high as possible. This monitor can return values greater than 100%. If the returned value is less than 100%, it may indicate that the server is not meeting the players stream requests. Nominal This monitor returns the percentage value that equals the total outgoing bandwidth divided by the delivery bandwidth that media players have requested using the RTSP SetDeliveryBandwidth directive. This directive indicates the rate at which the player wants to receive the stream, regardless of the streams encoded rate.
For example: Upon requesting a stream, a player may set an initial high delivery rate to fill its buffer quickly. The returned value should be as high as possible. This monitor can return values greater than 100%. If the returned value is less than 100%, it may indicate that the server is not meeting the players stream requests. Network Recent Statistic This component monitor returns miscellaneous network statistics. Returned values are as follows: Written_Packets This monitor returns the number of packets written to the network in this RSS period. Overload This monitor returns the number of packets that were late being scheduled. No_Buffer_Errors This monitor returns the number of ENOBUFS errors returned from UDP socket network write calls. An ENOBUFS error indicates that the output queue for a network interface was full. This generally means that the interface has stopped sending, which may be caused by transient congestion. A consistent, high number of these errors across many RSS periods indicate a consistently congested network. Other_UDP_Errors This monitor returns the number of general UDP write errors encountered. A consistent, high number of these errors may indicate technical problems with your network connection. Behind This monitor returns the number of packets that were written to the network late. These packets may or may not arrive too late to be of use to a media player. A large number of late packets may cause increased media player resend requests. Resend This monitor returns the number of packet resend requests made by media players that the server honored. Aggregated_Packets This monitor returns the number of aggregated packets written. Aggregated packets are packets from 200 to 1,350 bytes in size that the server writes when it determines that the large size is an efficient delivery means given the current server load and network state. Aggregating packets reduces CPU load and helps the server run more efficiently. As server load increases, the server tries to write more, and larger, aggregated packets. Packets are aggregated for streams using the UDP transport and the RealNetworks proprietary RDT packet format. Packets for streams using the TCP transport or the standards-based RTP format are not aggregated.
WouldBlocks This monitor returns the number of packet write attempts during this RSS interval that were blocked by the network (i.e. EWOULDBLOCK errors). When a write attempt is blocked, the server queues the blocked packet, attempting to deliver it later. In many cases, a successful delivery may occur within a few milliseconds of the blocked attempt, allowing the packet to reach the media player on time. A positive value for WouldBlocks typically reflects temporary network congestion. However, a consistently high number of blocked writes across several RSS periods may indicate persistent network problems. If you notice a frequent, high number for WouldBlocks, check for increases in the Behind and Resend values on the preceding lines of the RSS report to determine if the WouldBlocks events affected packet delivery. Accepts This monitor returns the number of incoming socket connections accepted since the last RSS interval. The number is typically close to the New players number, as most Accepts indicate a request from a new media player or another resource, such as a proxy or a transmitter. If the returned value is far greater than the New players number, this may indicate an external security issue, such as a denial-of-service attack. Mutex Collisions, Scheduler and Network Items This component monitor returns the statistic concerning Mutex Collisions, the activity of the servers internal Scheduler, and network items such as reads and writes. Returned values are as follows: Mutex_Collisions This monitor returns the average number of collisions per second, as measured across this RSS period. A Mutex collision occurs when one server process must wait for another process to release a lock on a shared server resource. Mutex collisions are normal, and the number to expect can vary greatly depending on server tasks and load, as well as the machine architecture. A consistently high number, such as 100,000 or more collisions per second, may indicate a server problem. CPU_Spinning This monitor returns a rough measure of Mutex collisions as related to average CPU usage. Ideally, this value should be near zero. A number greater than a fraction of a percent (such as 2.000%) indicates a great deal of Mutex contention. Memory_Ops This monitor returns the approximate percentage of Mutex collisions caused by non-mainlock locks. These are primarily memory-related locks, but also include registry locks and other types of locks. This value should be as low as possible. Scheduled_Items_With_Mutex This monitor returns the number of nonthreadsafe actions that were scheduled to occur at a specific time that were triggered. These items cause greater Mutex contention, as well as reduced scalability and performance relative to the Without Mutex items.
Scheduled_Items_Without_Mutex This monitor returns the number of threadsafe actions that were scheduled to occur at a specific time that were triggered. A higher value relative to the With Mutex value indicates better server performance. Network_Read_Items This monitor returns the number of reads to network sockets that were completed in this RSS interval. Network_Write_Items This monitor returns the number of writes to network sockets that were completed in this RSS interval. Miscellaneous Statistic This component monitor returns information about the internal server state. Returned values are as follows: File_Objects This monitor returns the number of internal file objects currently in use. When a server plug-in generates streaming packets for a clip, it opens one or more file objects. The number of open file objects may therefore be twice or more the number of connected media players. Idle_Streams This monitor returns the number of streams that are currently idle. (PPM refers to the servers standard packet delivery system.) Each stream using PPM periodically enters a state where it is ready to send more data to the player, but does not yet have any packets to send. That stream then goes idle, temporarily. Forced_Selects This monitor returns the number of times the server had to service a timer-triggered event without having data to read or write. Aggregation_Support This monitor returns the number of PPM streams that support packet aggregation. Total_Crash_Avoidances This monitor returns the total number of crash avoidances (CAs) since the last server restart. A CA occurs when the server uses fault-tolerance features to compensate for a problem. For example, if the server encounters corrupt packets in a media file, it attempts to compensate by dropping the corrupt packets and continuing the stream past the corruption point. If it can compensate without terminating the stream, it logs the event as a CA. A small number of CAs is to be expected, and does not indicate a significant problem. A consistently high number of CAs across several RSS periods may indicate serious system problems.
Current_Crash_Avoidances This monitor returns the number of crash avoidances (CAs) have occurred within the current, four-hour window. If it reaches 1,000, the server automatically restarts in an attempt to reset into a more stable state. A CA occurs when the server uses fault-tolerance features to compensate for a problem. For example, if the server encounters corrupt packets in a media file, it attempts to compensate by dropping the corrupt packets and continuing the stream past the corruption point. If it can compensate without terminating the stream, it logs the event as a CA. A small number of CAs is to be expected, and does not indicate a significant problem. A consistently high number of CAs across several RSS periods may indicate serious system problems. Net_Devices This monitor returns the number of network connections to the server, other than media player requests, at the time the RSS report was written. This number includes proxy accounting connections, as well as connections to other Helix Servers for content distribution, live stream splitting, and so on. Broadcast Reception Statistic This component monitor provides statistics about incoming broadcast streams. Returned values are as follows: Feeds This monitor returns the number of live feeds coming into the server from encoders or other Helix Server transmitters when the RSS report was written. Total_Bandwidth This monitor returns the total amount of bandwidth, in units defined by a script, coming into the server as live streams. Packets This monitor returns the total number of live stream packets arriving at the server during this RSS period. Lost This monitor returns the total number of packets lost in transit to this server during this RSS period. Lost_Upstream This monitor returns the number of live packets reported as lost by upstream transmitters. These packets were lost before the live stream was sent through the network to this receiver. Resends This monitor returns the total number of packet resends this receiver requested from encoders or upstream transmitters. The receiver requests a resend of a lost packet only if it determines the packet will arrive in time to be of use in its broadcast stream. In general, the lower the amount of receiver buffering, the fewer resends the receiver requests. Out_of_Order This monitor returns the total number of packets for live streams received out of order during this RSS interval.
Duplicate This monitor returns the total number of duplicate packets received for all live streams during this RSS interval. Late This monitor returns the total number of late packets for all live streams received during this RSS interval. The packets may or may not have been too late to be of use in the broadcast. Broadcast Distribution Statistic This component monitor provides statistics about streams being split to downstream receivers. This information applies only to downstream Helix Server receivers. Returned values are as follows: Feeds This monitor returns the total number of split feeds (both push and pull) being transmitted by this server when the RSS report was published. Push This monitor returns the total number of push-split feeds being transmitted by this server. With a push feed, the server sends the stream to a downstream receiver once the stream is available. Pull This monitor returns the total number of pull-split feeds being transmitted by this server. With a pull feed, the server does not send the stream to a downstream receiver until the receiver requests it. Data_Transmitted This monitor returns the amount of data transmitted by all feeds, in units defined by a script. Packets This monitor returns the total number of packets transmitted for the live feeds during this RSS interval. Resends This monitor returns the number of resend requests processed by this transmitter. The transmitter will not honor the resend request if the packet was lost upstream, or if it determines that the packet will arrive at the receiver too late to be of use. Requested this component returns the number of resends requested by downstream receivers. Lost_Upstream This monitor returns the number of live packets lost by upstream transmitters. A value greater than 0 is reported only if this server is not the origin transmitter for the stream. Dropped This monitor returns the number of packets dropped by this transmitter. This typically occurs if the packet arrives late from the encoder or upstream transmitter, and the server determines that the packet will subsequently arrive at downstream receivers too late to be of use.
Broadcast Core Statistic This component monitor provides statistics about streams being split to downstream receivers. This information applies only to downstream Helix Server receivers. Returned values are as follows: Dropped_Packets This monitor returns the number of live stream packets dropped in this RSS period by the broadcast core. These packets were queued for another process or thread, but were dropped when the queue for that process or thread overflowed. A significant number of dropped packets indicate a general system overload. Client_Overflows This monitor returns the number of live stream packets dropped in this RSS period because the outgoing connection to the receiving client was blocked. Although the server buffers packets to compensate for temporary blockages, it drops the packets if the network blockage does not clear quickly enough. Main Loop Iterations This component monitor provides statistics about streams being split to downstream receivers. This information applies only to downstream Helix Server receivers. Returned values are as follows: Main_Loop_Iterations This monitor returns the average number of loop iterations for all server processes per second during this RSS period. Load_State This monitor returns the servers current load state: 0Normal, 1High, 2Extreme. The server gauges its internal state using several measurements, including the number of packets written late to the network. During high load states, the server attempts to write large aggregate packets to conserve CPU usage. Process: rmserver This component monitor returns the CPU and memory usage of Real Helix Universal Media Server process (rmserver).
Helix Universal Media Server (Windows)

This template assesses the performance of the Real Helix Universal Media Server on Windows machines. It uses PowerShell scripts to get statistics from RSS log files and WMI process monitors for monitoring Universal Media Server process. Prerequisites: WinRM must be installed and properly configured on the target server. APM and Helix servers should be in the same domain. Credentials: Domain administrator credentials on the target server (WinRM requirement). Monitored Components: Note: You need to set thresholds for counters according to your environment. It is recommended to monitor counters for some length of time to understand potential value ranges and then set the thresholds accordingly. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Note: All PowerShell monitors retrieve statistical information from RSS log files which can be found here:
<Path_To_Helix_Folder> \Logs\rss\.
Each RSS configuration varies as to how many log files will be stored and how often this statistic will be updated. By default, the RSS interval is set to one minute in the following folder. (rmserver.cfg file, RSS Logging section) Before using this template, the correct arguments should be set to all PowerShell monitors. Following is an example using the arguments field:
C:\Program Files\Real\Helix Server\Logs\rss
The entire argument should be within in double brackets. The script in monitors automatically determine which log file is the most recent and will retrieve statistical information from it. CPU usage This component monitor returns the overall use of system processor time. For machines with up to 4 CPUs, these statistics provide an accurate guide to the server processing load. For machines with more processors, the number may fall short in representing the actual server load. Returned values are as follows: User This monitor returns the percentage of time used by the server itself, not counting operating system time and kernel time.
Kernel This monitor returns the percentage of time used by the operating system kernel on behalf of the server. System This monitor returns the total system CPU load, including CPU used by other applications. This includes both user and kernel time. Memory Statistic and Allocations This component monitor returns statistics about actual server memory usage, memory allocation according to the operating system, and allocated memory, in Kilobytes, divided by the number of currently connected media players at the time the RSS report was written. Returned values are as follows: Used This monitor returns the amount of memory, in units defined by a script, in use by the server when the RSS report was written. This may be less than the amount of application memory reported by the operating system. The difference represents memory that the server has reserved for use, but that is currently idle. Cache_Hit_Ratio This monitor returns the percentage of memory operations during this RSS period that were carried out using the s ervers memory cache. (This cache is internal to the server and unrelated to L1/L2 system memory cache.) Because these operations occur faster with less resource contention than non-cached memory functions, a higher percentage indicates greater server efficiency. Used_High_Watermark This monitor returns the high-water mark for the amount of memory used, in units defined by a script. This should be close to the amount of application memory in use as reported by the operating system. This number, which may have been reached in a preceding RSS period, never falls until the server is restarted. The maximum value is set by the -m command option. Pages This monitor returns the high-water mark for the amount of memory used, in pages. Memory_Mapped_IO This monitor returns the amount of memory, in units defined by a script, used for memory-mapped I/O when this report was written. This memory is not included in the application memory allocation. It is not limited by the -m option. Memory_Per_Player This monitor returns the allocated memory, in kB, divided by the number of currently connected media players. Keep in mind that this is only an average and the amount of memory allocated to each player can vary widely depending on the type of player and the type of media streamed.
Players statistic This component monitor returns general statistics about how many new players are connected or disconnected. Returned values are as follows: Total This monitor returns the total number of players connected when the RSS report was written. New This monitor returns the number of new player connections since the start of this RSS interval. Leaving This monitor returns the number of players disconnected since the start of this RSS interval. Players by Protocol This component monitor returns the percentage of media players using each of the supported control protocols in their streaming sessions. This breakdown includes the total number of players connected when the RSS report was generated. Returned values are as follows: RTSP This monitor returns the percentage of players connected through RTSP and RTSP cloaked as HTTP. RTMP This monitor returns the percentage of players connected through RTMP and RTMP cloaked as HTTP. MMS This monitor returns the percentage of players connected through MMS and MMS cloaked as HTTP. HTTP This monitor returns the percentage of players using HTTP as the control protocol. This does not include players using RTSP or MMS cloaked as HTTP. Players by Transport This component monitor returns the percentage of media players using each of the supported transports in their streaming sessions. This breakdown includes the total number of players that have connected since the start of this RSS interval. The total number of players connected in a scalable multicast is unknown during the broadcast. Players may report connection statistics to a Web server after the broadcast ends. Returned values are as follows: TCP This monitor returns the percentage of players receiving data by TCP. UDP This monitor returns the percentage of players receiving data by UDP. Multicast This monitor returns the percentage of players connected through a back-channel multicast.
HTTP Connections This component monitor returns the percentage of persistent, secure and cloaked, connections to the server. Returned values are as follows: Persistent This monitor returns the percentage of persistent HTTP connections. Secure This monitor returns the percentage of secure HTTP connections. Cloaked This monitor returns the percentage of cloaked HTTP connections. Bandwidth Statistic This component monitor provides a guide to how well the server fulfills the requirements for streaming rates of requested media. These statistics can help you determine if the servers outgoing bandwidth is sufficient to meet your streaming media needs. Returned values are as follows: Output This monitor returns the average amount of bandwidth, in units defined by a script, that the server delivered to the network over the RSS period. Bandwidth_Per_Player This monitor returns the average amount of bandwidth per media player during the RSS period, in units defined by a script. This is equal to the Output value divided by the number of players connected when the RSS report was written. Subscribed This monitor returns the percentage value that indicates the total output bandwidth divided by the cumulative bandwidth for all media player Subscribe requests. An RTSP Subscribe request indicates the encoded rate of a clip or broadcast requested by the media player. For example: To receive a 512 Kbps encoding of a SureStream clip, a player sends a Subscribe request for the 512 Kbps stream. The returned value should be as high as possible. This monitor can return values greater than 100%. If the returned value is less than 100%, it may indicate that the server is not meeting the players stream requests. Nominal This monitor returns the percentage value that equals the total outgoing bandwidth divided by the delivery bandwidth that media players have requested using the RTSP SetDeliveryBandwidth directive. This directive indicates the rate at which the player wants to receive the stream, regardless of the streams encoded rate.
For example: Upon requesting a stream, a player may set an initial high delivery rate to fill its buffer quickly. The returned value should be as high as possible. This monitor can return values greater than 100%. If the returned value is less than 100%, it may indicate that the server is not meeting the players stream requests. Network Recent Statistic This component monitor returns miscellaneous network statistics. Returned values are as follows: Written_Packets This monitor returns the number of packets written to the network in this RSS period. Overload This monitor returns the number of packets that were late being scheduled. No_Buffer_Errors This monitor returns the number of ENOBUFS errors returned from UDP socket network write calls. An ENOBUFS error indicates that the output queue for a network interface was full. This generally means that the interface has stopped sending, which may be caused by transient congestion. A consistent, high number of these errors across many RSS periods indicate a consistently congested network. Other_UDP_Errors This monitor returns the number of general UDP write errors encountered. A consistent, high number of these errors may indicate technical problems with your network connection. Behind This monitor returns the number of packets that were written to the network late. These packets may or may not arrive too late to be of use to a media player. A large number of late packets may cause increased media player resend requests. Resend This monitor returns the number of packet resend requests made by media players that the server honored. Aggregated_Packets This monitor returns the number of aggregated packets written. Aggregated packets are packets from 200 to 1,350 bytes in size that the server writes when it determines that the large size is an efficient delivery means given the current server load and network state. Aggregating packets reduces CPU load and helps the server run more efficiently. As server load increases, the server tries to write more, and larger, aggregated packets. Packets are aggregated for streams using the UDP transport and the RealNetworks proprietary RDT packet format. Packets for streams using the TCP transport or the standards-based RTP format are not aggregated.
WouldBlocks This monitor returns the number of packet write attempts during this RSS interval that were blocked by the network (i.e. EWOULDBLOCK errors). When a write attempt is blocked, the server queues the blocked packet, attempting to deliver it later. In many cases, a successful delivery may occur within a few milliseconds of the blocked attempt, allowing the packet to reach the media player on time. A positive value for WouldBlocks typically reflects temporary network congestion. However, a consistently high number of blocked writes across several RSS periods may indicate persistent network problems. If you notice a frequent, high number for WouldBlocks, check for increases in the Behind and Resend values on the preceding lines of the RSS report to determine if the WouldBlocks events affected packet delivery. Accepts This monitor returns the number of incoming socket connections accepted since the last RSS interval. The number is typically close to the New players number, as most Accepts indicate a request from a new media player or another resource, such as a proxy or a transmitter. If the returned value is far greater than the New players number, this may indicate an external security issue, such as a denial-of-service attack. Mutex Collisions, Scheduler and Network Items This component monitor returns the statistic concerning Mutex Collisions, the activity of the servers internal Scheduler, and network items such as reads and writes. Returned values are as follows: Mutex_Collisions This monitor returns the average number of collisions per second, as measured across this RSS period. A Mutex collision occurs when one server process must wait for another process to release a lock on a shared server resource. Mutex collisions are normal, and the number to expect can vary greatly depending on server tasks and load, as well as the machine architecture. A consistently high number, such as 100,000 or more collisions per second, may indicate a server problem. CPU_Spinning This monitor returns a rough measure of Mutex collisions as related to average CPU usage. Ideally, this value should be near zero. A number greater than a fraction of a percent (such as 2.000%) indicates a great deal of Mutex contention. Memory_Ops This monitor returns the approximate percentage of Mutex collisions caused by non-mainlock locks. These are primarily memory-related locks, but also include registry locks and other types of locks. This value should be as low as possible. Scheduled_Items_With_Mutex This monitor returns the number of nonthreadsafe actions that were scheduled to occur at a specific time that were triggered. These items cause greater Mutex contention, as well as reduced scalability and performance relative to the Without Mutex items.
Scheduled_Items_Without_Mutex This monitor returns the number of threadsafe actions that were scheduled to occur at a specific time that were triggered. A higher value relative to the With Mutex value indicates better server performance. Network_Read_Items This monitor returns the number of reads to network sockets that were completed in this RSS interval. Network_Write_Items This monitor returns the number of writes to network sockets that were completed in this RSS interval. Miscellaneous Statistic This component monitor returns information about the internal server state. Returned values are as follows: File_Objects This monitor returns the number of internal file objects currently in use. When a server plug-in generates streaming packets for a clip, it opens one or more file objects. The number of open file objects may therefore be twice or more the number of connected media players. Idle_Streams This monitor returns the number of streams that are currently idle. (PPM refers to the servers standard packet delivery system.) Each stream using PPM periodically enters a state where it is ready to send more data to the player, but does not yet have any packets to send. That stream then goes idle, temporarily. Forced_Selects This monitor returns the number of times the server had to service a timer-triggered event without having data to read or write. Aggregation_Support This monitor returns the number of PPM streams that support packet aggregation. Total_Crash_Avoidances This monitor returns the total number of crash avoidances (CAs) since the last server restart. A CA occurs when the server uses fault-tolerance features to compensate for a problem. For example, if the server encounters corrupt packets in a media file, it attempts to compensate by dropping the corrupt packets and continuing the stream past the corruption point. If it can compensate without terminating the stream, it logs the event as a CA. A small number of CAs is to be expected, and does not indicate a significant problem. A consistently high number of CAs across several RSS periods may indicate serious system problems.
Current_Crash_Avoidances This monitor returns the number of crash avoidances (CAs) have occurred within the current, four-hour window. If it reaches 1,000, the server automatically restarts in an attempt to reset into a more stable state. A CA occurs when the server uses fault-tolerance features to compensate for a problem. For example, if the server encounters corrupt packets in a media file, it attempts to compensate by dropping the corrupt packets and continuing the stream past the corruption point. If it can compensate without terminating the stream, it logs the event as a CA. A small number of CAs is to be expected, and does not indicate a significant problem. A consistently high number of CAs across several RSS periods may indicate serious system problems. Net_Devices This monitor returns the number of network connections to the server, other than media player requests, at the time the RSS report was written. This number includes proxy accounting connections, as well as connections to other Helix Servers for content distribution, live stream splitting, and so on. Broadcast Reception Statistic This component monitor provides statistics about incoming broadcast streams. Returned values are as follows: Feeds This monitor returns the number of live feeds coming into the server from encoders or other Helix Server transmitters when the RSS report was written. Total_Bandwidth This monitor returns the total amount of bandwidth, in units defined by a script, coming into the server as live streams. Packets This monitor returns the total number of live stream packets arriving at the server during this RSS period. Lost This monitor returns the total number of packets lost in transit to this server during this RSS period. Lost_Upstream This monitor returns the number of live packets reported as lost by upstream transmitters. These packets were lost before the live stream was sent through the network to this receiver. Resends This monitor returns the total number of packet resends this receiver requested from encoders or upstream transmitters. The receiver requests a resend of a lost packet only if it determines the packet will arrive in time to be of use in its broadcast stream. In general, the lower the amount of receiver buffering, the fewer resends the receiver requests. Out_of_Order This monitor returns the total number of packets for live streams received out of order during this RSS interval.
Duplicate This monitor returns the total number of duplicate packets received for all live streams during this RSS interval. Late This monitor returns the total number of late packets for all live streams received during this RSS interval. The packets may or may not have been too late to be of use in the broadcast. Broadcast Distribution Statistic This component monitor provides statistics about streams being split to downstream receivers. This information applies only to downstream Helix Server receivers. Returned values are as follows: Feeds This monitor returns the total number of split feeds (both push and pull) being transmitted by this server when the RSS report was published. Push This monitor returns the total number of push-split feeds being transmitted by this server. With a push feed, the server sends the stream to a downstream receiver once the stream is available. Pull This monitor returns the total number of pull-split feeds being transmitted by this server. With a pull feed, the server does not send the stream to a downstream receiver until the receiver requests it. Data_Transmitted This monitor returns the amount of data transmitted by all feeds, in units defined by a script. Packets This monitor returns the total number of packets transmitted for the live feeds during this RSS interval. Resends This monitor returns the number of resend requests processed by this transmitter. The transmitter will not honor the resend request if the packet was lost upstream, or if it determines that the packet will arrive at the receiver too late to be of use. Requested this component returns the number of resends requested by downstream receivers. Lost_Upstream This monitor returns the number of live packets lost by upstream transmitters. A value greater than 0 is reported only if this server is not the origin transmitter for the stream. Dropped This monitor returns the number of packets dropped by this transmitter. This typically occurs if the packet arrives late from the encoder or upstream transmitter, and the server determines that the packet will subsequently arrive at downstream receivers too late to be of use.
Broadcast Core Statistic This component monitor provides statistics about streams being split to downstream receivers. This information applies only to downstream Helix Server receivers. Returned values are as follows: Dropped_Packets This monitor returns the number of live stream packets dropped in this RSS period by the broadcast core. These packets were queued for another process or thread, but were dropped when the queue for that process or thread overflowed. A significant number of dropped packets indicate a general system overload. Client_Overflows This monitor returns the number of live stream packets dropped in this RSS period because the outgoing connection to the receiving client was blocked. Although the server buffers packets to compensate for temporary blockages, it drops the packets if the network blockage does not clear quickly enough. Main Loop Iterations This component monitor provides statistics about streams being split to downstream receivers. This information applies only to downstream Helix Server receivers. Returned values are as follows: Main_Loop_Iterations This monitor returns the average number of loop iterations for all server processes per second during this RSS period. Load_State This monitor returns the servers current load state: 0Normal, 1High, 2Extreme. The server gauges its internal state using several measurements, including the number of packets written late to the network. During high load states, the server attempts to write large aggregate packets to conserve CPU usage. Process: rmserver This component monitor returns the CPU and memory usage of Real Helix Universal Media Server process (rmserver).
HTTP
This template tests the ability of a web server to respond to HTTP requests. Prerequisites: None. Credentials: None. Monitored Components HTTP Monitor
HTTP Form Login

This template tests the ability of a web server to serve web pages secured behind a forms-based login page. Prerequisites: None. Credentials: A valid user name and password for the forms-based login page. Monitored Components Form Login Monitor
IBM DB2
This template assesses the performance of an IBM DB2 database by retrieving performance data from the built-in SYSIBMADM tables. Prerequisites: IBM DB2 9.7 installed on the target server. IBM DB2 ODBC Driver (The driver can be found on the IBM DB2 installation media). You should also have access to SYSIBMADM tables. Execute the following commands in the Command Editor before using this template:
UPDATE DBM CFG USING DFT_MON_BUFPOOL ON UPDATE DBM CFG USING DFT_MON_LOCK ON UPDATE DBM CFG USING DFT_MON_STMT ON UPDATE DBM CFG USING DFT_MON_UOW on grant execute on function SYSPROC.MON_GET_TABLE to username
where username is the user that will be used in SAM for monitoring IBM DB2. After these commands have been executed, restart the database server. Credentials: Database user name and password. Monitored Components Components without predetermined threshold values provide guidance such as "Use the lowest threshold possible" or "Use the highest threshold possible" to help you find a threshold appropriate for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Database Used Space (MB) This component monitor returns the used space, in MB, of the current database. Note: By default, this monitor returns a value for the database named, SAMPLE. To change the database, find the following parameter in the ODBC driver string and replace SAMPLE with your database name:
Database=SAMPLE;
Log File Used Space in Specified Database (MB) This component monitor returns the used space, in MB, of the log file in the specified database.
Note: By default, this monitor returns a value for the database named, SAMPLE. To change the database, replace SAMPLE with your database name in the following SQL query:
WHERE DB_NAME = 'SAMPLE'
Log File Free Space in Specified Database (MB) This component monitor returns the free space, in MB, of the log file in the specified database. Note: By default, this monitor returns the value for the database named, SAMPLE. To change the database, replace SAMPLE with your database name in the following SQL query:
Average Buffer Total Hit Ratio (%) This component monitor returns the average Total Hit Ratio (index, XDA, and data reads) for all buffers. To see the Hit Ratio for all buffers, you should manually execute the following SQL command:
SELECT * FROM SYSIBMADM.BP_HITRATIO
If you want to see the Hit Ratio for a specific buffer, you can use the following SQL construction:
SELECT REAL(AVG(TOTAL_HIT_RATIO_PERCENT)) FROM SYSIBMADM.BP_HITRATIO WHERE BP_NAME = 'IBMDEFAULTBP'
The returned value should be as high as possible. Average Data Hit Ratio (%) This component monitor returns the average Data Hit Ratio for all buffers. To see the Hit Ratio for all buffers, you should manually execute the following SQL command:
SELECT REAL(AVG(DATA_HIT_RATIO_PERCENT)) FROM SYSIBMADM.BP_HITRATIO WHERE BP_NAME = 'IBMDEFAULTBP'
The returned value should be as high as possible.

Average Index Hit Ratio (%) This component monitor returns the average Index Hit Ratio for all buffers. To see the Hit Ratio for all buffers, you should manually execute the following SQL command:
SELECT REAL(AVG(INDEX_HIT_RATIO_PERCENT)) FROM SYSIBMADM.BP_HITRATIO WHERE BP_NAME = 'IBMDEFAULTBP'
The returned vale should be as high as possible. Number of Locks Held in Specified Database This component monitor returns the number of Locks currently held in the specified database. Note: By default, this monitor returns the value for the database named, SAMPLE. To change the database, replace SAMPLE with your database name in the following SQL query:
The returned value should be as low as possible. Average Read Time (ms) This component monitor returns the average read time from the database in milliseconds. The returned value should be as low as possible. Connected applications to Specified Database This component monitor returns the number of connected applications to the specified database. Note: By default, this monitor returns the value for the database named, SAMPLE. To change the database, replace SAMPLE with your database name in the following SQL query:
Number of Long Running Queries This component monitor returns the number of Long Running Queries. You should set the threshold according to your environment.
Number of Table Scans This component monitor returns the number of table scans currently in progress in the specified database. Table with the Biggest Table Scans Value This component monitor returns the table name with the Biggest Value of Table Scans and the value itself. Used Space of the Biggest Table (MB) This component monitor returns the name of the Biggest Table and its size, in MB.
IBM Informix
This template assesses the performance of an IBM Informix database by retrieving performance data from the built-in system monitoring interface (SMI) tables located in the sysmaster database. Prerequisites: IBM Informix 11.70 installed on the target server. IBM Informix ODBC driver installed on the SAM server (The driver can be found in the IBM Informix Client SDK on the IBM site). Your database should be accessible by using the olsoctcp protocol. By default, all components use the following ODBC connection string:
Driver={IBM INFORMIX ODBC DRIVER};Host=${IP};Server=ol_informix1170;Service=ol_informix1170; Protocol=olsoctcp;Database=sysmaster;Uid=${USER};Pwd=${PASSWORD};
Adjust this string to suit your environment by updating the Server and Service fields. For IBM Informix installed on Windows: 1. Execute the following commands on the IBM Informix server before using this template. These commands will create all the necessary stored procedures for monitoring your IBM Informix server from SAM:
--Page Reads /sec CREATE PROCEDURE APM_P_READS () RETURNING DECIMAL(8,2); DEFINE x,y,res DECIMAL(8,2); SELECT value INTO x FROM sysprofile WHERE name = 'pagreads'; SYSTEM "timeout 10"; SELECT value INTO y FROM sysprofile WHERE name = 'pagreads'; LET res = (y - x) / 10; RETURN res; END PROCEDURE; --Page Writes /sec CREATE PROCEDURE APM_P_WRITES () RETURNING DECIMAL(8,2); DEFINE x,y,res DECIMAL(8,2); SELECT value INTO x FROM sysprofile WHERE name = 'pagwrites';
SYSTEM "timeout 10"; SELECT value INTO y FROM sysprofile WHERE name = 'pagwrites'; LET res = (y - x) / 10; RETURN res; END PROCEDURE; --Committed Transactions /sec CREATE PROCEDURE APM_TR_COM () RETURNING DECIMAL(8,2); DEFINE x,y,res DECIMAL(8,2); SELECT value INTO x FROM sysprofile WHERE name = 'iscommits'; SYSTEM "timeout 10"; SELECT value INTO y FROM sysprofile WHERE name = 'iscommits'; LET res = (y - x) / 10; RETURN res; END PROCEDURE; --Rolled back Transactions /sec CREATE PROCEDURE APM_TR_ROL () RETURNING DECIMAL(8,2); DEFINE x,y,res DECIMAL(8,2); SELECT value INTO x FROM sysprofile WHERE name = 'isrollbacks'; SYSTEM "timeout 10"; SELECT value INTO y FROM sysprofile WHERE name = 'isrollbacks'; LET res = (y - x) / 10; RETURN res; END PROCEDURE; --Latch Request Waits /sec CREATE PROCEDURE APM_LATCH_WAIT () RETURNING DECIMAL(8,2); DEFINE x,y,res DECIMAL(8,2); SELECT value INTO x FROM sysprofile WHERE name = 'latchwts'; SYSTEM "timeout 10"; SELECT value INTO y FROM sysprofile WHERE name = 'latchwts'; LET res = (y - x) / 10; RETURN res; END PROCEDURE; --Lock Requests /sec CREATE PROCEDURE APM_L_REQ () RETURNING DECIMAL(8,2);
DEFINE x,y,res DECIMAL(8,2); SELECT value INTO x FROM sysprofile WHERE name = 'lockreqs'; SYSTEM "timeout 10"; SELECT value INTO y FROM sysprofile WHERE name = 'lockreqs'; LET res = (y - x) / 10; RETURN res; END PROCEDURE; --Lock Waits /sec CREATE PROCEDURE APM_L_WAIT () RETURNING DECIMAL(8,2); DEFINE x,y,res DECIMAL(8,2); SELECT value INTO x FROM sysprofile WHERE name = 'lockwts'; SYSTEM "timeout 10"; SELECT value INTO y FROM sysprofile WHERE name = 'lockwts'; LET res = (y - x) / 10; RETURN res; END PROCEDURE; --Deadlocks /sec CREATE PROCEDURE APM_DEADL () RETURNING DECIMAL(8,2); DEFINE x,y,res DECIMAL(8,2); SELECT value INTO x FROM sysprofile WHERE name = 'deadlks'; SYSTEM "timeout 10"; SELECT value INTO y FROM sysprofile WHERE name = 'deadlks'; LET res = (y - x) / 10; RETURN res; END PROCEDURE; --Sequential Scans /sec CREATE PROCEDURE APM_SEQ_S () RETURNING DECIMAL(8,2); DEFINE x,y,res DECIMAL(8,2); SELECT value INTO x FROM sysprofile WHERE name = 'seqscans'; SYSTEM "timeout 10"; SELECT value INTO y FROM sysprofile WHERE name = 'seqscans'; LET res = (y - x) / 10; RETURN res; END PROCEDURE; --Sorts /sec CREATE PROCEDURE APM_SORTS () RETURNING DECIMAL(8,2); DEFINE x,y,res DECIMAL(8,2);
SELECT value INTO x FROM sysprofile WHERE name = 'totalsorts'; SYSTEM "timeout 10"; SELECT value INTO y FROM sysprofile WHERE name = 'totalsorts'; LET res = (y - x) / 10; RETURN res; END PROCEDURE; --Number of Network Connections /sec CREATE PROCEDURE APM_CONNECT () RETURNING DECIMAL(8,2); DEFINE x,y,res DECIMAL(8,2); SELECT ng_connects INTO x FROM sysnetglobal; SYSTEM "timeout 10"; SELECT ng_connects INTO y FROM sysnetglobal; LET res = (y - x) / 10; RETURN res; END PROCEDURE;
2. On the IBM Informix server, open the setnet32 utility found in the IBM Informix folder. Select the Host Information tab and add the following: Current Host: APM-server User Name: your_username (e.g.: Informix) Password Option: Password Password: username_password 3. Open C:\Windows\System32\drivers\etc\services and add the following line:
ol_informix1170 1526/tcp #INFORMIX
where service_name is name of your Informix instance (e.g.: ol_informix1170).
4. Add a firewall exception for TCP port 1526.
For IBM Informix installed on Linux: 1. Execute the same SQL commands as in the previous section; however, you should correct the following string in all procedures. Change the string from: SYSTEM "timeout 10"; to: SYSTEM "sleep
10";
2. Open the /etc/sqlhosts file and add the following line:

Dbservername Protocol APM-server Service_name
where: Dbservername is the database name; Protocol is the protocol used to connect to the database (put olsoctcp); APM-server is the hostname of your SAM server; Service_name is the name of your Informix instance. For example:
ol_informix1170 olsoctcp myAPM ol_informix1170
3. Open the /etc/services file and add the following line:

service_name 1526/tcp #INFORMIX
where service_name is the name of your Informix instance (e.g.: ol_informix1170). 4. Add a firewall exception for TCP port 1526. Credentials: Database user name and password.
Monitored Components Components without predetermined threshold values provide guidance such as "Use the lowest threshold possible" or "Use the highest threshold possible" to help you find a threshold appropriate for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Read Cache Hit % This monitor returns the percentage of the read cache rate. The read and write cache rates can vary dramatically depending upon the applications and the type and size of the data being operated on. In general, both the read cache rate and write cache rate should be in the 80 to 90th percentile. If these rates are consistently lower than 80%, you should consider increasing the value of the Buffers parameter in your Informix configuration file to achieve higher read and write cache rates. Low read and write cache rates indicate IDS is doing a lot more disk reads and writes than it should, which will greatly slow down overall database engine performance. Write Cache Hit % This monitor returns the percentage of write cache rate. The read and write cache rates can vary dramatically depending upon the applications and the type and size of the data being operated on. In general, both the read cache rate and write cache rate should be in the 80 to 90th percentile. If these rates are consistently lower than 80%, you should consider increasing the value of the Buffers parameter in your Informix configuration file to achieve higher read and write cache rates. Low read and write cache rates indicate IDS is doing a lot more disk reads and writes than it should, which will greatly slow down overall database engine performance. Page Reads /sec This monitor returns the number of physical database page reads issued. This value should be as low as possible. Higher values may indicate indexing or memory constraints. Page Writes /sec This monitor returns the number of physical database page writes issued. This value should be as low as possible. Higher values may indicate indexing or memory constraints. Committed Transactions /sec This monitor returns the number of committed transactions, per second. Rolled Back Transactions /sec This monitor returns the number of rolled back transactions, per second.
Latch Request Waits /sec A latch was the first method that was used in Informix products to protect shared memory resources from being accessed by multiple users at one time. This monitor returns the number of events, per second, when a thread had to wait for a latch. Buffer Waits Ratio This monitor returns the buffer waits ratio using the following formula: BR = (bufwaits/(pagreads + bufwrits)) * 100. If this value is below seven, everything is considered fine. If this value is between seven and ten, you can expect some sluggishness in response times. If this value is greater than ten, it is likely that system responses are very slow. Suggested resolutions: 1. Increase the value of the Buffers parameter if the number of unused buffers is zero, and/or if viewing onstat -P over time, you see a small number of partnums trading large percentages of the buffer cache back and forth. 2. Increase the value of the LRUS and Cleaners parameters significantly. (The Cleaners parameter should always be greater than or equal to the value of the LRUS parameter for the best LRU flush performance. Note: Avoid 32 and 64. A known bug may still remain with Informix that causes very poor LRU contention at those values. Lock Requests /sec A lock is used to reserve access to a database object. This monitor returns the rate of events, per second, that sessions requested a lock. Lock Waits /sec A lock is used to reserve access to a database object. This monitor returns the rate of events, per second, when sessions had to wait for a lock. Deadlocks /sec A deadlock occurs when two users hold locks and each user wants to acquire a lock that the other user owns. Informix uses the lock table to detect deadlocks automatically and stop them before they occur. This monitor returns the deadlocks rate, per second. This value should be as low as possible.
Sequential Scans /sec This monitor returns the sequential scans rate, per second. This value should be as low as possible. If the value of this monitor is constantly high and continues to increase, it may indicate some performance problems, especially if your system is in an OLTP environment. You should investigate further to determine the root cause of excessive sequential scans. Sequential access to a table is sometimes harmful to performance since the database engine needs to scan the entre table to pick up the rows that satisfy the query's conditions. Note: If tables are small, say a couple of hundred rows, this is acceptable because the database engine initially scans tables that will reside in memory. The next time the database engine scans, all of the data in that table can be retrieved directly from memory. This is actually an efficient way of using sequential scans. However, if the tables are large, say tables with more than 100,000 rows, repeated sequential scans are deadly to performance. If you have tables with a large number of sequential scans, it is recommended that you add indexes to this table or use program directives to force the internal query optimizer to choose indexes for accessing data in this table, rather than sequential scans. Sorts /sec This monitor returns the sorts rate, per second. Number of Databases This monitor returns the number of databases presented in this instance. Number of DBspaces This monitor returns the number of database spaces presented in this instance. Number of Network Connections /sec This monitor returns the cutwork connections rate, per second. Locks Overflow This monitor returns the number of times IDS attempted to exceed the maximum number of locks. If this number is non-zero, you may need to increase the value of the Locks parameter in the configuration file.
Datadbs available space (MB) This monitor returns the available space, in MB, for database space datadbs. This value should be as high as possible. You can change which dbspace to monitor by correcting the name in this line of your SQL query:
and name = 'datadbs'
IMAP4 Round Trip Email

This template simulates an email round trip to test the ability of your SMTP server to receive and distribute email, and the ability of your users to retrieve messages from IMAP4-enabled email clients. Prerequisites: None. Credentials: Windows credential valid on both the SolarWinds SAM server and the Microsoft Exchange server. Monitored Components IMAP 4 User Experience Monitor
Internet Information Services and Counters (IIS)

