SAMAdminGuide PDF

SolarWinds
Server & Application Monitor
Version 6.2.4
Administrator Guide
Last Updated: Friday, June 10, 2016

© 2016 SolarWinds Worldwide, LLC. All rights reserved.
This document may not be reproduced by any means nor modified, decompiled,
disassembled, published or distributed, in whole or in part, or translated to any
electronic medium or other means without the prior written consent of SolarWinds.
All right, title, and interest in and to the software and documentation are and shall
remain the exclusive property of SolarWinds and its respective licensors.
SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS

OR IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND DOCUMENTATION
FURNISHED HEREUNDER INCLUDING WITHOUT LIMITATION THE WARRANTIES OF
DESIGN, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, AND
NONINFRINGEMENT. IN NO EVENT SHALL SOLARWINDS, ITS SUPPLIERS, NOR ITS
LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR
ANY OTHER LEGAL THEORY EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.
The SolarWinds and other SolarWinds marks, identified on the SolarWinds website,
as updated from SolarWinds from time to time and incorporated herein, are
registered with the U.S. Patent and Trademark Office and may be registered or
pending registration in other countries. All other SolarWinds trademarks may be
common law marks or registered or pending registration in the United States or in
other countries. All other trademarks or registered trademarks contained and/or
mentioned herein are used for identification purposes only and may be trademarks
or registered trademarks of their respective companies.
Server & Application Monitor Administrator Guide, Version 6.2.4, 5/3/2016