This template assesses the status and overall performance of a Microsoft Internet Information Services (IIS) server. The critical threshold values for the performance counters are those recommended by Microsoft. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on the target server. This template is based on the following information: http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/3ff d9ede-2bc8-4bdc-871e-9d937f25d6c9.mspx?mfr=true http://www.tech-faq.com/iis-performance-monitoring-and-tuning.html Monitored Components Note: You need to set thresholds for counters according to your environment. It is recommended to monitor counters for some period of time to understand potential value ranges and then set the thresholds accordingly. Service: World Wide Web Publishing Provides Web connectivity and administration through the Internet Information Services Manager. HTTP Port Monitor Check the availability of standard http port (default is port 80). Note: You need change the port value if you are using another port. URI Cache Flushes Counter The number of URI cache flushes that have occurred since the server started. URI Cache Hits Counter The number of successful lookups in the URI cache. URI Cache Hits Percent Counter The ratio of URI Cache Hits to the total number of cache requests. URI Cache Misses Counter The number of unsuccessful lookups in the URI cache.
Web service: Bytes Received/sec Counter Rate at which data bytes are received by the WWW service, per second. Note: If World Wide Web Publishing Service is stopped, ignore this counter. Web service: Bytes Sent/sec Counter Rate that data bytes are sent by the WWW service, per second. Note: If World Wide Web Publishing Service is stopped, ignore this counter. Web service: Bytes Total/sec Counter Sum of bytes sent/sec and bytes received/sec. Note: If World Wide Web Publishing Service is stopped, ignore this counter. Web service: Connection Attempts/sec Counter Rate of attempted connections to the WWW service since service startup, per second. Note: If World Wide Web Publishing Service is stopped, ignore this counter. Web service: Current Connections Counter Current number of active connections to the WWW service. Note: If World Wide Web Publishing Service is stopped, ignore this counter. Web service: Get Requests/sec Counter Rate at which HTTP requests using the GET method are made to the WWW service, per second. Note: If World Wide Web Publishing Service is stopped, ignore this counter. System: System Calls/sec This counter is a measure of the number of calls made to the system components, Kernel mode services. This is a measure of how busy the system is taking care of applications and services. As low as possible. Note: For information about setting the counter as low as possible, see the following KB article Using the Orion APM MIN/MAX Average Statistic Data historical charts for creating threshold settings based on 95th percentile line at: http://knowledgebase.solarwinds.com/kb/questions/2415.
IRC Port Monitor

This template tests the ability of an IRC server to accept incoming sessions on port 6667. Prerequisites: None. Credentials: None. Monitored Components IRC Port Monitor
ISC DHCP Server (Linux)

This template assesses the performance of the ISC DHCP service on Linux machines. It uses Perl script and an SNMP process monitor for monitoring the performance of queries. Prerequisites: SSH and Perl installed on the target server. SNMP installed on the target server and permission to monitor dhcpd processes. If Perl is installed in a location different from /usr/bin/perl, you should correct all components in the first line of the Script Body field (#!/usr/bin/perl), or you can create a symbolic link to Perl (refer to your documentation for the ln command). You can find where Perl is installed by using the following command: which
perl
Credentials: Root credentials on the target server. Note: Tested on CentOS 5.5 and ISC DHCP 3.0.5 version. Monitored Components: Note: You need to set thresholds for counters according to your environment. It is recommended to monitor counters for some length of time to understand potential value ranges and then set the thresholds accordingly. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Queries Rate per Sec This monitor returns the rates per second of different queries. All rates are calculated as the number of specific queries for 20 seconds and then divided by 20. Information about DHCP queries are taken from the /var/log/messages file. It is possible that scripts will return non-integer values. Returned values are as follows: Discovery This component returns the number of queries, which the client broadcasts to locate available servers. Offer This component returns the number of DHCP server responses to Discovery queries offering, with configuration information. Request This component returns the number of clients responses to the server Offer packets, containing the following: Requesting offered parameters from one server and implicitly declining offers from all others;
Confirming correctness of previously allocated address after, (e.g., system reboot); Extending the lease on a particular network address.
Ack This component returns the server's response to the client Request queries containing configuration parameters, including committed network address. Nak This component returns the server's response to the client Request queries indicating the client's notion of the network address is incorrect (e.g., client has moved to new subnet) or client's lease has expired. Decline This component returns the number of clients queries indicating network address is already in use. Release This component returns the number of clients queries relinquishing network address and cancelling the remaining lease. Inform This component returns the number of clients queries where the client is asking only for local configuration parameters (client already has externally configured network address). SNMP Process Monitor: Dhcpd This component returns CPU and memory usage of the Dhcpd daemon. If this counter is unavailable, there may be problems with SNMP configuration or the Dhcpd service has stopped.
Java Application Server (SNMP)

This template assesses the overall performance of Java Application Servers by using SNMP protocol. The following application servers are supported: Apache Tomcat, JBoss, GlassFish, IBM WebSphere and Oracle WebLogic. Prerequisites: SNMP enabled on the operating system. Target JVM configured to allow SNMP queries. For more information, see Configuring Java Virtual Machines for SNMP" on page 668. Note: This template is configured to send SNMP requests on port 1161. Credentials: None (uses the SNMP public string assigned to the node). Monitored Components Some components may not have preset warning or critical threshold values. You can add your own threshold limits as necessary. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Classes Loaded Count Indicates the number of classes currently loaded in the JVM. For more information, reference the following Java method:
java.lang.management.ClassLoadingMXBean.getLoadedClassCount()
Classes Total Loaded Count Indicates the number of classes that have been loaded since the JVM was started. For more information, reference the following Java methods:
java.lang.management.ClassLoadingMXBean getTotalLoadedClassCount()
Classes Unloaded Count Indicates the number of classes that have been unloaded since the JVM was started. For more information, reference the following Java method:
java.lang.management.ClassLoadingMXBean.getUnloadedClassCount()
Memory Pending Final Count The approximate number of objects that are pending finalization. This should be as low as possible.
For more information, reference the following Java methods:

java.lang.management.MemoryMXBean. getObjectPendingFinalizationCount()
Memory Heap Init Size (B) The amount of memory (in bytes) that the JVM initially requests from the operating system for memory management used for heap memory pools. For more information, reference the following Java method:
java.lang.management.MemoryMXBean.getHeapMemoryUsage() getInit()
Memory Heap Used (B) The amount of used memory (in bytes) from heap memory pools. This should be as low as possible. For more information, reference the following Java method:
java.lang.management.MemoryMXBean.getHeapMemoryUsage() getUsed()
Memory Heap Committed (B) The amount of memory (in bytes) committed by heap memory pools. For more information, reference the following Java methods:
java.lang.management.MemoryMXBean.getHeapMemoryUsage(). getCommitted()
Memory Heap Max Size (B) The maximum amount of memory (in bytes) for all heap memory pools. For more information, reference the following Java method:
java.lang.management.MemoryMXBean.getHeapMemoryUsage() getMax()
Memory Non-heap Init Size (B) The amount of memory (in bytes) that the JVM initially requests from the operating system for memory management for non-heap memory pools. For more information, reference the following Java method:
java.lang.management.MemoryMXBean.getNonHeapMemoryUsage() getInit()
Memory Non-heap Used (B) The amount of used memory (in bytes) from non-heap memory pools. This should be as low as possible. For more information, reference the following Java method:
java.lang.management.MemoryMXBean.getNonHeapMemoryUsage() getUsed()
Memory Non-heap Committed (B) The amount of memory (in bytes) committed by non-heap memory pools. For more information, reference the following Java methods:
java.lang.management.MemoryMXBean. getNonHeapMemoryUsage() getCommitted()
Memory Non-heap Max Size (B) The maximum size of memory (in bytes) for all non-heap memory pools. For more information, reference the following Java method:
java.lang.management.MemoryMXBean.getNonHeapMemoryUsage() getMax()
Memory Garbage Collections Count The number of collections that have occurred, as returned by
GarbageCollectorMXBean.getCollectionCount()
If garbage collection statistics are not available, this object is set to 0. For more information, reference the following Java method:
java.lang.management.GarbageCollectorMXBean.getCollectionCount( )
Memory Garbage Collection Time (ms) The approximate accumulated collection elapsed time (in milliseconds) since the Java virtual machine has started. This object is set to 0 if the collection elapsed time is undefined for this collector. For more information, reference the following Java method:
java.lang.management.GarbageCollectorMXBean.getCollectionTime()
Memory Pool Init Size (B) The initial size of the memory pool. This counter shows statistics for the first memory pool. If another pool needs monitoring, change the last digit of the OID. For more information, reference the following Java method:
java.lang.management.MemoryPoolMXBean.getUsage() getInit()
Memory Pool Used (B) The amount of used memory in the memory pool. This counter shows statistics for the first memory pool. If another pool needs monitoring, change the last digit of the OID. This should be as low as possible. For more information, reference the following Java method:
java.lang.management.MemoryPoolMXBean.getUsage() getUsed()
Memory Pool Committed (B) The amount of committed memory in the memory pool. This counter shows statistics for the first memory pool. If another pool needs monitoring, change the last digit of the OID. For more information, reference the following Java method:
java.lang.management.MemoryPoolMXBean.getUsage() getCommitted()
Memory Pool Max Size (B) The maximum size of the memory pool. This counter shows statistics for the first memory pool. If another pool needs monitoring, change the last digit of the OID. For more information, reference the following Java method:
java.lang.management.MemoryPoolMXBean.getUsage() getMax()
Memory Pool Peak Used (B) The amount of used memory in the memory pool at the peak usage point. This counter shows statistics for the first memory pool. If another pool needs monitoring, change the last digit of the OID. For more information, reference the following Java method:
java.lang.management.MemoryPoolMXBean.getPeakUsage() Templates Reference 999
Administrator Guide SolarWinds Server & Application Monitor getUsed()
Memory Pool Peak Committed (B) The amount of used memory in the memory pool at the peak usage point. This counter shows statistics for the first memory pool. If another pool needs monitoring, change the last digit of the OID. For more information, reference the following Java method:
java.lang.management.MemoryPoolMXBean.getPeakUsage() getCommitted()
Memory Pool Peak Max Size (B) The maximum size of the memory pool at the peak usage point. This counter shows statistics for the first memory pool. If another pool needs monitoring, change the last digit of the OID. For more information, reference the following Java method:
java.lang.management.MemoryPoolMXBean.getPeakUsage() getMax()
Threads Total Started Count The number of threads created and started since the Java Virtual Machine started. This counter shows statistics for the first thread. If another thread needs monitoring, change the last digit of the OID. For more information, reference the following Java method:
java.lang.management.ThreadMXBean.getTotalStartedThreadCount()
Thread Instant Blocked Count The number of times that this thread has blocked the to enter or re-enter monitor. This counter shows statistics for the first thread. If another thread needs monitoring, change the last digit of the OID. For more information, reference the following Java methods:
java.lang.management.ThreadMXBean.getThreadInfo(long,boolean) getBlockedCount()
Thread Instant Blocked Time (ms) The approximate accumulated elapsed time (in milliseconds) that a thread has blocked the to enter or re-enter monitor since it has started, or since thread contention monitoring was enabled. This object is always set to 0 if thread contention monitoring is disabled or not supported. This counter shows statistics for the first thread. If another thread needs monitoring, change the last digit of the OID. This should be as low as possible. For more information, reference the following Java method:
java.lang.management.ThreadMXBean.getThreadInfo(long,boolean) getBlockedTime()
Thread Instant Wait Count This counter shows the number of times that this thread waited for notification. It also shows statistics for the first thread. If another thread needs monitoring, change the last digit of the OID. For more information, reference the following Java methods:
java.lang.management.ThreadMXBean.getThreadInfo(long,boolean). getWaitedCount()
Thread Instant Wait Time (ms) The approximate accumulated elapsed time (in milliseconds) that a thread has waited for a monitor through a java.lang.Object.wait method since it has started, or since thread contention monitoring was enabled. This object is always set to 0 if thread contention monitoring is disabled or not supported. It also shows statistics for first thread. If another thread needs monitoring, change the last digit of the OID. This should be as low as possible. For more information, reference the following Java methods:
java.lang.management.ThreadMXBean.getThreadInfo(long,boolean) getWaitedTime()
Runtime Input Arguments Count This is the number of input arguments passed to the Java Virtual Machine. For more information, reference the following Java method:
java.lang.management.RuntimeMXBean.getInputArguments()
Runtime Uptime (ms) This is the uptime of the Java virtual machine (in milliseconds). This is equivalent to (System.currentTimeMillis() - jvmStartTimeMs). For more information, reference the following Java methods:
jvmRTStartTimeMs.: java.lang.management.RuntimeMXBean.getUptime()
Compiler Time (ms) This gets the approximate accumulated elapsed time (in milliseconds) spent in compilation since the Java virtual machine has started. If multiple threads are used for compilation, this value is the summation of the approximate time that each thread spent in compilation. If compiler time monitoring is not supported, then this object remains set at 0. For more information, reference the following Java method:
java.lang.management.CompilationMXBean.getTotalCompilationTime( )
LDAP Connection Monitor

This template tests the ability of an LDAP server to respond to an LDAP query. The statistic returned is the LDAP version. Prerequisites: None. Credentials: Windows Administrator credential valid on both SolarWinds SAM and target server. Monitored Components LDAP Connection Monitor
LDAP User Experience Monitor

This template tests the capabilities of a Lightweight Directory Access Protocol (LDAP) server, and measures the time it takes to perform LDAP search-and compare operation. Prerequisites: None. Credentials: Credential that has administrator access to the LDAP server. Monitored Components LDAP User Experience Monitor
Linux CPU Monitoring Perl

This template assesses the CPU performance of a Linux computer. It uses Perl scripts for monitoring performance. Prerequisites: SSH and Perl installed on the target server. If Perl is installed in a location different from /usr/bin/perl, you should correct all components in the first line of the field script body ( #!/usr/bin/perl), or you can create a symbolic link to Perl (refer to the documentation for the ln command). You can find where Perl is installed by using the following command:
which perl
Operating Systems: The following operating system versions may cause issues with certain counters in this template: Red Hat Enterprise Linux 3 For a list of issues and recommendations, refer to the following KB article: http://knowledgebase.solarwinds.com/kb/questions/2440 Credentials: Root credentials on the target server. Monitored Components: Note: Components without predetermined threshold values have guidance such as "Use the lowest threshold possible" or "use the highest threshold possible" to help you find a threshold appropriate for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. CPU User Time Time, in percentages, spent running non-kernel code (user time, including nice time). This represents the time spent executing user code. It depends on the programs that the user uses. Note: Use the lowest threshold possible. CPU System Time Time, in percentages, spent running system kernel code (system time). Note: Use the lowest threshold possible. Wait IO Time, in percentages, spent waiting for input/output (IO) operations.
Note: Use the lowest threshold possible. If CPU waits IO is high, there may be problems with hard disk or problems with accessing NFS shares (if you use NFS). CPU Idle Time Time, in percentages, spent idle (this includes IO-wait time). Note: Use the highest threshold possible at all times. Run queue The number of processes waiting for run time. This should be as low as possible, but not more than 4 per processor. If the run queue is constantly growing, it may indicate the need for a more powerful CPU or more CPUs. Note: Set the thresholds appropriately for your environment. Interrupts per second The number of interrupts per second, including the clock. This depends on the processor. For current CPUs, use a threshold of 1500 interrupts per second. A dramatic increase in this counter value without a corresponding increase in system activity indicates a hardware problem. Identify the network adapter or disk controller card causing the interrupts. You may need to install an additional adapter or controller card. Note: Set the thresholds appropriately for your environment. Context switches per second The number of context switches per second. High activity rates can result from inefficient hardware or poorly designed applications. The normal amount of Context Switches/Sec depends on your servers and applications. To set the threshold, you really need to baseline the server. The threshold for Context Switches/sec is cumulative for all processors, so you need a minimum of 14000 per processor (single=14000, dual=28000, quad=56000 and so forth). Note: Set the thresholds appropriately for your environment. Total amount of interrupts after boot The total number of interrupts after boot.
Total amount of CPU context switches after boot The total number of CPU context switches after boot.
Linux Disk Monitoring Perl

This template assesses the disk performance of a Linux computer. This template uses Perl scripts for monitoring performance. This template has been tested on CentOS 5.5. Prerequisites: SSH and Perl installed on the target server. If Perl is installed in a location different from /usr/bin/perl, you should correct all components in the first line of the field script body ( #!/usr/bin/perl), or you can create a symbolic link to Perl (refer to the documentation for the ln command). You can find where Perl is installed by using the following command:
which perl
Operating Systems: The following operating system versions may cause issues with certain counters in this template: Fedora 14 For a list of issues and recommendations, refer to the following KB article: http://knowledgebase.solarwinds.com/kb/questions/2440 Credentials: Root credentials on the target server. Monitored Components: Note: Components without predetermined threshold values have guidance such as "use the lowest threshold possible" or "use the highest threshold possible" to help you find a threshold appropriate for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Timing cached reads (MB/sec) Perform timings of cache reads for benchmark and comparison purposes. This displays the speed of reading directly from the Linux buffer cache without disk access. This measurement is essentially an indication of the throughput of the processor, cache, and memory of the system under test. Note: Use the highest threshold possible. You should monitor this counter for some time and then set thresholds appropriately for your environment. Troubleshooting: There is a bug in the component script. It tests only the first hard drive (SATA or IDE). If you have a first SATA or a first IDE (but only one hard drive), the script works well. But if you have SATA first hard drive and IDE first hard drive (both hard drives), the result will be only for the SATA first hard drive.
If you need to monitor a second or third IDE hard drive, you should find and change the lines /dev/hda to /dev/hdb (for the second IDE) or to /dev/hdc (for the third IDE hard drive). If you need to monitor a second or third SATA hard drive, you should find and change the lines /dev/sda to /dev/sdb (for second SATA) or to /dev/sdc(for third SATA hard drive). Timing buffered disk reads (MB/sec) Perform timings of device reads for benchmark and comparison purposes. This displays the speed of reading through the buffer cache to the disk without any prior caching of data. This measurement is an indication of how fast the drive can sustain sequential data reads under Linux, without any file system overhead. Note: Use the highest threshold possible. You should monitor this counter for some time and then set thresholds appropriately for your environment. Troubleshooting: There is a bug in the component script. It tests only the first hard drive (SATA or IDE). If you have a first SATA or a first IDE (but only one hard drive), the script works well. But if you have SATA first hard drive and IDE first hard drive (both hard drives), the result will be only for the SATA first hard drive. If you need to monitor a second or third IDE hard drive, you should find and change the lines /dev/hda to /dev/hdb (for the second IDE) or to /dev/hdc (for the third IDE hard drive). If you need to monitor a second or third SATA hard drive, you should find and change the lines /dev/sda to /dev/sdb (for second SATA) or to /dev/sdc(for third SATA hard drive). Blocks received from block device (blocks/sec) This shows the number of blocks read from the disk in the previous interval. All Linux blocks are currently 1024 bytes. Old kernels may report blocks as 512 bytes, 2048 bytes, or 4096 bytes. Blocks sent to a block device (blocks/sec) This indicates the total number of blocks written to disk in the previous interval. All Linux blocks are currently 1024 bytes. Old kernels may report blocks as 512 bytes, 2048 bytes, or 4096 bytes. Available space on / partition (MB) This shows the available space on the root (/) partition in MB.
Note: You should set this threshold according to your Linux installation and your requirements. In the worst case, it should be more than 512 MB.
Linux Memory Monitoring Perl

This template assesses the memory performance of a Linux computer. This template uses Perl scripts for monitoring performance. Prerequisites: SSH and Perl installed on the target server. If Perl is installed in a location different from /usr/bin/perl, you should correct all components in the first line of the field script body ( #!/usr/bin/perl), or you can create a symbolic link to Perl (refer to the documentation for the ln command). You can find where Perl is installed by using the following command:
which perl
Operating Systems: The following operating system versions may cause issues with certain counters in this template: Red Hat Enterprise Linux 3, 4 SUSE Linux Enterprise Server 9 For a list of issues and recommendations, refer to the following KB article: http://knowledgebase.solarwinds.com/kb/questions/2440 Credentials: Root credentials on the target server. Monitored Components: Note: Components without predetermined threshold values have guidance such as "use the lowest threshold possible" or "use the highest threshold possible" to help you find a threshold appropriate for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Total memory (kB) This shows the amount of total usable RAM in kB. Used memory (kB) This shows the amount of used memory in kB. Note: This should be as low as possible. Free memory (kB) This shows the amount of available memory in kB. Note: This should be more than 100000 kB at all times or paging will occur.
Total swap (kB) This shows the amount of total swap space in kB. Used swap (kB) This shows the amount of used swap space in kB. Paging is one of the memory-management schemes by which a computer can store and retrieve data from secondary storage for use in main memory. Paging is an important part of virtual memory implementation in most contemporary general-purpose operating systems, allowing them to use disk storage for data that does not fit into physical random-access memory (RAM). This should be as low as possible. Ideally it should be near zero. If the value is large, it may indicate that there is no free memory left. Free swap (kB) This shows amount of available swap space in kB. It should be near the total swap value. If paging occurs in the system, the value should be as high as possible. Buffers (kB) RAM that is allocated to disk write operations. Cache (kB) RAM that is allocated to disk read operations. Dirty Pages (kB) The total amount of memory, in kilobytes, waiting to be written back to the disk. This should be as low as possible. Note: You should monitor this counter for some time and then set thresholds appropriately for your environment.
Anonymous Pages (kB) Anonymous memory is memory that is managed by segvn but is not really directly associated with a file. It is used for things like process stacks, heap, or COW (copy on write) pages. A good example of this is if you fork a process. All the addresses in the second process actually map back to the same bits of physical memory (the same pages). However if your child process was then to do something different with the memory (for example the child went off and manipulated an array in memory), the VM subsystem would copy those pages and change the mappings in the child process to point to the new pages. This new memory would be anonymous memory, and the child process would merrily make the changes to the array, unaware it now had new "physical" memory it was addressing. This should be as low as possible. You should monitor this counter for some time and then set thresholds appropriately for your environment. Amount of zombie processes This show the number of zombie processes. A zombie or defunct process is a process that has completed execution, but still has an entry in the process table. This entry is still needed to allow the process that started the (now zombie) process to read its exit status. When a process finishes execution, it will have an exit status to report to its parent process. Because of this last little bit of information, the process will remain in the operating systems process table as a zombie process, indicating that it is not to be scheduled for further execution, but that it cannot be completely removed (and its process ID cannot be reused) until it has been determined that the exit status is no longer needed. This should always be zero (0). If it is not zero, you should manually kill zombie processes. Use the following command to show these zombie processes (and look for a Z in the STAT column):
ps aux
To kill zombie processes: The first option is to wait. It is possible that the parent process is intentionally leaving the process in a zombie state to ensure that future children it may create will not receive the same pid. Or perhaps the parent is occupied, and will reap the child process momentarily. The second option is to send a SIGCHLD signal to the parent (kill -s SIGCHLD <ppid>). This will cause well-behaving parents to reap their zombie children.
The third option is to kill the parent process of the zombie. At that point, all of the parents children will be adopted by the init process (pid 1), which periodically runs wait() to reap any zombie children.
Linux Sendmail Monitoring Perl

This template assesses the Linux sendmail status and performance. This template uses Perl scripts for monitoring performance. Prerequisites: SSH and Perl installed on the target server. Perl should be found in: /usr/bin/perl. You can find where Perl is installed by using the following command:
which perl
If Perl is installed in another location, you should correct all components in the first line of the field script body (#!/usr/bin/perl), or you can create a symbolic link to Perl (refer to the documentation for the ln command). Operating Systems: The following operating system versions may cause issues with certain counters in this template: SUSE Linux Enterprise Server 9, 10, 11 OpenSUSE 11.3 Ubuntu Server 10.10 For a list of issues and recommendations, refer to the following KB article: http://knowledgebase.solarwinds.com/kb/questions/2440 Credentials: Root credentials on the target server. The counters and services in this template are based on the following information: Monitoring sendmail: http://opensmart.sourceforge.net/docs/documentation/userguide/appmon_se ndmail.html Monitored Components: Note: Components without predetermined threshold values have guidance such as "use the lowest threshold possible" or "use the highest threshold possible" to help you find a threshold appropriate for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Sendmail instances running This shows how many instances of sendmail daemon are currently started. 0 Sendmail is stopped. Run sendmail manually.
>1 Sendmail is up and running. Daemon: syslogd This shows the status of syslogd daemon (Syslog is a standard for logging program messages). 0 Syslog daemon is stopped. Run syslogd manually. 1 Syslog daemon is up and running. Disk space usage (kB) of mail folder This shows the disk space in kB used by the user mailboxes in /var/mail. Note: Set thresholds according to your requirements. Disk space usage (kB) of mail queue folder This shows the disk space in kB used by queued mail in /var/spool/mqueue. Note: Set thresholds according to your requirements. Mail queue length This shows the mail queue length (how many items are in the queue for delivery). This should be as low as possible. If the mail queue value is constantly rising, it may indicate problems with delivering messages. Note: Set thresholds according to your requirements. Available space on partition with /var/spool (MB) This shows the available space on the partition with /var/spool folder in MB. By default it checks available space on the root (/) partition. If you have created a separate partition /var or /var/spool you need change it in the script (grep "/\$"). You can investigate what partitions you have by using the following command: df For the /var partition, you should make the following change: change grep "/\$" to grep "/var\$" For the /var/spool partition, you should make the following change: change grep "/\$" to grep "/var/spool\$" Note: Set thresholds according to your requirements.
Log Parser (Perl)

The Log Parser template allows you to check a specified log file and determine the total number of lines that match your search criteria. Prerequisites: Perl must be installed on the target server. Credentials: Root on target server. Component Arguments and Syntax These three arguments are used in the following order:
perl ${SCRIPT} "LogFilePath" "RegularExpression" "Position"
1. Log file path This is the path of the log file on the target server. The path can contain spaces, as opposed to the PowerShell template, which cannot. 2. Regular Expression This is used for regular expression searches to find a desired string in the log file. Searches are case sensitive and can contain spaces, as opposed to the PowerShell template, which cannot. 3. Position This value determines the position from the last string of the log file in the Found String in # Position monitor. For other monitors, this takes part in generating temp files. Note: For the Total Number of Strings Found and Number of Newly Found Strings monitors: If you monitor the same file but different search strings, use random values in the Position argument to generate different temp files. Below is an example using the Command Line field used in the Number of Newly found strings component monitor. This example returns the number of newly found strings that match word init from the /etc/inittab file.
perl ${SCRIPT} "/etc/inittab" "init"
Components with Examples Total Number of Strings Found This monitor shows the total number of strings that match the search criteria in the entire log file. Additionally, in the message field, this monitor returns all strings that match search criteria. Below is an example using the Command Line field:
perl ${SCRIPT} "/etc/inittab" "init" "0" Templates Reference 1017
Number of Newly Found Strings This monitor shows the number of newly found strings after the last script execution. Additionally in message field this monitor returns all strings that matches search criteria. Below is an example using the Command Line field:
perl ${SCRIPT} "/etc/inittab" "init" "0"
Found String in # Position This monitor shows the number position of the string found from the end that matches the search criteria, as well as the string itself. By default, this counter also shows the last string. Below is an example using the Command Line field. The Position argument is employed as 1.
perl ${SCRIPT} "/etc/inittab" "init" "1"
Log Parser (PowerShell)

The Log Parser template allows you to check a specified log file and determine the total number of lines that match your search criteria. Prerequisites: WinRM must be installed and properly configured on the target server. Credentials: Administrator on target server. Configuring Windows Remote Management (WinRM) 1. If not already done so, install PowerShell 2.0 and WinRM on the SAM and target servers. PowerShell 2.0 can be found here: http://support.microsoft.com/kb/968930. 2. On the SAM server, open a command prompt as an Administrator. To do this, perform the following step: Go to the Start menu and right-click the cmd.exe and then select Run as Administrator.
winrm quickconfig q winrm set winrm/config/client @{TrustedHosts="*"}
3. Enter the following in the command prompt:
where IP address is the IP address of your SAM server. Component Monitors with Syntax Each monitor uses the same PowerShell script. In some arguments the values may be different. Also, each monitor uses these four arguments in the following order:
LogFilePath,RegularExpression,Usage,Position
1. Log file path This is the path of the target log file on the target server. The path cannot contain any spaces. 2. Regular Expression This is used for regular expression searches to find a desired string in the log file. Searches are not case sensitive.
3. Using one of the usage arguments below determines the type of information the monitor should return. The arguments used to return certain values are as follows: Total - Returns the total number of strings found. New - Shows the number of newly found strings. Match - Shows the position of the string found as well as the string itself. It uses the Position argument to determine which string to show.
4. Position This value determines the position from the last string of the log file in the Found String in # Position monitor. For other monitors thic takes part in generating temp files. Note: For the Total and New usage arguments: If you monitor the same file but different search strings, use random values in the Position argument to generate different temp files. Below is an example using the Scripts Arguments field. This example returns the number of the second line from the end, as well as the line itself, starting with the word error, from the powertest.log file on the D drive.
d:\powertest.log,êrror,match,2
Note: You must specify the correct arguments for each monitored component in the Script Arguments field. If you fail to do this, the monitor will return with a status error of "Undefined." Components Monitors with Examples Total number of strings found. This monitor shows the total number of strings that match the search criteria. Below is an example using the Scripts Arguments field to search the number of strings that match the word error in the powertest.log file:
d:\powertest.log,êrror,total,0
Number of newly found strings. This monitor shows the number of newly found strings. Additionally, in the message field, this monitor returns all new strings that match search criteria.
Below is an example using the Scripts Arguments field to search for the number of newly found strings since the last script execution. In this case, just the new instances of the searched word, error is returned.
d:\powertest.log,êrror,new,0
Found String in # Position. This monitor shows the number position of the string found from the end that matches the search criteria, as well as the string itself. By default, this counter also shows the last string. Below is an example using the Scripts Arguments field which searches for the position of the word, error in relation to the end of the log file.
d:\powertest.log,êrror,match,1
Lotus Domino Server

This template assess the overall health of a Lotus Domino server by monitoring its key performance indicators. Prerequisites: SNMP access to target server. Credentials: None. Installing Lotus Domino Server SNMP Agent You must first install the SNMP agent on the Domino Server. See the following location to access the Lotus Domino Administrator information: http://publib.boulder.ibm.com/infocenter/domhelp/v8r0/index.jsp. Then follow the instructions in the section Configuring the Domino SNMP Agent for Microsoft Windows to configure the agent. Monitored Components This template uses SNMP component monitors to monitor the following performance indicators: Available Resources (%) OID: 1.3.6.1.4.1.334.72.1.1.6.3.19.0 Open User Sessions OID: 1.3.6.1.4.1.334.72.1.1.6.3.6.0 Peak Open User Sessions OID: 1.3.6.1.4.1.334.72.1.1.6.3.11.0 Dropped Session Count OID: 1.3.6.1.4.1.334.72.1.1.6.3.1.0 DB Cache Rejection Count OID: 1.3.6.1.4.1.334.72.1.1.10.21.0 LDAP Tasks Running OID: 1.3.6.1.4.1.334.72.1.1.21.10.0 Peak Transactions per Minute OID: 1.3.6.1.4.1.334.72.1.1.6.3.3.0
Max Mail Delivery time (seconds) OID: 1.3.6.1.4.1.334.72.1.1.4.12.0 Pending Mail Messages OID: 1.3.6.1.4.1.334.72.1.1.4.31.0
Lotus Domino Server Statistics

This template assesses the overall performance of a Lotus Domino Server by using the SNMP protocol. Prerequisites: SNMP enabled on the operating system. SNMP adapter enabled on Lotus Domino. Credentials: None. (The SNMP public string assigned to the node is used.) Note: To enable the SNMP adapter on Lotus Domino, navigate here: http://publib.boulder.ibm.com/infocenter/domhelp/v8r0/index.jsp?topic=%2Fcom.i bm.help.domino.admin.doc%2FDOC%2FH_COMPLETING_SNMP_CONFIGUR ATION.html. Monitored Components Some components may not have preset warning or critical threshold values. You can add your own threshold limits as necessary. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Available Resources (%) This monitor returns the current percentage index of a server's availability. The value range is 0-100. Zero (0) indicates no available resources. A value of 100 indicates that the server is completely available. OID: 1.3.6.1.4.1.334.72.1.1.6.3.19.0 Open User Sessions This monitor returns the number of users with sessions open on the server. OID: 1.3.6.1.4.1.334.72.1.1.6.3.6.0 Peak Open User Sessions This monitor returns the peak number of concurrent users with open sessions since the server was started. OID: 1.3.6.1.4.1.334.72.1.1.6.3.11.0 Dropped Session Count This monitor returns the number of dropped sessions. OID: 1.3.6.1.4.1.334.72.1.1.6.3.1.0
DB Cache Rejection Count This monitor returns the number of times a database is not placed into the cache when it is closed because lnDBCacheCurrentEntries equals or exceeds lnDBCacheMaxEntries*1.5. This number should stay low. If this number begins to rise, you should increase the NSF_DbCache_Maxentries settings. OID: 1.3.6.1.4.1.334.72.1.1.10.21.0 LDAP Tasks Running This monitor returns the number of LDAP server tasks currently running. OID: 1.3.6.1.4.1.334.72.1.1.21.10.0 Peak Transactions per Minute This monitor returns the peak number of transactions that took place in any given minute since the server was started. OID: 1.3.6.1.4.1.334.72.1.1.6.3.3.0 Max Mail Delivery Time (sec) This monitor returns the maximum time for mail delivery in seconds. OID: 1.3.6.1.4.1.334.72.1.1.4.12.0 Note: If the counter returns with the error No such name, you should send a test email. The counter should be accessible at this point. Pending Mail Messages This monitor returns the number of mail messages pending. OID: 1.3.6.1.4.1.334.72.1.1.4.31.0 Note: If the counter returns with the error No such name, you should send a test email. The counter should be accessible at this point. Server Transactions per Minute This monitor returns the average number of transactions per minute since the server was started. OID: 1.3.6.1.4.1.334.72.1.1.6.3.2.0 Number of Undeliverable Messages This monitor returns the number of dead (undeliverable) mail messages. OID: 1.3.6.1.4.1.334.72.1.1.4.1.0
Total Mail Failures This monitor returns the total number of routing failures since the server started. OID: 1.3.6.1.4.1.334.72.1.1.4.3.0 Note: If the counter returns with the error No such name, you should send a test email. The counter should be accessible at this point. Number of Waiting Messages This monitor returns the number of mail messages waiting to be routed. OID: 1.3.6.1.4.1.334.72.1.1.4.6.0 Number of Messages on Hold This monitor returns the number of mail messages in message queue on hold. OID: 1.3.6.1.4.1.334.72.1.1.4.21.0 Database Cache Hit This monitor returns the number of times an lnDBCacheInitialDbOpen is satisfied by finding a database in the cache. A high hits-to-opens ratio indicates the database cache is working effectively, since most users are opening databases in the cache without having to wait for the usual time required by an initial (non-cache) open. If the ratio is low, the administrator can increase the NSF_DBCACHE_MAXENTRIES settings. OID: 1.3.6.1.4.1.334.72.1.1.10.17.0 Database Initial Opens This monitor returns the number of times a user/server opened a database that was not already being used by another user/server. By comparing this number to lnDBCacheHits, administrators can gauge the effectiveness of the cache. OID: 1.3.6.1.4.1.334.72.1.1.10.18.0 Access Denial of Agent Manager This monitor returns the number of times the agent manager failed to execute a given task, probably due to ACL restrictions. OID: 1.3.6.1.4.1.334.72.1.1.11.1.0 Note: If the counter returns with the error No such name, you should send a test email. The counter should be accessible at this point.
Unsuccessful Runs of Agent Manager This monitor returns the number of tasks the agent manager has unsuccessfully run during the course of the day. OID: 1.3.6.1.4.1.334.72.1.1.11.4.0 Note: If the counter returns with the error No such name, you should send a test email. The counter should be accessible at this point.
MAPI Round Trip Email

This template simulates an email round trip to test the ability of your SMTP server to receive and distribute email, and the ability of your users to retrieve messages from MAPI-enabled email clients. MAPI Profiles created manually or automatically are created in the context of the user whose credentials have been defined as part of the component monitor. For example: If you've assigned the "John Doe" credentials to this MAPI User Experience Monitor, then John Doe must be able to log in locally to the SAM server so a MAPI profile can be created. Prerequisites: MAPI access to a Microsoft Exchange server. MAPI Client and CDO Objects installed on SolarWinds SAM server. Credentials: Windows credential valid on both the SolarWinds SAM server and the Microsoft Exchange server. Note: You cannot monitor POP3-based Google Gmail accounts with this template. Use the POP3 Round Trip Email template instead. Monitored Components MAPI User Experience Monitor Note: It is recommended that you log into the SAM server console locally as the user whose credentials you have assigned to the MAPI User Experience Monitor. From here, use MFCMapi.exe (http://mfcmapi.codeplex.com/) to verify the profile defined in the monitor actually exists. If it does not, you can either manually create the MAPI profile under this users context, or delete all existing MAPI profiles and MAPI UX monitors and recreate the monitor, which should then automatically create the profile.
Microsoft Forefront Threat Management Gateway 2010

This template assesses the status and overall performance of a Microsoft Forefront Threat Management Gateway 2010 by using performance counters and windows service monitors. Prerequisites: WMI access to the target server. On the Forefront server in the Forefront TGM snap-in, you will need to allow monitoring performance counters and services from the SAM server with the following parameters in the Firewall Policy menu. Create the following access rule:
Rule: Allow; From: Local Host, SAM server; To: Local Host, SAM server; For: All users; Protocols: Microsoft CIFS (TCP), NetBios Datagram, NetBios Name Service, NetBios Session, RPC (all Interfaces), TCP-10003-OUT.
where:
SAM server is the IP address of your SAM server; TCP-10003-OUT is the manually configured protocol with the following
parameters in your primary connections:

Protocol: TCP; Port range: From 10003 to 10003; Direction: Outbound.
Credentials: Windows Administrator on the target server. Monitored Components Note: Components without predetermined threshold values have guidance such as "use the lowest threshold possible" or "use the highest threshold possible" to help you find a threshold appropriate for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415.
Service: Microsoft Forefront TMG Control This monitor returns the CPU and memory usage of the Microsoft Forefront TMG Control service. This service controls Forefront Threat Management Gateway services. Service: Microsoft Forefront TMG Firewall This monitor returns the CPU and memory usage of the Microsoft Forefront TMG Firewall service. This service provides Forefront TMG internet access protection services. Service: Microsoft Forefront TMG Job Scheduler This monitor returns the CPU and memory usage of the Microsoft Forefront TMG Job Scheduler service. This service runs Forefront Threat Management Gateway jobs according to specified job schedules. Service: Microsoft Forefront TMG Managed Control This monitor returns the CPU and memory usage of the Microsoft Forefront TMG Managed Control service. This service Controls Forefront Threat Management Gateway managed services. Service: Microsoft Forefront TMG Storage This monitor returns the CPU and memory usage of the Microsoft Forefront TMG Storage service. This service provides Forefront Threat Management Gateway configuration storage. Service: AD-LDS (ISASTGCTRL) This monitor returns the CPU and memory usage of the ISASTGCTRL service. This service provides the Active Directory LDS instance. Firewall Packet Engine: Active Connections This monitor shows the total number of active connections currently passing data. Use this counter to monitor general performance. Firewall Packet Engine: Bytes/sec This monitor shows the total throughput, in bytes per second, passing through the firewall. Each byte is counted twice; once when it enters the firewall, and once when it leaves the firewall. Use this counter to monitor general performance. Firewall Packet Engine: Dropped Packets/sec This monitor shows the number of packets that were denied each second. Use this to monitor general security threats. If numbers are large (more than 100), check for network configuration errors and attacks.
Firewall Packet Engine: Packets/sec This monitor shows the number of allowed and denied packets, per second. Use this to monitor general security threats and performance. This directly impacts CPU utilization. Firewall Packet Engine: Connections/sec This monitor shows the number of TCP and UDP connections created, per second. Use this to monitor general security threats and performance. This directly impacts CPU utilization. H.323 Filter: Active H.323 Calls This monitor returns the number of H.323 calls that are currently active. Cache: Disk Failure Rate (failures/sec) This monitor shows the number of I/O failures, per second, since the firewall service started. An I/O failure occurs when TMG fails to read from or write to the disk cache. This value should be as low as possible. Cache: Memory Usage Ratio Percent (%) This monitor shows the amount of fetches from the memory cache in proportion to the total fetches from the cache. Cache: URL Commit Rate (URL/sec) This monitor shows the rate at which URLs are stored to the cache. Firewall Service: DNS Cache Hits % This monitor shows the percentage of DNS domain names serviced by the DNS cache from the total of all DNS entries that have been retrieved by the firewall service. This value should be as high as possible. Firewall Service: Active Sessions This monitor shows the number of active sessions for the firewall service. Use this counter to monitor general performance. By comparing this counter at both peak and off-peak times, you can construct a good picture of routine usage. Firewall Service: Active TCP Connections This monitor shows the number of active TCP connections currently passing data. Connections pending, or not yet established, are counted elsewhere. Firewall Service: Active UDP Connections This monitor shows the number of active User Datagram Protocol (UDP) connections.
Firewall Service: Available Worker Threads This monitor shows the number of firewall service worker threads that are available or waiting in the completion port queue. Available worker threads should never remain near 0 for any length of time. If TMG keeps this at or near 0, you should scale out. Firewall Service: Worker Threads This monitor shows the total number of firewall service worker threads. SOCKS Filter: Active Sessions This monitor shows a single SOCKS session and includes the CONNECT and BIND commands for a single client. SOCKS Filter: Pending DNS Resolutions This monitor shows the number of pending Winsock getaddrinfo() requests. These requests resolve host DNS names and IP addresses for SOCKS connections. This monitor should be as low as possible. Web Proxy: Active Web Sessions This monitor indicates how many clients are currently being served by the Web Proxy filter. Monitoring this counter at both peak and off-peak times gives a good indication of server usage. The configuration setting for maximum web request connections influences this value. This counter may also be useful if you need to temporarily stop TMG services. When authentication does not take place, all of the clients from a single IP address are viewed as one session. Web Proxy: Average Milliseconds/request This monitor shows the mean number of milliseconds required to service a Web Proxy client request, not including requests serviced by the Secure Sockets Layer (SSL) tunnel. This counter can be monitored at peak and offpeak times to get a comprehensive picture of the rate at which client requests are being serviced. A counter with a value that is too high might indicate that the TMG computer is having difficulty in handling all requests and that requests are being delayed. This value should be as low as possible.
Web Proxy: Cache Hit Ratio (%) This monitor determines how many Web Proxy client requests have been served using cached data (Total Cache Fetches), as a percentage of the total number of successful Web Proxy client requests to the TMG computer (Total Successful Requests). Its value gives a good indication of the effectiveness of the cache. A high counter value indicates that a high level of requests is being serviced from the cache, meaning faster response times. A zero counter value indicates that caching is not enabled. A low counter value may indicate a configuration problem. The cache size may be too small, or requests may not be cacheable. Web Proxy: Connect Errors This monitor shows the total number of errors that occurred while connecting. Web Proxy: Failing Requests/sec This monitor shows the rate of Web Proxy client requests that have been completed with some type of error. This counter can be compared with the Requests/sec counter to give an indication of how well TMG is servicing incoming Web requests. A high failure rate, as compared with the rate of incoming requests, suggests that TMG is having difficulty in coping with all incoming requests. Connection settings for incoming Web requests may be incorrectly configured, or connection bandwidth may be insufficient. This monitor should be as low as possible. Web Proxy: Requests/sec This monitor shows the rate of incoming requests that have been made to Web proxy. A higher value means that more TMG resources will be required to service incoming requests. Web Proxy: Thread Pool Active Sessions This monitor shows the number of sessions being actively serviced by thread pools. Web Proxy: Memory Pool for HTTP Requests (%) This monitor returns the percentage of memory available for HTTP requests. When an HTTP request is made, TMG uses memory from a pre-allocated pool. You can use the ProxyVmemAlloc3pSize registry value in the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3Proxy\
parameters registry key to modify the size of this pool.
Web Proxy: Memory Pool for SSL Requests (%) This monitor returns the percentage of memory available for SSL requests. When an SSL request is made, TMG uses memory from a pre-allocated pool. You can use the ProxyVmemAlloc1pSize registry value in the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3Proxy\
parameters registry key to modify the size of this pool. Web Proxy: Compression - Current Compression Ratio This monitor returns the average size reduction of the HTTP response body as a percentage of the uncompressed body size during the sample period for HTTP responses compressed by TMG. Web Proxy: Compression - Responses Compressed: Accumulated Ratio This monitor shows the percentage of HTTP responses compressed by TMG out of the total number of HTTP requests handled by TMG
Microsoft Lync Server (Edge Role)

This template assesses the status and overall health of services as well as the performance of the Edge Microsoft Lync Server. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on the target server. Monitored Components Note: You need to set thresholds for these counters according to your environment. It is recommended to monitor these counters for some period of time to understand potential value ranges and then set the thresholds accordingly. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Service: Lync Server Replica Replicator Agent This component monitor returns the CPU and memory usage of the Lync Server Replica Replicator Agent. This service is used by the File Transfer Agent for replication configuration settings. SIP Peers: Connections Active This component monitor returns the number of established connections that are currently active. A connection is considered established when peer credentials are verified (e.g. via MTLS), or the peer receives a 2xx response. You will need to baseline this counter by testing and monitoring the user load. This returned value should be less than 15,000 connections per FrontEnd. SIP Peers: TLS Connections Active This component monitor returns the number of established TLS connections that are currently active. A TLS connection is considered established when the peer certificate, and possibly the host name, are verified for a trust relationship. You will need to baseline this counter by testing and monitoring the user load. SIP Peers: Average Outgoing Queue Delay This component monitor returns the average time, in seconds, that messages have been delayed in outgoing queues. Check the Outgoing Queue Delay for delays in sending messages to other servers or clients that could be causing messages to be accumulated in the server. The server will drop client connections if it is in a throttle state and messages stay in the outgoing queue for more than 32 seconds.
SIP Peers: Incoming Requests/sec This component monitor returns the rate of received requests, per second. You will need to baseline this counter by testing and monitoring the user load. SIP Protocol: Incoming Messages/sec This component monitor returns the rate of received messages, per second. You will need to baseline this counter by testing and monitoring the user load. SIP Load Management: Average Holding Time For Incoming Messages This component monitor returns the average time that the server held the incoming messages currently being processed. This should usually be less than one second, on average, but it is normal to see short spikes of up to three seconds. The server will throttle new incoming messages after going above the high benchmark and until the number of messages falls below the low benchmark. The server starts rejecting new connections when the average holding time is greater than overload time of 15 seconds. SIP Access Edge Server: External Messages/sec With Internally Supported Domain This component monitor returns the per-second rate of messages received at the external edge with an internally supported domain. SIP Access Edge Server: External Messages/sec Received With Allowed Partner Server Domain This component monitor returns the per-second rate of messages received at the external edge with an allowed partner server domain. SIP Access Edge Server: External Messages/sec Received With a Configured Allowed Domain This component monitor returns the per-second rate of messages received at the external edge with a configured allowed domain. A/V Edge UDP: Active Relay Sessions Authenticated This component monitor returns the number of active relay sessions over UDP. A/V Edge UDP: Active Relay Sessions Allocated Port This component monitor returns the number of active relay sessions with a UDP port allocation.
A/V Edge UDP: Active Relay Sessions Data This component monitor returns the number of active relay data sessions over UDP. A/V Edge UDP: Allocated Port Pool Count This component monitor returns the number of UDP ports available in the Allocated Port Pool. This monitor should be more than zero. If it reaches zero there is a resource issue. A/V Edge UDP: Allocate Requests/sec This component monitor returns the per-second rate of Allocate Requests over UDP. You will need to baseline this counter by testing and monitoring the user load. A/V Edge UDP: Authentication Failures/sec This component monitor returns the per-second rate of failed attempts to authenticate with the relay over UDP. The returned value should be as low as possible. A/V Edge UDP: Allocate Requests Exceeding Port Limit This component monitor returns the number of allocate requests over UDP that exceeded the port limit. If the value is greater than zero, this could indicate an attempt to misuse the port. A/V Edge UDP: Packets Received/sec This component monitor returns the number of packets, received per second, by the relay over UDP. You will need to baseline this counter by testing and monitoring the user load. A/V Edge UDP: Packets Sent/sec This component monitor returns the number of packets sent per second by the relay over UDP. You will need to baseline this counter by testing and monitoring the user load. A/V Edge UDP: Average Data Packet Latency (milliseconds) This component monitor returns the average latency for a valid data request over UDP in milliseconds. The returned value should be as low as possible. A/V Edge UDP: Packets Dropped/sec This component monitor returns the per-second rate of packets over UDP dropped by the relay. The returned value should be as low as possible.
This error occurs when an unexpectedly high rate of User Datagram Protocol (UDP) packets is received at the Media Relay (A/V Edge server) causing some packets to be discarded. This could be the result of system overload or an indication of an attempt to misuse the MR. To resolve this, check that the profile of network traffic to the MR is in line with expected usage. If the traffic exceeds 250 Mbps per interface, increase the Receive and Transmit buffer size on the associated network adapter network adapters to three times the default values. If the cause is a general system overload, increase the capacity of the deployed MR function. A network level trace can be used to determine if there is an unusual amount of traffic originating from a single source. If the situation persists, enable tracing to check the network source of sessions exceeding the bandwidth limits to allow further troubleshooting of the cause. A/V Edge TCP: Active Relay Sessions Authenticated This component monitor returns the number of active relay sessions over TCP. A/V Edge TCP: Active Relay Sessions Allocated Port This component monitor returns the number of active relay sessions with a TCP port allocation. A/V Edge TCP: Active Relay Sessions Data This component monitor returns the number of active relay data sessions over TCP. A/V Edge TCP: Allocated Port Pool Count This component monitor returns the number of TCP ports available in the Allocated Port Pool. This monitor should be greater than zero. If zero is reached, a resource issue exists. A/V Edge TCP: Allocate Requests/sec This component monitor returns the per-second rate of Allocate Requests over TCP. You will need to baseline this counter by testing and monitoring the user load. A/V Edge TCP: Authentication Failures/sec This component monitor returns the per-second rate of failed attempts to authenticate with the relay over TCP. The returned value should be as low as possible.
A/V Edge TCP: Allocate Requests Exceeding Port Limit This component monitor returns the number of allocate requests over TCP that exceeded the port limit. If the value is greater than zero, this could indicate an attempt to misuse the port. A/V Edge TCP: Packets Received/sec This component monitor returns the number of packets received per second by the relay over TCP. You will need to baseline this counter by testing and monitoring the user load. A/V Edge TCP: Packets Sent/sec This component monitor returns the number of packets sent per second by the relay over TCP. You will need to baseline this counter by testing and monitoring the user load. A/V Edge TCP: Average Data Packet Latency (milliseconds) This component monitor returns the average latency for a valid data request over TCP in milliseconds. The returned value should be as low as possible. A/V Edge TCP: Packets Dropped/sec This component monitor returns the per-second rate of packets over TCP dropped by the relay. The returned value should be as low as possible. This error occurs when an unexpectedly high rate of User Datagram Protocol (UDP) packets is received at the Media Relay (A/V Edge server) causing some packets to be discarded. This could be the result of system overload or an indication of an attempt to misuse the MR. To resolve this, check that the profile of network traffic to the MR is in line with expected usage. If the traffic exceeds 250 Mbps per interface, increase the Receive and Transmit buffer size on the associated network adapter network adapters to three times the default values. If the cause is a general system overload, increase capacity of the deployed MR function. A network level trace can be used to determine if there is an unusual amount of traffic originating from a single source. If the situation persists, enable tracing to check the network source of sessions
Microsoft Lync Server (Front-End Role)

This template assesses the status and overall health of services as well as the performance of the Front-End Microsoft Lync Server. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on the target server. Monitored Components Note: You need to set thresholds for these counters according to your environment. It is recommended to monitor these counters for some period of time to understand potential value ranges and then set the thresholds accordingly. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Service: Lync Server Audio Test Service This component monitor returns the CPU and memory usage of the Lync Server Audio Test Service. This service offers users the ability to subjectively test the quality of a call before placing the call. The user checks the call quality by making a test call. Service: Lync Server File Transfer Agent This component monitor returns the CPU and memory usage of the Lync Server File Transfer Agent. The File Transfer Agent is responsible for replicating configuration settings with the Replica Replicator Agent that runs on every Lync Server. Service: Lync Server Front-End This component monitor returns the CPU and memory usage of the FrontEnd Lync Server. The Front-End Servers maintain transient information, such as logged-on state and control information for an IM, Web, or audio/video (A/V) conference. Service: Lync Server IM Conferencing This component monitor returns the CPU and memory usage of the Lync Server IM Conferencing. The IM Conferencing service is responsible for multiplexing the instant messages data feed from the leader to all participants in the session. Service: Lync Server Master Replicator Agent This component monitor returns the CPU and memory usage of the Lync Server Master Replicator Agent. This service is used by File Transfer Agent for replication configuration settings.
Service: Lync Server Replica Replicator Agent This component monitor returns the CPU and memory usage of the Lync Server Replica Replicator Agent. This service is used by the File Transfer Agent for replication configuration settings. SIP Peers: Connections Active This component monitor returns the number of established connections that are currently active. A connection is considered established when peer credentials are verified (e.g. via MTLS), or the peer receives a 2xx response. You will need to baseline this counter by testing and monitoring the user load. This returned value should be less than 15,000 connections per FrontEnd. SIP Peers: TLS Connections Active This component monitor returns the number of established TLS connections that are currently active. A TLS connection is considered established when the peer certificate, and possibly the host name, are verified for a trust relationship. You will need to baseline this counter by testing and monitoring the user load. SIP Peers: Sends Outstanding This component monitor returns the number of messages that are currently present in the outgoing queues. If you receive error message 504, investigate the results from this counter. Doing so will indicate which servers are having problems. To do so, you will need to change the instance from _Total, to the server hostname. You can check this within perfmon.exe SIP Peers: Average Outgoing Queue Delay This component monitor returns the average time, in seconds, that messages have been delayed in outgoing queues. Check the Outgoing Queue Delay for delays in sending messages to other servers or clients that could be causing messages to be accumulated in the server. The server will drop client connections if it is in a throttle state and messages stay in the outgoing queue for more than 32 seconds. SIP Peers: Flow-controlled Connections Dropped This component monitor returns the total number of connections dropped because of excessive flow-control. You will need to baseline this counter by testing and monitoring the server's health. The returned value should be as low as possible.
SIP Peers: Average Flow-Control Delay This component monitor returns the average delay, in seconds, in message processing when the socket is flow-controlled. You will need to baseline this counter by testing and monitoring the server's health. The returned value should be as low as possible. SIP Peers: Incoming Requests/sec This component monitor returns the rate of received requests, per second. You will need to baseline this counter by testing and monitoring the user load. SIP Protocol: Incoming Messages/sec This component monitor returns the rate of received messages, per second. You will need to baseline this counter by testing and monitoring the user load. SIP Protocol: Events In Processing This component monitor returns the number of SIP transactions, or dialog state change events, that are currently being processed. You will need to baseline this counter by testing and monitoring the user load. SIP Responses: Local 500 Responses/sec This component monitor returns the rate of 500 responses generated by the server, per second. This can indicate that there is a server component that is not functioning correctly. SIP Responses: Local 503 Responses/sec This component monitor returns the rate of 503 responses generated by the server, per second. The 503 code corresponds to the server being unavailable. On a healthy server, you should not receive this code at a steady rate. However, during ramp up, after a server has been brought back online, there may be some 503 responses. Once all users get back in and the server returns to a stable state, there should no longer be any 503 responses returned. SIP Responses: Local 504 Responses/sec This component monitor returns the rate of 504 responses generated by the server, per second. A few 504 responses to clients (for clients disconnecting abruptly) is to be expected, but this counter mainly indicates connectivity issues with other servers. It can indicate connection failures or delays connecting to remote servers.
SIP Load Management: Average Holding Time For Incoming Messages This component monitor returns the average time that the server held the incoming messages currently being processed. This should usually be less than one second, on average, but it is normal to see short spikes of up to three seconds. The server will throttle new incoming messages after going above the high watermark and until the number of messages falls below the low watermark. The server starts rejecting new connections when the average holding time is greater than overload time of 15 seconds. SIP Load Management: Address space usage This component monitor returns the percentage of available address space currently in use by the server process. The returned value should be as low as possible. SIP Load Management: Page file usage This component monitor returns the percentage of available page file space currently in use by the server process. The returned value should be as low as possible. IM Conferences: Active Conferences This component monitor returns the number of active conferences. You will need to baseline this counter by testing and monitoring the user load. IM Conferences: Connected Users This component monitor returns the number of connected users in all conferences. You will need to baseline this counter by testing and monitoring the user load. IM Conferences: Throttled Sip Connections This component monitor returns the number of throttled Sip connections. If the value is greater than ten, it could indicate that Peer is not processing requests in a timely fashion. This can happen if the peer machine is overloaded. Peer is defined as the connected servers, adjacent Front-End servers, or MCUs in the same EE Pool. The same set of counters apply. IM MCU Health And Performance: MCU Health State This component monitor returns the current health of the MCU. Possible values: 0 = Normal. 1 = Loaded. 2 = Full. 3 = Unavailable.
IM MCU Health And Performance: MCU Draining State This component monitor returns the current draining status of the MCU. Possible values: 0 = Not requesting to drain. 1 = Requesting to drain. 2 = Draining. When a server is drained, it stops taking new connections and calls. These new connections and calls are routed through other servers in the pool. A server being drained allows its sessions on existing connections to continue until they naturally end. When all existing sessions have ended, the server is ready to be taken offline. User Services - DBStore: Queue Latency (msec) This component monitor returns the average time, in milliseconds, that a request is held in the database queue. This counter represents the time that a request spends in the queue of the Back-End Database Server. If the topology is healthy, this counter averages less than 100 ms. Occasional spikes are acceptable. The value will be higher on Front-End Servers that are located at the site opposite the location of the Back-End Database Servers. This value can increase if the Back-End Database Server is having performance problems or if network latency is too high. If the returned value is high, check both network latency and the health of the Back-End Database Server. Server health decreases as latency increases to 12 seconds, when server throttling begins. User Services - DBStore: Sproc Latency (msec) This component monitor returns the average time, in milliseconds, it takes to execute a stored procedure call. A healthy state is considered to be less than 100 ms. Server health decreases as latency increases to 12 seconds, when server throttling begins. User Services - Https Transport: Number of failed connection attempts / Sec This component monitor returns the rate of connection attempt failures, per second. You will need to baseline this counter by testing and monitoring the server's health.
Microsoft Lync Server (Mediation Role)

This template assesses the status and overall health of services as well as the performance of the Mediation Microsoft Lync Server. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on the target server. Monitored Components Note: You need to set thresholds for these counters according to your environment. It is recommended to monitor these counters for some period of time to understand potential value ranges and then set the thresholds accordingly. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Service: Lync Server Replica Replicator Agent This component monitor returns the CPU and memory usage of the Lync Server Replica Replicator Agent. This service is used by the File Transfer Agent for replication configuration settings. Outbound Calls: Current This component monitor returns the total number of active calls going through the Mediation Server. Outbound Calls: Active media bypass calls This component monitor returns the total number of active calls going through Mediation Server that are in Media Bypass mode. Calls using Media Bypass use significantly fewer Mediation Server resources because the media is not flowing through the Mediation Server. Inbound Calls: Current This component monitor returns the number of inbound calls in progress. Inbound Calls: Active media bypass calls This component monitor returns the number of media bypass calls in progress. Media Relay: Media Connectivity Check Failure This component monitor returns the number of calls where media connectivity between the Mediation Server and the remote endpoints could not be established. The returned value should be as low as possible.
Health Indices: Load Call Failure Index This component monitor returns the scaled index between zero and 100 that is related to all call failures due to Global Health Index as a heavy load. Global Counters: Current audio channels with PSM quality reporting This component monitor returns the total number of active channels that are having Phase Shift Modulation (PSM) quality reported. Calculating PSM quality has a processing overhead so this should be taken into account when measuring performance. Total failed calls caused by unexpected interaction from the Proxy This component monitor returns the number of calls that failed because of an unexpected response from the Front End Server. The returned value should be as low as possible. Total failed calls caused by unexpected interaction from a gateway This component monitor returns the number of calls that failed because of an unexpected response
Microsoft Network Policy Server Events

This template assesses the status and overall performance of a Microsoft Network Policy Server (NPS). This template uses Windows System and Security Event Logs. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on the target server. Monitored Components Note: All Windows Event Log monitors should return zero values. Returned values other than zero indicate an abnormality. Examining the Windows System and Security log files should provide information pertaining to the issue. Note: Detailed information about all these events can be found here: http://technet.microsoft.com/en-us/library/cc732054(WS.10).aspx. Warning: NPS discarded the request for a user This monitor returns the number of events when the Network Policy Server discarded the request for a user. Type of event: Warning. Event ID: 6274. This condition occurs when the NPS discards accounting requests because the structure of the accounting request message that was sent by a RADIUS client does not comply with the RADIUS protocol. You should reconfigure, upgrade, or replace the RADIUS client. Warning: Domain Controller is not responsive This monitor returns the number of events when domain controller is not responsive. Type of event: Warning. Event ID: 4401. You should check your domain controller availability. Warning: NPS denied access to a user This monitor returns the number of events when the Network Policy Server denied access to a user. Type of event: Warning. Event ID: 6273. This error might be caused by one of the following conditions: The user does not have valid credentials;
The connection method is not allowed by the network policy; The network access server is under attack; NPS does not have access to the user account database on the domain controller; NPS log files and/or the SQL Server database is not available.
Warning: Internal error This monitor returns the number of events when an internal error occurred while processing a request. Type of event: Warning. Event ID: 12. This error is typically returned when an exception that is not identified by some other error occurs. This error can also be returned by Extensible Authentication Protocol (EAP) or Schannel. Warning: NPS discarded the accounting request for a user This monitor returns the number of events when Network Policy Server discarded the accounting request for a user. Type of event: Warning. Event ID: 6275. Network corruption, latency, or other network problems unrelated to NPS might produce this condition. Wait a short while to see if the condition still exists. This problem might resolve itself. Warning: Remote RADIUS server has not responded This monitor returns the number of events when the remote RADIUS server has not responded to consecutive requests. Type of event: Warning. Event ID: 36. You should manually check the availability of the remote RADIUS server. Warning: Server communication problems This monitor returns the number of events when NPS cannot communicate with RADIUS clients due to different errors in the RADIUS message. Type of event: Warning. Event ID: 15,16,17,18,19. This condition can occur if the server running NPS receives one of the following from a RADIUS client: A response of a malformed message;
A response that contains an incorrect value in the Code field; An Access-Request message that does not contain a MessageAuthenticator attribute; A response that contains a message authenticator that is not valid; An Access-Request message that contains an Extensible Authentication Protocol (EAP) message, but no MessageAuthenticator attribute.
Network corruption, latency, or other network problems unrelated to NPS might produce this condition. Wait a short while to confirm that the condition still exists. This problem might resolve itself. Warning: NPS could not send a response due to network problems This monitor returns the number of events when NPS could not send a response due to a network error. The data is the error code generated by Windows Sockets. Type of event: Warning. Event ID: 22. Use Windows Sockets error messages and documentation to determine the Windows Sockets reason for failure and to help determine the steps for a resolution. For more information, see Windows Sockets Error Codes at http://go.microsoft.com/fwlink/?LinkId=95404. Warning: RADIUS error occurred This monitor returns the number of events when a RADIUS error occurred. Type of event: Warning. Event ID: 23. Use Windows Sockets error messages and documentation to determine the Windows Sockets reason for failure and to help determine the steps for a resolution. For more information, see Windows Sockets Error Codes at http://go.microsoft.com/fwlink/?LinkId=95404. Warning: Message with invalid authenticator This monitor returns the number of events when a RADIUS message was received from a RADIUS client with an invalid authenticator. Type of event: Warning. Event ID: 14. This is typically caused by mismatched shared secrets. Verify the configuration of the shared secret for the RADIUS client in the Network Policy Server snap-in and the configuration of the network access server.
Warning: Response to client exceeds maximum message length This monitor returns the number of events when the response to a RADIUS client exceeds the maximum RADIUS message length of 4096 bytes. Type of event: Warning. Event ID: 21. This condition can occur under the following circumstances: The RADIUS client configuration is incorrect and NPS received a RADIUS message that contains an authenticator that is not valid The RADIUS client needs to be updated because the size of the RADIUS message received from the RADIUS client exceeds the message size specified in the RADIUS protocol.
Warning: Could not resolve the name of RADIUS client This monitor returns the number of events when the name of the RADIUS client could not be resolved. The data returned is the error code generated by Windows Sockets. Type of event: Warning. Event ID: 10. This condition can occur under the following circumstances: In the NPS Microsoft Management Console (MMC), a RADIUS client is configured by fully qualified domain name (FQDN) or NetBIOS name, rather than by IP address, and NPS has not received a DNS server response to the name resolution query. Without the IP address provided by the name resolution query, NPS cannot contact the RADIUS client; NPS is receiving communication from a RADIUS client that is not configured in the NPS MMC; In the NPS MMC, a RADIUS client is configured by either IPv4 or IPv6 address, but the format of the IP address is incorrect.
Warning: Wrong RADIUS clients IP address This monitor returns the number of events when the IP address of the RADIUS client is not a valid IP address. Type of event: Warning. Event ID: 11. This condition can occur under the following circumstances:
In the NPS Microsoft Management Console (MMC), a RADIUS client is configured by fully qualified domain name (FQDN) or NetBIOS name rather than by IP address, and NPS has not received a DNS server response to the name resolution query. Without the IP address provided by the name resolution query, NPS cannot contact the RADIUS client NPS is receiving communication from a RADIUS client that is not configured in the NPS MMC; In the NPS MMC, a RADIUS client is configured by either IPv4 or IPv6 address, but the format of the IP address is incorrect.
Warning: Message received from invalid RADIUS client IP This monitor returns the number of events when a RADIUS message was received from the invalid RADIUS client IP address. Type of event: Warning. Event ID: 13. This condition can occur under the following circumstances: In the NPS Microsoft Management Console (MMC), a RADIUS client is configured by fully qualified domain name (FQDN) or NetBIOS name rather than by IP address, and NPS has not received a DNS server response to the name resolution query. Without the IP address provided by the name resolution query, NPS cannot contact the RADIUS client; NPS is receiving communication from a RADIUS client that is not configured in the NPS MMC; In the NPS MMC, a RADIUS client is configured by either IPv4 or IPv6 address, but the format of the IP address is incorrect.
Error: No available domain controllers This monitor returns the number of events that occur when there is no domain controller available for the domain. Type of event: Error. Event ID: 4402. You should check your domain controller availability. Error: NPS license compliance This monitor returns the number of events when this edition of Windows Server cannot support any of the following NPS configurations: More than 50 RADIUS clients;
More than two RADIUS server groups; Client identification by subnet mask.
Type of event: Error. Event ID: 46. To set up your server to support any of these configurations, install a Windows Server edition without these limitations. Error: Disk is full This monitor returns the number of events that occur when a disk is full. NPS could not delete older log files to create free space or could not find older an log file to delete and create free space. Type of event: Error. Event ID: 43,44. You should verify that there is free disk space. Error: RADIUS proxy could not resolve the name of remote server This monitor returns the number of events when the RADIUS Proxy could not resolve the name of remote RADIUS server in a remote RADIUS server group to an IP address. Type of event: Error. Event ID: 24. You should manually check DNS settings and the availability of the remote RADIUS server. Error: Unable to forward request to remote server This monitor returns the number of events that occur when the RADIUS Proxy was unable to forward a RADIUS request to a remote RADIUS server because of a network error. Type of event: Error. Event ID: 33. You should manually check network configuration.
Microsoft Network Policy Server RADIUS Proxy

This template assesses the status and overall performance of a Microsoft Network Policy Server (NPS) configured as RADIUS proxy. Note: Apply this template if you have NPS installed as a RADIUS proxy. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on the target server. Monitored Components Note: You need to set thresholds for counters according to your environment. It is recommended to monitor counters for some period of time to understand potential value ranges and then set the thresholds accordingly. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Accounting: Accounting-Requests/sec This monitor returns the average number of RADIUS Accounting-Request packets sent per second to the accounting port. Accounting: Accounting-Responses/sec This monitor returns the average number of RADIUS Accounting-Response packets received per second on the accounting port. Authentication: Access-Accepts/sec This monitor returns the average number of RADIUS Access-Accept packets received per second from this server. Authentication: Access-Challenges/sec This monitor returns the average number of RADIUS Access-Challenge packets received per second from this server. Authentication: Access-Rejects/sec This monitor returns the average number of RADIUS Access-Reject packets received per second from this server. Authentication: Access-Requests/sec This monitor returns the average number of RADIUS Access-Request packets sent per second to this server. Authentication: Bad Authenticators/sec This monitor returns the average number of RADIUS packets that contain an invalid Message Authenticator attribute per second.
Authentication: Dropped Packets/sec This monitor returns the average number of incoming packets per second that are silently discarded for a reason other than "malformed," "invalid Message Authenticator," or "unknown type." Authentication: FullAccess-Decisions/sec This monitor returns the average number of Full-Access decisions received per second from this server. Authentication: Malformed Packets/sec This monitor returns the average number of packets containing malformed data received per second. Authentication: Probation-Decisions/sec This monitor returns the average number of probation decisions received per second from this server. Authentication: Quarantine-Decisions/sec This monitor returns the average number of quarantine decisions received per second from this server. Authentication: Unknown Type/sec This monitor returns the average number of unknown type (non-RADIUS) packets received per second. Authentication: Invalid Addresses/sec This monitor returns the average number of packets received per second from unknown addresses. Authentication: Pending Requests This monitor returns the number of requests destined for this server that have not yet timed out or received a response. Authentication: Request Timeouts/sec This monitor returns the average number of request timeouts per second to this server. Authentication: Retransmissions/sec This monitor returns the average number of requests retransmitted per second to this server.
Policy Engine: Last Round-Trip Time This monitor returns the interval (in hundredths of a second) between the most recent request to the policy engine and its response. Policy Engine: Matched Remote Access Policies/sec This monitor returns the average number of remote access policies that have been matched per second. Policy Engine: Pending Requests This monitor returns the number of requests that have entered the policy engine but have not yet completed the process. Service: Network Policy Server This monitor returns the CPU and memory usage of the Network Policy Server service. This service manages authentication, authorization, auditing and accounting for virtual private network (VPN), dial-up, 802.1x wireless or Ethernet switch connection attempts sent by access servers that are compatible with the IETF RADIUS protocol. If this service is stopped, users might be unable to obtain a VPN, dial-up, wireless, or Ethernet connection to the network. If this service is disabled, any services that explicitly depend on it will fail to start.
Microsoft Network Policy Server RADIUS Server

This template assesses the status and overall performance of a Microsoft Network Policy Server (NPS) configured as a RADIUS server. Note: Apply this template if you have NPS installed as a RADIUS server. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on the target server. Monitored Components Note: You need to set thresholds for counters according to your environment. It is recommended to monitor counters for some period of time to understand potential value ranges and then set the thresholds accordingly. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Service: Network Policy Server This monitor returns the CPU and memory usage of the Network Policy Server service. This service manages authentication, authorization, auditing, and accounting for virtual private network (VPN), dial-up, 802.1x wireless or Ethernet switch connection attempts sent by access servers that are compatible with the IETF RADIUS protocol. If this service is stopped, users might be unable to obtain a VPN, dial-up, wireless, or Ethernet connection to the network. If this service is disabled, any services that explicitly depend on it will fail to start. Accounting: Accounting-Requests/sec This monitor returns the average number of RADIUS Accounting-Requests received on the accounting port, per second. Accounting: Accounting-Responses/sec This monitor returns the average number of RADIUS Accounting-Responses sent per second. Accounting: Server Reset Time This monitor returns the time elapsed (in hundredths of a second) since the configuration of this NPS server was reset because of a configuration change or because the service control manager sent a reset to the NPS service. Accounting: Server Up Time This monitor returns the time elapsed (in hundredths of a second) since the server process was started on this NPS server.
Authentication: Access-Accepts/sec This monitor returns the average number of RADIUS Access-Accept packets sent per second. Authentication: Access-Challenges/sec This monitor returns the average number of RADIUS Access-Challenge packets sent per second. Authentication: Access-Rejects/sec This monitor returns the average number of RADIUS Access-Reject packets sent per second. Authentication: Access-Requests/sec This monitor returns the average number of packets received per second on the authentication port. Authentication: Bad Authenticators/sec This monitor returns the average number of RADIUS packets per second that contain an invalid Message Authenticator attribute. Authentication: Dropped Packets/sec This monitor returns the average number of incoming packets per second that are silently discarded for a reason other than "malformed," "invalid Message Authenticator," or "unknown type." Authentication: FullAccess-Decisions/sec This monitor returns the average number of Full-Access decisions sent per second to this client. Authentication: Malformed Packets/sec This monitor returns the average number of packets containing malformed data received per second. Authentication: Probation-Decisions/sec This monitor returns the average number of probation decisions sent per second to this client. Authentication: Quarantine-Decisions/sec This monitor returns the average number of quarantine decisions sent per second to this client.
Authentication: Unknown Type/sec This monitor returns the average number of unknown type (non-RADIUS) packets received per second. Authentication: Invalid Requests/sec This monitor returns the average number of RADIUS packets from unknown clients or remote RADIUS servers received per second. Policy Engine: Last Round-Trip Time This monitor returns the interval (in hundredths of a second) between the most recent request to the policy engine and its response. Policy Engine: Matched Remote Access Policies/sec This monitor returns the average number of remote access policies that have been matched per second. Policy Engine: Pending Requests This monitor returns the number of requests that have entered the policy engine but have not yet completed the process.
Microsoft Windows Server 2003 Failover Cluster

This template assesses the status and overall health and status of a Microsoft Windows 2003 Failover Cluster by retrieving information from the Windows System Event Log. For more information, refer to the following Microsoft article: http://technet.microsoft.com/en-us/library/cc720058%28WS.10%29.aspx. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on the target server. Note: All Windows Event Log monitors should return zero values. Returned values other than zero indicates an abnormality. Examining the Windows system log files should provide information pertaining to the issue. Detailed information about these events can be found here: http://technet.microsoft.com/enus/library/dd353290(WS.10).aspx. Monitored Components Service: Windows Time This monitor returns the CPU and memory usage of the Windows Time service. This service maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Service: Cluster Service This monitor returns the CPU and memory usage of the Cluster service. This service enables servers to work together as a cluster to keep server-based applications highly available, regardless of individual component failures. If this service is stopped, clustering will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Backup and Restore Functionality Problems This monitor returns the number of events that occur when: The backup operation for the cluster configuration data has been aborted because quorum for the cluster has not yet been achieved; The restore request for the cluster configuration data has failed during the "pre-restore" or "post-restore" stage.
Type of event: Error. Event ID: 1541, 1542, 1543. Check for the following pre-conditions to make sure they have been met, and then retry the backup or restore operation:
The cluster must achieve quorum. In other words, enough nodes must be running and communicating (perhaps with a witness disk or witness file share, depending on the quorum configuration) that the cluster has achieved a majority, that is, quorum. The account used by the person performing the backup must be in the local Administrators group on each clustered server, and must be a domain account, or must have been delegated the equivalent authority.
During a restore, the restore software must obtain exclusive access to the cluster configuration database on a given node. If other software has access (open handles to the database), the restore cannot be performed. Cluster Network Connectivity Problems This monitor returns the number of events that occur when: The Cluster network interface for some cluster node on a special network failed; The Cluster network is partitioned and some attached failover cluster nodes cannot communicate with each other over the network; The Cluster network is down; The Cluster IP address resource failed to come online; Attempting to use IPv4 for a special network adapter failed.
Type of event: Warning and Error. Event ID: 1127, 1129, 1130, 1360, 1555. Run the Validate a Configuration Wizard, selecting only the network tests. Also check network devices (adapters, cables, hubs, switches, etc) and quorum configuration. Compare the properties of the IP Address resource with the properties of the corresponding network to ensure that the network and subnet information match. If this is an IPv6 resource, make sure that the cluster network for this resource has at least one IPv6 prefix that is not link-local or tunnel. Cluster Service Startup Problems This monitor returns the number of events that occur when: The Cluster service suffered an unexpected fatal error; The Cluster service was halted due to incomplete connectivity with other cluster nodes;
The Cluster service was halted to prevent an inconsistency within the failover cluster; The Cluster resource host subsystem (RHS) stopped unexpectedly; The Cluster resource either crashed or deadlocked; The Cluster service encountered an unexpected problem and will be shut down; The Cluster service has prevented itself from starting on this node. (This node does not have the latest copy of cluster configuration data.) The membership engine detected that the arbitration process for the quorum device has stalled.
Type of event: Error. Event ID: 1000, 1006, 1073, 1146, 1230, 1556, 1561, 1178. There are various software or hardware related causes that can prevent the Cluster service from starting on a node. Sometimes the Cluster service can restart successfully after it has been interrupted by one of those causes. Review the event logs for indications of the problem. Check network hardware and configuration. Use the Validate a Configuration Wizard to review the network configuration. Check to see which resource DLL is causing the issue and report the problem to the resource vendor. Consider configuring the resource to run in its own Resource Monitor. Note that while a problem with a resource DLL will not stop the Cluster service from running, it can prevent other resource DLLs from running unless the resource runs in its own Resource Monitor. Try starting the Cluster service on all other nodes in the cluster. If the Cluster service can be started on a node with the latest copy of the cluster configuration data, then the node that previously could not be started will probably be able to obtain the latest copy and then join the cluster successfully. Cluster Shared Volume Functionality Problems This monitor returns the number of events that occur when: The Cluster Shared Volume is no longer available on this node; The Cluster Shared Volume is no longer directly accessible from this cluster node;
The Cluster service failed to create the Cluster Shared Volumes root directory; The Cluster service failed to set the permissions (ACL) on the Cluster Shared Volumes root directory; The Cluster Shared Volume is no longer accessible from this cluster node; The Cluster service failed to create a cluster identity token for Cluster Shared Volumes.
Type of event: Error. Event ID: 5120, 5121, 5123, 5134, 5135, 5142, 5200. Review events related to communication with the volume. Check storage and network configuration. Check Cluster Shared Volumes folder creation and permissions. Check communication between domain controllers and nodes. Cluster Storage Functionality Problems This monitor returns the number of events that occur when: The Cluster Physical Disk resource cannot be brought online because the associated disk could not be found; While the disk resource was being brought online, access to one or more volumes failed with an error; The file system for one or more partitions on the disk for the resource may be corrupt; The Cluster disk resource indicates corruption for specific volume; The Cluster disk resource contains an invalid mount point.
Type of event: Error. Event ID: 1034, 1035, 1037, 1066, 1208. Confirm that the affected disk is available. Check the underlying storage hardware and confirm that the device is being presented correctly to the cluster nodes. If you have problems with partitions on the disk or corruption, we recommend that you run Chkdsk so that it can correct any problems with the file system.
Confirm that the mounted disk is configured according to the following guidelines: Clustered disks can only be mounted onto clustered disks (not local disks); The mounted disk and the disk it is mounted onto must be part of the same clustered service or application. They cannot be in two different clustered services or applications, and they cannot be in the general pool of Available Storage in the cluster. Cluster Witness Problems This monitor returns the number of events that occur when: The Cluster service failed to update the cluster configuration data on the witness resource due to resource inaccessibility; The Cluster service detected a problem with the witness resource; The File Share Witness resource failed a periodic health check; The File Share Witness resource failed to come online; The File Share Witness resource failed to arbitrate for the specific file share; The node failed to form a cluster because the witness was not accessible.
Type of event: Error. Event ID: 1557, 1558, 1562, 1563, 1564, 1573. Confirm witness accessibility by viewing the quorum configuration of a failover cluster and the status of a witness disk. Configuration Availability Problems This monitor returns the number of events that occur when: The cluster configuration database could not be loaded or unloaded; The cluster service cannot start due to failed attempts to read configuration data.
Type of event: Error. Event ID: 1057, 1090, 1574, 1575, 1593.
When the cluster configuration on a node is missing or corrupt, the Cluster service cannot load the configuration and therefore cannot start. Where possible, the Cluster service will obtain the latest cluster configuration from other nodes in the cluster. Ensure that other nodes are started. If the only node or nodes that can be started appear to have a missing or corrupt cluster configuration database, you will probably need to restore one of the nodes from a system state backup. (For a failover cluster node, the system state backup includes the cluster configuration.) Sometimes when the node attempts to unload the cluster configuration database, the action does not fully complete. Try stopping and restarting the Cluster service. If this does not succeed, restart the operating system on the affected node. DFS Namespace Resource Availability Problems This monitor returns the number of events that occur when: The creation of DFS namespace root failed with error; The resynchronization of DFS root target failed with error; The cluster file share resource for DFS Namespace cannot be brought online due to error.
Type of event: Error. Event ID: 1138, 1141, 1142. Check DFS namespace configuration. Encrypted Settings for Cluster Resource Could not Applied This monitor returns the number of events when encrypted settings for a cluster resource could not be successfully applied to the container on this node. Type of event: Error. Event ID: 1121. Close any application that might have an open handle to the registry checkpoint indicated by the event. This will allow the registry key to be replicated as configured with the resource properties. If necessary, contact the application vendor about this problem. You can use a utility called Handle with the -a option to view handles to the registry. Failed to Form Cluster This monitor returns the number of Failed to Form cluster events. Type of event: Error. Event ID: 1092, 1009. You might be able to correct this issue by restarting the Cluster service.
File Share Resource Availability Problems This monitor returns the number of events that occur when: The Cluster File Share cannot be brought online because a file share could not be created; The retrieving of information for a specific share returned an error code; The retrieving of information for a specific share indicated that the share does not exist; The Creation of a file share failed due to an error; The Cluster file share resource has detected shared folder conflicts; The Cluster file server resource failed a health check because some of its shared folders were inaccessible.
Type of event: Warning and Error. Event ID: 1053, 1054, 1055, 1068, 1560, 1585, 1586, 1587, 1588. Confirm that the share exists and that the permissions allow access to the share. If possible, determine whether the path to the share has been changed. If so, recreate the share with the correct name. View all the resources in the clustered file server instance to ensure that they are coming online, and review the dependencies among the resources. Reconfigure as necessary to correct any problems. Ensure that no two shared folders have the same share name. Check shared folder accessibility and the State of Server service. Generic Application Could not be Brought Online This monitor returns the number of events that occur when a generic application could not be brought online during an attempt to create the process due to; the application not being present on this node, an incorrect path name, or an incorrect binary name. Type of event: Error. Event ID: 1039. Confirm that the following are true for the application used by the clustered Generic Application instance:
The application is fully installed on all nodes that are possible owners of the Generic Application resource; The configuration for the Generic Application resource specifies the correct application and path; The configuration for the Generic Application resource specifies the appropriate parameters and settings for registry replication.
Generic Service Resource Availability Problems This monitor returns the number of events that occur when: The generic service is either not installed or the specified service name is invalid; The specified generic service parameters might be invalid; The generic service failed with an error.
Type of event: Error. Event ID: 1040, 1041, 1042. Confirm that the correct service is specified in the configuration for the Generic Service resource and confirm that the service is fully installed on all nodes that are possible owners of the resource. Check service operation and examine the application event log. IP address Resource Availability Problems This monitor returns the number of events that occur when: The Cluster IP address resource cannot be brought online because the subnet mask value is invalid; The Cluster IP address resource cannot be brought online because the address value is invalid; The configuration data for the network adapter corresponding to the cluster network interface could not be determined; The Cluster IP address resource cannot be brought online because a duplicate IP address was detected on the network; The Cluster IP address resource cannot be brought online because WINS registration; The lease of the IP address associated with the cluster IP address resource has expired or is about to expire, and currently cannot be renewed;
The IPv6 Tunnel address resource failed to come online because it does not depend on an IP Address (IPv4) resource; The Cluster network associated with dependent IP address (IPv4) resource does not support ISATAP tunneling.
Type of event: Error. Event ID: 1046, 1047, 1048, 1049, 1078, 1242, 1361, 1363. Check the address, subnet, and network properties of the IP Address resource. If the resource is an IPv6 Tunnel address resource, make sure it depends on at least one IP Address (IPv4) resource. Also make sure the network supports Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) tunneling. If the IP Address resource appears to be configured correctly, check the condition of network adapters and other network components used by the cluster. Network Connectivity and Configuration Problems This monitor returns the number of events that occur when: The Cluster Service was unable to access the network adapter or the cluster node has no network connectivity; The Cluster node has no network connectivity; The Cluster node has lost all network connectivity; The failover cluster virtual adapter failed to initialize the miniport adapter.
Type of event: Error. Event ID: 1289, 1553, 1554, 4871. Correct any problems with the physical network adapters and the cluster virtual adapter. If a previous change in the configuration is interfering with the function of the cluster virtual adapter, it might be necessary to reinstall the failover clustering feature on the node. Also, use the Validate a Configuration Wizard to review the network configuration. Node Failed to Join Cluster This monitor returns the number of events that occur when the node failed to join the failover cluster due to an error. Type of event: Error. Event ID: 1070.
You might be able to correct this issue by restarting the Cluster service. Problems with Cluster Service This monitor returns the number of events that occur when: The cluster resource in the Clustered service or application failed; The Cluster service failed to bring the Clustered service or application completely online or offline and one or more resources may be in a failed state.
Type of event: Warning and Error. Event ID: 1039, 1205. Check and correct any problems with the application or service associated with the resource. Check and correct any problems with cables or cluster-related devices. Adjust the properties for the resource in the cluster configuration, especially the value for the Pending Timeout for the resource. This value must allow enough time for the associated application or service to start. Check the state of all resources in the clustered service or application. Quorum was Lost This monitor returns the number of events that occur when the Cluster service is shutting down because quorum was lost. Type of event: Error. Event ID: 1177. This can occur when network connectivity is lost between some or all of the nodes in the cluster, or the witness disk fails over. It can also occur if you make a change in the cluster configuration such as increasing the number of nodes, when the number of nodes currently online is too few to achieve quorum in the new configuration. Run the Validate a Configuration Wizard, selecting only the network tests. Also check network devices (adapters, cables, hubs, switches, etc.) and quorum configuration. Registry Checkpoint Could not be Restored to Registry Key This monitor returns the number of events that occur when the Registry Checkpoint for Cluster resource could not be restored to a registry key. Type of event: Error. Event ID: 1024.
Close any application that might have an open handle to the registry checkpoint indicated by the event. This will allow the registry key to be replicated as configured with the resource properties. If necessary, contact the application vendor about this problem. You can use a utility called Handle with the -a option to view handles to the registry. System is not being Responsive This monitor returns the number of events that occur when the Failover cluster virtual adapter has lost contact with the process. Type of event: Error. Event ID: 4869, 4870. Use Resource Monitor to determine, in real time, how many system resources a service or application is utilizing. This may take several minutes if the system is critically low on resources.
Microsoft Windows Server 2008 Failover Cluster