Table of Contents
Before you install 37
Introduction 38
Applications Defined 39
How Does SolarWinds Server & Application Monitor Work? 40
Requirements and Installation 44
Prepare a SolarWinds Orion Platform installation 44
SAM hardware requirements 44
SAM software requirements 45
Server port requirements 47
SolarWinds SAM database server (SQL server) requirements 47
SAM requirements for virtual machines and servers 49
Requirements for monitoring Microsoft Hyper-V, VMware ESXi, and ESX Servers 49
Additional monitoring requirements 50
Agent requirements 51
Quality of Experience requirements 52
Configure the SolarWinds Orion server to use the correct syslog port 54
Server sizing 54
Recommendations 55
5
SolarWinds Server & Application Monitor Administrator Guide
SQL server configuration best practices 55
Maximizing SQL server performance 55
Hardware settings for SQL servers 56
Recommendations for multi-CPU systems and the optimal settings of the I/O subsystem 57
Database file setting recommendations 58
Memory setting recommendations 58
CPU setting recommendations 58
Security enhancements and exceptions for SolarWinds Orion Platform products 58
Enable secure channels with SSL 58
Enable FIPS 60
Antivirus directory exclusions 61
SolarWinds Orion Platform products licensing 61
Activate your SolarWinds license 62
License Manager requirements 63
Additional SAM technology requirements 67
SAM technology requirements 67
SNMP requirements for monitored devices 68
Additional SolarWinds SAM requirements 68
Asset inventory and hardware health monitoring requirements 68
AppInsight for SQL requirements and permissions 69
AppInsight for Exchange requirements and permissions 71
AppInsight for IIS requirements and permissions 72
Requirements for the Windows Scheduled Task Monitor 73
Scale SAM for larger environments 74
6
Table of Contents
SAM licensing model detailed 75
See the available component monitors remaining in your license 77
Install and configure Server & Application Monitor 77
Configure Server & Application Monitor 78
Run SolarWinds SAM 78
Perform common tasks 78
Install, upgrade, and move SolarWinds Server & Application Monitor 79
Uninstall SAM from your server 79
Administer and implement SAM technologies 81
Manage Orion Web Console 81
Log in to the Orion Web Console 81
Customize the Orion Web Console 82
Customize resources 87
Customize views 95
Orion Web Console and chart settings 107
Administrative functions 110
Manage Users 113
Manage Orion Web Console user accounts 113
Create users 113
Change account passwords 116
Enable users to authenticate through LDAP 117
Define what users can access and do 117
Set default menu bars and views for users 120
Limit users to specific network areas 121
Configure automatic login 123
7
Enable LogonFallback 125
Discover and add network devices 128
Discover your network with the Discovery Wizard 129
Add nodes using Active Directory 133
Credentials for Active Directory discovery 134
Automatically add discovered nodes 135
Add discovered devices to SolarWinds NPM 137
Choose the polling method to use 140
External Node (No Status) 140
Status Only: ICMP 140
Most Devices: SNMP & ICMP 140
Windows Servers: WMI and ICMP 140
Windows Servers: Agent 141
Import nodes from a list of IP addresses 142
Manage scheduled discovery results 143
Minimize SNMP processing load during discoveries using the Discovery Ignore List 144
Add ignored devices back to discovery 144
Manage devices in the Orion Web Console 145
Stop monitoring devices 146
View node data in tooltips 147
Edit node properties 148
Promote a node from ICMP to SNMP monitoring 151
View the resources and statistics monitored on a node 152
Suspend collecting data for monitored nodes 153
Poll and rediscover devices immediately 154
8
Table of Contents
Troubleshoot Windows Server memory over 100% 155
Manage groups and dependencies 156
Groups 157
Mirror network object dependencies in the Orion Web Console 163
Discover applications in your environment 169
Access Application Discovery 169
Select nodes to scan 169
Select applications 169
Add application monitors to nodes 171
Customize the application details view 172
Custom application details view 172
Select a view for a template 172
Select a view for an application 173
Viewing node and application data in tooltips 174
Enable SolarWinds SAM data in the Node Details view 176
Customize SAM Application Summary views 177
Add a summary view menu item to the menu bar in the Applications tab: 177
Monitor network events in the web console 178
178
View event details in the web console 178
Acknowledge events in the web console 178
Manage nodes, applications, and settings from the web console 181
Manage nodes from the web console 181
9
Unmanage nodes 181
View node resources 181
Delete nodes from monitoring 181
Manage nodes and applications (Advanced) 182
Delete applications or volumes from monitoring 182
Promoting the node 182
Unscheduled node polling and rediscovery 183
Performing an unscheduled poll or rediscovery 183
Unmanage a node using the Unmanage Scheduling Utility 183
Viewing the details of a selected item's schedule 183
Access nodes using HTTP, SSH, and Telnet 184
Manage SAM settings and general thresholds 185
Adjust SAM account settings 185
Set SolarWinds general thresholds 185
Certificate Credentials Library 186
Understand the Credentials Library 187
Add, edit, and delete credentials within the Credentials Library 189
189
Add a certificate to the library 190
Assign certificate credentials 191
Use Quick Credentials 193
Create and assign credentials using Quick Credentials when editing a template or
application monitor. 193
Configure and manage the web console 194
10
Table of Contents
Administrative Functions of the Orion Web Console 195
Customize views 208
Schedule tasks to be stopped using the Unmanage Scheduling utility 236
Schedule tasks to be stopped 236
View the details of a selected item's schedule 236
Monitor your network 237
View events, alerts, traps, and syslogs in the Orion Web Console Message Center 237
Monitor hardware health 237
Add server hardware monitoring 237
Hardware monitoring and VMware 238
Access hardware monitoring agent software 239
Hardware Details 239
Hardware Health Chart 242
Monitor virtual infrastructure in the Orion Web Console 245
Prerequisites to monitoring virtual infrastructure 245
Create ESX server credentials for SolarWinds Orion products 247
Enabling SNMP on VMware ESXi and ESX Servers 247
Edit VMware Credentials in the Orion Web Console 251
Add virtual servers for monitoring 252
Assess the status of the virtual environment 252
View ESX host details 253
Assign credentials to virtual servers 253
Monitoring Quality of Experience 255
Benefits of QoE 256
11
Packet Analysis Sensor Licensing 259
How SolarWinds Packet Analysis Sensors Work 263
Limitations to Packet Analysis Sensors 264
Deploying Packet Analysis Sensors 265
Aggregation with access to network (NPAS) 268
Aggregation with access to application servers (SPAS) 269
Aggregation per site with access to network (NPAS) 270
Aggregation per site with access to application servers (SPAS) 271
Aggregation per computer with access to network (NPAS) 272
Aggregation per computer with access to application servers (SPAS) 273
Monitor QoE Applications and Nodes 278
Advanced Sensor Configuration 288
SolarWinds Orion agents 293
Agent settings 294
Server-initiated communication 295
Agent-initiated communication 296
Windows agent deployment 297
Add the MST file to a Group Policy 302
Enable server-initiated communication on deployed agents 303
Requirements for manual agent deployment 310
Install through the command prompt 310
Deploy the agent manually using the interactive wizard 310
Certificates and the agent 313
Manage agents, connections, and deployment status 314
12
Table of Contents
Agent polling method 324
View network events in the Web Console 326
Filter the displayed logged events in the Web Console 327
Remove events from the Web Console 328
Syslogs and traps 328
Monitor Syslog messages 328
Monitor SNMP traps 337
Integrate an Orion Platform product with ServiceNow 342
Before you begin 342
Install and configure the SolarWinds Alert Integration application in ServiceNow 343
Configure an Orion Platform product with ServiceNow 344
Manage SAM technologies 345
Work with application monitor templates 346
Creating component monitors and templates 347
Add tags 357
Remove tags 358
Assign component monitors to a node 360
Copy assigned component monitors to an assigned application monitor 361