This template assesses the status and overall performance of a Microsoft Windows 2008 Failover Cluster by retrieving information from performance counters and the Windows System Event Log. For more information, refer to the following Microsoft article: http://technet.microsoft.com/enus/library/cc720058%28WS.10%29.aspx. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on the target server. Note: All Windows Event Log monitors should return zero values. Returned values other than zero indicates an abnormality. Examining the Windows system log files should provide information pertaining to the issue. Detailed information about these events can be found here: http://technet.microsoft.com/enus/library/dd353290(WS.10).aspx. Monitored Components Note: You need to set thresholds for counters according to your environment. It is recommended to monitor counters for some period of time to understand potential value ranges and then set the thresholds accordingly. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Service: Windows Time This monitor returns the CPU and memory usage of the Windows Time service. This service maintains date and time synchronization on all clients and servers in the network. If this service is stopped, date and time synchronization will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Service: Cluster Service This monitor returns the CPU and memory usage of the Cluster service. This service enables servers to work together as a cluster to keep server-based applications highly available, regardless of individual component failures. If this service is stopped, clustering will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Network Reconnections: Reconnect Count This monitor returns the number of times the nodes have reconnected. Note: The instance field is installation-specific. You need to specify the hostname of your cluster node (for example: node1). By default, this component monitor is disabled and should only be enabled for troubleshooting purposes.
Network Reconnections: Normal Message Queue Length This monitor returns the number of normal messages that are in the queue waiting to be sent. Normally this number is 0, but if the TCP connection breaks, you might observe it is going up until the TCP connection is reestablished and we can send all of them through. Note: The instance field is installation-specific. You need to specify the hostname of your cluster node (for example: node1). By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. Network Reconnections: Urgent Message Queue Length This monitor returns the number of urgent messages that are in the queue waiting to be sent. Normally this number is 0, but if the TCP connection breaks, you might observe it going up until the TCP connection is reestablished, thereby allowing all messages to be sent. Note: The instance field is installation-specific. You need to specify the hostname of your cluster node (for example: node1). By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. Messages Outstanding This monitor returns the number of cluster MRR outstanding messages. The returned value should be near zero. Resource Control Manager: Groups Online This monitor returns the number of online cluster resource groups on this node. The returned value should be above zero at all times. Resource Control Manager: RHS Processes This monitor returns the number of running resource host subsystem processes (rhs.exe). The returned value should be above zero at all times. Resource Control Manager: RHS Restarts This monitor returns the number of resource host subsystem process (rhs.exe) restarts. Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. Resources: Resource Failure This monitor returns the number of resource failures. The returned value should be as low as possible.
Resources: Resource Failure Access Violation This monitor returns the number of resource failures caused by access violation. The returned value should be as low as possible. Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. Resources: Resource Failure Deadlock This monitor returns the number of resource failures caused by deadlock. Deadlocks are usually caused by the resource taking too long to execute certain operations. The returned value should be as low as possible. Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. Backup and Restore Functionality Problems This monitor returns the number of events that occur when: The backup operation for the cluster configuration data has been aborted because quorum for the cluster has not yet been achieved; The restore request for the cluster configuration data has failed during the "pre-restore" or "post-restore" stage.
Type of event: Error. Event ID: 1541, 1542, 1543. Check for the following pre-conditions to make sure they have been met, and then retry the backup or restore operation: The cluster must achieve quorum. In other words, enough nodes must be running and communicating (perhaps with a witness disk or witness file share, depending on the quorum configuration) that the cluster has achieved a majority, that is, quorum. The account used by the person performing the backup must be in the local Administrators group on each clustered server, and must be a domain account, or must have been delegated the equivalent authority.
During a restore, the restore software must obtain exclusive access to the cluster configuration database on a given node. If other software has access (open handles to the database), the restore cannot be performed. Cluster Network Connectivity Problems This monitor returns the number of events that occur when:
The Cluster network interface for some cluster node on a special network failed; The Cluster network is partitioned and some attached failover cluster nodes cannot communicate with each other over the network; The Cluster network is down; The Cluster IP address resource failed to come online; Attempting to use IPv4 for a special network adapter failed.
Type of event: Warning and Error. Event ID: 1127, 1129, 1130, 1360, 1555. Run the Validate a Configuration Wizard, selecting only the network tests. Also check network devices (adapters, cables, hubs, switches, etc) and quorum configuration. Compare the properties of the IP Address resource with the properties of the corresponding network to ensure that the network and subnet information match. If this is an IPv6 resource, make sure that the cluster network for this resource has at least one IPv6 prefix that is not link-local or tunnel. Cluster Service Startup Problems This monitor returns the number of events that occur when: The Cluster service suffered an unexpected fatal error; The Cluster service was halted due to incomplete connectivity with other cluster nodes; The Cluster service was halted to prevent an inconsistency within the failover cluster; The Cluster resource host subsystem (RHS) stopped unexpectedly; The Cluster resource either crashed or deadlocked; The Cluster service encountered an unexpected problem and will be shut down; The Cluster service has prevented itself from starting on this node. (This node does not have the latest copy of cluster configuration data.) The membership engine detected that the arbitration process for the quorum device has stalled.
Type of event: Error. Event ID: 1000, 1006, 1073, 1146, 1230, 1556, 1561, 1178. There are various software or hardware related causes that can prevent the Cluster service from starting on a node. Sometimes the Cluster service can restart successfully after it has been interrupted by one of those causes. Review the event logs for indications of the problem. Check network hardware and configuration. Use the Validate a Configuration Wizard to review the network configuration. Check to see which resource DLL is causing the issue and report the problem to the resource vendor. Consider configuring the resource to run in its own Resource Monitor. Note that while a problem with a resource DLL will not stop the Cluster service from running, it can prevent other resource DLLs from running unless the resource runs in its own Resource Monitor. Try starting the Cluster service on all other nodes in the cluster. If the Cluster service can be started on a node with the latest copy of the cluster configuration data, then the node that previously could not be started will probably be able to obtain the latest copy and then join the cluster successfully. Cluster Shared Volume Functionality Problems This monitor returns the number of events that occur when: The Cluster Shared Volume is no longer available on this node; The Cluster Shared Volume is no longer directly accessible from this cluster node; The Cluster service failed to create the Cluster Shared Volumes root directory; The Cluster service failed to set the permissions (ACL) on the Cluster Shared Volumes root directory; The Cluster Shared Volume is no longer accessible from this cluster node; The Cluster service failed to create a cluster identity token for Cluster Shared Volumes.
Type of event: Error. Event ID: 5120, 5121, 5123, 5134, 5135, 5142, 5200. Review events related to communication with the volume. Check storage and network configuration.
Check Cluster Shared Volumes folder creation and permissions. Check communication between domain controllers and nodes. Cluster Storage Functionality Problems This monitor returns the number of events that occur when: The Cluster Physical Disk resource cannot be brought online because the associated disk could not be found; While the disk resource was being brought online, access to one or more volumes failed with an error; The file system for one or more partitions on the disk for the resource may be corrupt; The Cluster disk resource indicates corruption for specific volume; The Cluster disk resource contains an invalid mount point.
Type of event: Error. Event ID: 1034, 1035, 1037, 1066, 1208. Confirm that the affected disk is available. Check the underlying storage hardware and confirm that the device is being presented correctly to the cluster nodes. If you have problems with partitions on the disk or corruption, we recommend that you run Chkdsk so that it can correct any problems with the file system. Confirm that the mounted disk is configured according to the following guidelines: Clustered disks can only be mounted onto clustered disks (not local disks); The mounted disk and the disk it is mounted onto must be part of the same clustered service or application. They cannot be in two different clustered services or applications, and they cannot be in the general pool of Available Storage in the cluster. Cluster Witness Problems This monitor returns the number of events that occur when: The Cluster service failed to update the cluster configuration data on the witness resource due to resource inaccessibility; The Cluster service detected a problem with the witness resource;
The File Share Witness resource failed a periodic health check; The File Share Witness resource failed to come online; The File Share Witness resource failed to arbitrate for the specific file share; The node failed to form a cluster because the witness was not accessible.
Type of event: Error. Event ID: 1557, 1558, 1562, 1563, 1564, 1573. Confirm witness accessibility by viewing the quorum configuration of a failover cluster and the status of a witness disk. Configuration Availability Problems This monitor returns the number of events that occur when: The cluster configuration database could not be loaded or unloaded; The cluster service cannot start due to failed attempts to read configuration data.
Type of event: Error. Event ID: 1057, 1090, 1574, 1575, 1593. When the cluster configuration on a node is missing or corrupt, the Cluster service cannot load the configuration and therefore cannot start. Where possible, the Cluster service will obtain the latest cluster configuration from other nodes in the cluster. Ensure that other nodes are started. If the only node or nodes that can be started appear to have a missing or corrupt cluster configuration database, you will probably need to restore one of the nodes from a system state backup. (For a failover cluster node, the system state backup includes the cluster configuration.) Sometimes when the node attempts to unload the cluster configuration database, the action does not fully complete. Try stopping and restarting the Cluster service. If this does not succeed, restart the operating system on the affected node. DFS Namespace Resource Availability Problems This monitor returns the number of events that occur when: The creation of DFS namespace root failed with error; The resynchronization of DFS root target failed with error; The cluster file share resource for DFS Namespace cannot be brought online due to error.
Type of event: Error. Event ID: 1138, 1141, 1142. Check DFS namespace configuration. Encrypted Settings for Cluster Resource Could not Applied This monitor returns the number of events when encrypted settings for a cluster resource could not be successfully applied to the container on this node. Type of event: Error. Event ID: 1121. Close any application that might have an open handle to the registry checkpoint indicated by the event. This will allow the registry key to be replicated as configured with the resource properties. If necessary, contact the application vendor about this problem. You can use a utility called Handle with the -a option to view handles to the registry. Failed to Form Cluster This monitor returns the number of Failed to Form cluster events. Type of event: Error. Event ID: 1092, 1009. You might be able to correct this issue by restarting the Cluster service. File Share Resource Availability Problems This monitor returns the number of events that occur when: The Cluster File Share cannot be brought online because a file share could not be created; The retrieving of information for a specific share returned an error code; The retrieving of information for a specific share indicated that the share does not exist; The Creation of a file share failed due to an error; The Cluster file share resource has detected shared folder conflicts; The Cluster file server resource failed a health check because some of its shared folders were inaccessible.
Type of event: Warning and Error. Event ID: 1053, 1054, 1055, 1068, 1560, 1585, 1586, 1587, 1588.
Confirm that the share exists and that the permissions allow access to the share. If possible, determine whether the path to the share has been changed. If so, recreate the share with the correct name. View all the resources in the clustered file server instance to ensure that they are coming online, and review the dependencies among the resources. Reconfigure as necessary to correct any problems. Ensure that no two shared folders have the same share name. Check shared folder accessibility and the State of Server service. Generic Application Could not be Brought Online This monitor returns the number of events that occur when a generic application could not be brought online during an attempt to create the process due to; the application not being present on this node, an incorrect path name, or an incorrect binary name. Type of event: Error. Event ID: 1039. Confirm that the following are true for the application used by the clustered Generic Application instance: The application is fully installed on all nodes that are possible owners of the Generic Application resource; The configuration for the Generic Application resource specifies the correct application and path; The configuration for the Generic Application resource specifies the appropriate parameters and settings for registry replication.
Generic Service Resource Availability Problems This monitor returns the number of events that occur when: The generic service is either not installed or the specified service name is invalid; The specified generic service parameters might be invalid; The generic service failed with an error.
Type of event: Error. Event ID: 1040, 1041, 1042.
Confirm that the correct service is specified in the configuration for the Generic Service resource and confirm that the service is fully installed on all nodes that are possible owners of the resource. Check service operation and examine the application event log. IP address Resource Availability Problems This monitor returns the number of events that occur when: The Cluster IP address resource cannot be brought online because the subnet mask value is invalid; The Cluster IP address resource cannot be brought online because the address value is invalid; The configuration data for the network adapter corresponding to the cluster network interface could not be determined; The Cluster IP address resource cannot be brought online because a duplicate IP address was detected on the network; The Cluster IP address resource cannot be brought online because WINS registration; The lease of the IP address associated with the cluster IP address resource has expired or is about to expire, and currently cannot be renewed; The IPv6 Tunnel address resource failed to come online because it does not depend on an IP Address (IPv4) resource; The Cluster network associated with dependent IP address (IPv4) resource does not support ISATAP tunneling.
Type of event: Error. Event ID: 1046, 1047, 1048, 1049, 1078, 1242, 1361, 1363. Check the address, subnet, and network properties of the IP Address resource. If the resource is an IPv6 Tunnel address resource, make sure it depends on at least one IP Address (IPv4) resource. Also make sure the network supports Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) tunneling. If the IP Address resource appears to be configured correctly, check the condition of network adapters and other network components used by the cluster.
Network Connectivity and Configuration Problems This monitor returns the number of events that occur when: The Cluster Service was unable to access the network adapter or the cluster node has no network connectivity; The Cluster node has no network connectivity; The Cluster node has lost all network connectivity; The failover cluster virtual adapter failed to initialize the miniport adapter.
Type of event: Error. Event ID: 1289, 1553, 1554, 4871. Correct any problems with the physical network adapters and the cluster virtual adapter. If a previous change in the configuration is interfering with the function of the cluster virtual adapter, it might be necessary to reinstall the failover clustering feature on the node. Also, use the Validate a Configuration Wizard to review the network configuration. Node Failed to Join Cluster This monitor returns the number of events that occur when the node failed to join the failover cluster due to an error. Type of event: Error. Event ID: 1070. You might be able to correct this issue by restarting the Cluster service. Problems with Cluster Service This monitor returns the number of events that occur when: The cluster resource in the Clustered service or application failed; The Cluster service failed to bring the Clustered service or application completely online or offline and one or more resources may be in a failed state.
Type of event: Warning and Error. Event ID: 1039, 1205. Check and correct any problems with the application or service associated with the resource. Check and correct any problems with cables or cluster-related devices.
Adjust the properties for the resource in the cluster configuration, especially the value for the Pending Timeout for the resource. This value must allow enough time for the associated application or service to start. Check the state of all resources in the clustered service or application. Quorum was Lost This monitor returns the number of events that occur when the Cluster service is shutting down because quorum was lost. Type of event: Error. Event ID: 1177. This can occur when network connectivity is lost between some or all of the nodes in the cluster, or the witness disk fails over. It can also occur if you make a change in the cluster configuration such as increasing the number of nodes, when the number of nodes currently online is too few to achieve quorum in the new configuration. Run the Validate a Configuration Wizard, selecting only the network tests. Also check network devices (adapters, cables, hubs, switches, etc.) and quorum configuration. Registry Checkpoint Could not be Restored to Registry Key This monitor returns the number of events that occur when the Registry Checkpoint for Cluster resource could not be restored to a registry key. Type of event: Error. Event ID: 1024. Close any application that might have an open handle to the registry checkpoint indicated by the event. This will allow the registry key to be replicated as configured with the resource properties. If necessary, contact the application vendor about this problem. You can use a utility called Handle with the -a option to view handles to the registry. System is not being Responsive This monitor returns the number of events that occur when the Failover cluster virtual adapter has lost contact with the process. Type of event: Error. Event ID: 4869, 4870. Use Resource Monitor to determine, in real time, how many system resources a service or application is utilizing. This may take several minutes if the system is critically low on resources.
MySQL
This template assesses the performance of a MySQL Server database by retrieving performance data from the built-in INFORMATION_SCHEMA.GLOBAL_STATUS pseudo-table. Prerequisites: MySQL 5.1.12 or later. MySQL ODBC must be installed on the SAM server. Log into the MySQL database in order to monitor and execute the following queries:
MYSQL ALLOW REMOTE CONECTIONS; GRANT ALL PRIVILEGES ON *.* TO USERNAME@ADDRESS IDENTIFIED BY PASSWORD;
where:
USERNAME is a user with administrative privileges; ADDRESS is the IP address of your SAM server;
PASSWORD is the user password. Credentials: Database user name and password. Monitored Components Components without predetermined threshold values provide guidance such as "Use the lowest threshold possible" or "Use the highest threshold possible" to help you find a threshold appropriate for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Total Memory Used (MB) This component monitor returns the possible total memory usage of MySQL, in MB, using the following formula:
read_buffer_size+sort_buffer_size)*max_connections+key_buffer_s ize.
Kilobytes Received This counter returns the number of kilobytes received from all clients. Kilobytes Sent This component monitor returns the number of kilobytes sent to all clients.
Created Temporary Disk Tables This counter returns the number of internal, on-disk, temporary tables created by the server while executing statements. This value should be as low as possible. If an internal temporary table is initially created as an in-memory table but becomes too large, MySQL automatically converts it to an on-disk table. The maximum size for in-memory temporary tables is the minimum of the tmp_table_size or max_heap_table_size values, whichever is less. If the value returned from this counter is large, you may want to increase the value of tmp_table_size or max_heap_table_size to lessen the likelihood that internal temporary tables in memory will be converted to on-disk tables. Created Temporary Files This counter the number of temporary files mysql has created. Created Temporary Tables This counter returns the number of internal temporary tables created by the server while executing statements. Opened Table Definitions This counter returns the number of .frm files that have been cached. Opened Tables This counter returns the number of tables that have been opened. This should be as low as possible. If the value returned is large, you may want to increase the value of table_open_cache. Opened Files This counter returns the number of files that have been opened with the my_open()function. Note: If the my_open() function is not used, the count will not be incremented. Statements Executed This counter returns the number of statements executed by the server. Note: This includes only statements sent to the server by clients and no longer includes statements executed within stored programs, unlike the Queries variable. This variable does not count the following commands: COM_PING, COM_STATISTICS, COM_STMT_PREPARE, COM_STMT_CLOSE, or COM_STMT_RESET.
Key Reads This counter returns the number of physical reads of a key block from disk. This value should be as low as possible. If the value returned from this counter is large, you may want to increase the value of key_buffer_size. Key Writes This counter returns the number of physical writes of a key block to disk. Table Locks Immediate This counter returns the number of times that a request for a table lock could be granted immediately. Table Locks Waited This counter returns the number of times that a request for a table lock could not be granted immediately and a wait was needed. This value should be as low as possible. If the counter returns a value that is high and you have performance problems, you may want to optimize your queries. You may also consider either splitting your tables or using replication. Threads Cached This counter returns the number of threads in the thread cache. Threads Connected This counter returns the number of currently open connections. Threads Created This counter returns the number of threads created to handle connections. This value should be as low as possible. If the counter returns a value that is high, you may want to increase the value of thread_cache_size. Threads Running This counter returns the number of threads that are running. Up Time This counter returns the number of seconds that the server has been up. Transactions that use disk This counter returns the number of transactions that used the temporary binary log cache but exceeded the value of binlog_cache_size and used a temporary file to store statements from the transaction. This value should be as low as possible.
Transactions that use cache This counter returns the number of transactions that used the temporary binary log cache. Joins that perform table scans This counter returns the number of joins that perform table scans because they do not use indexes. If the returned value is not zero, you should carefully check the indexes of your tables. Joins that check for key usage This counter returns the number of joins without keys that check for key usage after each row. If this is not zero, you should carefully check the indexes of your tables. Joins that perform full scan This counter returns the number of joins that did a full scan of the first table. This value should be as low as possible. Slow Queries This counter returns the number of queries that have taken more than long_query_time seconds. The returned value should be less than 10. Note: To enable the slow query log, start mysqld with the --log-slowqueries[=file_name] option. The slow query log can be used to find queries that take a long time to execute and are therefore candidates for optimization. Max Used Connections This counter returns the maximum number of connections that have simultaneously been in use since the server started. Free Memory in Query Cache (MB) This counter returns the amount of free memory in MB for the query cache. Queries Registered in Query Cache This counter returns the number of queries registered in the query cache. Deleted Queries from Cache This counter returns the number of queries that were deleted from the query cache because of low memory. The value returned should consistently be zero.
Opened Connections This counter returns the number of active connections. Aborted Connections This counter returns the number of failed attempts to connect to the MySQL server. Aborted Clients This counter returns the number of connections that were aborted because the client died without closing the connection properly. Thread Cache Size This counter returns the number of threads the server should cache for reuse. When a client disconnects, the client's threads are put in the cache. If there are fewer threads than the thread cache size, the threads remain in the cache. Requests for threads are satisfied by reusing threads taken from the cache, if possible. When the cache is empty, a new thread created. This variable can be increased to improve performance if you have a lot of new connections. Normally, this does not provide noticeable performance improvement if you have good thread implementation. However, if your server sees hundreds of connections per second, you should set the thread cache size high enough so that most new connections use cached threads. Slow Launch Threads This counter returns the number of threads that have taken more than slow_launch_time seconds to create. Sort Scan This counter returns the number of sorts that were done by scanning the table by using Order By or Group By commands. Sort Rows This counter returns the number of sorted rows. Sort_rows is a total count of the number of rows sorted in step two. Since step two can be bypassed in some cases, Sort_rows is not entirely inclusive. Also, since Sort_scan and Sort_range in step two are essentially the same, the Sort_rows value is not very indicative of anything. Suffice to say, most servers sort hundreds of millions of rows.
Select Scan This counter returns the number of joins that did a full scan of the first table. Select_scan refers to a table that is completely read in sequence from the hard drive. For such tables Explain lists "All" in the "Type" column. Table scans are not desirable because they are slow (meaning they are limited by the speed of the hard drive). However, table scans are prevalent. It is not uncommon to see a server where 50% of all Select queries are Select_scan. The fundamental reason why a Select results in a table scan is because no index on the table can satisfy the conditions of the query (i.e., everything after Where), or there are no indexes, so all queries will result in a table scan. From a performance perspective it is safe to say you always want to decrease this value. However, in some cases this value may be increased after optimization because the server is then able to do more. Ultimately, it will have to decrease again when the QPS (queries per second) increases. Select Full Join This counter returns the number of joins that perform table scans because they are not using indexes. Select_full_join is the same as Select_scan with the difference being that Select_full_join applies to the second and subsequent tables in the join's plan for a multiple table query. For such tables, Explain lists type: All. Select_full_join results if there are no indexes on the table, or if no indexes can be used to join the table. A query similar to: SELECT * FROM tbl1, tbl2 WHERE tbl1.col1 = tbl2.col1; without any indexes results in a Select_scan and a Select_full_join; Select_scan for the first table, and Select_full_join for the second. Select_full_join is no more desirable than Select_scan. Together, the two are even worse. When Explain lists type: All for each table in a join, "this output indicates that MySQL is generating a Cartesian product of all the tables; that is, every combination of rows," (MySQL manual). In simpler terms, two tables of 10 rows each joined together does not result in 20 rows, it results in 100 rows (10 multiplied by 10). In real-world applications, tables usually have at least a few thousand rows, so the cross product (a.k.a. Cartesian product) of even two small tables can quickly become enormous. If this counter is not 0, you should carefully check the indexes of your tables. Select Range Check This counter returns the number of joins without keys that check for key usage after each row.
Select_range_check is a little better than Select_full_join and uses the same range principles as Select_range. The difference is Select_range_check is not sure whether it can use a range to join the table so it keeps checking in case it finds that it can. This "uncertainty" is an effect of the join. With Select_range there is only one table, therefore, MySQL can be certain ahead of time. With multiple tables, the preceding tables may alter the range conditions and MySQL cannot be certain ahead of time. For such tables, Explain still lists type All because a type range is not certain. For such tables, MySQL also lists "Range checked for each record (index map: #)" in the "Extra" column. Like Select_range at least one of the tables require an index for this optimization to be possible, otherwise the table will probably cause a Select_full_join. If MySQL does use a range to join the table it will not increment Select_range, it still only increments Select_range_check. If this counter is not 0, you should carefully check the indexes of your tables.
Nagios Linux File & Directory Count Script

This template uses one Nagios script monitor to provide file and directory count statistics using multiple value script outputs. Prerequisites: SSH and Perl installed on the target server. Credentials: Root credentials on the target server. Note: A maximum of 10 output pairs can be returned. The monitor in this template uses three. Field Descriptions Description This field allows you to provide a description as to what this monitor will actually do for easy reference. Component Type This describes the type of monitor you are using. Enable Component This option determines whether or not the component is enabled. Disabling this component leaves it in the application as deactivated and does not influence application availability or status. Credential for Monitoring Select a credential that can access the Linux or Unix server over SSH and that has sufficient rights to run scripts. If the credential you need is not already present in the credentials list, use the Quick Credentials section to add a new credential. Port Number This field allows you to specify the port number used for the SSH connection. The default value is 22. Script Working Directory This field allows you to specify the working directory of the script process. Check Type This determines how the return code is evaluated.
Return Code 0 Service State Ok Host State Up

1 2 3 Warning Critical Unknown Up or Down/Unreachable Down/Unreachable Down/Unreachable
If the Use Aggressive Host Checking option is enabled, return codes of 1 will result in a host state of DOWN, otherwise return codes of 1 will result in a host state of UP. Command Line This field is in the script editing window and allows you to specify the script you want to run on the target node followed by the arguments. To enter your script, click the Edit button that reveals the script editing window. For more information, see http://nagios.sourceforge.net/docs/3_0/pluginapi.html. In this template, the following code is used in the Command Line field:
perl ${SCRIPT} /etc -sub
Body This field is in the script editing window and allows you to enter your script via typing or pasting. In this template, the following code is used in the Script Body field to provide three script outputs: Parameters: directory This is the path of the directory (e.g. /bin,/etc,/usr/local,/). -sub Include subdirectories. This parameter is optional.
Note: This Perl script counts the number of files, directories, and symbolic links in a given directory.
#!/usr/bin/perl if ($#ARGV != 0 && $#ARGV != 1) { print "Invalid arguments count. Usage: directory\n"; exit 3; } $dir=$ARGV[0]; $sub=""; if ($#ARGV == 1) { $sub=$ARGV[1]; } if ($sub ne "-sub") { $fcount=`find $dir -maxdepth 1 -type f $dcount=`find $dir -maxdepth 1 -type d $lcount=`find $dir -maxdepth 1 -type l }else { 1090 Templates Reference
perl FileCount.pl
| wc -l`; | wc -l`; | wc -l`;
SolarWinds Server & Application Monitor Administrator Guide $fcount=`find $dir -depth -type f | wc -l`; $dcount=`find $dir -depth -type d | wc -l`; $lcount=`find $dir -depth -type l | wc -l`; } $exit=ècho $?`; #remove the last character (new line symbol) chop($fcount); chop($dcount); chop($lcount); #find list also parent directory, so we need to remove them $dcount=$dcount-1; print "Script OK - Directory: $dir FileCount: $fcount DirectoryCount: $dcount SymbolicLinkCount: $lcount | 'FileCount'=$fcount 'DirectoryCount'=$dcount 'SymbolicLinkCount'=$lcount\n"; exit 0;
Script Output #X Each script output has the following fields: Unique ID This is the statistic identifier from the script output. Display Name This is the name displayed in the User Interface. After generation of the script output, the Unique ID and Display Name become the same. You can change the Display Name to something more user friendly if you so desire. Convert Value If this option is selected, you can convert your output with a variety of mathematical functions to suit your needs using either a selection from the dropdown menu or selecting Custom Conversion. With the Custom Conversion option, you have the ability to enter your own formulas to manipulate the data output further. Warning threshold Select a threshold level in conjunction with the logical operators to alert you when the warning threshold has been breached. Critical Threshold - Select a threshold level in conjunction with the logical operators to alert you when the critical threshold has been breached.
Status Roll-Up This option allows you to choose how you would like the monitor to report based on the output provided by the script. The default selection is Show worst status. User Notes
This field allows you to add notes for easy reference. You can access this field by using the variable, ${UserNotes}. For more information, see Configuring SolarWinds SAM Alerts"
OpenLDAP
This template assesses the performance of the OpenLDAP server by retrieving performance data from the cn=Monitor sub-tree. Prerequisites: Perl must be installed on the target server. SNMP must be installed on the target server You must have permission to monitor slapd processes on the target server. The OpenLDAP monitoring branch must be enabled. You can enable this by adding the following lines to the slapd.conf file, which is located here: /etc/openldap/slapd.conf.
database monitor access to dn.subtree="cn=Monitor" by * read by * none
Create a user on the Linux/Unix server with the same, case sensitive, username and password, as OpenLDAP. OpenLDAP has Manager as the default user, which is equivalent to the OpenLDAP administrator. Create the user, Manager, on the server and set the password to be the same for Manager in OpenLDAP. See the following example:
[root@centos56 ~]# useradd Manager [root@centos56 ~]# passwd Manager Changing password for user Manager. New UNIX password: Retype new UNIX password: passwd: all authentication tokens updated successfully. [root@centos56 ~]#
Credentials: User with access to the OpenLDAP and Linux/Unix servers. Component Arguments and Syntax All components use the ldapsearch command with arguments to get the required values, as in the following:
ldapsearch -x -D 'cn=User,dc=your,dc=domain' -w password -b 'cn=Monitor' -s base '(objectClass=*)' '+'
The three arguments below are used in the following order:

perl ${SCRIPT} cn=${USER} ${PASSWORD} dc=your,dc=domain Templates Reference 1093
4. Username This argument specifies which user will get the required statistic from the OpenLDAP server using the following format: cn=${USER}. By default, this argument will use the username from the application. Normally, this argument should remain unchanged. 5. Password This argument specifies the user's password. By default, it will use the password from the application's username. Normally, this argument should remain unchanged. 6. Domain This argument specifies the domain name and should be formatted in the following manner: dc=your,dc=domain. This is where you set your domain. For example: dc=example,dc=com or
dc=test1,dc=testing,dc=com
Below is an example using the Command Line field with arguments used in any component monitor:
perl ${SCRIPT} cn=${USER} ${PASSWORD} dc=example,dc=com
Components with Examples Operations Rate per Sec This monitor returns the rates per second of different LDAP operations. All rates are calculated as the number of specific queries for five seconds, and then divided by five. Information about LDAP operations are taken from the cn=Operations,cn=Monitor sub-tree. Returned values are as follows: Note: It is possible that scripts will return non-integer values. Total This component returns the total number of LDAP operations. Bind This component returns the number of Bind operations occurring on the server. The LDAP Bind operation can be used to authenticate to the LDAP Server. Unbind This component returns the number of Unbind operations occurring on the server. The LDAP Unbind operation is used to indicate that the client wants to disconnect from the server. Add This component returns the number of Add operations occurring on the server. The LDAP Add operation can be used to create an entry in the LDAP Server. Delete This component returns the number of Delete operations occurring on the server. The LDAP Delete operation can be used to remove an entry or sub-tree from the server.
Modify This component returns the number of Modify operations occurring on the server. The LDAP Modify operation can be used to alter an existing entry in the LDAP Server. Compare This component returns the number of Compare operations occurring on the server. The LDAP Compare operation can be used to determine whether a specified entry contains a given attribute value. Search This component returns the number of Search operations occurring on the server. The LDAP Search operation can be used to identify entries in the LDAP Server that match a given set of criteria. Active Operations This monitor returns the number of active operations. Current Connections This monitor returns the number of current OpenLDAP connections. Bytes Sent Rate per Sec This monitor returns the number of bytes sent, per second, by the server. Uptime This monitor shows the server uptime, in seconds. The returning message shows the time in days, hours, minutes, and seconds. Read Waiters This monitor returns the number of connections that are waiting to read data. Write Waiters This monitor returns the number of connections that are waiting to write data. Process Monitor (SNMP): slapd This component monitor returns CPU and memory usage of the slapd daemon. If this counter is unavailable, there may be a problem with your SNMP configuration or the slapd service has stopped. LDAP User Experience Monitor This component monitor tests the capabilities of the Light Weight Directory Access Protocol (LDAP) server and measures the time it takes to perform an LDAP query.
Oracle Database
This template assesses the status and performance of an Oracle database by retrieving performance data from the built-in Oracle statistics views. Prerequisites: Oracle client installed on SolarWinds SAM server. This is available from the SolarWinds customer portal under Additional Downloads. Credentials: An Oracle user name and password with read access to the Oracle views: dba_free_space, v$sysstat, v$rowcache, v$librarycache, v$sgastat, and v$session. Note: For issues connecting to Oracle databases using this monitor, see the following SolarWinds knowledgebase article: http://knowledgebase.solarwinds.com/kb/questions/2067/. For more information, see "Configuring SAM to Monitor an Oracle Database Server" on page 690. Monitored Components Components without predetermined threshold values provide guidance such as "Use the lowest threshold possible" or "Use the highest threshold possible" to help you find an appropriate threshold for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Available free space (MB) This component monitor returns the available free space of the database in MB. This value should be as high as possible. Buffer cache hit ratio (%) This component monitor returns the percentage of pages found in the buffer cache without having to read from the disk. This ratio should exceed 90%, and ideally be over 99%. If your Buffer Cache Hit Ratio is lower than 90%, you should consider adding more RAM, if possible. A higher ratio value returned indicates improved performance by your Oracle Server. Note: If your database is very large, you may not be able to get close to 99%, even if you put the maximum amount of RAM in your server. Dictionary cache hit ratio (%) This component monitor returns the ratio, as a percentage, of dictionary cache hits to total requests.
The dictionary cache stores data referenced from the data dictionary. A properly tuned dictionary cache can significantly improve overall database performance. Guidelines for acceptable ratios are as follows: 70% or above. 99% would be ideal. If the ratio is below 70%, increase the value of the initialization parameter, SHARED_POOL_SIZE. It is recommended that the SHARED_POOL_SIZE parameter be at least 4 MB. o Large databases may require a shared pool of at least 10 MB.
Note: Increasing the SHARED_POOL_SIZE parameter will increase the size of the System Global Area (SGA). Library cache hit ratio (%) This component monitor returns the percentage of Pin requests that result in hits. PINS - Defined as the number of times an item in the library cache was executed. PINHITS - Defined as the number of times an item was executed without reloads.
The library cache stores the executable form of recently referenced SQL and PL/SQL code. Ideally, the value of this component monitor should be greater than 95%. If the value is less than 95%, you may want to try the following: Increase the SHARED_POOL_SIZE parameter. The CURSOR_SHARING parameter may need to be set to FORCE. Increase the size of the SHARED_POOL_RESERVED_SIZE parameter. Sharing of SQL, PLSQL or JAVA code may be inefficient. Use of bind variables may be insufficient.
Available free memory (MB) This component monitor returns the free memory in MB, of all SGA pools. This value should be as high as possible. Number of connected users to the database through SQL Net This component monitor returns the number of currently connected users.
Temp files size (MB) This component monitor returns the size of all temporary files in MB. This value should be as low as possible. Data files size (MB) This component monitor returns the size of all database files in MB. Total short table scans This component monitor returns the total number of full table scans that were performed on tables having less than five Oracle data blocks since database instance startup. Note: It is generally more efficient to perform full table scans on short tables rather than access the data using indexes. Total long table scans This component monitor returns the total number of full table scans done on tables containing five or more Oracle data blocks since database instance startup. Note: It may be advantageous to access long tables using indexes. User transactions This component monitor returns the total number of users transactions. Disk sort operations This component monitor returns the number of sort operations that require at least one disk write. This value should be as low as possible. Note: Sorts that require continual reading and writing to disk can consume a great deal of resources. If this monitor returns a high value, consider increasing the size of the initialization parameter, SORT_AREA_SIZE. For more information, see: http://download.oracle.com/docs/cd/B28359_01/server.111/b28320/initparam s232.htm#i1134127. Memory sort operations This component monitor returns the number of sort operations that were performed completely in memory meaning no disk writes were required.
User rollbacks This component monitor returns the number of times that users manually issued the Rollback statement. Use of the Rollback statement may also indicate an error occurred during a user's transactions. This value should be as low as possible.
POP3 Round Trip Email

This template simulates an email round trip to test the ability of your SMTP server to receive and distribute email, and the ability of your users to retrieve messages from POP3-enabled email clients. If you want to monitor Google gmail, you need to use the POP3 Roundtrip Email Template rather than the MAPI Roundtrip Email Template. MAPI is not compliant for gmail, because gmail is not a desktop email client. Prerequisites An SMTP server and a POP3 server. Credentials: POP3 mailbox account. If the SMTP server requires authentication, the POP3 mailbox and the SMTP server must have identical user names and passwords. Monitored Components POP3 User Experience Monitor
Postfix
This template assesses the performance of the Postfix MTA agent installed on the target server. Perl scripts are used for monitoring the performance of queries. Prerequisites: SSH and Perl installed on the target server. SNMP installed on the target server and permission to monitor master, qmgr and pickup processes. Credentials: Root credentials on the target server. Monitored Components: Note: You need to set thresholds for counters according to your environment. It is recommended to monitor counters for some period of time to understand potential value ranges and then set the thresholds accordingly. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Postfix statistic from maillog file This monitor returns the Postfix mail statistic from the maillog file. The returned values are as follows: Delivered This component returns the number of successfully delivered messages. Search for these messages in the maillog file using the following search pattern: status=sent (delivered to. Forwarded This component returns the number of successfully forwarded messages. Search for these messages in the maillog file using the following search pattern: status=sent (forwarded to. Rejected This component returns the number of rejected messages. Search for these messages in the maillog file using the following search pattern: reject:. Received This component returns the number of received messages. Search for these messages in the maillog file using the following search pattern: postfix/pickup. (Look in the strings for: sender= or uid=). Discarded This component returns the number of discarded messages. Search for these messages in the maillog file using the following search pattern: discard:. Deferred This component returns the number of deferred messages. If a message still has recipients for which delivery failed for some transient reason, and the message has been delivered to all the recipients possible, Postfix places the message into the deferred queue. Search for these messages in the maillog file using the following search pattern: status=deferred.
Bounced This component returns the number of bounced messages usually caused by undeliverable mail. Search for these messages in the maillog file using the following search pattern: status=bounced. Held This component returns the number of messages held. The administrator can define smtpd access policies and cleanup header and body checks that cause messages to be automatically diverted from normal processing and placed indefinitely in the hold queue. Messages placed in the hold queue stay there until the administrator intervenes. Search for these messages in the maillog file using the following search pattern: hold:. Note: By default, the script retrieves this information from the /var/log/maillog file. If this file has another location on the target server, you should correct the path in the script argument box. By default, this monitor has the Count statistic as difference box checked. It will show the total number of messages in the Message field while the Statistic field will show only new messages since the last polling period. Messages from maillog file This monitor returns the Postfix service messages statistic from the maillog file. The returned values are as follows: Fatal This component returns the number of fatal service messages. Search for these messages in the maillog file using the following search pattern: fatal:. Warning This component returns the number of warning service messages. Search for these messages in the maillog file using the following search pattern: warning:. Panic This component returns the number of panic service messages. Search for these messages in the maillog file using the following search pattern: panic:. Error This component returns the number of error service messages. Search for these messages in the maillog file using the following search pattern: error:. Note: By default, the script retrieves this information from the /var/log/maillog file. If this file has another location on the target server, you should correct the path in the script argument box. By default, this monitor has the Count statistic as difference box checked. It will show the total number of messages in the Message field while the Statistic field will show only new messages since the last polling period.
Mail queue This monitor shows the length of the mail queue. IMAP4 User Experience Monitor This component monitor tests an email round trip from your SMTP mail server to your IMAP4 server and measures the time it takes to complete the trip. Note: By default, this component is disabled. To use this component, you should enable it and properly configure it. More information about this monitor can be found here: http://www.solarwinds.com/NetPerfMon/SolarWinds/wwhelp/wwhimpl/js/html/ wwhelp.htm#context=SolarWinds&file=OrionAPMPHComponentTypesImap4 UserExperience.htm. POP3 User Experience Monitor This component monitor tests an email round trip from your SMTP mail server to your POP3 mail server and measures the time it takes to complete the trip. Note: By default, this component is disabled. To use this component, you should enable it and properly configure it. More information about this monitor can be found here: http://www.solarwinds.com/NetPerfMon/SolarWinds/wwhelp/wwhimpl/js/html/ wwhelp.htm#context=SolarWinds&file=OrionAPMPHComponentTypesPop3 UserExperience.htm. SMTP Monitor This component monitor tests the ability of an SMTP server to accept incoming connections and respond with the correct code. Process: master This monitor returns the CPU and memory usage of the Postfix master process using SNMP. The Master daemon is the supervisor of Postfix, and it oversees all other Postfix daemons. The master waits for incoming jobs to be delegated to subordinate daemons. If there is a lot of work to do, the Master can invoke multiple instances of a daemon.
Process: qmgr This monitor returns the CPU and memory usage of the Postfix qmgr process using SNMP. The qmgr daemon manages the Postfix queues; it is the heart of the Postfix mail system. It distributes delivery tasks to the local, smtp, lmtp, and pipe daemons. After delegating a job, it submits queue file path-name information, the message sender address, the target host (if the destination is remote), and one or more message-recipient addresses to the daemon it delegated the delivery task to. Process: pickup This monitor returns the CPU and memory usage of the Postfix pickup process using SNMP. The pickup daemon picks up messages put into the maildrop queue by the local sendmail user client program. After performing a few sanity checks, pickup passes messages to the cleanup daemon.
PostgreSQL
This template assesses the performance of a PostgreSQL 9 Server database by retrieving performance data from the built-in pg_stat_database, pg_locks, pg_trigger, pg_proc, pg_stat_all_tables and pg_indexes views. Prerequisites: On the SAM Server, download and install the PostgreSQL 9 ODBC driver from the following location: http://www.postgresql.org/ftp/odbc/versions/msi/. On the PostgreSQL Server, find the following file:
C:\Program Files\PostgreSQL\9.0\data\pg_hba.conf
and add the following line to allow remote connections for the SAM Server:
host all all 192.168.3.198/32 trust
where 192.168.3.198 is IP address of your APM Server. Credentials: Database user name and password. Monitored Components Note: Components without predetermined threshold values will provide guidance such as "Use the lowest threshold possible" or "Use the highest threshold possible" to help you find a threshold appropriate for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Database Cache Hit Ratio (%) This counter returns the percentage of pages found in the buffer cache without having to read from the disk in the specified database. This is the formula used: cache reads/(cache reads+physical reads)*100 This ratio should exceed 90%, and ideally be over 99%. If your counter is lower than 90%, you should consider adding more RAM if possible. A higher ratio value returned indicates improved performance by your server. Note: By default, this counter looks in the postgres database. If you want to monitor another database, you should change the database name in the Connection String field: (DataBase=postgres;) and the Sql Query field: (where datname = 'postgres'). Database Success Rate (%) This counter returns the percentage of successful transactions in the specified database. This is the formula used: committed
transactions/(committed transactions+rolled back transactions)*100
This ratio should exceed 90%, and ideally be over 99%. Note: By default, this counter looks in the postgres database. If you want to monitor another database, you should change the database name in the Connection String field: (DataBase=postgres;) and Sql Query field: (where datname = 'postgres'). Total Active Server Connections This counter returns the total number of server connections that are active. You should set the thresholds appropriate to your environment. Active Connections in Specified Database This counter returns the number of connections to the specified database. You should set the thresholds appropriate to your environment. Note: By default, this counter looks in the postgres database. If you want to monitor another database, you should change the database name in the Connection String field, (DataBase=postgres;) and the Sql Query field: (where datname = 'postgres'). Database Size (MB) This counter returns the size of the specified database in MB. Note: By default, this counter looks in the postgres database. If you want to monitor another database, you should change the database name in the Connection String field, (DataBase=postgres;) and the Sql Query field, (pg_database_size('postgres')). Current Number of Locks on Server This counter returns the total number of locks on the server. This counter should be as low as possible. For more information about locks you should create a query and look in the pg_locks view. Total Indexes in Current Database This counter returns the total number of indexes for a current database. For more information about locks, you should look in the pg_indexes view. Note: By default this counter looks in the postgres database. If you want to monitor another database, you should change the database name in the Connection String field: (DataBase=postgres;). Table with the biggest number of Sequential Scans This counter returns the name of the table and its number of sequential scans for the current database.
Note: By default, this counter looks in the postgres database. If you want to monitor another database, you should change the database name in the Connection String field: (DataBase=postgres;). Table with the biggest number of Index Scans This counter returns the name of the table and its number of index scans for the current database. Note: By default, this counter looks in the postgres database. If you want to monitor another database, you should change the database name in the Connection String field: (DataBase=postgres;). Table with the biggest number of Row Reads This counter returns the name of the table and its number of row reads for the current database. Note: By default, this counter looks in the postgres database. If you want to monitor another database, you should change the database name in the Connection String field: (DataBase=postgres;). Total Number of Triggers This counter returns the total number of triggers for the current database. Note: By default this counter looks in the postgres database. If you want to monitor another database, you should change the database name in the Connection String field: (DataBase=postgres;). Size of the Largest Table (MB) This counter returns the name of the largest table and its size in MB for the current database. Note: By default this counter looks in the postgres database. If you want to monitor another database, you should change database name in the Connection String filed: (DataBase=postgres;). Total Number of Tables in Current Database This counter returns the total number of tables for the current database. Note: By default this counter looks in the postgres database. If you want to monitor another database, you should change the database name in the Connection String field: (DataBase=postgres;).
RADIUS User Experience

This template tests user authentication through the RADIUS protocol. Prerequisites A server with RADIUS authentication. You must know the secret shared key. Credentials: A valid RADIUS username and password. Monitored Components RADIUS User Experience Monitor
Run 3rd Party Application

This template demonstrates using a Windows script to run an executable program. The statistic is the return value of the executable program. The Windows Script component monitor in this template is preset to run the Windows notepad.exe executable program on the SolarWinds SAM server. Prerequisites: None. Credentials: Windows Administrator credential valid on both SolarWinds SAM and target server. Usage To run an executable program locally on the SolarWinds SAM server: Type the program name in the Script Arguments field. To run an executable program on a remote server: Specify all of the following arguments in the Script Arguments field:
hostname workingdirectory executablefile username password
hostname The hostname or IP address of the remote server where the program resides. workingdirectory The local path or Universal Naming Convention path to a folder on the remote server that the program can use as its working directory. executablefile The local path or UNC path to the executable program. username The user name of a Windows administrator account on the remote server. password The password of the Windows administrator account. Example of Running a Program Locally on the SolarWinds SAM Server This argument runs the executable program notepad.exe on the SolarWinds SAM Server.
notepad.exe Templates Reference 1109
Example of Running a Program on a Remote Server These arguments run the executable program C:\temp\testantivirus.exe on the remote host, and use the C:\temp folder as the working directory. The paths are in UNC syntax.
remotehost \\remotehost\c$\temp\testantivirus.exe \\remotehost\c$\temp\ username password
Example of Using Credentials Variables to Run a Program on a Remote Server These arguments run the same executable program as the previous example, but hide the Windows administrator credentials from plain sight by substituting ${USER} and ${PASSWORD} variables. If you use these variables, you must set the Credential field of this component to a credential with administrator rights to the remote server.
remotehost \\remotehost\c$\temp\testantivirus.exe \\remotehost\c$\temp\ ${USER} ${PASSWORD}
RWHOIS Port Monitor

This template tests the ability of an RWHOIS server to accept incoming sessions on port 4321. Prerequisites: None. Credentials: None. Monitored Components RWHOIS Port Monitor
SharePoint Server 2007

This template assess the overall health and performance of Microsoft Office SharePoint Server 2007. Prerequisites: WMI access to SharePoint server. For more information, see Requirements for Component Monitors and Templates that use WMI on page 218. Credentials: Windows Administrator on SharePoint server. Monitored Components Components without predetermined threshold values provide guidance such as "Use the lowest threshold possible" or "Use the highest threshold possible" to help you find a threshold appropriate for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Document Conversions Launcher This service schedules and initiates document conversions. When SharePoint Foundation passes a document conversion request to the document conversion launcher service, the service must call the appropriate document converter. Document Conversions Load Balancer This service balances the document conversion requests from across the server farm. When it receives a converter request from SharePoint Foundation, the document conversion load balancer service must return a URI to the appropriate document conversion launcher service. SharePoint Foundation connects to the specified launcher via .NET remotely and requests the specified document be converted. Single Sign-on This component monitor provides the storage and mapping of credentials such as account names and passwords so that portal-based applications can retrieve information from third-party Enterprise Resource Planning (ERP) and Customer Relations Management (CRM) systems. SharePoint Server Search This is a server farm-wide service that responds to query requests from frontend Web servers or crawl items. ASP.NET: Requests/sec
This component monitors the number of requests executed per second. This represents the current throughput of the application. Under constant load, this number should remain within a certain range, barring other server work (such as garbage collection, cache cleanup thread, external server tools, and so on). This value should be as low as possible. ASP.NET: Worker Processes Restarts This component monitor returns the number of times a worker process has restarted. Restarts use a great deal of resources and therefore should be monitored closely. Restarts can be caused by various process settings, memory leaks, and access violations. It is recommended to closely monitor restarts to determine their cause, thus preventing them from occurring in the future. Any returned number above zero may indicate a problem. Search Indexer: Queries This component monitor returns the number of search queries. Search Gatherer: Crawls In Progress This component monitor returns the number of crawls in progress. Unless an administrator has manually initiated a crawl, the value should match the number of content sources with crawls scheduled. Search Gatherer: Document Add Rate This component monitor returns the number of items indexed per second, per content source. Search Gatherer: Error Rate This component monitor returns the number of index errors per second and should be as low as possible. Search Gatherer: Incremental Crawls This component monitor returns the number of incremental crawls in progress. An incremental crawl indexes only items that have changed. Search Gatherer: Processed Documents Rate This component monitor returns the number of documents processed per second. Search Gatherer: Retries This component monitor returns the total number of times document access has been retried.
Search Gatherer: Waiting Documents This component monitor returns the number of documents waiting to be processed. Search Gatherer: Documents Filtered Rate This component monitor returns the number of documents filtered per second. Search Gatherer: Filtering Threads This component monitor returns the number of threads that have retrieved content and are being filtered. If the number is high, it may indicate that resources on the index server are being bottlenecked. This number should be as low as possible. Search Gatherer: Threads Accessing Network This component monitor returns the number of threads in the gatherer process that have sent requests to a remote data store and are either waiting for a response or processing a response. High values returned may indicate either a network bottleneck or that slow hosts may be connected to the index server. Search Gatherer: Document Entries This component monitor returns the number of document entries currently in memory.
SharePoint Server 2010

This template assesses the overall health and performance of Microsoft SharePoint Server 2010. Prerequisites: WMI access to SharePoint server. For more information, see Requirements for Component Monitors and Templates that use WMI" on page 218. Credentials: Windows Administrator on SharePoint server. Monitored Components Components without predetermined threshold values provide guidance such as "Use the lowest threshold possible" or "Use the highest threshold possible" to help you find a threshold appropriate for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Service: SharePoint 2010 Timer This component monitor sends notifications and performs scheduled tasks for SharePoint. Service: SharePoint 2010 Tracing This component monitor manages trace output. Service: SharePoint 2010 User Code Host This component monitor executes user code in a sandbox. Service: SharePoint Foundation Search V4 This service provides full-text indexing and search to SharePoint user and help content. Service: SharePoint Server Search 14 SharePoint Server Search 14 provides enhanced full-text indexing and search capabilities. Service: Document Conversions Launcher This component launches the Microsoft SharePoint Server 2010 Document Conversions Services. This service schedules and initiates document conversions. When SharePoint Foundation passes a document conversion request to the document conversion launcher service, the service must call the appropriate document converter.
Service: Document Conversions Load Balancer This component launches the Microsoft SharePoint Server 2010 Document Conversions Services Load Balancer. This service balances the document conversion requests from across the server farm. When it receives a converter request from SharePoint Foundation, the document conversion load balancer service must return a URI to the appropriate document conversion launcher service. SharePoint Foundation connects to the specified launcher via .NET remotely and requests the specified document be converted. Cache API Trims This component monitor returns the number of cache items that have been removed due to a memory limit being hit, (i.e. they were trimmed). Ideally, this number should be very low or zero. Too many trims may indicate that you need to revisit your caching strategy or manually configure your cache memory limits. Cache API Hit Ratio This component monitor returns the cache hit-to-miss ratio when accessed through the external cache APIs. This counter does not track any use of the cache internally by ASP.NET. For read-only sites, the ratio should be 1. For read-write sites, the ratio may be lower. Potential causes of a low hit ratio include the following: You are using anonymous user caching and users are regularly requesting content that has not yet been cached. You are using ASP.NET output caching for authenticated users and they have edit permissions on the pages they are viewing. You have customized any of the VaryBy* parameters on a page or customized a cache profile. You may have configured a parameter that prevents the pages in the site from being cached effectively
Requests Queued SharePoint Foundation 2010 provides the building blocks for HTML pages that are rendered in the user browser over HTTP. This component monitor returns the number of requests waiting to be processed. If this counter shows hundreds or thousands of requests queued, you should implement additional web servers. The default maximum for this counter is 5,000. You can change this setting in the configuration file. This number should be as low as possible. Request Wait Time This component monitor returns the time, in milliseconds, that the most recent request waited for processing. As the number of wait events increases, you may experience degraded page-rendering performance. This number should be as low as possible. If this value consistently grows, you should think about implementing additional web servers. Requests Rejected This component monitor returns the total number of requests not executed because of insufficient server resources. This represents the number of requests that return a 503 HTTP status code, indicating that the server is too busy. This value should be zero. If this value consistently grows, you should think about implementing additional web servers. Worker Process Restarts This component monitor returns the number of times a worker process has restarted. Restarts use a great deal of resources and therefore should be monitored closely. Restarts can be caused by various process settings, memory leaks, and access violations. It is recommended to closely monitor restarts to determine their cause, thus preventing them from occurring in the future. Any returned number above zero may indicate a problem. Requests/Sec This component monitor returns t the number of requests executed per second. This represents the current throughput of the application. Under constant load, this number should remain within a certain range, barring other server work (such as garbage collection, cache cleanup
SharePoint Services (WSS) 3.0

This template assess the overall health and performance of Windows SharePoint Services 3.0. Prerequisites: WMI access to SharePoint server. For more information, see Requirements for Component Monitors and Templates that use WMI on page 218. Credentials: Windows Administrator on SharePoint server. Monitored Components Components without predetermined threshold values provide guidance such as "Use the lowest threshold possible" or "Use the highest threshold possible" to help you find a threshold appropriate for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Internet Information Services This component monitors only the service that provides Web connectivity through the Internet Information Services Manager. SharePoint Services Search This service provides support for constructing complex search queries through the SQL syntax. search in Windows SharePoint Services. SharePoint Services Timer This component monitor sends notifications and performs scheduled tasks for SharePoint. SharePoint Services Tracing This component monitor manages the trace output of the call stack. Administrators can specify the path used to store the trace log files. This log file may be used by applications that are built on top of Windows SharePoint Services 3.0. ISAPI Connection Count This component monitor returns the current number of extension requests that are simultaneously being processed by the web service. ISAPI Request/Sec This component monitor returns the rate at which ISAPI extension requests are simultaneously being processed by the web service.
ASP.NET Worker Process Restarts This component monitor returns the number of times a worker process has restarted. Restarts use a great deal of resources and therefore should be monitored closely. Restarts can be caused by various process settings, memory leaks, and access violations. It is recommended to closely monitor restarts to determine their cause, thus preventing them from occurring in the future. Any returned number above zero may indicate a problem.
SNPP Port Monitor

This template tests the ability of an SNPP server to accept incoming sessions on port 444. Prerequisites: None. Credentials: None. Monitored Components SNPP Port monitor
Solaris LPD
This template assesses the status and performance of a Solaris LPD print service. Perl scripts are used for retrieving performance data. Prerequisites: SSH and Perl installed on the target server. Credentials: Root credentials on the target server. Monitored Components: Daemon: lpsched This monitor returns the status of the Solaris LPD print server daemon. Possible values: 0 Print server daemon is stopped. 1 Print server daemon is running. Print queue This monitor returns the current length of the default print queue. Successfully printed jobs This monitor returns the number of successfully printed jobs by retrieving data from the requests log file. Successful printed jobs have the following status string in the requests log file: s 0x0014 More information about the status of printed jobs can be found here: http://download.oracle.com/docs/cd/E19963-01/html/821-1457/printref18623.html. Note: By default, the script retrieves this information from the /var/spool/lp/logs/requests file. If this file has another location on the target server, you should correct the path in the script argument box. Unsuccessfully printed jobs This monitor returns the number of jobs that were not successfully printed by retrieving data from the requests log file. The script in this component is looking for all print status strings in the requests log file other than s 0x0014. More information about the status of printed jobs can be found here: http://download.oracle.com/docs/cd/E19963-01/html/821-1457/printref18623.html.
Note: By default, the script retrieves this information from the /var/spool/lp/logs/requests file. If this file has another location on the target server, you should correct the path in the script argument box. LP Print Server Listening TCP Port This component monitor tests the ability of an LP print service to accept incoming sessions. Note: By default, TCP 631 port is monitored. If your print server listens on another port, you should manually change it.
SolarWinds (Orion) Server

This template assesses the status of Windows services related to SolarWinds servers. Prerequisites: WMI access to target server. For more information, see Requirements for Component Monitors and Templates that use WMI on page 218. Credentials: Windows Administrator on target server. Monitored Components SW Alerting Engine SW Network Performance Monitor SW Job Engine SW Job Scheduler SW Module Engine SW Syslog Service SW Web Console UE
SolarWinds NetFlow Traffic Analyzer Database

This template assesses the performance of a SolarWinds NetFlow Traffic Analyzer by retrieving performance data from the SolarWinds database. Prerequisites: None. Credentials: SQL Server user name and password. Monitored Components Status of NetFlow maintenance This monitor checks to make sure maintenance is running properly. If the NetFlow Traffic Analyzer maintenance is functioning properly, this component will return a value of zero. If the returned value is greater than zero, NTA Maintenance is not performing properly which can lead to performance issues. If this is the case, run NTA Database Maintenance manually. (This application can be found in the SolarWinds directory). If the value returned is still greater than zero, contact SolarWinds support. Number of NetFlow Interfaces Receiving Data This monitor returns the number of NetFlow interfaces that have received data within two minutes. If this counter is consistently zero, problems with receiving this information exists. Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. Number of CBQoS Interfaces Receiving Data This monitor returns the number of CBQoS interfaces that received data within two minutes. If this counter is consistently zero, problems with receiving this information exists. Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. Number of NetFlow Interfaces not Receiving Data This monitor returns the number of NetFlow interfaces which should, but have not yet, received data within two minutes. The value returned should be as low as possible. If the returned value is greater than zero, the flow is not received even though the interfaces are configured to receive this type of flow. This could be an indication of an improperly configured switch. If this is the case, ensure that the switch exports a flow for that interface or disable the interface in NetFlow Sources.
Number of CBQoS Interfaces not Receiving Data This monitor returns the number of CBQoS interfaces which should, but have not yet, received data within two minutes. The returned value should be as low as possible. If the returned value is greater than zero, a flow is not received even though the interfaces are configured to receive this type of flow. This could be an indication of an improperly configured switch. If this is the case, ensure that switch exports a flow for that interface or disable the interface in NetFlow Sources. NetFlow Service Status This monitor returns the running state of the NetFlow service by comparing the current time with the KeepAlive timestamp. If the difference is greater than 15 minutes, a zero value will be returned, indicating a problem with the service status; otherwise, a value of one is returned. If this is the case, verify the NTA service is running properly on the server. If there are persistent problems with this service, contact SolarWinds support. Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. High Priority Queue Addresses that are not Processed This monitor returns the number of addresses in the high priority queue that are not processed but should be processed. The returned value should be near or at zero. If the value fails to drop to zero, this means DNS server is not able to process all of the incoming IP addresses. If this is the case, adjust your DNS server to process more requests per second, or switch DNS resolving to On Demand. For more information, refer to the APM Administrator Guide. This counter will function only when the DNS resolution is set to "persistent." Low Priority Queue Addresses that are not Processed This monitor returns the number of addresses in the low priority queue that are not processed but should be processed. The returned value should be near or at zero. This queue contains IP addresses which were not resolved and should be resolved and is processed when the first queue is empty. If the returned value continues to grow, it can be an indication of an improperly configured DNS which is not able to resolve IP addresses. This counter will function only when the DNS resolution is set to "persistent."
Number of records in NTA Summary table 1 This monitor returns the number of records in NetFlowSummary1 table. This value should be around the same value for each summary table. Compare this monitor with Number of records in NTA Summary table 2 and Number of records in NTA Summary table 3 monitors. If the value is growing daily, this is an indication that the NTA Database Maintenance is not working properly. If this is the case, run NTA Database Maintenance manually. (This application can be found in the SolarWinds directory). If the value returned is still greater than zero, contact SolarWinds support. Note: This query uses a great deal of resources and should be executed just once per day. By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. Number of records in NTA Summary table 2 This monitor returns the number of records in NetFlowSummary1 table. This value should be around the same value for each summary table. Compare this monitor with Number of records in NTA Summary table 1 and Number of records in NTA Summary table 3 monitors. If the value is growing daily, this is an indication that the NTA Database Maintenance is not working properly. If this is the case, run NTA Database Maintenance manually. (This application can be found in the SolarWinds directory). If the value returned is still greater than zero, contact SolarWinds support. Note: This query uses a great deal of resources and should be executed just once per day. By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. Number of records in NTA Summary table 3 This monitor returns the number of records in NetFlowSummary1 table. This value should be around the same value for each summary table. Compare this monitor with Number of records in NTA Summary table 1 and Number of records in NTA Summary table 2 monitors. If the value is growing daily, this is an indication that the NTA Database Maintenance is not working properly. If this is the case, run NTA Database Maintenance manually. (This application can be found in the SolarWinds directory). If the value returned is still greater than zero, contact SolarWinds support. Note: This query uses a great deal of resources and should be executed just once per day. By default, this component monitor is disabled and should only be enabled for troubleshooting purposes.
Number of Detail Tables This monitor returns the number of Detail Tables in the database, per node. Each node has a specific number of Detail Tables which can be changed in the NetFlow Settings. The default is four. If the number of Detail Tables per node exceeds the allowed maximum and continually grows, this could be an indication that there is a problem with the NTA service. If this is the case, verify that all services are running properly. If needed, run NTA Database Maintenance manually. (This application can be found in the SolarWinds directory). If the problem persists, contact SolarWinds Technical Support. Number of polling Huawei devices This monitor returns the number of Huawei devices with interface mapping that are enabled and working properly. If you do not have any Huawei devices, the value returned should be zero. If you have devices with interface mapping enabled and the returned value is zero, interface mapping may not be working properly. Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes.
SolarWinds NetFlow Traffic Analyzer

This template assesses the performance of the SolarWinds NetFlow Traffic Analyzer by retrieving performance data from performance counters and checking services' status. Prerequisites: WMI access to the target server. Credentials: User with administrative privileges on the target server. Monitored Components Service: SolarWinds NetFlow Service This component returns CPU and memory usage of the SolarWinds NetFlow Service. This service is responsible for receiving and saving data to the database as well as providing licensing information to the web console. If this service is stopped, data will not be collected. Cached Data Queue Length This monitor returns the amount of data not currently saved to the database. If this service is stopped or disabled, this data will be lost. This value should be as low as possible. If the returned value grows, the NTA server will not be able to save processed flows into the database. It is recommended that you adjust Top Talkers Optimization. Collapsed Records Per Second This monitor returns the amount of incoming records that are collapsed, per second. Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. IP Address Cache Size This monitor returns the size of the IP address cache. This counter will function only when the DNS resolution is set to "persistent." Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. IP Requests Per Second This monitor returns the IP requests rate, per second. This counter will function only when the DNS resolution is set to "persistent." Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes.
IP Requests Queued This monitor returns the number of IP requests in the queue. This counter will function only when the DNS resolution is set to "persistent." IP Resolved Per Second This monitor returns the IP resolved rate, per second. This counter will function only when the DNS resolution is set to "persistent." Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. IP Responses Per Second This monitor returns the IP responses rate, per second. This counter will function only when the DNS resolution is set to "persistent." Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. IP Responses Queued This monitor returns the number of IP responses in the queue. This counter will function only when the DNS resolution is set to "persistent." IP UnResolved Per Second This monitor returns the IP unresolved rate, per second. This counter will function only when the DNS resolution is set to "persistent." Packets Per Second This monitor returns the packets rate, per second, before the queue. Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. Packet Dropped: Unmanaged Node This monitor returns the number of packets dropped due to a node not being managed by NetFlow. This is caused by the node being disabled or the node not existing in NPM. The returned value should be zero. If the returned value is greater than zero, add these nodes to NPM or disable the exporting of these flows on your router.
Packet Dropped: Unmonitored Node This monitor returns the number of packets dropped due to a node not being monitored by NetFlow. These nodes are monitored by NPM. The returned value should be zero. If the value is greater than zero, add these nodes as NetFlow Sources or disable the exporting of these flows on the router. PDU Dropped: Unmanaged Interface This monitor returns the number of PDUs dropped due to an interface not being managed by NetFlow. This is caused by the node being disabled or the node not being in the NetFlow Sources table. This counter will function only when the option, "Allow monitoring of flows from unmanaged interfaces," in the NTA settings is set. PDU Dropped: Unmonitored Interface This monitor returns the number of packets dropped due to an interface not being monitored by NetFlow. These Interfaces are in NPM. The value returned should be zero. If the value is greater than zero, add these interfaces into NetFlow Sources or disable the exporting of these flows on the router. PDU Dropped: Unmonitored Port This monitor returns the number of packets dropped due to an unmonitored application. This counter is connected to the "Enable data retention for traffic on unmonitored ports" setting in NTA settings. If checked, flows with unmonitored ports will remain stored in the database. If unchecked, flows will be dropped and this counter will continue to grow. The returned value should be zero. If the value returned is greater than zero, you should verify that all the ports you want to monitor are actually being monitored. PDU Dropped: Unmonitored Protocol This monitor returns the number of packets dropped due to a disabled protocol. Protocols to be monitored can be changed in the NetFlow Settings > Monitored Protocols section. The returned value for this monitor should be zero. If the value returned is greater than zero, you should verify that the protocols you want to monitor are actually being monitored. PDU Per Second This monitor returns the PDU rate, per second, after the queue.
Raw Packet Queue Length This monitor returns the number of raw packets in the queue. If the value returned continues to grow, this indicates that the NetFlow service will not be able to handle the amount of incoming flows quickly enough, thereby placing them in the queue. Consider upgrading your APM server to improve performance. Netflow V1 Bytes Received Per Second This monitor returns the number of bytes NetFlow V1 received per second. Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. Netflow V1 Flows Received Per Second This monitor returns the number of flows NetFlow V1 received per second. Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. Netflow V5 Bytes Received Per Second This monitor returns the number of bytes NetFlow V5 received per second. Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. Netflow V5 Flows Received Per Second This monitor returns the number of flows NetFlow V5 received per second. Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. Netflow V9 Bytes Received Per Second This monitor returns the number of bytes NetFlow V9 received per second. Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. Netflow V9 Flows Received Per Second This monitor returns the number of flows NetFlow V9 received per second. Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes.
sFlow V5 Bytes Received Per Second This monitor returns the number of bytes sFlow V5 received per second. Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. sFlow V5 Flows Received Per Second This monitor returns the flow rate received, per second, for sFlow V5. Note: By default, this component monitor is disabled and should only be enabled for troubleshooting purposes. Packet Dropped: Insufficient performance This monitor returns the amount incoming packets dropped due to the poor performance of the SQL server or NTA Service. The returned value should be zero. If this occurs in one specific instance, verify that the database server is not overloaded. Database Maintenance may be the culprit. If this is a persistent problem, the database server probably is not able to process the amount of incoming flows. It is recommended that you adjust Top Talkers Optimization. Netflow service time difference error This monitor returns the number of events when the time difference between the database server and the NTA Server is greater than 5 minutes. Type of event: Error. Event ID: 340, 341. Possible impact: Data in the database could be saved and represented wrongly. Solution: Synchronize the time between the NTA Server(s) and the database server. Unmonitored traffic record is missing This monitor returns the number of events that occur when system records go missing in the NTA table. Type of event: Event ID: 304. Solution: Run the Configuration Wizard to repair this problem.
Unable to start listening on port This monitor returns the number of events when the NTA service cannot start the port listener on NTA port. (Default is port 2055). Type of event: Event ID: 323. Impact: NTA Service is not able to receive flows. Solution: Verify the actual port that is occupied and attempt to free it, or, change the port of the NTA service which can be located on the NTA Settings page.
SQL Server (via SNMP)

This template assesses the status of Windows services related to Microsoft SQL Server servers. Prerequisites: SNMP access to target server. Credentials: None. Monitored Components SQL Server Browser - SNMP SQL Server Port SQL Server Process SNMP
SQL Server 2005 2008 Performance (WMI)

This template uses Windows performance counters via RPC to assess the status and performance of Microsoft SQL Server 2005 or 2008 databases. Prerequisites: WMI access to the target server. RPC and Remote Registry services must be running on the target server. For more information, see Requirements for Component Monitors and Templates that use WMI on page 218. Credentials: Windows Administrator on target server. Monitored Components Buffer Manager: Buffer cache hit ratio This SQL Server Buffer Cache Hit Ratio counter indicates how often SQL Server goes to the buffer, not the hard disk, to get data. In OLTP applications, this ratio should exceed 90%, and ideally be over 99%. If your buffer cache hit ratio is lower than 90%, you need to go out and buy more RAM as soon as possible. If the ratio is between 90% and 99%, then you should seriously consider purchasing more RAM, as the closer you get to 99%, the faster your SQL Server will perform. In some cases, if your database is very large, you may not be able to get close to 99%, even if you put the maximum amount of RAM in your server. All you can do is add as much as you can, and then live with the consequences. In OLAP applications, the ratio can be much less because of the nature of how OLAP works. In any case, more RAM should increase the performance of SQL Server. Buffer Manager: Page reads/sec The number of physical database page reads issued. 80 90 per second is normal; anything that is above indicates indexing or memory constraint. Values for this counter will vary between database applications, but this information is useful when determining if SQL Server is the primary application using the disk. If the Buffer Manager page read-writes are low but disk-queue lengths are high, there might be a disk bottleneck. If the Page read-writes are higher than normal, a memory shortage is likely to exist. Buffer Manager: Page writes/sec The number of physical database page writes issued. 80 90 per second is normal; anything more and you need to check the lazy writer/sec and checkpoint counters. If these counters are also relatively high, then it is a memory constraint.
Values for this counter will vary between database applications, but this information is useful when determining if SQL Server is the primary application using the disk. If the Buffer Manager page read-writes are low but disk-queue lengths are high, there might be a disk bottleneck. If the Page read-writes are higher than normal, a memory shortage is likely to exist. SQL Server Port Check the availability of SQL Server Port (default is port 1433). Note: You need to change the port value if you are using another port. Latches: Latch waits\sec This is the number of latch requests that could not be granted immediately. In other words, these are the amount of latches, in a one second period, that had to wait. Latches are light-weight synchronization constructs that are designed to protect the physical integrity of a page in a similar way to how locks protect the logical consistency of rows. They are taken any time something wants to modify a page, be it moving the page from disk to memory or via versa, writing a record onto a page or changing a page's metadata. Access Methods: Full scans\sec This counter monitors the number of full scans on base tables or indexes. Values greater than 1 or 2 indicate that we are having table / Index page scans. If we see high CPU, then we need to investigate this counter. Otherwise, if the full scans are on small tables, we can ignore this counter. A few of the main causes of high Full Scans/sec are: missing indexes and too many rows requested. Queries with missing indexes or too many rows requested will have a large number of logical reads and an increased CPU time. Server work queues: Queue Length Queue Length is the current length of the server work queue for this CPU. A sustained queue length greater than twice the number of CPU cores might indicate processor congestion. Note: Set a threshold according to your number of CPU cores.
Memory: Pages/sec A page fault occurs when the operating system (OS) cannot find the requested information in its physical memory, forcing the OS to seek the information at the disk level. A soft page fault is when a page is found elsewhere in the physical memory, and a hard fault requires disk access. Most processors can handle large numbers of soft faults without significant consequence. However, hard faults, which require disk access, can cause significant delays. This value should stay below 20-25 pages per second. Disk: Average Disk Read Queue Length Average Disk Read Queue Length is the average number of read requests that were queued for the selected disk during the sample interval. The value for this counter should always be under 2. This is the most reliable counter to use when the SQL instance is using external SAN storage for its databases. Disk: Average Disk Write Queue Length Average Disk Write Queue Length is the average number of write requests that were queued for the selected disk during the sample interval. The value for this counter should always be under 2. This is the most reliable counter to use when the SQL instance is using external SAN storage for its databases. Locks: Lock Waits/sec This counter reports how many times users waited to acquire a lock over the past second. Note that while you are actually waiting on the lock, this is not reflected in this counter. It gets incremented only when you wake up after waiting on the lock. If this value is nonzero, then it is an indication that there is at least some level of blocking occurring. If you combine this with the Lock Wait Time counter, you can get some idea of how long the blocking lasted. A zero value for this counter can definitively rule out blocking as a potential cause; a nonzero value will require looking at other information to determine whether it is significant. Buffer Manager: Page life expectancy This performance monitor counter tells you, on average, how long data pages are staying in the buffer. If this value gets below 300 seconds, this is a potential indication that your SQL Server could use more memory in order to boost performance.
Memory Manager: Total Server Memory (KB) The Total Server Memory is the current amount of memory that SQL Server is using. If this counter is still growing, the server has not yet reached its steady-state, and it is still trying to populate the cache and get pages loaded into memory. Performance will likely be somewhat slower during this time, since more disk I/O is required at this stage. This behavior is normal. Eventually Total Server Memory should approximate Target Server Memory. Note: Set a threshold according to your environment. SQL Statistics: Batch Requests/sec This counter measures the number of batch requests that SQL Server receives per second, and generally follows in step to how busy your server's CPUs are. Generally speaking, over 1000 batch requests per second indicates a very busy SQL Server, and could mean that if you are not already experiencing a CPU bottleneck, that you may be experiencing one soon. Of course, this is a relative number, and the bigger your hardware, the more batch requests per second SQL Server can handle. From a network bottleneck approach, a typical 100Mbs network card is only able to handle about 3000 batch requests per second. If you have a server that is this busy, you may need to have two or more network cards, or go to a 1Gbs network card. Note: Sometimes low batch requests/sec can be misleading. If there were a SQL statements/sec counter, this would be a more accurate measure of the amount of SQL Server activity. For example, an application may call only a few stored procedures, yet each stored procedure does lot of work. In that case, we will see a low number for batch requests/sec but each stored procedure (one batch) will execute many SQL statements that drive CPU and other resources. As a result, many counter thresholds based on the number of batch requests/sec will seem to identify issues because the batch requests on such a server are unusually low for the level of activity on the server. We cannot conclude that a SQL Server is not active by looking at only batch requests/sec. Rather, you have to do more investigation before deciding there is no load on the server. If the average number of batch requests/sec is below 5 and other counters (such as SQL Server processor utilization) confirm the absence of significant activity, then there is not enough of a load to make any recommendations or identify issues regarding scalability. Note: Set this threshold according to your environment.
General Statistics: User Connections The number of users currently connected to the SQL Server. Note: It is recommended to review this counter along with Batch Requests/Sec. A surge in user connections may result in a surge of Batch Requests/Sec. So if there is a disparity (one going up and the other staying flat or going down), then that may be a cause for concern. With a blocking problem, for example, you might see user connections, lock waits, and lock wait time all increase, while batch requests/sec decreases. Memory Manager: Target Server Memory (KB) Total amount of dynamic memory the server can consume. Buffer Manager: Lazy writes/sec How many times per second lazy writer has to flush dirty pages out of the buffer cache instead of waiting on a checkpoint. Typically dirty pages are flushed out of cache by the checkpoint process. If the value of this counter is higher than 20, then the server could use additional RAM. Logins/sec Total number of logins started per second. This does not include pooled connections. Buffer Manager: Free pages Total number of pages on all free lists. This should be greater than 640. Databases: Transactions/sec The number of database transactions started in the last second. Memory Manager: Memory Grants Pending Total number of processes waiting to acquire a workspace memory grant. Locks: Average Wait Time (ms) The average wait time in milliseconds of each lock request that had a wait time. Locks: Lock Timeouts/sec The number of lock requests per second that time out. This number includes NOWAIT lock requests.
Databases: Data File(s) Size (KB) The total size of the database data files. Transactions: Longest Transaction Running Time The length of time in seconds the transaction that has been running the longest has been active. Log Flushes/sec The total number of log bytes flushed. SQL Compilations/sec The number of SQL compilations that occur each second. Values higher than 100 indicate a high proportion of adhoc queries and may be using up valuable CPU time. Solutions include rewriting adhoc queries as stored procedures and using sp_executeSQL. This value should be as low as possible. Locks: Number of Deadlocks/sec The number of lock requests that end up in a deadlock per second. This value should less than 1. Database: Log File(s) Size (KB) The total size of the database log files.
SQL Server 2005-2008 Performance (SQL)