Copy assigned component monitors to an application monitor template 361
Edit assigned application monitors 361
Delete assigned application monitors 361
Edit an individual application 369
Add a JMX component monitor 373
Load WSDL Files 374
Manually Enter XML 375
13
Adapt an existing Perl script to a Linux/Unix Script component monitor in a new template 378
Linux/Unix scripts 380
Example Scripts 380
Scripts Must Report Status Through Exit Codes 380
Scripts with Text Output 380
Field Descriptions 382
Creating a Windows Script Monitor 384
Adapt an existing Visual Basic script to a Windows Script Monitor in a new template 384
Macros for Script Arguments 384
Example Scripts 386
Return Codes 388
What needs to be monitored 391
Troubleshooting the Lsass.exe PowerShell Monitor 392
Threshold Adjustments at the Template Level 395
Threshold Adjustments at the Component Monitor Level 395
Change the amount of data used in baseline calculations 401
Apply baseline thresholds at the template level 401
Apply baseline thresholds at the application level 402
Use latest baseline details 403
Edit capacity planning thresholds 404
View the Latest Baseline Details Page 405
Scan nodes for applications 408
14
Table of Contents
Select Nodes 408
Select Applications 408
Enter Credentials 409
Review & Start Scan 409
Add UX Monitors 409
Common Tasks with SolarWinds SAM 410
Manage Asset Inventory 421
Enable and disable the Asset Inventory dashboard 422
Asset Inventory data collection 423
Manage AppStack 424
Navigate to AppStack 425
Use AppStack 426
Manage processes, services, tasks, and events in real time 428
The Real Time Process Explorer 429
The Service Control Manager 437
The Windows Scheduled Task Monitor 440
445
The Real Time Event Log Viewer 451
Manage audit events 457
Add the Audit Events resource 457
Filter audit events 458
Manage SolarWinds SAM polling engines 459
View polling engine status 460
Node Status 471
Percent Packet Loss 471
15
AppInsight for Exchange 472
Quick configuration - AppInsight for Exchange requirements and permissions 473
Advanced Manual Configuration of AppInsight for Exchange 477
Non-Domain Account 480
AppInsight for IIS 494
Quick configuration and navigation 495
Manually configure AppInsight for IIS 499
AppInsight for SQL 509
Add AppInsight for SQL to a node via discovery 510
Add a named instance 511
Edit the AppInsight for SQL template 513
Navigate the different AppInsight for SQL views 514
Monitor clusters with AppInsight for SQL 515
Manage the Desktop Notification tool 516
Agents 518
Agent resource consumption 520
Agent port requirements 520
Agent settings 521
Navigate to the Agent Settings page 521
Adjust the Global Agent Settings 521
16
Table of Contents
Deploy a Windows agent with the Add Node wizard 524
Deploy Windows agent software via server push 525
Deploy the Windows agent manually 526
Mass deploy a Windows agent 527
Deploy with a Gold Master Image 529
Deploy a Windows agent with Patch Manager 530
Deploy on Windows Core Servers 537
Deploy Windows agents in the cloud 537
Manage Agents toolbar options 540
Manage Agents table columns 542
Edit agent settings 543
Track your polling method 544
View the status of agent plug-ins 545
Edit agent settings in the Windows Control Panel 546
Connect to a previously installed agent 546
Change agent communication modes 547
Change the agent port 548
Check nodes polling with agents for changes 550
Agent performance counters 550
SolarWinds: Agent Service 550
SolarWinds: Agent Management Service 551
Custom properties 553
17
Create a custom property 553
Remove a custom property 556
Import custom property values 556
Export custom property data 558
Change custom properties values 558
Filter objects when assigning custom properties 559
Alerting 560
Use alerts to monitor your environment 560
Alert preconfiguration tasks 561
Configure the default information in the email action 561
Best practices and tips for alerting 562
Navigate to the Alert Manager 562
Create new alerts to monitor your environment 563
Add a preexisting action to the alert 572
Commonly Created Alerts 575
View triggered alerts in the Orion Web Console 578
Remove alerts from the Active Alerts list 579
Test alert triggers and actions 579
Modify multiple alerts or share alerts 580
Build complex conditions 581
Manage alert actions 583
Available Alert Actions 584
Changes in the alerting engine 610
Alert migration to the web 612
18
Table of Contents
SolarWinds SAM Alerts 612
Component Monitor Alerting Properties 612
Application Monitor Alerting properties 616
Application Monitor Variables for Alerts 616
Component Monitor Variables for Alerts 627
Share alerts with other SolarWinds products 640
Reports 644
Creating and Viewing Reports 644
Predefined Orion Reports 644
Viewing, Creating, Exporting, Importing, Editing and Scheduling Reports in the Orion Web
Console 644
Create a report schedule 656
Edit a schedule 658
Assign a report to a schedule or multiple schedules 659
Unassign a report from a schedule or multiple schedules 659
Using Report Writer 660
OrionGlobalSearch 666
Search syslogs, traps and objects monitored in the Orion Web Console globally 666
Install Orion Global Search 666
Search with Orion Global Search 666
Orion Global Search query syntax 667
Auto-completing queries and properties in Orion Global Search 668
Refining Global Search with available filters 668
Adding more properties for filtering search results 669
NetworkAtlasAdminGuide 671
19
Network Atlas tooltip variables 703
Application variables for Network Atlas tooltips 703
Application component monitor variables for Network Atlas tooltips 703
Date and Time Variables for Network Atlas tooltips 704
General variables for Network Atlas tooltips 705
Group variables for Network Atlas tooltips 706
Interface variables for Network Atlas tooltips 707
IP SLA variables for Network Atlas tooltips 711
Node variables for Network Atlas tooltips 712
Volume variables for Network Atlas tooltips 716
Wireless variables for Network Atlas tooltips 717
Network Atlas 717
What can you see on maps? 717
What customization options are there? 718
Install Network Atlas 718
Start Network Atlas 719
Create network maps 720
Create wireless heat maps 728
Display Network Atlas maps in the Orion Web Console 735
Advanced mapping techniques 738
Delete a custom icon 743
Add custom icons from graphics files 744
Assign a custom icon to an object 744
Environment requirements 747
User requirements 747
20
Table of Contents
Configure environment for the map import 747
Advanced map layouts 749
Access remote nodes 753
Using Integrated Remote Desktop 753
References 755
AppInsight Applications 756
Zooming 763
Zooming 826
Change thresholds for the Database Files performance counter 830
Change thresholds for the Top Indexes for Database performance counter 843
Changing the number of tables displayed in this resource requires values be changed in two
locations 843
Change the thresholds for the Top Indexes for Database performance counter 847
Change thresholds for the Top Tables for Database performance counter 849
Zooming 863
Zooming 899
The AppInsight Performance Counter Details view 1005
Zooming 1006
Zooming 1009
21
The AppStack environment 1010
Introduction to the AppStack Environment view 1011
AppStack categories and data 1015
Understand status and colors 1021
Understand mixed icons 1021
Understand Quick Links 1022
Understand Categories 1024
Understand the Overview bar 1025
Understand filtering options 1026
Understand filter properties 1027
Understand layouts 1029
Understand the AppStack resource 1031
Customize the AppStack Environment view 1032
The Template and Application relationship 1033
Understand component monitors 1034
1034
1034
View the component monitor library 1035
Choose component monitors and templates based on protocol 1036
Monitor external nodes 1037
Application availability and status 1038
Charts in the SolarWinds web console 1039
Chart Information 1039
Custom Chart Resource Title Bar Options 1039
Edit Chart Title View 1039
22
Table of Contents
Enable hardware health monitoring 1045
Change hardware health temperature units 1046
Edit hardware health thresholds 1047
Agents 1048
Viewing and customizing application and component performance and status 1051
Volume details 1052
Navigate to the volume details page 1052
Add Disk Volumes to the current view 1052
Understand interface details 1053
Navigate to the Interface Details page 1053
1054
Understand component monitors and application monitor templates 1055
Available data transformations 1057
Web service monitoring 1059
JSON 1060
23
SOAP Monitor 1061
Definitions 1061
About the SOAP Monitor 1061
View the Asset Inventory dashboard 1065
Custom Asset Information 1066
Drivers 1067
Firmware 1068
Graphics and Audio 1069
Hard Drives 1070
Hosted Virtual Machines 1071
Logical Volumes 1072
Memory 1073
Network Interfaces 1074
Operating System Updates Applied 1075
Out of Band Management 1076
Peripherals 1077
Ports and USB Controllers 1078
Processors 1079
Removable Media 1080
Software Inventory 1081
Storage Controllers 1082
System Information 1083
General 1085
Hardware 1085
Operating System 1086
24
Table of Contents
Windows Update Information 1087
SolarWinds SAM Charts and Resources 1088
Application Availability Chart 1089
Custom Chart 1091
Custom Area Chart 1093
Custom Bar Chart 1094
Component Availability Chart 1095
Custom Chart View 1097
Printing Options 1097
Chart Titles 1097
Time Period 1097
Sample Interval 1097
Chart Size 1097
Font Size 1097
Data Export Options 1098
Custom Line Chart 1099
Custom Query resource 1100
Custom Table 1101
Custom Node Charts 1102
Availability 1102
CPU Load 1102
Memory Usage 1102
Packet Loss and Response Time 1102
Custom Volume Charts 1103
Event Log Message Details 1104
25
Min/Max Average Chart 1105
Zooming 1105
Multiple Object Chart 1107
Multiple Statistic Chart 1109
Zooming 1109
Multi Chart 1111
Reading the Application Summary view 1113
Active application alerts 1114
Application Health Overview 1115
Applications with Problems 1116
Last 25 Application Events 1117
Thwack Latest Application Templates 1118
Top 10 Components Monitored by Response Time 1119
Top 10 Monitored Processes by CPU Load 1120
Top 10 Monitored Processes by Physical Memory 1121
Top 10 Monitored Processes by Virtual Memory 1122
Top 10 Monitored Processes by I/O Reads/Sec 1123
Top 10 Monitored Processes by I/O Writes/Sec 1124
Top 10 Monitored Processes by I/O Total Operations/Sec 1125
Server Warranty Summary 1126
Application Monitor Thresholds 1128
Multi-Value scripts and thresholds 1129
Understand latest baseline details 1130
Understand sustained thresholds 1134
SolarWinds Variables and Examples 1135
26
Table of Contents
Filter syntax reference 1135
Filter syntax reference and navigation 1135
SolarWinds SAM SWQL resource matrix 1136
SolarWinds EOC SWQL resource matrix 1138
SWQL filter syntax examples 1151
SQL Filter Syntax Examples 1153
Variable Modifiers 1154
Date Time 1155
Group Variables 1156
SQL Query 1157
Status Variables 1158
Node variables 1159
View monitored objects on maps 1165
The Worldwide Map 1166
Set up the Worldwide map 1166
Map objects 1167
Network Atlas Maps 1168
Set up a user account on a SQL server 1169
1171
Add credentials to the Credentials Library 1171
Edit credentials in the Credentials Library 1171
27
Delete credentials from the Credentials Library 1171
Component Monitor Types 1173
DHCP User Experience Monitor 1175
Directory Size monitor 1177
DNS Monitor - TCP 1179
DNS User Experience monitor 1180
DNS Monitor - UDP 1182
Download Speed monitor 1183
Exchange Web Services User Experience monitor 1185
File Age Monitor 1187
File Count monitor 1189
File Existence monitor 1191
File Change monitor 1192
File Size monitor 1194
28
Table of Contents
FTP User Experience monitor 1196
FTP monitor 1199
HTTP Form Login monitor 1200
HTTP monitor 1203
HTTPS monitor 1206
IMAP4 monitor 1210
IMAP4 User Experience monitor 1211
JMX monitor 1213
LDAP User Experience Monitor 1215
Linux/Unix Script monitor 1217
MAPI User Experience monitor 1219
Nagios Script monitor 1222
29
NNTP monitor 1224
ODBC User Experience monitor 1225
Oracle User Experience monitor 1228
Performance Counter monitor 1232
POP3 monitor 1234
POP3 User Experience Monitor 1236
Process monitor - SNMP 1238
Process monitor - WMI 1239
RADIUS User Experience monitor 1241
Service Status – SNMP 1243
SMTP monitor 1244
SNMP monitor 1245
SOAP component monitor 1247
30
Table of Contents
SQL Server User Experience monitor 1250
SSL Certificate Expiration Date monitor 1252
TACACS+ User Experience monitor 1254
TCP Port monitor 1256
Tomcat Server monitor 1257
VMware Performance Counter monitor 1260
Field Description 1260
Web Link monitor 1263
Windows Event Log monitor 1265
Windows PowerShell monitor 1268
Windows Script monitor 1271
Windows Service monitor 1273
WMI monitor 1275
Worldwide Map of Orion Nodes Resource 1277
31
Regular Expression Pattern Matching 1281
Characters 1281
Character Classes or Character Sets [abc] 1282
Anchors 1283
Quantifiers 1284
Dot 1286
Word Boundaries 1287
Alternation 1287
95th Percentile Calculations 1288
Required SolarWinds account permissions 1290
Notifications in the Orion Web Console 1292
SAM Glossary of Terms 1293
Solutions 1295
Move the SQL server temporary directory 1296
SAM WMI monitors show a status of Unknown 1296
Redefine Windows system temporary directories 1297
Troubleshooting 1297
Back up your data 1297
Verify program operation 1297
Stop and restart 1298
Run the Configuration Wizard 1298
Slow Performance on Windows Server 2008 1298
Troubleshoot slow performance on Windows Server 2008 1299
32
Table of Contents
Error When Creating New Group 1300
Why can't I connect to thwack? 1300
WMI troubleshooting flowchart for SolarWinds SAM 1301
Test local WMI services 1302
Test WMI on the target server 1302
Manually reset the WMI counters 1303
Test remote WMI connectivity 1303
Remotely test WMI on the target server 1304
Verify administrator credentials 1305
Enable Remote Procedure Call (RPC) 1305
Configure Distributed Component Object Model (DCOM) and User Account Control (UAC) 1305
Enable DCOM permissions for your SAM credentials 1306
Enable Account Privileges in WMI 1306
Disable Remote User Account Control for workgroups 1307
Add a Windows firewall exception for remote WMI connections 1307
Determine if an additional polling engine is needed 1308
Verify SAM component configuration 1308
Service reporting, "Invalid Class" 1308
WMI is still not working. Now what? 1309
Working with Temporary Directories 1309
Moving the SQL Server Temporary Directory 1309
Redefining Windows System Temporary Directories 1309
Troubleshooting agents 1310
Troubleshooting agent installation 1310
Troubleshooting agent deployment 1311
33
Troubleshooting agent configuration 1311
Troubleshooting agent connections 1312
Troubleshoot hardware health 1313
Hardware troubleshooting flowchart 1314
Troubleshoot an SNMP node 1315
Troubleshoot a WMI node 1317
Use Wbemtest.exe to troubleshoot WMI 1317
Troubleshoot a VMWare node 1319
Hardware prerequisite checklist 1320
Troubleshoot AppInsight for Exchange 1321
Troubleshoot permissions 1321
Troubleshoot Exchange performance counters 1324
Troubleshoot error codes in AppInsight for Exchange 1327
Troubleshooting AppInsight for IIS 1332
Access is denied when configuring AppInsight for IIS 1333
Change between 32-bit and 64-bit polling 1333
Credentials test failed 1334
Polling fails due to a missing certificate. 1334
IIS polling failed 1334
Node unreachable 1335
IIS version failed 1335
WinRM testing failed 1335
Error code 1367 1335
34
Table of Contents
Error Code 16049 1339
Other errors 1339
Event IDs 1341
WinRM 2.0 1347
An HTTPS listener currently exists on port 5986 1347
Create a firewall rule 1348
Troubleshoot ESX hardware monitoring 1349
Troubleshoot baseline thresholds 1349
35
Before you install
Before you install SAM, you should explore this section which contains information on different technology
and licensing requirements.
n SAM hardware requirements
n Additional SAM technologyrequirements
37
Introduction
SolarWinds Server & Application Monitor (SolarWinds SAM) allows you to create and
monitor your own custom collection of monitored components, providing an open
field of opportunity to the network engineer. It also allows you to create flexible
Application Monitor templates to combine process monitors, port availability, and
performance counters, allowing you to assess the status of every aspect of your
application and the health of the application as a whole.
The following illustration shows a basic visualization of how SolarWinds Server &
Application Monitor works:
38
Applications Defined
In SolarWinds SAM, an application is a collection of component monitors inherited
from a template. A component monitor queries for values returned by a process,
counter, status, or script. SolarWinds SAM uses the data received to display vital
statistics concerning the health of the system.
Templates provide blueprints for the applications to be monitored. You can