This template assesses the performance of a Microsoft SQL Server 2005-2008 database by retrieving performance data from the built-in master .sysperfinfo pseudo-table. Prerequisites: None. For more information, see SQL Server User Experience Monitor" on page 605. Credentials: SQL Server user name and password. Monitored Components User Connections The number of users currently connected to the SQL Server. Note: It is recommended to review this counter alo ng with Batch Requests/Sec. A surge in user connections may result in a surge of Batch Requests/Sec. So if there is a disparity (one going up and the other staying flat or going down), then that may be a cause for concern. With a blocking problem, for example, you might see user connections, lock waits, and lock wait time all increase, while batch requests/sec decrease. Total Server Memory (KB) The Total Server Memory is the current amount of memory that SQL Server is using. If this counter is still growing, the server has not yet reached its steady-state, and it is still trying to populate the cache and get pages loaded into memory. Performance will likely be somewhat slower during this time since more disk I/O is required at this stage. This behavior is normal. Eventually Total Server Memory should approximate Target Server Memory. Set a threshold according to your environment. Target Server Memory (KB) The total amount of dynamic memory the server can consume.
Buffer cache hit ratio This SQL Server Buffer Cache Hit Ratio counter indicates how often SQL Server goes to the buffer, not the hard disk, to get data. In OLTP applications, this ratio should exceed 90%, and ideally be over 99%.If your buffer cache hit ratio is lower than 90%, you need to go out and buy more RAM as soon as possible. If the ratio is between 90% and 99%, then you should seriously consider purchasing more RAM, as the closer you get to 99%, the faster your SQL Server will perform. In some cases, if your database is very large, you may not be able to get close to 99%, even if you put the maximum amount of RAM in your server. All you can do is add as much as you can, and then live with the consequences. In OLAP applications, the ratio can be much less because of the nature of how OLAP works. In any case, more RAM should increase the performance of SQL Server. Page reads/sec Number of physical database page reads issued. 80 90 per second is normal; anything that is above indicates indexing or memory constraint. Values for this counter will vary between database applications, but this information is useful when determining if SQL Server is the primary application using the disk. If the Buffer Manager page read-writes are low but disk-queue lengths are high, there might be a disk bottleneck. If the Page read-writes are higher than normal, a memory shortage is likely to exist. Page writes/sec Number of physical database page writes issued. 80 90 per second is normal, anything more we need to check the lazy writer/sec and checkpoint counters, if these counters are also relatively high then, it is a memory constraint. Values for this counter will vary between database applications, but this information is useful when determining if SQL Server is the primary application using the disk. If the Buffer Manager page read-writes are low but disk-queue lengths are high, there might be a disk bottleneck. If the Page read-writes are higher than normal, a memory shortage is likely to exist. Lazy writes/sec Number of buffers written per second by the lazy writer system process. The lazy writer flushes out old, dirty buffer cache pages to make them available for reuse. If the value of this counter is higher than 20, then the server could use additional RAM.
Page Life Expectancy The time in seconds before the average data page is removed from the cache buffer. If the average page life falls below 300 seconds, this may indicate that your SQL server may require more RAM to improve performance. Lock Waits/sec This counter reports how many times users waited to acquire a lock over the past second. Note that while you are actually waiting on the lock, this is not reflected in this counter. It gets incremented only when you wake up after waiting on the lock. If this value is nonzero, then it is an indication that there is at least some level of blocking occurring. If you combine this with the Lock Wait Time counter, you can get some idea of how long the blocking lasted. A zero value for this counter can definitively rule out blocking as a potential cause; a nonzero value will require looking at other information to determine whether it is significant. Logins/sec Total number of logins started per second. This does not include pooled connections. Latch Waits/sec This is the number of latch requests that could not be granted immediately. In other words, these are the amount of latches in a one second period that had to wait. Latches are light-weight synchronization constructs that are designed to protect the physical integrity of a page in a similar way to how locks protect the logical consistency of rows. They're taken any time something wants to modify a page, be it moving the page from disk to memory or via versa, writing a record onto a page, or changing a page's metadata. Full Scans/sec This counter monitors the number of full scans on base tables or indexes. Values greater than 1 or 2 indicate that we are having table / Index page scans. If we see high CPU then we need to investigate this counter. Otherwise, if the full scans are on small tables, we can ignore this counter. Two of the main causes of high Full Scans/sec are missing indexes and too many rows requested. Queries with missing indexes or too many rows requested will have a large number of logical reads and an increased CPU time.
Batch Requests/sec This counter measures the number of batch requests that SQL Server receives per second, and generally follows in step to how busy your server's CPUs are. Generally speaking, over 1000 batch requests per second indicates a very busy SQL Server, and could mean that if you are not already experiencing a CPU bottleneck, that you may be experiencing one soon. Of course, this is a relative number, and the bigger your hardware, the more batch requests per second SQL Server can handle. From a network bottleneck approach, a typical 100Mbs network card is only able to handle about 3000 batch requests per second. If you have a server that is this busy, you may need to have two or more network cards, or go to a 1Gbs network card. Note: Sometimes low batch requests/sec can be misleading. If there were a SQL statements/sec counter, this would be a more accurate measure of the amount of SQL Server activity. For example, an application may call only a few stored procedures, yet each stored procedure does a lot of work. In that case, we will see a low number for batch requests/sec but each stored procedure (one batch) will execute many SQL statements that drive CPU and other resources. As a result, many counter thresholds based on the number of batch requests/sec will seem to identify issues, because the batch requests on such a server are unusually low for the level of activity on the server. We cannot conclude that a SQL Server is not active by looking at only batch requests/sec. Rather, you have to do more investigation before deciding there is no load on the server. If the average number of batch requests/sec is below 5 and other counters (such as SQL Server processor utilization) confirm the absence of significant activity, then there is not enough of a load to make any recommendations or identify issues regarding scalability. Note: Set this threshold according to your environment. Blocked Queries The number of queries that are currently blocked. Poorly written queries can block even the faster, more efficient queries and make them slow. This value should be as low as possible. Fragmentation (%) of Most Fragmented Table The fragmentation percentage of the most fragmented table in the database. Fragmentation occurs naturally because INSERT, UPDATE, and DELETE statements are not typically distributed equally among the table rows and its indexes, creating variations in how full each page is. For queries that scan portions of the indexes of a table, fragmentation can cause additional page reads.
The fragmentation percentage of a table should ideally be as close to zero as possible, but values from 0 10% are usually acceptable for day-to-day operations. Moderate fragmentation is 30%, severe fragmentation is 50%. Fragmented Tables in Database The number of tables in the database that have one or more out-of-order index pages. Row Count of Largest Table The number of rows in the largest table in the database. Transactions/sec The number of database transactions started in the last second. Memory Grants Pending Total number of processes waiting to acquire a workspace memory grant. Average Lock Wait Time (ms) The average wait time in milliseconds of each lock request that had a wait time. This value should be kept under 500ms. Wait times over 500ms may indicate blocking. Lock timeouts/sec The number of lock requests per second that time out. This number includes NOWAIT lock requests. Total Size (KB) of Database Files The total size of the database data files. Longest Transaction Running Time The length of time in seconds the transaction that has been running the longest has been active. Log Flushes/sec The total number of log bytes flushed. SQL Compilations/sec The number of SQL compilations that occur each second. Values higher than 100 indicate a high proportion of adhoc queries and may be using up valuable CPU time. Solutions include rewriting adhoc queries as stored procedures and using sp_executeSQL.
This value should be as low as possible, preferably under 10% of the Batch Requests/sec. Deadlocks/sec The number of lock requests that end up in a deadlock per second. This value should less than 1. Total Size (KB) of Log Files The total size of the database log files.
SQL Server Query

This template assesses the performance of a Microsoft SQL Server database by retrieving performance data from the built-in master..sysperfinfo pseudo-table. Prerequisites: None. Note: This template only works for Microsoft SQL Server instances on the default port 1433. To monitor SQL Server instances on a different port, you must convert the SQL Server User Experience monitors in this template to ODBC User Experience monitors, and use an appropriate connection string that matches the custom port number. For more information, see ODBC User Experience Monitor on page 579. Credentials: SQL Server user name and password. Monitored Components Buffer cache hit ratio Lazy writes/sec Lock Wait Time (ms) Local Waits/sec Logins/sec Page Life Expectancy Page reads/sec Page writes/sec Target Server Memory % Total Server Memory (KB) User Connections
Streaming Media Services 2008

This template assesses the overall health of Streaming Media Services 2008 services and counters. It is recommended to use this template in conjunction with the Windows Server 2003-2008 Services and Counters template. Prerequisites: RPC and WMI access to the domain controller. For more information, see Requirements for Component Monitors and Templates that use WMI in the SolarWinds SAM Administrator Guide. Credentials: Windows Administrator on the domain controller. Note: For more information on how to optimize Windows Media Services, refer to the following article: http://www.microsoft.com/windows/windowsmedia/howto/articles/optimize_web.a spx#appendix_f. Monitored Components Components without predetermined threshold values provide guidance such as "Use the lowest threshold possible" or "Use the highest threshold possible" to help you find a threshold appropriate for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Current Cache Downloads This component monitor returns the number of concurrent streams being downloaded to the memory area of the cache/proxy server. Current Connected Players This component monitor returns the current number of players with unicast connections to the server. This number does not include distribution server connections. Current Connection Queue Length This component monitor returns the current number of connection requests that are pending on the server from both player and distribution servers. This value should be as low as possible. Current Connection Rate This component monitor returns the current number of clients per second that are connecting to the server.
Current File Read Rate (Kbps) This component monitor returns the current rate, in kilobits per second (Kbps), at which data packets are read from a file. Current Incoming Bandwidth (Kbps) This component monitor returns the current bandwidth, in Kbps, allocated for streams from other servers. Current Late Read Rate This counter returns the current number of data packets per second that take longer than 400 milliseconds to read from the file system. The value for this monitor should not be higher than zero for an extended period of time. If it is, this may indicate that the WMS server is not able to read from its data sources fast enough. Current Late Send Rate This component monitor returns the current number of packets that are sent out 0.5 seconds, or more, after the marked send time. Current Outgoing Distribution Allocated Bandwidth (Kbps) This component monitor returns the current bandwidth, in Kbps, allocated for streams to distribution servers. Current Outgoing Distribution Connections This component monitor returns the current number of distribution servers that are connected to the server. Current Outgoing Distribution Send Rate (Kbps) This component monitor returns the current rate, in Kbps, at which data packets are being streamed to distribution servers. Current Player Allocated Bandwidth (Kbps) This component monitor returns the current amount of bandwidth, in Kbps, that is allocated for all streams to players. Current Player Send Rate (Kbps) This component monitor returns the current rate, in Kbps, at which data packets are being streamed to players. If the send rate continuously drops below the allocated bandwidth, WMS will be unable to service all the clients. This may indicate an outbound network bottleneck.
Current Stream Error Rate This component monitor returns the current number of errors per second due to dropped packets. If this value is higher than zero for an extended period of time, this may indicate that the WMS server is unable to keep up with the demand. This also may indicate late reads. Current Streaming HTTP Players This component monitor returns the current number of players that are being streamed through the HTTP protocol. This does not include players that are stopped or paused. Current Streaming MMS Players This component monitor returns the current number of players that are being streamed through the MMS protocol. This does not include players that are stopped or paused. Current Streaming Players This component monitor returns the current number of players that are being streamed across all protocols. This does not include players that are stopped or paused. Current Streaming RTSP Players This component monitor returns the current number of players that are being streamed through the RTSP protocol. This does not include players that are stopped or paused. Current Streaming UDP Players This component monitor returns the current number of players that are being streamed through the UDP transport protocol. This does not include players that are stopped or paused. Current UDP Resend Requests Rate This component monitor returns the current number of requests for UDP resends per second received from clients. Current UDP Resends Sent Rate This component monitor returns the current number of UDP resends per second that are sent to clients.
Service: Windows Media Services This component monitor returns a status of up or down. This enables you to manage delivery of live or on-demand digital media content, including Windows Media Audio (WMA) and Windows Media Video (WMV), over networks by using administrative interfaces in Microsoft Windows Media Services 2008. Total Advertisements This counter returns the total number of advertisements that have been streamed from playlists since the last time the counter was reset. Total Connected Players This counter returns the total number of players that have connected to the server since the last time the counter was reset. Total Late Reads This counter returns the total number of times that the server required more than 400 milliseconds to read data from the file system since the last time the counter was reset. Total Late Sends This counter returns the total number of times the server sent out data packets, 0.5 seconds or more after the marked send time since the last time the counter was reset. Total Outgoing Distribution Connections This counter returns the total number of distribution servers that have connected to the server or publishing point since the last time the counter was reset. Total Server Uptime (s) This counter returns the elapsed time, in seconds, that the Windows Media Services service has been running since it was last started. Total Stream Denials This counter returns the total number of times the server refused to send a requested stream to a client since the last time the counter was reset. This includes denials that occurred due to authorization/authentication failure as well as denials that occurred because limits were exceeded. Total Stream Errors This counter returns the total number of stream errors due to dropped packets since the last time the counter was reset.
Total Streaming HTTP Players This counter returns the total number of players that have streamed data through the HTTP protocol since the last time the counter was reset. Total Streaming Players This counter returns the total number of players that have streamed data since the last time the counter was reset. Total Streaming RTSP Players This counter returns the total number of players that have streamed data through the RTSP protocol since the last time the counter was reset. Total Streaming UDP Players This counter returns the total number of players that have streamed data through the UDP transport protocol since the last time the counter was reset.
Sybase ASE
This template assesses the performance of the Sybase ASE database by retrieving performance data from the monitoring tables. Prerequisites: Sybase ASE 15.0. Sybase ASE ODBC must be installed on the SAM server. (Instructions can be found on the Sybase ASE installation media.) Complete the following before using this template: 1. Database user must have mon_role role. 2. The database server should have the following options enabled: Enable monitoring Wait event timing Object lockwait timing Statement statistic active Per object statistic active Statement pipe active Statement pipe max messages SQL batch capture SQL text pipe active SQL text pipe max messages
More information on how to enable these options can be found here: http://www.sypron.nl/mda.html.
3. The database server and the ODBC driver on the SAM server should
use the same character set. If you receive the following error: "Could not load code page for requested charset," inspect what character set is used by the client by default by looking in SYBASE_PATH\locales\locales.dat. Also, look at which character set is used by the database server. More information about character sets can be found here:
http://infocenter.sybase.com/help/index.jsp?topic=/com.sybase.help.as e_15.0.sag1/html/sag1/sag1462.htm. 4. Check the monitor tables installed on the database server by running the
following command:
SELECT * FROM monTables
If the query returns an error, examine this error for troubleshooting clues. If monitor tables are not installed, you should manually install them. Installation instructions can be found here: http://infocenter.sybase.com/help/index.jsp?topic=/com.sybase.dc20022
_1251/html/monitoring/monitoring33.htm . Credentials: Database user name and password. Monitored Components Components without predetermined threshold values provide guidance such as "Use the lowest threshold possible" or "Use the highest threshold possible" to help you find a threshold appropriate for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Transactions/sec This component monitor returns the transactions rate, per second. Days Running This component monitor returns the number of days the Adaptive Server has been running. Deadlocks This component monitor returns the total number of deadlocks that have occurred. This number should be as low as possible. Active Connections This component monitor returns the number of active inbound connections. Lock Waits This component monitor returns the number of processes that have waited longer than LockWaitThreshold seconds (10 seconds by default). Lock Waits/sec This component monitor returns the lock waits rate, per second. Currently Opened Databases This component monitor returns the number of currently opened databases. Active Worker Processes This component monitor returns the number of active worker processes. Memory Used by Worker Process (kb) This component monitor returns the amount of memory, in kilobytes, currently in use by worker processes.
Memory Used by Cache (kb) This component monitor returns the number of kilobytes of the cache the object is occupying. Active Processes This component monitor returns the number of currently active processes. Specific Database Used Space (MB) This component monitor returns the used size, in MB, for the specified database. Note: By default, this monitor returns the value for the master database. To change the database, replace "master" with your database name in the following SQL query:
select @dbn = 'master'
Specific Database Free Space (MB) This component monitor returns the available space, in MB, for the specified database. Note: By default, this monitor returns the value for the master database. To change the database, replace "master" with your database name in the following SQL query:
select @dbn = 'master'
Total Databases Size (MB) This component monitor returns the total size of all databases, in MB. Requests/sec This component monitor returns the rate of stored procedures requested per second. Procedure Cache Hit Ratio (%) This component monitor returns the procedure cache hit ratio. This value should be as high as possible. Cache Hit Ratio (%) This component monitor returns the percentage of times a requested data page has been found in the data cache. A cache hit ratio of 97% or less could indicate memory starvation. If this becomes a continual issue, allocate more memory to the data cache.
Writes/sec This component monitor returns the number of buffers written from the cache to the disk.
TACACS+ User Experience

This template tests user authentication through the TACACS+ protocol. Prerequisites: A server with TACACS+ authentication. You must know the secret shared key. Credentials: A valid TACACS+ username and password. Monitored Components TACACS+ User Experience Monitor
Thwack.com - User Experience Monitor

This template demonstrates using the HTTP Monitor to monitor the operational status of the thwack.com search function. Note: Prerequisites: None. Credentials: None. Monitored Components Thwack.com UE
Tomcat Server
This template collects server resource information from an Apache Tomcat server by retrieving status information from the Tomcat status page. Prerequisites: None. Credentials: User with manager role: Tomcat users and roles can be configured in tomcat-users.xml file. Example:
<role rolename="manager"/> <user username="user" password="pass" roles="manager"/>
Monitored Components: Note: You need to set thresholds for counters according to your environment. It is recommended to monitor counters for some length of time to understand potential value ranges and then set the thresholds accordingly. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Note: By default all components use port 8080. If your Tomcat server uses another port, you should manually change the Port Number field in all components. Tomcat Free Memory This monitor returns the amount of heap space currently available to the Java Virtual Machine. This value should be as high as possible. The heap space may be of a fixed size or may be expanded and shrunk, depending on the garbage collector's strategy. More information can be found here: http://javarevisited.blogspot.com/2011/05/java-heap-space-memory-sizejvm.html. Tomcat Total Memory This monitor returns the total amount of memory currently allocated to the Java Virtual Machine heap space. This value should be as low as possible. You should set thresholds according to your Tomcat Max Memory value. If the returned value is near the Tomcat Max Memory value or you received OutOfMemoryError errors, you may need to increase the heap size. More information can be found here: http://javarevisited.blogspot.com/2011/05/java-heap-space-memory-sizejvm.html.
Tomcat Max Memory This monitor returns the maximum size of the heap space, not including the permanent generation area. Tomcat Total Processing Time This monitor returns the total processing time, in milliseconds, since the server started. Tomcat Total Request Count This monitor returns the total number of requests from the server since the server started. Tomcat Total Bytes Sent This monitor returns the total number of bytes sent from the server since the server started. Tomcat Total Bytes Received This monitor returns the total number of bytes sent to the server since the server started. Tomcat Total Errors Count This monitor returns the total number of errors from all request processors.
Unix CPU Monitoring Perl

This template uses Perl scripts to assess the CPU performance of computers running AIX 5.3 or 6.1; Solaris 8, 9, or 10; or HP-UX 11.0. Prerequisites: SSH and Perl installed on the target server. If Perl is installed in a location different from /usr/bin/perl, you should correct all components in the first line of the field script body (#!/usr/bin/perl), or you can create a symbolic link to Perl (refer to the documentation for the ln command). You can find where Perl is installed by using the following command:
which perl
Credentials: Root credentials on the target server. Note: Some Unix implementations such as Solaris have a character limit in the input buffers of SSH sessions that prevents SolarWinds SAM from copying over scripts. If a monitored component fails to return a result or returns error code 255, manually copy the script to the target machine and then make the appropriate path and file name change in the Command Line field. For example, if you manually copied the script over as /usr/script.pl, you should change the Command Line to: perl /usr/script.pl. Monitored Components: Note: Components without predetermined threshold values have guidance such as "Use the lowest threshold possible" or "use the highest threshold possible" to help you find a threshold appropriate for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. CPU User Time (%) Percent of CPU time spent running non-kernel code (user time). This represents the time spent executing user code. It depends on the programs that the user uses. Use the lowest threshold possible. CPU System Time (%) Percent of CPU time spent running system kernel code (system time). Use the lowest threshold possible. CPU Idle Time (%) Percent of CPU time spent idle.
Use the highest threshold possible at all times. Interrupts/sec The number of interrupts per second. The threshold for this depends on the processor. For modern CPUs, a threshold of 1500 interrupts/sec is a good start. A dramatic increase in this counter value without a corresponding increase in system activity indicates a hardware problem. System calls/sec The number of system calls per second. This is a measure of how busy the system is taking care of applications and services. High System calls/sec indicates high utilization caused by software Note: Set the thresholds appropriately for your environment. Context switches/sec The number of context switches per second. High activity rates can result from inefficient hardware or poorly designed applications. The normal amount of Context Switches/Sec depends on your servers and applications. To set the threshold, baseline the server. The threshold for Context Switches/sec is cumulative for all processors, so you need a minimum of 14000 per processor (single=14000, dual=28000, quad=56000 and so forth). Kernel threads in run queue AIX and Solaris: Average number of runnable kernel threads over the sampling interval. Runnable refers to threads that are ready but waiting to run and to those threads already running. HP-UX: Rename this counter to Processes in run queue - average number of runnable processes over the sampling interval. This should be as low as possible. If the run queue is constantly growing, it may indicate the need for a more powerful CPU or more CPUs. Note: Set the thresholds appropriately for your environment. Kernel threads blocked waiting resources AIX and Solaris: Average number of kernel threads placed in the VMM wait queue (awaiting resource, awaiting input/output) over the sampling interval. HP-UX: Rename this counter to Processes blocked waiting resources average number of processes blocked for resources (I/O, paging, and so on) over the sampling interval.
This should be as low as possible. Note: Set the thresholds appropriately for your environment. Total amount of system calls after boot The total number of system calls after boot. Total amount of device interrupts after boot The total number of interrupts after boot. Total amount of CPU context switches after boot The total number of CPU context switches after boot.
Unix Disk Monitoring Perl

This template uses Perl scripts to assess the disk performance of computers running AIX 5.3 or 6.1; Solaris 8, 9, or 10; or HP-UX 11.0. Prerequisites: SSH and Perl installed on the target server. If Perl is installed in a location different from /usr/bin/perl, you should correct all components in the first line of the field script body ( #!/usr/bin/perl), or you can create a symbolic link to Perl (refer to the documentation for the ln command). You can find where Perl is installed by using the following command:
which perl
Credentials: Root credentials on the target server. Note: Some Unix implementations such as Solaris have a character limit in the input buffers of SSH sessions that prevents SolarWinds SAM from copying over scripts. If a monitored component fails to return a result or returns error code 255, manually copy the script to the target machine and then make the appropriate path and file name change in the Command Line field. For example, if you manually copied the script over as /usr/script.pl, you should change the Command Line to: perl/usr/script.pl. Monitored Components: Note: Components without predetermined threshold values have guidance such as "Use the lowest threshold possible" or "use the highest threshold possible" to help you find a threshold appropriate for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Available space on root (/) partition (MB) This shows the available space on the root (/) partition in MB. You should set this threshold according to your Unix installation and your requirements. In the worst case, it should be more than 512 MB. Used space on root (/) partition (%) This shows the used space on the root (/) partition in percentage. Should be less than 95%. Percent busiest device is in use The percent of time the busiest device was busy servicing a transfer request. The name of the busiest device can be seen in the message field.
The next command allow you to see all devices currently connected to machine: For AIX: lscfg For Solaris: cat /etc/mnttab For HP-UX: ioscan If no devices are currently active, the statistic is 0. Use the lowest threshold possible. Note: This counter doesnt work on Solaris 8. Disk operations/sec of busiest device The number of read/write transfers to and from the busiest device. The name of the busiest device can be seen in the message field. The next command allow you to see all devices currently connected to machine: For AIX: lscfg For Solaris: cat /etc/mnttab For HP-UX: ioscan If no devices are currently active, the statistic is 0. Use the lowest threshold possible. Note: This counter doesnt work on Solaris 8
Unix Memory Monitoring Perl

This template uses Perl scripts to assess the memory performance of computers running AIX 5.3 or 6.1; Solaris 8, 9, or 10; or HP-UX 11.0. Prerequisites: SSH and Perl installed on the target server. If Perl is installed in a location different from /usr/bin/perl, you should correct all components in the first line of the field script body (#!/usr/bin/perl), or you can create a symbolic link to Perl (refer to the documentation for the ln command). You can find where Perl is installed by using the following command:
which perl
Credentials: Root credentials on the target server. Note: Some Unix implementations such as Solaris have a character limit in the input buffers of SSH sessions that prevents SolarWinds SAM from copying over scripts. If a monitored component fails to return a result or returns error code 255, manually copy the script to the target machine and then make the appropriate path and file name change in the Command Line field. For example, if you manually copied the script over as /usr/script.pl, you should change the Command Line to: perl /usr/script.pl. Monitored Components: Note: Components without predetermined threshold values have guidance such as "Use the lowest threshold possible" or "use the highest threshold possible" to help you find a threshold appropriate for your application. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Total memory (MB) This shows the amount of total usable RAM in MB. Used memory (MB) This shows the amount of used memory in MB. This should be as low as possible. Free memory (MB) This shows the amount of available memory in MB. This should be more than 100 MB at all times or paging will occur.
Total swap (MB) This shows the amount of total swap space in MB. Used swap (MB) This shows the amount of used swap space in MB. Paging is one of the memory-management schemes by which a computer can store and retrieve data from secondary storage for use in main memory. Paging is an important part of virtual memory implementation in most contemporary general-purpose operating systems, allowing them to use disk storage for data that does not fit into physical random-access memory (RAM). This should be as low as possible. Ideally it should be near zero. If the value is large, it may indicate that there is no free memory left. Free swap (MB) This shows amount of available swap space in MB. It should be near the total swap value. If paging occurs in the system, the value should be as high as possible. Page faults/sec AIX and Solaris: Shows the number of page faults per second. This is not a count of page faults that generate I/O, because some page faults can be resolved without I/O. HP-UX: Rename this counter to Page address translation faults/sec shows the number of page address translation faults per second. Should be as low as possible. Zombie processes This show the number of zombie processes. A zombie or defunct process is a process that has completed execution, but still has an entry in the process table. This entry is still needed to allow the process that started the (now zombie) process to read its exit status. When a process finishes execution, it will have an exit status to report to its parent process. Because of this last little bit of information, the process will remain in the operating systems process table as a zombie process, indicating tha t it is not to be scheduled for further execution, but that it cannot be completely removed (and its process ID cannot be reused) until it has been determined that the exit status is no longer needed.
This should always be zero (0). If it is not zero, you should manually kill zombie processes. Use the following commands to show these zombie processes: For AIX: ps ef | grep defunct For Solaris: ps ecl | grep Z For HP-UX: ps ef | grep defunct To kill zombie processes: The first option is to wait. It is possible that the parent process is intentionally leaving the process in a zombie state to ensure that future children it may create will not receive the same pid. Or perhaps the parent is occupied, and will reap the child process momentarily. The second option is to send a SIGCHLD signal to the parent (kill -s SIGCHLD <ppid>). This will cause well-behaving parents to reap their zombie children. The third option is to kill the parent process of the zombie. At that point, all of the parents children will be adopted by the init process (pid 1), which periodically runs wait() to reap any zombie children. Page cache: page ins Amount of pages paged in from paging space. The operation of reading one inactive page or a cluster of inactive memory pages to disk is called a page out. Should be as low as possible. Page cache: page outs Amount of pages paged in from paging space. The operation of writing one inactive page or a cluster of inactive memory pages to disk is called a page out. Value numbers above 20 pages or so indicate a significant performance problem. In this situation more memory should be installed.
VMware ESX Host

This template reads the specified VMware performance counter data using the VMware vSphere Web Services API. Prerequisites: The currently used vSphere Web Services API version is 4.0, which supports vSphere 4.0 servers and also is compatible with previous releases of ESX/ESXi, including the following: 1. ESX/ESXi 3.5.x or later The vSphere Web Services SDK package includes WSDL files for vSphere API 4.0, which is a superset of API versions starting with API 2.5, and for VI API 2.0. Credentials: Access to VMware performance counter data using the VMware vSphere Web Services API. Monitored Components CPU.CPU Reserved Capacity.average CPU.CPU Usage (Average).average CPU.CPU Usage in MHz (Average).average Disk.Disk Usage (Average).average Memory.Memory Active (Average).average Memory.Memory Balloon (Average).average Memory.Memory Consumed (Average).average Memory.Memory Granted (Average).average Memory.Memory Heap (Average).average Memory.Memory Heap Free (Average).average Memory.Memory Overhead (Average).average Memory.Memory Reserved Capacity.average Memory.Memory Shared (Average).average Memory.Memory Shared Common (Average).average
Memory.Memory State.latest Memory.Memory Swap In (Average).average Memory.Memory Swap Out (Average).average Memory.Memory Swap Used (Average).average Memory.Memory Unreserved (Average).average Memory.Memory Usage (Average).average Memory.Memory Used by vmkernel.average Memory.Memory Zero (Average).average Network.Network Usage (Average).average System.Uptime.latest
Web Link
This template validates the hyperlinks on the web page served by the target web server. If any hyperlinks are invalid or unreachable, the test fails. The statistic is the number of invalid or unreachable hyperlinks. Prerequisites: None. Credentials: None. Monitored Components Web Link Monitor
Windows 2003-2008 FTP Service

This template assesses the status and overall of services and performance of a Microsoft Windows 2003-2008 FTP service. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on the target server. Monitored Components Note: You should manually put thresholds for component monitors according to your requirements. FTP Publishing Service This monitor returns CPU and memory usage for the FTP Publishing Service, which enables this server to be a File Transfer Protocol (FTP) server. If this service is stopped, the server cannot function as an FTP server. If this service is disabled, any services that explicitly depend on it will fail to start. FTP User Experience Monitor This component monitor tests the ability of an FTP server to accept an incoming session, process the user login, and then transmit the specified file to the APM server. After receiving the file, APM performs a file integrity test comparing the MD5 checksum of the downloaded file against a previously generated checksum. If the checksums match, the component monitor reports its status as up. More information can be found here: http://www.solarwinds.com/NetPerfMon/SolarWinds/default.htm?context=Sol arWinds&file=OrionAPMPHComponentTypesFtpUserExperience.htm. Note: This monitor should be properly configured before using it on the target FTP server. By default, this monitor is disabled. Bytes Received/sec This monitor returns the number of bytes received per second by the FTP service. Bytes Sent/sec This monitor returns the number of bytes sent per second by the FTP service. Current Anonymous Users This monitor returns the number of users who currently have an anonymous connection using the FTP service.
Current Connections This monitor returns the current number of connections established with the FTP service. Current Non-Anonymous Users This monitor returns the number of users who currently have a nonanonymous connection using the FTP service. Total Connection Attempts This monitor returns the number of connections that have attempted to use the FTP service since service startup. This counter is for all instances listed. Note: This counter has the Count statistic as difference option enabled and will show the statistical difference from the last APM polling cycle. Total Files Received This monitor returns the total number of files received by the FTP service since service startup. Note: This counter has the Count statistic as difference option enabled and will show the statistical difference from the last APM polling cycle. Total Files Sent This monitor returns the total number of files sent by the FTP service since service startup. Note: This counter has the Count statistic as difference option enabled and will show the statistical difference from the last APM polling cycle. Total Files Transferred This monitor returns the total number of files transferred by the FTP service since service startup. Note: This counter has the Count statistic as difference option enabled and will show the statistical difference from the last APM polling cycle.
Windows 2008 R2 FTP Service

This template assesses the status and overall of services and performance of a Microsoft Windows 2008 R2 FTP service. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on the target server. Monitored Components Note: You should manually enter thresholds for component monitors according to your requirements. Microsoft FTP Service This monitor returns CPU and memory usage for the Microsoft FTP Service, which enables this server to be a File Transfer Protocol (FTP) server. If this service is stopped, the server cannot function as an FTP server. If this service is disabled, any services that explicitly depend on it will fail to start. FTP User Experience Monitor This component monitor tests the ability of an FTP server to accept an incoming session, process the user login, and then transmit the specified file to the APM server. After receiving the file, APM performs a file integrity test comparing the MD5 checksum of the downloaded file against a previously generated checksum. If the checksums match, the component monitor reports its status as up. More information can be found here: http://www.solarwinds.com/NetPerfMon/SolarWinds/default.htm?context=Sol arWinds&file=OrionAPMPHComponentTypesFtpUserExperience.htm. Note: This monitor should be properly configured before using it on the target FTP server. By default this monitor is disabled. Bytes Received/sec This monitor returns the number of bytes received per second by the FTP service. Bytes Sent/sec This monitor returns the number of bytes sent per second by the FTP service. Current Anonymous Users This monitor returns the number of users who currently have an anonymous connection using the FTP service.
Current Connections This monitor returns the current number of connections established with the FTP service. Current Non-Anonymous Users This monitor returns the number of users who currently have a nonanonymous connection using the FTP service. Total Connection Attempts This monitor returns the number of connections that have attempted to use the FTP service since service startup. This counter is for all instances listed. Note: This counter has the Count statistic as difference option enabled and will show the statistical difference from the last APM polling cycle. Total Files Received This monitor returns the total number of files received by the FTP service since service startup. Note: This counter has the Count statistic as difference option enabled and will show the statistical difference from the last APM polling cycle. Total Files Sent This monitor returns the total number of files sent by the FTP service since service startup. Note: This counter has the Count statistic as difference option enabled and will show the statistical difference from the last APM polling cycle. Total Files Transferred This monitor returns the total number of files transferred by the FTP service since service startup. Note: This counter has the Count statistic as difference option enabled and will show the statistical difference from the last APM polling cycle.
Windows DHCP Server

This template assesses the status and overall health of services and performance of a Microsoft DHCP server. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on the target server. Monitored Components Note: You need to set thresholds for counters according to your environment. It is recommended that you monitor counters for a length of time to understand potential value ranges and then set the thresholds accordingly. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Note: All Windows Event Log monitors (beginning with Warning or Error) should return zero values. Returned values other than zero indicate an abnormality. Examining the Windows System log file should provide information pertaining to the issue. Packets Received/sec This component monitor returns the rate at which packets are received by the DHCP server. A high value indicates heavy DHCP-related message traffic to the server. Duplicates Dropped/sec This component monitor returns the rate at which the DHCP server received duplicate packets. A high value indicates that clients are probably timing out too fast or that the server is taking a great deal of time to respond. Packets Expired/sec This component monitor returns the rate at which packets expire in the DHCP server message queue. Packets expire because they are in the server's internal message queue too long. A large number indicates that the server is either taking too long to process some packets while other packets are queued and becoming stale, or traffic on the network is too high for the DHCP server to handle. This suggests either a disk or memory bottleneck.
Milliseconds per Packet (Avg) This component monitor returns the average time per packet taken by the DHCP server to send a response. This number can vary depending upon the server hardware and its I/O subsystem. A sudden or unreasonable increase may indicate a problem, either with the I/O subsystem slowing or because of intrinsic processing overhead on the server computer. Active Queue Length This component monitor returns the number of packets in the processing queue of the DHCP server. This number equals the number of unprocessed messages received by the server. A high value may indicate heavy server traffic. Conflict Check Queue Length This component monitor returns the number of packets waiting in the DHCP server queue due to conflict detection. This queue holds messages that have not been responded to while the DHCP server performs address conflict detection. A high value may indicate that conflict detection attempts have been set too high in DHCP server properties or that there is heavy lease traffic at the server. Discovers/sec This component monitor returns the rate at which DHCP Discovers have been received by the DHCP server. A sudden or abnormal increase indicates that a large number of clients are probably attempting to initialize and obtain an IP address lease from the server. This may indicate that a number of client computers are started at one time. Offers/sec This component monitor returns the rate at which DHCP Offers have been sent out by the DHCP server. A sudden or abnormal increase in this value indicates heavy traffic on the server. Requests/sec This component monitor returns the rate at which DHCP Requests have been received by the DHCP server.
A sudden or abnormal increase in this value may indicate a large number of clients trying to renew their leases with the DHCP server. This may indicate that scope lease times are too short. Informs/sec This component monitor returns the rate at which DHCP Informs have been received by the DHCP server. DHCP inform messages are used when the DHCP server queries the directory service for the enterprise root and when dynamic updates are being done on behalf of clients by the server. Acks/sec This component monitor returns the rate at which DHCP Acknowledgements have been sent by the DHCP server. A sudden or abnormal increase in this number indicates that a large number of clients are being renewed by the DHCP server. This may indicate that scope lease times are too short. Nacks/sec This component monitor returns the rate at which DHCP negative acknowledgments (Nacks) have been sent by the DHCP server. A high value may indicate potential network problems such as misconfiguration of clients or the server. One possible cause of server problems is a deactivated scope. For clients, a very high value could be caused by computers moving between subnets, such as laptop portables or other mobile devices. Declines/sec This component monitor returns the rate at which DHCP Declines have been received by the DHCP server. A high value indicates that several clients have found their address to be in conflict, possibly indicating network trouble. It may help to enable conflict detection on the DHCP server. Conflict detection should only be used temporarily on the server. Releases/sec This component monitor returns the rate at which DHCP Releases have been received by the DHCP server.
This number is only incremented when clients manually release their address, such as when the ipconfig/release command is used at the client computer. Because clients rarely release their address, this counter should not be high for most networks and configurations. Service: DHCP Server This component monitor performs TCP/IP configuration for DHCP clients, including dynamic assignments of IP addresses, specification of the WINS and DNS servers, and connection-specific DNS names. If this service is stopped or disabled, the DHCP server will not perform TCP/IP configuration for clients and any services that explicitly depend on it will fail to start. DHCP User Experience Monitor This component monitor measures the time it takes to get a lease from a DHCP server. The monitor verifies that the DHCP responds with an IP address, but neither confirms nor accepts the lease. Warning: Jet Database Error This component monitors events when a problem occurs with the Jet database. Type of event: Warning. Event ID: 1014. If the DHCP server database becomes corrupted or is lost, you should restore your backup database file. More information can be found here: http://technet.microsoft.com/en-us/library/cc726907(WS.10).aspx. Error: DHCP Server is Shutting Down with Error This component monitors events when the DHCP Server service is shutting down due to an error. Type of event: Error. Event ID: 1008. The Dynamic Host Configuration Protocol (DHCP) Server service is dependent on these services: Service Controller, Global parameters initialization, Registry parameters initialization, RPC server start, Winsock data initialization. The failure of any of these services to initialize or start can cause the DHCP Server service to fail. Information how to resolve this issue can be found here: http://technet.microsoft.com/en-us/library/cc726880(WS.10).aspx. Error: Failed to Restore Database This component monitors events when the DHCP service failed to restore the database.
Type of event: Error. Event ID: 1018. If the DHCP server database becomes corrupted or is lost, you should restore your backup database file. More information can be found here: http://technet.microsoft.com/en-us/library/cc726928(WS.10).aspx. Error: Failed to Initialize Database This component monitors events when the DHCP service failed to initialize the database. Type of event: Error. Event ID: 1004. If the DHCP server database becomes corrupted or is lost you should restore your backup database file. More information can be found here: http://technet.microsoft.com/en-us/library/cc726910(WS.10).aspx. Warning: Server Scope is Almost Full This component monitors events when the server scope is almost full and there are few free IP addresses left. Type of event: Warning. Event ID: 1020. If the DHCP server does not have IP addresses available to provide to the requesting client, then the request fails, and the client might not be able to communicate with other computers on the network. To resolve this issue, you can extend the DHCP scopes or reduce the lease duration. More information can be found here: http://social.technet.microsoft.com/wiki/contents/articles/event-id-1020microsoft-windows-dhcp-server.aspx. Error: Server Scope is Full This component monitors events when there are no IP addresses available for lease in the scope or super-scope. Type of event: Error. Event ID: 1063. If the DHCP server does not have IP addresses available to provide to the requesting client, then the request fails, and the client might not be able to communicate with other computers on the network. To resolve this issue you can extend the DHCP scopes or reduce the lease duration. More information can be found here: http://technet.microsoft.com/en-us/library/cc774806(WS.10).aspx.
Windows DNS Server

This template assesses the status and overall health of services and performance of a Microsoft DNS server. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on the target server. Monitored Components Note: You need to set thresholds for counters according to your environment. It is recommended to monitor counters for some length of time to understand potential value ranges and then set the thresholds accordingly. For more information, see http://knowledgebase.solarwinds.com/kb/questions/2415. Service: DNS Server This component monitor enables DNS clients to resolve DNS names by answering DNS queries and dynamic DNS update requests. If this service is stopped or disabled, DNS updates will not occur and any services that explicitly depend on it will fail to start. Memory: Caching Memory This component monitor returns the total amount of system memory in use by the DNS Server service for caching. Monitor this counter to determine whether cache use is optimizing the use of available memory. Memory: Database Node Memory This component monitor returns the total amount of system memory in use by the DNS Server service for database nodes. Memory: Nbstat Memory This component monitor returns the total amount of system memory in use by the DNS Server service for Nbtstat. Memory: Record Flow Memory This component monitor returns the total amount of system memory in use by the DNS Server service for record flow. Dynamic Update: NoOperation/sec This component monitor returns the average number of No-operation/Empty dynamic update requests received by the DNS server per second.
Dynamic Update: Received This component monitor returns the total number of dynamic update requests received by the DNS server. Monitor this counter after enabling dynamic updates to determine whether DNS clients are attempting to update their DNS addresses. Dynamic Update: Rejected This component monitor returns the total number of dynamic updates rejected by the DNS server. Monitor this counter and compare this value against Dynamic Update: Received to determine how many systems are experiencing problems updating DNS addresses. Dynamic Update: TimeOuts This component monitor returns the total number of dynamic update timeouts of the DNS server. Dynamic Update: Written to Database This component monitor returns the total number of dynamic updates written to the database by the DNS server. Monitor this counter and compare this value against Dynamic Update: Received to determine how many systems are successfully updating DNS records. Recursive: Queries/sec This component monitor returns the average number of recursive queries received by the DNS server per second. Recursive: Query Failure/sec This component monitor returns the average number of recursive query failures per second. Recursive: TimeOut/sec This component monitor returns the average number of recursive query sending time-outs per second. Secure Update: Failure This component monitor returns the total number of secure updates that failed on the DNS server.
Monitor this counter to determine whether or not clients can perform secure dynamic updates. Also, compare this value against Secure Update: Received to determine how many systems fail to perform secure updates in DNS. Secure Update: Received This component monitor returns the total number of secure update requests received by the DNS server. Monitor this counter and compare this value against Secure Update: Failure to determine how many systems are successfully performing secure updates in DNS. TCP: Message Memory This component monitor returns the total amount of TCP message memory used by the DNS server. TCP: Query Received/sec This component monitor returns the average number of TCP queries received by the DNS server per second. TCP: Response Sent/sec This component monitor returns the average number of TCP responses sent by the DNS server per second. Total Query Received/sec This component monitor returns the average number of queries received by the DNS server per second. Monitor this counter to create baselines of server usage in heavily trafficked networks. Total Response Sent/sec This component monitor returns the average number of responses sent by the DNS server per second. Monitor this counter to create baselines of server usage in heavily trafficked networks. UDP: Message Memory This component monitor returns the total amount of UDP message memory used by the DNS server.
UDP: Query Received/sec This component monitor returns the average number of UDP queries received by the DNS server per second. UDP: Response Sent/sec This component monitor returns the average number of UDP responses sent by the DNS server per second. Zone Transfer: Failure This component monitor returns the total number of failed zone transfers of the master DNS server. Monitor this counter to troubleshoot name resolution failures. Zone Transfer: Success This component monitor returns the total number of successful zone transfers of the master DNS server. Monitor this counter to troubleshoot name resolution failures. DNS User Experience Monitor This component monitor tests a DNS server's ability to respond to a record query, compares the query response against a list of IP addresses, and measures the response time. The component monitor passes if the DNS response matches the expected IP addresses.
Windows DNS Server (via SNMP)