customize templates, and use only the component monitors you need to monitor a
specific environment. SolarWinds SAM provides the following types of templates:
n AppInsight application templates are preconfigured templates that provide

detailed information. If you have business-critical Exchange, Microsoft IIS, or
Microsoft SQL instances, use the AppInsight templates to monitor these
applications. These templates have their own mechanism of discovering
elements of an application dynamically. They also have special licensing.
n If you have other business-critical applications, apply one of the many
preconfigured application templates that ship with SolarWinds SAM.
SolarWinds recommends deploying a single template, making necessary edits
to customize it to your environment, and then deploying the edited template on
all similar applications. You can also obtain a template from the thwack
community for an application not shipped with SAM.
n If you have a custom, homegrown application that you need to monitor, you can
build a custom template.
The following illustration explains the template and application relationship. If you
make a change at the template level, the applications based on that template are
affected. Conversely, if you make a change at the application level, only the individual
application is affected.
This inheritance relationship is beneficial if you need to make a lot of changes. For
example, rather than making one change to 100 applications (and therefore 100
changes), you can change one item that affects all 100 applications based on that
template.
39
How Does SolarWinds Server & Application Monitor Work?
Remove an Application Template from multiple nodes

1. Navigate to Settings > SAM Settings > Manage Application Monitors.
2. From here, you can change the Group By drop down menu to Application
Monitor Template.
3. Find the template in the list on the left and click that template.
4. Multi-select the nodes you want to delete the Application Monitor from.
How Does SolarWinds Server & Application