This template assesses the status of Windows services related to Windows DNS servers. Prerequisites: SNMP access to target server. Credentials: None. Monitored Components DNS Monitor - TCP DNS Server SNMP
Windows Event Log Count

This template contains a Windows Script that searches the Windows Event log on a computer for specific events that may have occurred during a specified time frame, and reports the number of occurrences as a SolarWinds SAM statistic. Prerequisites: None. Credentials: Windows Administrator credential valid on both SolarWinds SAM and target server. Monitored Components Windows Event Log Script Script Arguments [-computer computerName] [-area eventArea] [-type eventType] [-id eventID] [-source eventSource] [-exclusions findExclusionText] [-match findMatchText] [-timespan timeSpanMins] [-failmode failmodeType] computerName Name of the computer whose event logs you want to read. If not specified, the default value is localhost. eventArea Name of the Windows NT Event Log File: Application, Security, or System. eventType Name of the event type: Error, Warning, Information, Success, or Failure. eventID Identifier of the event, specific to the source that generated the event log entry. Used together with the eventSource to uniquely identify a Windows NT event type. The default value is 0. eventSource Name of the source (application, service, driver, or subsystem) that generated the entry. Used together with eventID to uniquely identify a Windows NT event type. findExclusionsText A string of text which, if located by the script, prohibits that event from being counted towards the SAM statistic.
findMatchText A string of text which, if located by the script, counts towards the SAM statistic. timeSpanMins The age, in minutes, of the oldest event that the script attempts to locate. Example These arguments return the number of events in the localhost Application event log that have an ID of 1 and that have occurred within the last 5 minutes. If any events are found, the component is put into a down state. -computer localhost -area Application -id 1 -timespan 5
Windows FTP Server (via WMI)

This template monitors the Windows FTP Publishing Service and tests the ability of the FTP server to accept incoming sessions on port 21. Prerequisites: None. Credentials: Windows Administrator on target server. Monitored Components FTP Monitor FTP Publishing Service
Windows Network Load Balancing

This template assesses the status and overall performance of Microsoft Windows Network Load Balancing by retrieving information from the MicrosoftNLB namespace and the Windows System Event Log. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on the target server. Note: All Windows Event Log monitors should return zero values. A returned value other than zero indicates an abnormality. Examining the Windows system log files should provide information pertaining to the issue. Detailed information about these events can be found at: http://technet.microsoft.com/en-us/library/dd364005(WS.10).aspx http://technet.microsoft.com/en-us/library/cc783006(WS.10).aspx.
Monitored Components NLB Cluster Node status This component monitor returns the current state of an NLB node. Possible values: 0 Node is remote. The StatusCode value cannot be retrieved on the remote node. 1005 Stopped: Cluster operations have stopped on the node; 1006 Converging: The cluster node is converging. Convergence is the process of redistributing the existing connection load to operational cluster nodes according to the current load balancing rules; 1008 Converged: The cluster node has converged successfully; 1009 Draining: The cluster nodes are draining; meaning, this is a state in which a node is no longer accepting incoming traffic and is draining. No new connections are allowed, but existing connections are allowed to complete their jobs and terminate naturally. While draining, a node can participate in convergence and remains part of the cluster; 1013 Suspended: Cluster operations have been suspended on the node.
Note: Before using this monitor, you should set the correct NLB node name. Replace NLB_node with the NLB node name on which you applied this template in the WQL query section. If you assign the template on NLB_node1 and put NLB_node2 in the WQL query, the returned value will be zero. Network Adapter Functionality This monitor returns the number of events that occur when: The NLB driver failed to bind or attach to the adapter; The NLB failed to add a multicast MAC address to the network adapter; The adapter does not support dynamic changing of its MAC address; The NLB driver failed to register with the NDIS; The NLB failed to update the adapter multicast list; The MTU reported by the adapter is too small.
Type of event: Error. Event ID: 9, 50, 53, 85, 89, 90, 94, 98. If you have problems with binding to the adapter, ensure that NLB is bound to an Ethernet network adapter. If you have problems with MAC addresses, change the network adapter operating mode. If the NLB driver failed to register or update the adapter multicast list, disable and re-enable NLB network adapters. When the MTU is small, ensure that the MTU is properly configured. NLB Bi-Directional Affinity (BDA) Configuration This monitor returns the number of events that occur when: An inconsistent teaming configuration is detected; An invalid bi-directional affinity (BDA) team ID is detected; An invalid bi-directional affinity (BDA) teaming port rule is detected; The bi-directional affinity (BDA) team, which this cluster has attempted to join, already has a designated master;
The bi-directional affinity (BDA) team, in which this cluster participates, has no designated master; This cluster has left a bi-directional affinity (BDA) team in which it was the designated master; NLB failed to initialize bi-directional affinity (BDA) teaming on the adapter.
Type of event: Error and Warning. Event ID: 55, 56, 57, 59, 60, 62, 114. Reconfigure the BDA teaming configuration. The bi-directional affinity (BDA) configuration must be identical on all cluster hosts. The team in which this cluster participates will be marked inactive and this cluster will remain in the converging state until consistent teaming configuration is achieved. You should first reconfigure the BDA configuration, and then restart the NLB cluster. NLB Cluster Control This monitor returns the number of events that occur when: A version mismatch between the driver and control programs is detected; The NLB driver failed to register the device object.
Type of event: Error. Event ID: 37, 88. If a host is not running the same version of all Network Load Balancing (NLB) components as other hosts in the cluster, you should first delete the host that is not running the correct NLB version, remove NLB from the host, reinstall NLB, and then rejoin the cluster. If the Network Load Balancing (NLB) driver fails to register a device, such as a network adapter, the cluster will converge and operate normally, but controlling the cluster might not work properly. You should disable all network adapters with NLB bound on this host, and then re-enable the adapters. NLB Connection Tracking and Load Balancing This monitor returns the number of events that occur when: The NLB driver could not allocate enough memory resources to perform driver operations; The maximum number of actively serviced connections that could be tracked by NLB is reached;
NLB cannot track TCP connections because it was unable to open the TCP connection callback object; A load distribution error was detected during convergence; NLB failed to register as a WMI provider; The maximum number of actively serviced connections (using extended affinity) that could be tracked by NLB is reached.
Type of event: Error and Warning. Event ID: 10, 19, 81, 87, 115, 117. If the Network Load Balancing (NLB) driver cannot allocate enough memory resources to operate the driver, you should close all programs on this cluster host that might be consuming memory, and then rebind NLB to the adapters. If this problem persists, you might need to add additional memory (RAM) to this host. When the maximum number of actively serviced connections is reached, you can either add more hosts to the NLB cluster, (which distributes the number of incoming connections across more cluster hosts), or increase the connection tracking limit. When NLB cannot track TCP connections or fails to register as a WMI provider, disable and re-enable NLB network adapters. If load distribution errors were detected during convergence, this may result in either client traffic not being handled, general cluster traffic errors, or connections being reset. Convergence is a process by which hosts exchange messages to determine a new, consistent state of the cluster and to elect the default host. During convergence, a new load distribution is determined for hosts that share the handling of network traffic for specific Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) ports. To resolve the load distribution error, you should restart the NLB cluster. NLB Dedicated IP (DIP) Addresses Functionality This monitor returns the number of events that occur when: The dedicated IP (DIP) address or mask is invalid; NLB detected an unequal number of dedicated IP (DIP) addresses and network masks; Duplicate dedicated IP (DIP) addresses were detected on the network;
NLB failed to add all the dedicated IP (DIP) addresses to this host because the maximum number of DIPs that can be added to this network adapter have been exhausted.
Type of event: Error. Event ID: 15, 30, 32, 83, 107. You should verify that the dedicated IP address and subnet mask are correctly specified. On all Network Load Balancing (NLB) cluster hosts, the dedicated IP addresses must have an equal number of subnet masks specified. If there are an unequal number, the NLB cluster will continue to operate, but the IP address that has no corresponding network mask will be ignored. To use this IP address, make sure that the number of IP addresses and network masks are the same. All dedicated IP addresses must be unique in a Network Load Balancing (NLB) cluster. If the number of dedicated IP addresses added to a network adapter has exceeded the maximum number allowed by the adapter, you will need to remove one or more IP addresses. The extra dedicated IP addresses will be ignored by the Network Load Balancing (NLB) cluster. NLB Denial-of-service Protection This monitor returns the number of events that occur when: A SYN attack has been detected; The NLB driver failed to open the SYN attack callback object; The NLB driver failed to open the timer starvation callback object; Timer starvation has been detected due to a denial of service attack or a very high server load.
Type of event: Error and Warning. Event ID: 92, 99, 104, 105. Analyze the threats against the Network Load Balancing (NLB) cluster, including potential denial-of-service attacks, and then take the appropriate measures. If this is not an attack, the NLB cluster may be overloaded. To distribute the cluster traffic load over more hosts, you can add more hosts to the NLB cluster. Disable and re-enable NLB network adapters.
NLB Extended Affinity Configuration This monitor returns the number of events that occur when: The NLB driver has detected an inconsistency in the extended affinity configuration on the cluster host; The NLB driver has detected an inconsistency in the extended affinity configuration between cluster hosts.
Type of event: Warning. Event ID: 118, 119. Confirm that the extended affinity configurations for all port rules are identical on all Network Load Balancing (NLB) hosts. NLB Network Host Configuration This monitor returns the number of events that occur when: The NLB driver failed to initialize because the cluster IP, network address, or mask is invalid; NLB detected duplicate cluster subnets; The NLB cluster IGMP multicast IP address is invalid; The NLB driver failed to register for notifications with the IPv4 or IPv6 NSI provider; The virtual IP (VIP) address or mask is invalid; NLB detected an unequal number of virtual IP (VIP) addresses and network masks.
Type of event: Error and Warning. Event ID: 14, 16, 18, 31, 73, 102, 103, 108, 109, 110, 112. If the network media access control (MAC) address is not in the following format: XX-XX-XX-XX-XX-XX, where X is a hexadecimal value, it needs to be reconfigured. If the Network Load Balancing (NLB) driver fails to initialize because the cluster IP address is not in a valid format, you should check that the network IP address is specified in a valid IPv4 or IPv6 address format. If Network Load Balancing (NLB) detects that there are duplicate subnets in the cluster, it may be due to network partitioning, which prevents NLB heartbeats of one or more hosts from reaching the other cluster hosts. You may need to restart the NLB cluster to resolve this issue.
If the Network Load Balancing (NLB) driver fails to initialize because the cluster network mask is not in a valid format, you should check that the network mask is specified in a valid format. If the Network Load Balancing (NLB) cluster detects that the Internet Group Management Protocol (IGMP) multicast IP address is invalid, you should check the NLB configuration and make sure that the cluster IGMP multicast IP address is in a valid format. If the NLB driver failed to register for notifications, the correct IP stack version (IPv4 or IPv6) must be installed on the network adapter to which Network Load Balancing (NLB) is bound. The virtual IP address must be in a valid IPv4 or IPv6 format. The virtual IP address and mask must be in a valid IPv4 or IPv6 format. On all Network Load Balancing (NLB) cluster hosts, the virtual IP addresses must have an equal number of subnet masks specified. NLB Host State Persistence This monitor returns the number of events that occur when NLB failed to update the NLB host state in the registry Type of event: Warning. Event ID: 74. To check the initial Network Load Balancing (NLB) host state, you must first delete the registry key defined in the event log, and then confirm that the initial host state is correct. Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on your computer. NLB Port Rules Configuration This monitor returns the number of events that occur when: NLB failed to converge due to port rules with a duplicate single host priority in the cluster; NLB failed to converge due to inconsistencies in the port rules between hosts; Configured port rules conflict with the port rules of another host; A port rule operation on the port was issued but there is no port rule that contains this port;
The NLB driver has detected one or more sessions corresponding to a port rule that is improperly configured; The virtual IP (VIP) address in a port rule is invalid;
Type of event: Error and Warning. Event ID: 20, 21, 22, 25, 95, 111. When single host filtering mode is used, traffic to the port or ports governed by that port rule is handled exclusively by the host whose priority has the lowest numeric value. When the host's single host priority is identical to the single host priority of another host, the cluster will not converge until the problem is corrected. You should check the NLB configuration of all port rules and make sure that each has a unique host priority (a number between 1 and 32). When a Network Load Balancing (NLB) host in the cluster either contains a different number of port rules from another host, or its configured port rules conflict with the port rules of another host, the cluster will not converge until the problem is corrected. You should first ensure that all NLB hosts have identical port rules, and then, if there are port rules that are not identical and if there are not the same number of port rules on each NLB host, you should reconfigure the port rules to make them identical. If there is no port rule that contains a specified port, you should confirm that the port rules are identical on all Network Load Balancing (NLB) hosts. If the virtual IP address for a port rule is not in a valid format, the Network Load Balancing (NLB) cluster will converge and operate normally, but the port rule will be ignored. You should check that the virtual IP address is specified in a valid IPv4 or IPv6 address format. NLB Host Configuration This monitor returns the number of events that occur when: NLB detected a duplicate host priority that is shared between cluster hosts; NLB failed to query parameters from the registry key; NLB failed to verify its parameters due to an improper configuration; Host converged with legacy host(s) during rolling upgrades; NLB received a heartbeat from a host with an invalid ID; An unsupported legacy host was discovered on the network.
Type of event: Error and Warning. Event ID: 17, 34, 35, 86, 91, 97.
If a Network Load Balancing (NLB) host has a host priority that is identical to the host priority on another host, or the host priority is not valid, the cluster will not converge until the problem is corrected. The host priority must be a number from 1 through 32, and this value must be unique for all hosts in the cluster. If Network Load Balancing (NLB) is unable to process its configuration settings, you should confirm that the settings are correctly configured, and then, if changes are made, restart the NLB cluster. A Network Load Balancing (NLB) cluster operating in a mixed mode (where hosts have different versions of an operating system installed) is only supported during rolling upgrades. Until all hosts are upgraded to the latest operating system version, newer NLB features will not be available. You should upgrade all hosts to the latest operating system version. If an unsupported legacy host is discovered on the Network Load Balancing (NLB) cluster, you should remove the legacy host from the cluster. The cluster will remain in a converging state until all deprecated legacy hosts are removed.
Windows Print Services

This template assess the status of Windows Print services. Prerequisites: WMI access to print server. For more information, see Requirements for Component Monitors and Templates that use WMI on page 218. Credentials: Windows Administrator on print server. Monitored Components Job Errors Jobs Jobs Spooling Not Ready Errors Out of Paper Errors Print Server Spooler Service Print Server Thread Count Total Jobs Printed Total Pages Printed
Windows Remote Desktop Services (Session Host Role)

This template assesses the status and overall performance of a Microsoft Windows Remote Desktop Services Session Host Role by monitoring RDS services and retrieving information from performance counters and the Windows System Event Log. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on the target server. Note: All Windows Event Log monitors should return zero values. A returned value other than zero indicates an abnormality. Examining the Windows system log files should provide information pertaining to the issue. Detailed information about these events can be found here: http://technet.microsoft.com/enus/library/ee891242(WS.10).aspx. Monitored Components Service: Remote Desktop Configuration This monitor returns the CPU and memory usage of the Remote Desktop Configuration service. Remote Desktop Configuration Service (RDCS) is responsible for all Remote Desktop Services and Remote Desktop related configuration and session maintenance activities that require system context. These include per-session temporary folders, Remote Desktop themes, and Remote Desktop certificates. Service: Remote Desktop Services This monitor returns the CPU and memory usage of the Remote Desktop Services. This service allows users to connect interactively to a remote computer. Remote Desktop and Remote Desktop Session Host Server depend on this service. To prevent remote use of this computer, clear the checkboxes on the Remote tab of the System properties control panel item. Service: Remote Desktop UserMode Port Redirector This monitor returns the CPU and memory usage of the Remote Desktop UserMode Port Redirector service, which allows the redirection of Printers/Drives/Ports for RDP connections RDP TCP port availability This monitor tests the ability of an RDP service to accept incoming sessions. By default, it monitors TCP port 3389.
Active Sessions This monitor returns the number of active Terminal Services sessions. Inactive Sessions This monitor returns the number of inactive Terminal Services sessions. Total Sessions This monitor returns the total number of Terminal services sessions. Events: Remote Desktop Services Authentication and Encryption This monitor returns the number of events that occur when: The Terminal Server listener is configured with inconsistent authentication and encryption settings; The Terminal Server is configured to use SSL with a user selected certificate, however, no usable certificate was found on the server; The Terminal Server is configured to use a certificate that will expire soon or is expired; The Terminal Server is configured to use a certificate that does not contain an Enhanced Key Usage attribute of Server Authentication; The Terminal Server is configured to use a certificate but is unable to access the private key associated with this certificate; The Terminal Server has failed to create a new, or replace an expired, self-signed certificate to be used for Terminal Server authentication on SSL connections; The Terminal Server authentication certificate configuration data was invalid and the service reset it; The Terminal Server is configured to use a template-based certificate for Transport Layer Security, but the subject name on the certificate is invalid; The Terminal Server cannot install a new template-based certificate to be used for Transport Layer Security; The template-based certificate that is being used by the Terminal Server for Transport Layer Security has expired and cannot be replaced by the Terminal Server;
The certificate issued by the Remote Desktop license server to the Remote Desktop Session Host server is not valid.
Type of event: Error and Warning. Event ID: 1050, 1051, 1052, 1053, 1054, 1055, 1057, 1058, 1059, 1062, 1064, 1065, 1133. If the Terminal Server listener is configured with inconsistent authentication and encryption settings, check the Encryption and Authentication settings on the Remote Desktop Session Host server to ensure that they are compatible, and that they are appropriate for your security requirements and the level of security that your client computers can support. If the Terminal Server is configured to use SSL with a user selected certificate and cannot find a usable certificate or is unable to access the private key, install a certificate onto the Remote Desktop Session Host server that meets the requirements for an Remote Desktop Session Host server certificate. Configure the Remote Desktop Session Host server to use the certificate for TLS 1.0 (SSL). If the Terminal Server certificate or template-based certificate will expire soon or is expired, take the following steps: 1. Use Remote Desktop Session Host Configuration to determine which certificate needs to be renewed. 2. Renew the certificate being used by the Remote Desktop Session Host server with the same or new key. 3. Configure the Remote Desktop Session Host server to use the certificate for TLS 1.0 (SSL). If the certificate does not contain an Enhanced Key Usage attribute, confirm that the certificate for the Remote Desktop Session Host server is configured to use TLS 1.0 (SSL) and has the correct Enhanced Key Usage (EKU) value. The certificate must have an Enhanced Key Usage of Server Authentication (1.3.6.1.5.5.7.3.1) or no Enhanced Key Usage at all. If the certificate does not meet these requirements, install an alternate certificate on the Remote Desktop Session Host server that does meet these requirements, and then configure the Remote Desktop Session Host server to use this certificate for TLS 1.0 (SSL). If there are problems with the self-signed certificate for Terminal Server authentication on SSL connections, you should increase available memory. One way to increase the amount of available memory is to determine if there are any programs or processes running on the Remote Desktop Session Host server that can be closed. Use Task Manager to determine which processes are using the most memory, and end those processes if possible.
If the configuration data is not valid, check the certificate store for the certificate that the Remote Desktop Session Host server is configured to use for TLS 1.0 (SSL). Configure the Remote Desktop Session Host server to use the certificate for TLS 1.0 (SSL). If Terminal Server is configured to use a template-based certificate for Transport Layer Security and the subject name on the certificate is not valid, you must modify the certificate template that Active Directory Certificate Services (ADCS) uses as the basis for server certificates enrolled to Remote Desktop Session Host servers. The certificate template must be modified so that the alternate subject name for the certificate matches the DNS name of the Remote Desktop Session Host server. If the Terminal Server cannot install a new template-based certificate for Transport Layer Security, one or more of the following conditions may apply: The correct certificate template name is not specified in the Group Policy. The permissions on the certificate template do not allow the RD Session Host server to enroll for this type of certificate. The certificate is not valid for the requested usage. The certificate template does not exist. The certificates that are based on the certificate template are not being issued to computers.
If the Terminal Server is configured to use SSL with a user selected certificate and cannot find a usable certificate, you should install a certificate onto the Remote Desktop Session Host server that meets the requirements for an Remote Desktop Session Host server certificate. Configure the Remote Desktop Session Host server to use the certificate for TLS 1.0 (SSL). If the certificate is not valid, you should delete the certificate from the Remote Desktop Session Host server and then restart the Remote Desktop Services service. Events: Remote Desktop Services Availability This monitor returns the number of events that occur when: The Local Multi-User session manager failed to start; The Remote Desktop Service start failed; The Remote Desktop Service is shut down for an unknown reason;
Registering with the Service Control Manager to monitor the Remote Desktop Service status failed; An attempt to send a message to the Windows video subsystem failed.
Type of event: Warning and Error. Event ID: 16, 17, 18, 19, 20. To resolve these issues, you should start the Remote Desktop Services service on the computer. If the problem persists, restart the computer. When there is a failed attempt to send messages to the Windows video subsystem, the error code will indicate the issue. Events: Remote Desktop Services Client Access License Availability This monitor returns the number of events that occur when: The remote desktop client has provided an invalid license; The Remote Desktop Session Host server cannot issue a client license; The remote session could not be established from the remote desktop client because its temporary license has expired; The remote session could not be established from the remote desktop client because its license could not be renewed; The Remote Desktop Session Host server was unable to retrieve users licensing information from the Active Directory; The Remote Desktop Licensing mode has not been configured; The Remote Desktop Licensing grace period has expired and licensing mode for the Remote Desktop Session Host server has not been configured.
Type of event: Warning and Error. Event ID: 1003, 1004, 1011, 1028, 1043, 1061, 1068, 1069. If the remote desktop client provides an invalid license, delete the MSLicensing registry subkey on the client computer, restart the client computer, and then try to connect remotely to the Remote Desktop Session Host server from the client computer. If the issue persists, delete the following: X509 Certificate, X509 Certificate2, and X509 Certificate ID registry entries on the Remote Desktop Session Host server. Next, restart the Remote Desktop Session Host server, and then try again to connect to the Remote Desktop Session Host server from the client computer.
If the Remote Desktop Session Host server cannot issue a client license, it might be caused by one of the following conditions: The licensing mode for the Remote Desktop Session Host server does not match the type of RDS CALs installed on the license server. The RDP encryption levels on the Remote Desktop Session Host server and the client are not compatible. The certificate on the Remote Desktop Session Host server is corrupt.
If the temporary license has expired, ensure that the Remote Desktop Session Host server can contact a Remote Desktop license server with a sufficient number of the appropriate type of Remote Desktop Services client access licenses (RDS CALs). If the client's license could not be renewed, determine if the Remote Desktop Session Host server can discover a license server. If the Remote Desktop Session Host server cannot communicate with the Remote Desktop license server, add the computer account for the Remote Desktop Session Host server to the Terminal Server Computers local group on the Remote Desktop license server. If the Remote Desktop Session Host server was unable to retrieve users licensing information from the Active Directory, identify and fix any network connectivity problems between the Remote Desktop Session Host server and the Active Directory domain. If there are problems with Remote Desktop licensing mode, specify the Remote Desktop licensing mode on the Remote Desktop Session Host server. Events: Remote Desktop Session Host Connections This monitor returns the number of events that occur when: The Terminal Server received a large number of incomplete connections; Autoreconnect failed to reconnect the user to the session because authentication failed; The Terminal Server cannot register the "TERMSRV" Service Principal Name;
A logon request was denied because the Terminal Server is currently in drain mode; A connection request was denied because the Terminal Server is currently configured to not accept connections; The Remote Desktop Session Host server does not have a Remote Desktop license server specified; The Remote Desktop Session Host server could not contact the Remote Desktop license server.
Type of event: Warning and Error. Event ID: 1006, 1041, 1067, 1070, 1071, 1130, 1131. If the Terminal Server received a large number of incomplete connections, use Remote Desktop Services Manager to check which users are connecting to the Remote Desktop Session Host server. Ensure that there are no suspicious accounts. If Autoreconnect failed to reconnect the user, establish a new connection to the Remote Desktop Session Host server by using a Remote Desktop Protocol (RDP) client such as Remote Desktop Connection. If the Terminal Server cannot register the "TERMSRV" Service Principal Name, manually register the Service Principal Name (SPN) for the Remote Desktop Session Host server. If a logon request was denied because the Terminal Server is currently in drain mode, configure the Remote Desktop Session Host server to allow new user logons by using Remote Desktop Session Host Configuration. If the connection request was denied because the terminal server is currently configured to not accept connections, configure the Remote Desktop Session Host server to allow connections by using the chglogon command-line tool. If the Remote Desktop Session Host server does not have a Remote Desktop license server specified, specify a Remote Desktop license server on the Remote Desktop Session Host server. If the Remote Desktop Session Host server could not contact the Remote Desktop license server, identify and fix any network connectivity problems between the Remote Desktop Session Host server and the Active Directory domain controller. Events: Remote Desktop Session Host Listener Availability This monitor returns the number of events that occur when:
The listener has stopped listening; The listener failed while listening with an error code; The Terminal Server listener stack was down; The Terminal Server session creation failed; The remote control session connection failed.
Type of event: Error. Event ID: 259, 260, 1035, 1036, 1148. If the Listener has stopped listening or the listener stack was down, attempt to restart the listener on the Remote Desktop Session Host server. If restarting the listener is not successful, attempt to increase available system resources, such as memory, on the Remote Desktop Session Host server. If the Listener failed while listening with an error code or the Terminal Server session creation failed, this could indicate that another application on the Remote Desktop Session Host server is using the same TCP port as the Remote Desktop Protocol (RDP). The default port assigned to RDP is 3389. If the remote control session connection failed, you must ensure that the user account has Remote Control permissions on the Remote Desktop Session Host Listener. Events: Remote Desktop Session Host User Configuration This monitor returns the number of events that occur when: The Terminal Server Profile path failed to load; The Terminal Services User Home Directory was not set because the path specified does not exist or is not accessible.
Type of event: Warning and Error. Event ID: 1046, 1060. If the Terminal Server Profile path failed to load, specify a new location for the Remote Desktop Services profile path, ensuring that the path does not exceed 256 characters. If the Terminal Services User Home Directory was not set because the path specified does not exist or is not accessible, one or more of the following conditions may be the culprit: The Remote Desktop Services home folder name for a user is incorrect. The computer on which the home folder is located is not accessible.
The user does not have sufficient permissions to the home folder.
Events: Remote Desktop IP Virtualization Availability This monitor returns the number of events that occur when: An error occurs when the computer tries to start Remote Desktop IP Virtualization; Remote Desktop IP Virtualization detected more than one network adapter; Remote Desktop IP Virtualization could not find the network adapter; Remote Desktop IP Virtualization could not allocate the IP address.
Type of event: Warning and Error. Event ID: 102, 111, 113, 118. If an error occurred when the computer tried to start Remote Desktop IP Virtualization or the network adapter could not be found, or the IP address could not be allocated, ensure that the network adapter used for Remote Desktop IP Virtualization is enabled. Freeing up memory on the Remote Desktop Session Host server may help. If Remote Desktop IP Virtualization detected more than one network adapter, you must disable additional network adapters that are installed on the Remote Desktop Session Host server.
Windows Server 2003 Domain Controller Security

This template allows you to check locked and /or disabled users as well as events from the Windows security log in relation to Windows 2003 Domain Controller security. Prerequisites: WinRM must be installed and properly configured on the target server. WMI access to the target server. Auditing on domain controller (success and failure) must be enabled for the following items: Account Management, Logon Events, Policy Changes and System Events. To learn how to enable auditing , refer to this article: http://support.microsoft.com/kb/814595. Credentials: Administrator on target server. Configuring Windows Remote Management (WinRM) Take the following steps to properly configure Windows Remote Management: 1. If not already done so, install PowerShell 2.0 and WinRM on the SAM and target servers. PowerShell 2.0 can be found here: http://support.microsoft.com/kb/968930. 2. On the SAM server, open a command prompt as an Administrator. To do this, perform the following step: Go to the Start menu and right-click cmd.exe and then select Run as Administrator.
winrm quickconfig winrm set winrm/config/client @{TrustedHosts="*"}
where IP address is the IP address of your SAM server. Monitored Components Note: All monitors, except Locked out users and Disabled users, should return zero values. Returned values other than zero may indicate an abnormality. If you
believe an abnormality exists, you should examine the Windows security log for details. Locked out users This monitor returns the number of currently locked out users. Set the threshold value according to your requirements. Disabled users This monitor returns the number of currently disabled users. Set the threshold value according to your requirements. User Account: Creating a user account This monitor returns the number of events generated from creating new user accounts. Event ID: 624. Only authorized people and processes should create network accounts. Examine the Primary User Name field to detect whether an authorized person or process created an account. This event also detects if administrators create accounts outside organizational policy guidelines. User Account: Deleting a user account This monitor returns the number of events generated from deleting user accounts. Event ID: 630. Only authorized people and processes should delete network accounts. Search for these events and examine the Primary Account Name field to detect if unauthorized people have deleted accounts. User Account: Changing a user account This monitor returns the number of events generated from changes that were made to security-related properties of user accounts. Event ID: 642. User Account: Change password attempt This monitor returns the number of account password change attempts. Event ID: 627.
This event results from a password change request in which the user supplies the original password to the account. Compare Primary Account Name to Target Account Name to determine whether the account owner or someone else attempted to change the password. If Primary Account Name does not equal Target Account Name, someone other than the account owner tried to change the password. User Account: Password set or reset This monitor returns the number of times a user or process resets an account password through an administrative interface, such as Active Directory Users and Computers, rather than through a password change process. Event ID: 628. Only authorized people or processes should carry out this process, such as help desk or user self-service password reset. Logon Failure: Unknown user name or password This monitor returns the number of failed login attempts with an incorrect username and/or password. Event ID: 529. Check for attempts where Target Account Name equals Administrator or the renamed default administrator account. Check multiple logon failures that are below the account lockout threshold. Logon Failure: Disabled account This monitor returns the number of failed login attempts using a disabled account. Event ID: 531. Always investigate this event. Check Target Account Name value and Workstation Name. This event can signal attempted abuse by former internal users. Logon Failure: Expired account This monitor returns the number of failed login attempts using an expired account. Event ID: 532. Always investigate this event. This event can signal attempted abuse by contractors or temporary internal users.
Logon Failure: Logon type not allowed This monitor returns the number of failed attempts to log on interactively with service account credentials when Group Policy settings prevent that account from interactive logon. Event ID: 534. Logon Failure: Account locked out This monitor returns the number of failed login attempts using an account that has been locked out. Event ID: 539. Correlate with Event 529 to detect a pattern of continued lockouts. Logon Failure: User account automatically locked This monitor returns the number of accounts that have been automatically locked out. Event ID: 644. A user account has been locked out because the number of sequential failed logon attempts is greater than the account lockout limit. Logon Failure: Time restrictions This monitor returns the number of attempts to logon outside the permitted times. Event ID: 530. Check User Account Name and Workstation Name. Logon Failure: Replay attack detected This monitor returns the number of detected attempts by the authentication package to log on by replaying a user's credentials. Event ID: 553. Investigate immediately. Alternatively, this could be a sign of improper network configuration. System: Change directory services restore mode password This monitor returns the number of attempts to change the Directory Services Restore Mode password on a domain controller. Event ID: 698.
Check Workstation IP and Account Name and investigate immediately. System: Windows is shutting down This monitor returns the number of times Windows goes to shut down. Event ID: 513. Usually appears before Event 512. On high-value computers, authorized personnel should restart computers in accordance with established policies. Investigate immediately when this event occurs on any server. System: Clearing the security event logs This monitor returns the number of times security logs have been cleared. Event ID: 517. Administrators should not clear security event logs without authorization. Check Client User Name and Client Domain, then cross-correlate with authorized personnel. System: Changing system time This monitor returns the number of times the system time has been changed. Event ID: 520. This action can mislead forensic investigation or provide an attacker with a false alibi. The process name is %windir %\system32\svchost.exe. Check Client User Name and Client Domain, then cross-correlate with authorized personnel. System: Changing audit policy This monitor returns the number of times audit policies have been changed. Event ID: 612. This event does not necessarily indicate a problem. However, an attacker can change audit policy as part of a computer system attack. You should monitor for this event on high value computers and domain controllers. System: Changing the domain security policy This monitor returns the number of attempts to modify a password policy or other domain security policy settings. Event ID: 643. Check user name of subject and correlate with authorization.
Windows Server 2003-2008

This template assesses the status and overall of services and performance of a Microsoft Windows Server 2003 or Windows Server 2008 operating system. For more information, see Requirements for Component Monitors and Templates that use WMI on page 218. Prerequisites: WMI access to the target server. Credentials: Windows Administrator on the target server. These performance counters and services are based on SolutionBase: "Working with Microsoft Windows Server 2003's Performance Monitor, http://www.techrepublic.com/article/solutionbase-working-with-microsoftwindows-server-2003s-performance-monitor/5298961. Monitored Components Service: Distributed Transaction Coordinator Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will fail. If this service is disabled, any services that explicitly depend on it will fail to start. Service: Network Connections Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections. Service: Protected Storage Provides protected storage for sensitive data, such as passwords, to prevent access by unauthorized services, processes, or users. Service: Remote Registry Enables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer. If this service is disabled, any services that explicitly depend on it will fail to start. Total Available Memory (MBytes) Shows the amount of physical memory, in megabytes (MB), immediately available for allocation to a process or for system use. It is equal to the sum of memory assigned to the standby (cached), free, and zero page lists. For a full explanation of the memory manager, refer to Microsoft Developer Network (MSDN) or "System Performance and Troubleshooting Guide" in the Windows Server 2003 Resource Kit.
This should remain above 100 MB at all times. Page File Usage This is a measure of how much of the pagefile is actually being used. This is the counter you should use to determine whether the pagefile is an appropriate size. If this counter reaches 100, the pagefile is completely full and operations stop working. Depending on the volatility of your workload, you probably want to set the pagefile large enough so that no more than 50 to 75 percent of it is used. If a large part of the pagefile is in use, having more than one pagefile on different physical disks may improve performance. Disk Queue Length Tracks the number of requests that are queued and waiting for a disk during the sample interval, as well as requests in service. As a result, this might overstate activity. If more than two requests are continuously waiting on a single-disk system, the disk might be a bottleneck. To analyze queue length data further, use Avg. Disk Read Queue Length and Avg. Disk Write Queue Length. Virtual Memory This is a measure of the demand for virtual memory. It shows how many bytes have been allocated by processes and to which the operating system has committed a RAM page frame or a page slot in the pagefile (or both). As Committed Bytes grows above the available RAM, paging increases, and the amount of the pagefile in use also increases. At some point, paging activity starts to significantly affect perceived performance. % Processor Time Shows the percentage of time that the processor is executing application or operating system processes. This is when the processor is not idle. This should be less than 75% on average. Service: Server Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
Service: Plug and Play Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability. Pages/sec Pages/sec is the number of pages read from the disk or written to the disk to resolve memory references to pages that were not in memory at the time of the reference. This is the sum of Pages Input/sec and Pages Output/sec. This counter includes paging traffic on behalf of the system Cache to access file data for applications. This should be 0-20 at all times. It is unhealthy if this is greater than 80, which probably indicates there is not enough RAM. Logical Disk: Avg. Disk Queue Length Tracks the number of requests that are queued and waiting for a disk during the sample interval, as well as requests in service. As a result, this might overstate activity. If more than two requests are continuously waiting on a single-disk system, the disk might be a bottleneck. This should be less than 4 at all times. Note: When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at. Physical Disk: Avg. Disk Queue Length Tracks the number of requests that are queued and waiting for a disk during the sample interval, as well as requests in service. As a result, this might overstate activity. If more than two requests are continuously waiting on a single-disk system, the disk might be a bottleneck. This should be less than 4 at all times. Note: When looking at hard disks using perfmon.exe, an understanding of the underlying hard disk subsystem is required to determine which counters (physical disk or logical disk) to look at.
Windows Server 2008 Domain Controller Security

This template allows you to check locked and/or disabled users and events from the Windows security log related with Windows 2008 Domain Controller security. Prerequisites: WinRM must be installed and properly configured on the target server; WMI access to the target server; Auditing on domain controller (success and failure) must be enabled for the following items: Account Management, Logon Events, Policy Changes and System Events. To learn how to enable auditing , refer to this article: http://technet.microsoft.com/enus/library/cc731607(WS.10).aspx.
Credentials: Administrator on target server. Configuring Windows Remote Management (WinRM) Take the following steps to properly configure Windows Remote Management: 1. If not already done so, install PowerShell 2.0 and WinRM on the SAM and target servers. PowerShell 2.0 can be found here: http://support.microsoft.com/kb/968930. 2. On the SAM server, open a command prompt as an Administrator. To do this, perform the following step: Go to the Start menu and right-click cmd.exe and then select Run as Administrator.
where IP address is the IP address of your SAM server. Monitored Components Note: All monitors, except Locked out users and Disabled users, should return zero values. Returned values other than zero may indicate an abnormality. If you
believe an abnormality exists, you should examine the Windows security log for details. Locked out users This monitor returns the number of currently locked out users. Set the threshold value according to your requirements. Disabled users This monitor returns the number of currently disabled users. Set the threshold value according to your requirements. User Account: User account was created This monitor returns the number of new user accounts created. Event ID: 4720. Only authorized people and processes should create network accounts. Examine the Primary User Name field to detect whether an authorized person or process created an account. This event also detects if administrators create accounts outside organizational policy guidelines. User Account: Attempt to change password This monitor returns the number of account password change attempts. Event ID: 4723. This event is logged as a failure if his new password fails to meet the password policy. This event results from a password change request in which the user supplies the original password to the account. Compare Primary Account Name to Target Account Name to determine whether the account owner or someone else attempted to change the password. If Primary Account Name does not equal Target Account Name, someone other than the account owner tried to change the password. User Account: Attempt to reset password This monitor returns the number of times a user or process resets an account password through an administrative interface, such as Active Directory Users and Computers, rather than through a password change process. Event ID: 4724. This event is logged as a failure if the new password fails to meet the password policy.
Only authorized people or processes should carry out this process, such as help desk or user self-service password reset. User Account: Account was disabled This monitor returns the number of times an account becomes disabled. Event ID: 4725. Always investigate this event. User Account: Account was deleted This monitor returns the number of deleted user accounts. Event ID: 4726. Only authorized people and processes should delete network accounts. Search for these events and examine the Primary Account Name field to detect if unauthorized people have deleted accounts. User Account: Account was changed This monitor returns the number of times when changes were made to security-related properties of user accounts. Event ID: 4738. User Account: Account was locked out This monitor returns the number of automatically locked out accounts. Event ID: 4740. A user account has locked out because the number of sequential failed logon attempts is greater than the account lockout limit. User Account: Account name was changed This monitor returns the number of changes to the normal logon name or the pre-Win2k logon name. Event ID: 4781. When an account name is changed, the SID remains the same. However the Target ID in this event indicates the new name. This is because when the operating system displays this event it evidently queries the database where the SID is stored and translates the SID to the domain\username. A rogue administrator might change his account name or computer name seeking to cover his tracks.
Logon: Account failed to log on This monitor returns the number of failed login attempts with an incorrect username and/or password. Event ID: 4625. Check for attempts where Target Account Name equals Administrator or the renamed default administrator account. Check multiple logon failures that are below the account lockout threshold. Logon: Replay attack detected This monitor returns the number of detected attempts by the authentication package to log on by replaying a user's credentials. Event ID: 4649. Investigate immediately. Alternatively, this could be a sign of improper network configuration. Logon: Attempted logon using explicit credentials This monitor returns a number for the following events: A user connects to a server or runs a program locally using alternate credentials (run as); A process logs on as a different account; such as when the Scheduled Tasks service starts a task as the specified user; With User Account Control enabled, an end user runs a program requiring administrative authority.
Event ID: 4648. Policy: Domain policy was changed This monitor returns the number of events when the computer's Security Settings\Account Policy or Account Lockout Policy was modified, either via Local Security Policy or Group Policy in the Active Directory. Event ID: 4739. Unfortunately, the Subject fields don't identify who actually changed the policy because this policy is not directly configured by administrators. Instead, it is edited in a group policy object which then gets applied to the computer. Therefore, this event always shows the local computer as the one who changed the policy since the computer is the security principal under which gpupdate runs.
Policy: Kerberos policy was changed This monitor returns the number of times Windows detects a change to the domain's Kerberos policy. Kerberos policy is defined in GPOs linked to the root of the domain under Computer Configuration\Windows Settings\Security Settings\Account Policy\Kerberos Policy. Event ID: 4713. Unfortunately, the Subject fields do not identify who actually changed the policy because this policy is not directly configured by administrators. Instead, it is edited in a group policy object which then gets applied to the computer. Therefore, this event always shows the local computer as the one who changed the policy since the computer is the security principal under which gpupdate runs. Policy: System audit policy was changed This monitor returns the number of times audit policies have been changed either via Local Security Policy, Group Policy in Active Directory, or the audipol command. Event ID: 4719. According to Microsoft, this event is always logged when an audit policy is disabled, regardless of the "Audit Policy Change" sub-category setting. If group policy was used to configure audit policy, the Subject fields do not identify who actually changed the policy. In such cases, this event always shows the local computer as the one who changed the policy since the computer is the security principal under which gpupdate runs. This event does not necessarily indicate a problem; however, an attacker can change audit policy as part of a computer system attack. You should monitor this event on high value computers and domain controllers. Policy: Encrypted data recovery policy was changed This monitor returns the number of times a computer's Security Settings\Public Key Policies\Encrypting File System data recovery agent policy was modified either via Local Security Policy or Group Policy in an Active Directory. Event ID: 4714.
Unfortunately, the Subject fields do not identify who actually changed the policy because this policy is not directly configured by administrators. Instead, it is edited in a group policy object which then gets applied to the computer. Therefore, this event always shows the local computer as the one who changed the policy since the computer is the security principal under which gpupdate runs. System: Windows Firewall setting has changed This monitor returns the number of changes that were made to the Windows Firewall with the Advanced Services MMC console. Event ID: 4950. System: Windows is shutting down This monitor returns the number of times Windows goes to shut down. Event ID: 4609. On high-value computers, authorized personnel should restart computers in accordance with established policies. Investigate immediately when this event occurs on any server. System: The system time was changed This monitor returns the number times the system time has changed. Event ID: 520. This event indicates the old and new system times, as well as who changed the time as specified in the Subject section. It is routine to see this event, where the subject is "LOCAL SERVICE," and can probably be ignored. You will frequently see this event logged twice in a row. System: Service installed in the system This monitor returns the number of new services installed by the user as indicated in the subject. Event ID: 4697. Subject often identifies the local system (SYSTEM) for services installed as part of native Windows components and therefore you cannot determine who actually initiated the installation. This is a key change control event as new services are significant extensions of the software running on a server and the roles it performs.
Windows Update Monitoring