Monitor Work?
Using UDP, TCP, SNMP, and WMI calls to your network framework and application
servers, SolarWinds Server & Application Monitor provides real time feedback on your
applications and trending through statistics stored in the Orion database. Keeping
with the SolarWinds common components infrastructure, there are no agents
installed on your servers and no remote software to maintain. All calls are made in
real time and displayed on a Web Console accessible from any supported browser.
40
As a standalone product, SAM operations can be visualized with the following
flowchart:
Installed as a module in your family of SolarWinds products, SAM can be visualized

with the following flowchart:
41
How Does SolarWinds Server & Application Monitor Work?
42
Requirements and Installation
Prepare a SolarWinds Orion Platform installation
Orion Platform products use a simple wizard to direct the installation process.
Downgrades of Orion Platform products are not supported. If you are upgrading or installing
multiple products, confirm that you are installing them in the order given in the upgrade
instructions located in your SolarWinds Customer Portal or in the Upgrade Guide.
SAM hardware requirements
Important: These system requirements define the minimum requirements for SAM 6.2.4 as a single
installed product. You may need to increase your requirements in small, medium, or large
environments with multi-modules installed.
The following table lists minimum hardware requirements and recommendations for your
SolarWinds Orion server. Installing multiple SolarWindsOrion Platform products on the same computer
may change the requirements.
Hardware requirements are listed by SolarWinds SAM license level.
HARDWARE AL150 - AL300 AL700 - AL1100 AL1500-ALX
2.4 GHz 3.0 GHz 3.0 GHz

Dual core, dual processor is Dual core, dual processor is Quad core processor is
recommended recommended recommended
CPU speed
For production environments, quad core is recommended.
Do not enable Physical Address Extension (PAE).
4 GB 10 GB 25 GB
A RAID 1 drive for the server operating system, SolarWinds installation, and
tempdb files is recommended. The SolarWinds installer needs 1GB on the drive
where temporary Windows system or user variables are stored. Per Windows
Hard drive standards, some common files may need to be installed on the same drive as
space your server operating system.
The Orion installer needs 2 GB on the drive where temporary Windows system or user
variables are stored.
Some common files may need to be installed on the same drive as your server
operating system.
44
HARDWARE AL150 - AL300 AL700 - AL1100 AL1500-ALX
4 GB 8 GB 16 GB

Memory
8 GB recommended 16 GB recommended 32 GB recommended
n 25 (TCP) SMTP port for non-encrypted messages

n 161 (UDP) for statistics collection
n 162 (UDP) for Trap Server listening for incoming messages
n 443 (TCP) default port for https binding and bi-directional ESX/ESXi server polling
and for Cisco UCS monitoring
n 465 (TCP) for SSL-enabled email alert actions
n 587 ( TCP) for TLS-enabled email alert actions
Server port
n 1801 (TCP) for MSMQ WCF binding
requirements
n 5671 (TCP) for Rabbit MQ messaging
n 17777 (TCP) open for Orion module traffic
n 17778 (HTTPS and TCP) open to access the SolarWinds Information Service API and
agent communication
n 17779 (HTTP and HTTPS) for the SolarWinds Toolset Integration
n 17791 (TCP) open for agent communication on any SolarWinds Orion server
running Windows Server 2008 R2 SP1
n 17778 (Active mode): In Active mode, no ports need to be open on the host where
the agent is installed. However, TCP port 17778 must be open on the Orion server
or the additional poller with which the agent is associated. This port must be
opened on the Orion server (inbound) and allowed by the firewall. It is used on a
continual basis once the agent has been deployed. Communication is initiated
Agent Open outbound from the agent to the Orion server.
Port
Requirements: Important: This requirement is for Active agents only. If Passive agents are used,
no ports need to be opened on the firewall for the Orion server. For more
information, see Changing the Agent Port.
n 17790 (Passive mode): In Passive mode, port 17790 must be opened on the host
where the agent is installed and allowed by the firewall.
SAM software requirements

The following table lists minimum software requirements and recommendations for a SAM installation.
n SolarWinds does not support installing SolarWinds Orion on domain controllers.

n SolarWinds neither recommends nor supports the installation of any Orion product on the
same server or using the same database server as a Research in Motion (RIM) Blackberry
server.
45
SOFTWARE REQUIREMENTS
Production Evaluation Only
n Windows Server 2008 R2 SP1 with IIS in 32-bit mode.

n Windows Server 2012, 2012 Datacenter edition, and n Windows 7 SP1
2012 R2. IIS must be installed.
n Windows 8 (except for

Standard Edition)
SolarWinds recommends that SolarWinds
Operating administrators have local administrator privileges to n Windows 8.1 (except for
system ensure full functionality of local SolarWinds tools. Standard Edition)
Accounts limited to use of the SolarWinds Web n Windows 10
Console do not require administrator privileges.
Installing SAM on Windows Server 2012 R2 Essentials is not supported.
Operating
system n English
languages
IPv4
IP address IPv6 implemented as a dual stack. For more information, see RFC 4213 - Basic Transition
version Mechanisms for IPv6 Hosts and Routers.
CIDR notation is not supported for IPv6 addresses.
Microsoft Internet Information Services (IIS), version 7.5 or later, in 32-bit mode
n DNS specifications require that host names be composed of alphanumeric

characters (A-Z, 0-9), the minus sign (-), and periods (.). Underscore
Web characters (_) are not allowed. For more information, see RFC 952 - DOD
server Internet Host Table Specification.
n IIS is installed by the SolarWinds installer. You can install this software
manually to reduce your installation time or network bandwidth.
n SolarWinds products are not compatible with IIS version 6.0 installations that
use web gardens.
.NET .NET 4.5
Framework
Compatible with 4.6.1
n Microsoft Internet Explorer version 11 or later with Active scripting

Web
n Microsoft Edge
console
n Firefox 46.0 or later (Toolset Integration is not supported on Firefox)
browser
n Chrome 51.0 or later
46
SOFTWARE REQUIREMENTS
n Safari for iPhone
Other MSMQ
The following services must be running after installation is complete to collect syslog
messages and traps:
Services
n SolarWinds Syslog Service
n SNMP Trap Service
SolarWinds recommends that administrators have local administrator privileges to ensure