This template allows you to check the status of Windows' updates. It monitors how many updates are available and how many updates are installed. It also checks if a reboot is required before or after the installation of updates. It also monitors the number of reboots that have passed since the last update is also monitored. Prerequisites: WinRM must be installed and properly configured on the target server. Credentials: Administrator on target server. Configuring Windows Remote Management (WinRM) Take the following steps to properly configure Windows Remote Management: 1. If not already done so, install PowerShell 2.0 and WinRM on the SAM and target servers. PowerShell 2.0 can be found here: http://support.microsoft.com/kb/968930. 2. On the SAM server, open a command prompt as an Administrator. To do this, perform the following step: Go to the Start menu and right-click the cmd.exe and then select Run as Administrator.
where IP address is the IP address of your SAM server. Monitored Components Available hidden updates This component monitor returns the number of available hidden updates. Available critical updates This component monitor returns the number of available critical updates. This should always be zero.
Available optional updates This component monitor returns the number of available optional updates. Installed updates This component monitor returns the number of installed updates. Days passed from last Windows Update This component monitor returns the number of days that have passed from the last Windows update installation. Additionally, this component returns the name of the last installed update. Windows Updates activity status This component monitor returns the installation status of Windows update. Possible values: 0 Windows currently is not installing updates. 1 Windows currently is installing updates. Machine restart status before installing Windows Updates This component monitor shows the restart status before installing Windows updates. Possible values: 0 No reboot requires. 1 Reboot required before installing updates. Machine restart status after installing Windows Updates This component monitor shows the restart status after installing Windows updates. Possible values: 0 No reboot requires. 1 Updates installed. Reboot required. Service: Windows Updates This component monitors the Windows update service which enables the detection, download, and installation of updates for Windows and other programs. If this service is disabled, users of this computer will not be able to use Windows update or its automatic updating feature. If this service is down, programs will not be able to use the Windows Update Agent (WUA) API.
.
Index
Index
6
64-bit counters 101 email a web page 330 executing an external program 329, 404, 415 flagging traps 414 GET/POST 334 logging alerts to a file 324, 404 logging alerts to NetPerfMon Event Log 326 logging alerts to Windows Event Log 325, 404 logging traps to a file 414 logging traps to Windows Event Log 414 modifying Syslog message 404 playing a sound 323, 404, 415 send email/page 322, 405, 415 send SNMP trap 333, 404 send Windows Net messages 332, 404, 415 sending syslog messages 327, 404 sending traps 415 syslog See the SolarWinds Orion Common Components Administrator Guide tag message 403 tag trap 414 text-to-speech 332, 404, 415 traps 414, See the SolarWinds Orion Common Components Administrator Guide visual basic scripts 415 Visual Basic scripts 329, 404 activating APM license 46 Active Directory 135, See the SolarWinds Orion Common Components Administrator Guide Add a node 78 Add Application Monitors 162 add new view 83
Index 1225
9 A
95 percentile calculations definition 481 Accessing RTPE 390 account limitations 184, See the SolarWinds Orion Common Components Administrator Guide creating 289 deleting 290 introduction 289 maps 443 pattern 186 removing 290 viewing reports 373 account list 80 Account Manager 80 accounts editing users 180 new user 179 acknowledging events in the Web Console 287 Syslog messages in Syslog Viewer 399 Syslog messages in the Web Console 398 actions 403, 414, See the SolarWinds Orion Common Components Administrator Guide advanced alerts 314 alert See the SolarWinds Orion Common Components Administrator Guide creating 291 dial pager 335 dial SMS 335 discard message 403 discard trap 414
th
adding alert actions 321 database servers 451 devices in the Web Console 88 Adding server Hardware Monitoring 378 additional poller installing 474 understanding 471 Additional Polling Engines See the SolarWinds Orion Common Components Administrator Guide Additional Web Server See the SolarWinds Orion Common Components Administrator Guide additional website 476 Advanced Alert Manager Active Alerts 319 creating alerts 305, 306 Current Events 318 escalation 316 monitoring period 314 overview 318 reset actions 315 reset conditions 311 settings 320 suppressions 313 time of day 314 trigger actions 314 trigger conditions 308 advanced alerts See alerts acknowledging (Web Console) 302 adding actions 321 alert trigger 308 configuration See the SolarWinds Orion Common Components Administrator Guide creating 305, 306 escalated 335 escalation 316, See the SolarWinds Orion Common Components Administrator Guide monitoring period 314 reset actions 315 reset conditions 311
1226 Index
suppressions 313 testing actions 301 time of day 314 trigger actions 314 trigger conditions 308 advanced options maps 439 alert custom SQL 308 alert actions dial pager 335 discard message 403 discard trap 414 email a web page 330 executing an external program 329, 404, 415 flagging traps 414 GET/POST 334 logging alerts to a file 324, 404 logging alerts to NetPerfMon Event Log 326 logging alerts to Windows Event Log 325, 404 logging traps to a file 414 logging traps to Windows Event Log 414 modifying Syslog message 404 playing a sound 323, 404, 415 send email/page 322, 405, 415 send SNMP trap 333, 404 send Windows Net messages 332, 404, 415 sending Syslog messages 327, 404 sending traps 415 SMS 335 tagging message 403 tagging traps 414 text-to-speech 332, 404, 415 visual basic scripts 415 Visual Basic scripts 329, 404 alert suppressions advanced 313 alert trigger advanced alerts 308
alert variables See the SolarWinds Orion Common Components Administrator Guide advanced alert engine 487 Date/Time (advanced) 488 date/time (Syslog) 498 date/time (traps) 500 examples (basic) 497 general (advanced) 487 group (advanced) 488 HW (advanced) 494 modifiers 481 node (advanced) 490 other (Syslog) 499 other (traps) 499 SQL query (advanced) 489 status (advanced) 490 Syslog 406, 498 Syslog (date/time) 406 Syslog (other) 407 traps 415, 499 traps (date/time) 416 traps (other) 416 volume (advanced) 493 alerts acknowledging (Web Console) 302 adding actions 321 advanced See the SolarWinds Orion Common Components Administrator Guide audible web 183 condition groups 316 creating 81, 291 deleting 81 disabling 81 editing 81 enabling 81 escalated 335 escalation example 335 executing an external program 329, 404, 415 log files 324, 404 logging to NetPerfMon Event Log 326
logging to Windows Event Log 325, 404 mobile device view 303 mobile view See the SolarWinds Orion Common Components Administrator Guide on child objects of dependencies 177 playing a sound 415 testing actions 301 types 295 variables, application monitor 298 variables, component monitor 299 viewing in the Web Console 302 visual basic scripts 415 Visual Basic scripts 329, 404 windows service, restarting 304 alignment tools maps 440 allocation failures charts 124 anchor points 425 Apache template 795 APM activating license 46 common components requirements 7 installing 41 licensing 51 running 50 standalone 7 upgrading 21 APM license summary 147 APM licensing 51 APM settings 84 APM thwack forum 148 application component monitors variables 445 application details view customizing 283 Application Discovery 150, 161 application monitor See applications application monitor templates See application templates
Index 1227
application summary views, customizing 280 application templates 216 assigning 225, 229 copying 230 creating 226, 228 deleting 232 editing 229 managing 228 tagging 233 using 223 applications adding 162 creating 213, 229 editing 234 monitoring 275 Orion example 266 remanaging 236 unmanaging 235 variables 445 what is an application 2 Applications tab 86 assigned application monitors 216 assigned component monitors 216 audible web alerts 183 authentication See the SolarWinds Orion Common Components Administrator Guide Windows 135 autoarrange maps 441 automatic login DirectLink 504 introduction 501 URL pass-through 504 Windows pass-through 501 availability calculation 196 charts 123 Available Product Updates 82
configuration 119 basic alerts See alerts adding actions 321 Blackberry Delivery Confirmation template 817 Blackberry Enterprise Server template 819 breadcrumbs 85, 86
C
calculating availability 196 calculation availability 195 baseline 195 Changing Threshold Values 382 charts allocation failures 124 availability 123 configuration See the SolarWinds Orion Common Components Administrator Guide CPU load 123 custom chart view 124 custom node 122 custom volume 124 data export options 125 disk usage 124 font size 125 memory usage 123 nodes 122 packet loss 123 percent loss 123 printing options 124 response time 123 sample intervals 125 size 125 time periods 125 titles 125 volume sizes 124 volumes 124 child status icon 285 choosing monitors and templates by protocol 218 Cisco CallManager template 821 CiscoSecure ACS template 823 Citrix ICA templates 828 Citrix Presentation templates 834
B
background image 427 Background Image 427 backgrounds maps 426 banner
1228 Index
Citrix WMI templates 824 Citrix XenApp templates 839 color scheme 80, 119 command line filter 61 common tasks 53 compacting database tables 454 databases in Database Manager 453 component monitor library 237 component monitors 216 adding single or multiple 226 Linux/Unix Script 246 Windows Script 250 condition groups 316 all 316 any 317 none 317 not all 317 Configs tab 86 configuration web console resources 109 configuring audible web alerts 183 database compression 146 reports folders 189 settings 75, 87, 141 contacting sales iii SolarWinds iii technical support iii user forums iii copying application templates 230 counter rollover 195 counter rollovers 101 CPU load charts 123 threshold 102 create a new template 226 creating account limitations 289 alerts, advanced 305, 306 backup databases 452 custom properties 465 custom properties filters 469 dependencies 174
escalated alerts 336 user accounts 179 creating application monitors 229 creating application templates 226, 228 credentials See credentials library restoring security certificate 35 credentials library adding credentials 220 deleting credentials 220 editing credentials 220 understanding 220 VMware 208 critical thresholds 216 custom application details view 283 custom object resource 277, See also the SolarWinds Orion Common Components Administrator Guide Custom Object Resource 128 custom properties See the SolarWinds Orion Common Components Administrator Guide creating a property 465 creating filters 469 Custom Property Editor 465 Custom Property Editor settings 468 deleting 466 deleting filters 470 editing 468 filters 469 importing data 467 introduction 465 removing 466 removing filters 470 settings 468 Custom Property Editor 340 custom SQL alerts 308 Custom Summary 128 customize menu bars 80 customizing color scheme 80 menu bars 80 Customizing Hardware Chart 384, 385
Index 1229
D
data export charts 125 security 101, 194 database compression 146 grooming 146 maintenance 194, See the SolarWinds Orion Common Components Administrator Guide management See the SolarWinds Orion Common Components Administrator Guide Database Manager See the SolarWinds Orion Common Components Administrator Guide database details 85 in Database Manager 454 database maintenance 461 introduction 461 migrating a database 462 Database Manager adding a server 451 backup databases 452 compacting a database 453 compacting database tables 454 database details 454 detaching a database 457 editing fields 456 introduction 451 maintenance plan 457 restoring a database 453 table details 455 date variables 446 debug enable advanced debugging for support 226 debug logging for support 226, 234 definition account limitation 289 availability 196 custom property 465 deleting account limitations 290
1230 Index
custom properties 466 custom properties filters 470 dependencies 177 devices from the Web Console 91 deleting application templates 232 deleting assigned application monitors 237 dependencies See the SolarWinds Orion Common Components Administrator Guide alerts on child objects 177 creating new 174 deleting 177 editing 176 introduction 174 managing 79 detaching a database 457 device discovery See the SolarWinds Orion Common Components Administrator Guide devices adding in the Web Console 88 deleting from the Web Console 91 poll now 98 rediscover 98 DHCP User Experience Monitor 529 template 860 DirectLink See the SolarWinds Orion Common Components Administrator Guide DirectLink automatic login 504 directories temporary 524 Directory Size Monitor 532 discarding syslog messages 403 traps 414 discovering applications 150, 161 discovery 150 results 157 scheduled results 158 Discovery Central 78, 149 Network Discovery 149 Discovery Ignore List 159 disk usage
charts 124 disk usage threshold 102 distributing objects maps 441 DNS Monitor - TCP 534 DNS Monitor - UDP 535 DNS User Experience Monitor 536 DNS User Experience template 868 documentation conventions iii library iv Download Speed Monitor 538 template 869 dynamic groups 169
E
editing custom properties 468 dependencies 176 groups 171 editing application templates 229 editing device properties in the web console 93 editing user accounts 180 element 13 email a web page 330 Enabling SNMP ESXi 203 Engineers Toolset 131 Errors in Application Event Log template 871 escalated alerts 335 creation 336 example 335 escalation advanced alerts 316 ESX API polling
ESX Servers See the SolarWinds Orion Common Components Administrator Guide adding 208 creating credentials 207 monitoring requirements 202 polling methods 202 ESXi enabling SNMP 203 monitoring requirements 202 polling methods 202 event summary adding to web console 111 events acknowledging in the Web Console 287 viewing in the Web Console 286 Events view 286 Exchange 2007 template 872 exporting databases 462 exporting, importing application templates 231 external nodes 220 external websites 81, 129
F
facility 407 fields editing in Database Manager 456 File Age Monitor 540 template 938 File Change Monitor 542 template 939 File Count Monitor 544 File Count Script template 940 File Existence Monitor 546 template 941 File Size Monitor 547 template 942 FileModified (vbscript) template 943 filtering APM Application Summary Views 280 custom properties 469 filtering a node list resource 115 filters defining 344
Index 1231
settings 195
ESX Host Details 210 ESX HW Troubleshooting 211 ESX Server enabling SNMP on version 3.5 204 enabling SNMP on version 4.0 205
SQL syntax 345 SWQL syntax 346 find processes, services, and performance counters 65, 68, 227 Finger Port Monitor template 944 FIPS support 11 font size charts 125 FTP Monitor 549 FTP User Experience Monitor 550 FTP User Experience template 945
G
general variables 447 Generic DNS template 946 Generic Mail Server template 947 Generic Web Server template 948 GET alerts 334 gmail, monitoring 1100 Gopher Port Monitor template 949 gridlines maps 440 grouping nodes in a resource 117 groups See the SolarWinds Orion Common Components Administrator Guide combining applications 79 creation 169 deleting 172 dependencies 172 dynamic 169 editing 171 managing 79 status display 172 using 79
add component monitors 226 add credentials 220 assign application monitor templates 225 change configuration 75, 87, 141 change database settings 146 copy application templates 230 create an Orion application 266 create application monitors 229 create application templates 226, 228 create applications 213 create Linux/Unix Script component monitors 246 create Windows Script component monitors 250 delete credentials 220 edit application templates 229 edit assigned application monitors 234 edit credentials 220 enable debug logging for support 234 enable Orion Node Details application resources 279 view reports 342 HTTP 138 HTTP Form Login Monitor 553 HTTP Form Login template 976 HTTP Monitor 557 HTTP template 975 HTTPS scheduled reports 363 HTTPS Monitor 560
I
ICMP promoting to SNMP 94 promoting to WMI 96 settings 195 ignored devices 159 IIS enabling See the SolarWinds Orion Common Components Administrator Guide on Windows Server 2003 14 on Windows Server 2008 18 on Windows Vista 18
H
Hardware Alerting 386 Hardware Alerting thresholds 387 Hardware Chart 383 Hardware Details 380 Hardware Health 380, 381 Home tab 86 how it works 5 how to
1232 Index
on Windows XP 14 IMAP4 Monitor 563 IMAP4 Round Trip Email template 990 IMAP4 User Experience Monitor 564 importing custom properties data 467 databases 462 independent labels 433 nodes 433 installing additional pollers 474 APM 41 on remote computer 421 Orion Network Atlas 421 requirements 421 installing APM 41 integrated remote desktop 139 Integrated Virtual Infrastructure Monitoring 201 interface links in maps 425 interfaces adding in the Web Console 88 deleting from the Web Console 91 editing properties in the web console 93 poll now 98 polling intervals 194 polling statistics intervals 194 unpluggable 93 viewing resources in the web console 97 Internet Explorer security settings 51 IRC Port Monitor template 993 IVIM 201
J
Java application Server Template 996
L
large directories, monitoring 72 layouts
circular 441 hierarchical 441 orthogonal 441 symmetrical 441 tree 441 LDAP Connection Monitor template 1003 LDAP User Experience Monitor 569 template 1004 library iv license details 85 License Manager See the SolarWinds Orion Common Components Administrator Guide licensing See the SolarWinds Orion Common Components Administrator Guide component monitors 51 software license key 46 viewing components in license 51 licensing APM 51 limitations account 184 pattern 186 linking URLs maps 438 links anchor points 425 status 425 Linux/Unix Script component monitors 246 Linux/Unix Script Monitor 571 List Resources 97 load balancing 197, See the SolarWinds Orion Common Components Administrator Guide log files number to keep 226 logging alerts to a file 324, 404 alerts to NetPerfMon Event Log 326 alerts to Windows Event Log 325, 404 traps to a file 414 traps to Windows Event Log 414
Index 1233
Lotus Domino Server monitoring requirements 1022 Lotus Domino Server template 1022
M
maintaining a database 461 maintenance plan 457 manage accounts 80 manage advanced alerts 81 manage assigned component monitors 238 manage component monitors within templates 241 manage dependencies 79 manage groups 79 manage nodes 79, 97 manage templates 228 manage views 83 Management Studio 458 managing application monitors 234 manually assign application monitors 225 MAPI Round Trip Email template 1028 MAPI User Experience Monitor 573, 679 maps adding map objects 424 adding to web console 109 backgrounds 426 creating 423 examples 419 icon styles 443 label appearance 437 layout 441 line styles 443 link 425 linking URLs 438 list resource 110 map defaults 443 nested 431 node tree 443 objects list resource 110 settings 443 system requirements 421 memory swapping 100 memory usage charts 123
1234 Index
menu bar customizing 282 using 280 menu bars account defaults 187 custom 118 customization See the SolarWinds Orion Common Components Administrator Guide Message Center 137 metrics maps 432 Microsoft Office SharePoint Server 2007 template 1112 Microsoft Office SharePoint Server 2010 template 1115 migrating databases 462 mobile alerts view See the SolarWinds Orion Common Components Administrator Guide mobile devices acknowledging alerts 303 viewing alerts 303 modifying syslog messages 404 monitoring memory 100 period (advanced alerts) 314 Monitoring Hardware Health 375 monitoring large directories 72 monitoring requirements 13 Monitoring the RTPE 393 moving servers 35 multiple monitors of same type adding to template 226 MySql template 1082
N
Nagios Script Monitor 258 Nagios template 1089 nested maps 431 Net messages 332, 404, 415 NetPerfMon Event Log alerts 326 Network Discovery getting started 150 ignored results 159
results 157 scheduled results 158 network links 436 network settings 195 Network Sonar Discovery 78, See the SolarWinds Orion Common Components Administrator Guide Network tab 86 NNTP Monitor 578 node child status, calculating 285 node details resources enabling 279 node graphics maps 433 node maintenance mode 100 node management poll now 98 rediscover 98 states 97 node metrics 432 node warning interval 198 nodes adding 78 adding in the Web Console 88 availability 196 custom charts 122 deleting from the Web Console 91 discovering 78 editing properties in the web console 93 filtering a resource list 115 grouping in a resource 117 managing 79 poll now 98 polling intervals 194 polling statistics intervals 194 reassigning to polling engines 197 rediscover 98 variables 447 viewing resources in the web console 97 NotePage 335 NotePager Pro 335 notification bar 136
number of log files to keep 234
O
ODBC User Experience Monitor 579 Oracle template 1096 Oracle User Experience Monitor 582 Orion application example 266 Orion core details 85 Orion Network Atlas installing 421 Orion Polling Settings 194 Orion Product Team Blog 82 Orion Report Scheduler 362 Orion Server templates 1123 Orion thresholds 84 Orion Web Console 75
P
packet loss calculation 103 charts 123 packet loss reporting 199 paging alerts 335 pattern limitations 186 percent loss charts 123 percent memory used threshold 103 percent packet loss threshold 103 Performance Counter Monitor 587 troubleshooting 587 playing a sound 323, 404, 415 poll ESX server directly 210 poll now 98 poller aware 473, 474 load balancing 474 selecting 54, 55 unaware 472, 474 understanding 471 pollers configuration 193 settings 194 polling settings See the SolarWinds Orion Common Components Administrator Guide polling engine mode 146
Index 1235
local-only 146 poller-bound 146 polling engines 85 configuration 193 load balancer 197 load balancing See the SolarWinds Orion Common Components Administrator Guide management 193 reassigning nodes 197 settings 194 web console view 193 polling intervals response time 194 status 194 polling settings node warning interval 198 polling settings 84 polling settings packet loss reporting 199 polling statistics intervals 194 polling through 210 POP3 Monitor 590 POP3 Round Trip Email template 1100 POP3 User Experience Monitor 592 POST alerts 334 printing charts 124 process diagram 213 Process Monitor - SNMP 594 Process Monitor - WMI 596 processes monitoring 61, 226 product updates downloading 121 viewing 120 promoting nodes from ICMP to SNMP 94 promoting nodes from ICMP to WMI 96 properties maps 442 protocol for monitors and templates 218
1236 Index
R
RADIUS User Experience Monitor 598 RADIUS User Experience template 1108 Real Time Polling 389 realtime change detection 404, 415 rediscovery 98 regular expressions alternation 486 anchors 484 character sets/classes 483 characters 483 dot 486 eamples 486 pattern matching 483 quantifiers 485 word boundaries 486 remanaging assigned application monitors 236 remote access HTTP 138 SSH 138 Telnet 138 remote desktop 139 remote installation 421 removing account limitations 290 custom properties 466 custom properties filters 470 Report Scheduler 340, See the SolarWinds Orion Common Components Administrator Guide Report Writer creating reports 339 using 342 using custom properties 340 using predefined reports 340 reports See the SolarWinds Orion Common Components Administrator Guide account limitations 373 adding to web console 114 alerts 351 availability 349, 350 component availability 70 CPU 352
creating 339 creating a report 357 current groups and groups members 353 current status 340 custom, creating 70 daily availability 341 design mode 357 device types 354 disk space 354 down events 351 down nodes 350 events 351 example 366 exporting 365 field formatting options 361 field options 358 filter results options 359 folder 189 footers 365 formats 365 general options 358 getting started 356 group availability 353 group availability with members 354 group member status 353 group status 353 grouping options 361 groups and group member status 353 headers 365 historical groups status 354 historical status 341 included 342 interface bandwidth 354 interface types 354 inventory 354 IOS versions 354 last 250 events 351 list resource 114 modifying a report 357 node response time 350 node status 350 predefined 340, 348 preview mode 356
response time 352 scheduling 362 SQL query 366 summarization options 360 time frame options 360 top XX records options 360 using custom properties 340 viewing 342 virtual machine CPU utilization 352 virtual machine memory utilization 352 virtual machine running time 352 virtual machine traffic 352 VMware ESX Server 352 volume status 350 volume usage 354 volumes 354 website-only 476 Reports view 355 requirements monitored devices 13 Orion database server 10 Orion server hardware 8 Orion server software 8 SNMP monitoring 13 virtual machines 9 virtual servers 9 VMware Servers 13 requirements for component monitors using WMI 218 requirements for templates using WMI 218 reset actions (advanced alerts) 315 conditions (advanced alerts) 311 resources active application alerts 275, 277 additional node details 279 all applications tree 275 all groups 276 APM sample map 276 application availability 278 application details 277 application health overview 275
Index 1237
applications with problems 275 component availability 278 component details 278 component statistics 278 components 277 configuration 109 custom HTML 113 Custom Object 128 custom object resource 277 custom text 113 event summary 111 last 25 application events 276 last xx application events 277 last xx component events 278 map objects list 110 maps 109 maps list 110 min/max average CPU load 279 min/max average physical memory 279 min/max average response time 278 min/max average statistic data 279 min/max average virtual memory 279 process and service monitors 277 reports 114 reports list 114 Syslog 396 top xx components by response time 276 top xx components by statistic data 276 top xx processes by CPU load 276 top xx processes by physical memory 276 top xx processes by virtual memory 276 user-defined links 112 response calculation 103 response time charts 123 threshold 103 restarting a Windows service 304
1238 Index
restoring databases 453 rollover 101 root cause displaying in alert for group 291 RTPE Alerts 394 Run 3rd-Party Application template 1109 running Orion APM 50 RWHOIS Port Monitor templates 1111
S
sample intervals adjust 125 scan nodes for applications 223 scheduled discovery See the SolarWinds Orion Common Components Administrator Guide ignored results 159 managing results 158 scheduling node maintenance 100 Script Engine 632 scripting custom component monitors 244 security maps 443 security certificate 35 security of data 101, 194 sending email/page 322, 405, 415 SNMP trap 333, 404 syslog messages 327, 404 traps 415 server requirements 13 sizing 13 Server & Application Monitor adding map objects 424 starting 423 service accounts 162, 224 Service Status - SNMP 600 setting account defaults 187 account limitations 184 pattern account limitations 186 settings
charts See the SolarWinds Orion Common Components Administrator Guide discovery See the SolarWinds Orion Common Components Administrator Guide web console See the SolarWinds Orion Common Components Administrator Guide website See the SolarWinds Orion Common Components Administrator Guide severity 408 shared thwack templates 147 SharePoint Server (MOSS) 2007 template 1112 SharePoint Server (MOSS) 2010 template 1115 SharePoint Services (WSS) 3.0 template 1118 site logo configuration 119 SMS alerts 335 SMTP Monitor 602 SNMP monitoring requirements 13 SNMP settings 195 SNMP ESX Server version 3.5 204 SNMP ESX Server version 4.0 205 SNMP Monitor 603 snmp traps See traps SNPP Port Monitor template 1120 software license key enabling 46 SolarWinds contacting iii website iii spoofing network packets 405 SQL query as a variable 489 Server Management Studio 458 variables 489
SQL Server tempdb 524 SQL Server (via SNMP) template 1134 SQL Server 2005 2008 template 1135, 1141 SQL Server Query template 1147 SQL Server User Experience Monitor 605 SQL syntax 345 SSH 138 SSL alert email 322 SSL CEM 608 standalone product 7 starting 423 status groups 172 maps 442 status indicators 479 status variables 490 StatusRootCause 291 summarization 461 suppression advanced alerts 313 SWQL syntax 346 Syslog See the SolarWinds Orion Common Components Administrator Guide acknowledging messages in Syslog Viewer 399 acknowledging messages in the Web Console 396, 398 alert actions 403 alert variables 406, 498 alerts 327, 401, 404 daemons 407 facility 407 filters 401 forwarding messages 405 messages in the Web Console 396 monitoring 395 port configuration 395 priority value 407 processes 407
Index 1239
resources 396 searching messages 399 server settings 400 severity 408 view 397 viewing messages in Syslog Viewer 399 viewing messages in the Web Console 397 syslog variables See the SolarWinds Orion Common Components Administrator Guide System Manager availability calculation 196 node maintenance 100
T
tables compacting 454 details 455 tabs 86 TACACS+ User Experience Monitor 610 TACACS+ User Experience template 1157 tagging syslog messages 403 traps 414 tagging application templates 233 TCP Port Monitor 612 Telnet 138 TEMP 524 tempdb 524 templates See also application templates active directory 782 Apache 795 Blackberry Delivery Confirmation 817 Blackberry Enterprise Server 819 Cisco CallManager 821 Cisco Secure ACS 823 Citrix ICA 828 Citrix Presentation 834 Citrix WMI 824 Citrix XenApp Services 839 DHCP User Experience Monitor 860
1240 Index
DNS User Experience 868 Download Speed Monitor 869 Errors in Application Event Log 871 Exchange 2007 872 File Age Monitor 938 File Change Monitor 939 File Count Script 940 File Existence Monitor 941 File Modified 943 File Size Monitor 942 Finger Port Monitor 944 FTP User Experience 945 Generic DNS 946 Generic Mail Server 947 Generic Web Server 948 Gopher Port Monitor 949 HTTP 975 HTTP Form Login 976 IMAP4 Round Trip Email 990 IRC Port Monitor 993 JavaTemplate 996 LDAP Connection Monitor 1003 LDAP User Experience Monitor 1004 listing 776 Lotus Domino Server 1022 MAPI Round Trip Email 1028, 1082, 1089, 1096 Microsoft Office SharePoint Server 2007 1112 Microsoft Office SharePoint Server 2010 1115 Orion Server 1123 POP3 Round Trip Email 1100 RADIUS User Experience 1108 Run 3rd-Party Application 1109 RWHOIS Port Monitor 1111 SharePoint Server (MOSS) 2007 1112 SharePoint Server (MOSS) 2010 1115 SharePoint Services (WSS) 3.0 1118 SNPP Port Monitor 1120 SQL Server (via SNMP) 1134
SQL Server 2005 -2008 1135, 1141 SQL Server Query 1147 TACACS+ User Experience 1157 Thwack.com - User Experience Monitor Example 1158 Tomcat Server Template 1159 VMware ESX Host Template 1169 Web Link 1171 Windows Event Log Count 1186 Windows FTP Server (via WMI) 1188 Windows Print Services 1198 Windows Server 2003-2008 1213 Windows SharePoint Services 3.0 1118 testing alert actions 301 text-to-speech 332, 404, 415 thresholds 102, 195 configuration 104 CPU load 102 critical 216 disk usage 102 percent memory used 103 percent packet loss 103 response time 103 warning 216 Thwack iii thwack.com integration See the SolarWinds Orion Common Components Administrator Guide thwack.com - User Experience Monitor Example template 1158 time variables 446 time of day advanced alerts 314 time periods charts 125 TLS alert email 322 TMP 524 Tomcat Server Monitor 614
Tomcat Server Template template 1159 Toolset integration 131, See the SolarWinds Orion Common Components Administrator Guide adding programs 132 configuration 131 tooltips maps 438 trap variables See the SolarWinds Orion Common Components Administrator Guide Trap Viewer 410 settings 411 traps See the SolarWinds Orion Common Components Administrator Guide alert actions 412 alert actions 333, 404 alert variables 415, 499 alerts 412, 415 alerts actions 414 community string 412 conditions 412 defined 409 DNS hostname 412 email/page 415 executing an external program 415 filters 412 log files 414 logging to Windows Event Log 414 playing a sound 415 port 410 protocol 409 searching 411 text-to-speech 415 time of day 412 Trap Viewer configuration 410 Trap Viewer settings 411 trigger thresholds 412 viewing 410 viewing in the Web Console 409 visual basic scripts 415 Traps
Index 1241
view 409 trigger actions advanced alerts 314 trigger conditions advanced alerts 308 troubleshooting 505 temporary directories 524 variables 507 Windows Server 2008 performance 525 Windows Vista performance 525 troubleshooting Windows performance counters 587
U
understanding applications 2, 216 credentials library 220 resources 275 Universal Device Pollers transformations 269 unmanage nodes 97 unmanaging assigned application monitors 235 unplugged interfaces 93 upgrading moving servers 35 upgrading APM 21 URL pass-through automatic login 504 user accounts access settings 182 creating 179 editing 180 limitations 184 menu bars 187 pattern limitations 186 reports folder 189 views 187 user forums iii user-defined links 112 Using the RTPE 392
V
variables 445, See the SolarWinds Orion Common Components Administrator Guide advanced alerts 487
1242 Index
application component monitors 445 applications 445 basic alerts 481 date 446 Date/Time (advanced alerts) 488 date/time (Syslog alerts) 498 date/time (trap alerts) 500 examples (basic alerts) 497 full names 507 general 447 general (advanced alerts) 487 group (advanced alerts) 488 HW(advanced alerts) 494 introduction 481 node (advanced alerts) 490 nodes 447 other (Syslog alerts) 499 other (trap alerts) 499 SQL query (advanced alerts) 489 status (advanced alerts) 490 Syslog alerts 406, 498 Syslog alerts (date/time) 406 Syslog alerts (other) 407 time 446 trap alerts 415, 499 trap alerts (date/time) 416 trap alerts (other) 416 volume (advanced alerts) 493 volumes 449 vCenter 210 viewing alerts (Web Console) 302 device resources (Web Console) 97 events (Web Console) 286 Syslog messages (Web Console) 397 traps (Web Console) 409 views account defaults 187 Alerts 302 by device type 108 copying 108 creating 105 Custom Summary 128 customizing 104
deleting 108 editing 105 exporting to PDF 127 menu bars 118 Message Center 137 Orion Poller Settings 193 product updates 120 Reports 355 Syslog 397 Traps 409 Virtualization Summary 209 views by application type 83, 145 views by device type 83 virtual machines See the SolarWinds Orion Common Components Administrator Guide hosting Orion See the SolarWinds Orion Common Components Administrator Guide monitoring See the SolarWinds Orion Common Components Administrator Guide Virtualization Summary 209 Virtualization tab 86 virtualization thresholds 84 visual basic scripts 415 Visual Basic scripts 329, 404 vMotion 201 VMware adding ESX Servers 208 credentials library 208 ESX Servers See the SolarWinds Orion Common Components Administrator Guide monitoring requirements 13 VMware ESX Host Template 1169 VMware monitoring 65, 617, 1169 wizard 65 VMware Performance Counter Monitor 617 VMware settings 79 VMware Template See VMware ESX Host Template VMware tools 209 VMware Tools 13
VMware wizard 65 volumes adding in the Web Console 88 custom charts 124 deleting from the Web Console 91 polling intervals 194 polling statistics intervals 194 size charts 124 variables 449 viewing resources in the web console 97
W
warning thresholds 216 web console 75 breadcrumbs 86 configuring resources 109 navigation 85 notification bar 136 tabs 86 views See the SolarWinds Orion Common Components Administrator Guide Web Console accounts See the SolarWinds Orion Common Components Administrator Guide acknowledging alerts 302 Active Directory 135 adding a map 109 adding devices 88 adding interfaces 88 adding nodes 88 adding volumes 88 Admin login 135 administration See the SolarWinds Orion Common Components Administrator Guide Alerts view 302 banner 119 changing passwords 100 clearing configurations 134 color scheme 119
Index 1243
configuration See the SolarWinds Orion Common Components Administrator Guide configuring product updates 120 copying views 108 creating accounts 179 creating configuration backups 133 creating views 105 custom HTML 113 custom text 113 data security 101, 194 deleting devices 91 deleting interfaces 91 deleting nodes 91 deleting views 108 deleting volumes 91 downloading product updates 121 editing accounts 180 editing device properties 93 editing views 105 event summary resource 111 Events view 286 exporting views to PDF 127 external websites 129 filtering a node list resource 115 grouping nodes in a resource 117 interface tooltips 92, 285 login 135 map objects list resource 110 maps list resource 110 menu bars 118 Message Center 137 node management states 97 node tooltips 92, 285 poll now 98 polling engines 193 promoting nodes from ICMP to SNMP 94 promoting nodes from ICMP to WMI 96 rediscover 98 Reports 355 reports list resource 114 reports resource 114
1244 Index
restoring configuration backups 134 site logo 119 Syslog 396 thresholds 102 Toolset integration 131 Traps 409 user-defined links resource 112 view customization 104 viewing alerts 302 viewing device resources 97 Views by Device Type 108 Windows Authentication 135 Web Console Configuration 133 Web Console Configuration 133 web console settings 84 Web Link Monitor 621 Web Link template 1171 website 476 Windows Event Log alerts 325, 404, 414 memory 100 Net messages 332, 404, 415 pass-through automatic login 501 Windows Authentication 135, See the SolarWinds Orion Common Components Administrator Guide Windows Event Log Count template 1186 Windows Event Log Monitor 624, 628 Windows FTP Server (via WMI) template 1188 Windows PowerShell Monitor creating 261 Windows Print Services template 1198 Windows Script component monitors 250 Windows Script Monitor 576 Windows Server 2003-2008 template 1213 Windows Server 2008 slow performance 525 Windows Service Monitor 633 Windows SharePoint Services 3.0 template 1118
Windows Vista slow performance 525 WMI requirements for 218 WMI Monitor 635
Z
zoom maps 431
Index 1245

Sam Admin Guide

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Sam Admin Guide

Uploaded by

Copyright:

Available Formats

SolarWinds

Server & Application Monitor Administrator Guide

SolarWinds Server & Application Monitor Administrator Guide

About SolarWinds iii

Administrator Guide SolarWinds Server & Application Monitor

SolarWinds Server & Application Monitor Documentation Library

iv SolarWinds Orion Server & Application Monitor Documentation Library

SolarWinds Server & Application Monitor Administrator Guide

Administrator Guide SolarWinds Server & Application Monitor

SolarWinds Server & Application Monitor Administrator Guide

Administrator Guide SolarWinds Server & Application Monitor

SolarWinds Server & Application Monitor Administrator Guide

Administrator Guide SolarWinds Server & Application Monitor

SolarWinds Server & Application Monitor Administrator Guide

Administrator Guide SolarWinds Server & Application Monitor

SolarWinds Server & Application Monitor Administrator Guide

Administrator Guide SolarWinds Server & Application Monitor

SolarWinds Server & Application Monitor Administrator Guide

Administrator Guide SolarWinds Server & Application Monitor

SolarWinds Server & Application Monitor Administrator Guide

Administrator Guide SolarWinds Server & Application Monitor

SolarWinds Server & Application Monitor Administrator Guide

Group Variables ......................................................................................... 450

Administrator Guide SolarWinds Server & Application Monitor

Status Icons and Identifiers ......................................................................... 479

SolarWinds Server & Application Monitor Administrator Guide

Administrator Guide SolarWinds Server & Application Monitor

SolarWinds Server & Application Monitor Administrator Guide

Administrator Guide SolarWinds Server & Application Monitor

SolarWinds Server & Application Monitor Administrator Guide

Administrator Guide SolarWinds Server & Application Monitor

SolarWinds Server & Application Monitor Administrator Guide

Administrator Guide SolarWinds Server & Application Monitor

SolarWinds Server & Application Monitor Administrator Guide

Windows Update Monitoring .................................................................. 1222

Index .......................................................................................................... 1225

SolarWinds Server & Application Monitor Administrator Guide

SolarWinds SAM vs. Orion APM

Administrator Guide SolarWinds Server & Application Monitor

SolarWinds Server & Application Monitor Administrator Guide

SAM Glossary of Terms

Administrator Guide SolarWinds Server & Application Monitor

SolarWinds Server & Application Monitor Administrator Guide

How Does SolarWinds Server & Application Monitor Work?

Administrator Guide SolarWinds Server & Application Monitor

SolarWinds Server & Application Monitor Administrator Guide

Requirements and Installation

Requirements for SolarWinds SAM

Requirements and Installation 7

Administrator Guide SolarWinds Server & Application Monitor

.NET Framework SNMP Trap Services Web Console Browser

Note: Dual processor, dual core is recommended.

8 Requirements and Installation

SolarWinds Server & Application Monitor Administrator Guide

Memory Application Ports

Requirements and Installation 9

Administrator Guide SolarWinds Server & Application Monitor

Hard Drive Space

10 Requirements and Installation

SolarWinds Server & Application Monitor Administrator Guide

Administrator Guide SolarWinds Server & Application Monitor

12 Requirements and Installation

SolarWinds Server & Application Monitor Administrator Guide