User
full functionality of local SolarWinds tools. Accounts limited to the Orion Web Console do
privileges
not require administrator privileges.
Server port requirements
n 25 (TCP) SMTP port for non-encrypted messages

n 161 (UDP) for statistics collection
n 162 (UDP) for Trap Server listening for incoming messages
n 443 (TCP) default port for https binding and bi-directional ESX/ESXi server polling and for Cisco UCS
monitoring
n 465 (TCP) for SSL-enabled email alert actions
n 587 ( TCP) for TLS-enabled email alert actions
n 1801 (TCP) for MSMQ WCF binding
n 5671 (TCP) for RabbitMQ messaging
n 17777 (TCP) open for Orion module traffic
n 17778 (HTTPS and TCP) open to access the SolarWinds Information Service API and agent
communication
n 17779 (HTTP and HTTPS) for the SolarWinds Toolset Integration
n 17791 (HTTPS and TCP) open for agent communication on Windows Server 2008 R2 SP1
SolarWinds SAM database server (SQL server) requirements

Your Orion Platform product and your SolarWinds Orion database should use separate servers.
Multiple SolarWinds Orion server installations using the same database are not supported.
The following table lists software and hardware requirements for your SolarWinds Orion database server
using SolarWindsNPM license levels as a reference.
REQUIREMENTS AL150 - AL300 AL700 - AL1100 AL1500-ALX

SolarWinds supports Express, Standard, or Enterprise versions of the following:
SQL Server
n SQL Server 2008, 2008 SP1, 2008 SP2, 2008 SP3, or 2008 SP4
47
n SQL Server 2008 R2, 2008 R2 SP1, 2008 R2 SP2, or 2008 R2 SP3
n SQL Server 2012, 2012 SP1, 2012 SP2, or 2012 SP3
n SQL Server 2014 or 2014 SP1
n SQL Server 2016
n Due to latency effects, SolarWinds does not recommend installing your SQL
Server and your SolarWinds server or additional polling engine in different
locations across a WAN. For more information, see this SolarWinds
Knowledge Base article,
n Either mixed-mode or SQL authentication must be supported.
n If you are managing your Orion database, SolarWinds recommends you
install the SQL Server Management Studio component.
Dual core processor, Quad core processor,

CPU speed 2.4 GHz
3.0 GHz 3.0 GHz
4 GB 10 GB 25 GB
Due to intense I/O requirements, a RAID 1+0 drive is strongly recommended for

the SolarWinds database, data, and log files. RAID 5 is not recommended for the
Hard drive SQL Server hard drive.
space
The Orion installer needs at least 1 GB on the drive where temporary Windows system
or user variables are stored.
Per Windows standards, some common files may need to be installed on the same drive
as your server operating system.
4 GB 6 GB 8 GB

Memory
Additional memory improves both performance and reliability.
Memory and Each additional poller requires 8GB of additional RAM. For example, SAM plus 2
Additional additional pollers would require 24GB of RAM. 3 additional pollers would require 32GB
Pollers of RAM, and so on.
Authentication Either mixed-mode or SQL authentication
If you are managing your SolarWinds Orion database, SolarWinds recommends you
Other install the SQL Server Management Studio component.
software The Installation Wizard installs the following required x86 components if they are not
found on your Orion database server:
48
l SQL Server System Common Language Runtime (CLR) Types. Orion products use
secure SQL CLR stored procedures for selected, non-business data operations to
improve overall performance.
l Microsoft SQL Server Native Client
l Microsoft SQL Server Management Objects
SAM's PowerShell Script Monitor works with PowerShell 1.0 and higher for local
execution.
PowerShell 2.0 or higher is required for remote execution.
SAM requirements for virtual machines and servers

SAM installations on VMware Virtual Machines and Microsoft Virtual Servers are fully supported if the
following minimum configuration requirements are met for each virtual machine.
You must maintain your SQL Server database on a separate, physical server.
VM REQUIREMENTS BY SAM LICENSE LEVEL FOR REFERENCE

CONFIGURATION AL150 - AL300 AL700 - AL1100 AL1500 - ALX
CPU speed 2.4 GHz Dual core 3.0 GHz Quad core 3.0 GHz
4 GB 10 GB 25 GB

Allocated
hard drive Due to intense I/O requirements, SQL Server should be hosted on a separate
space physical server configured as RAID 1+0. RAID 5 is not recommended for the SQL
Server hard drive.
Memory 4 GB 6 GB 8 GB
Requirements for monitoring Microsoft Hyper-V, VMware ESXi, and ESX Servers
REQUIREMENT DESCRIPTION
SNMP must be enabled on all ESXi and ESX servers. For more information, consult your
SNMP
ESX or ESXi server vendor documentation.
ESXi and ESX Server version 4.1 or later

Virtualization
VMware vSphere version 4.1 or later
software
Microsoft Hyper-V Server versions 2008 R2, 2012, 2012 R2
VMware
VMware Tools must be installed on all virtual machines you want to monitor.
tools
49
If your virtual machines are on monitored ESXi and ESX servers, VMware Tools are not a
requirement but provide access to additional information, such as IP addresses.
For more information about requirements, see IVIM Minimum Requirements in the SolarWinds
Virtual Manager documentation.
The following methods are used by SolarWinds Orion to monitor VMware ESX Servers and their component
features.
FEATURES 4 4i 5i 6.0
Datacenter VMware API
ESX cluster VMware API
Virtual Center VMware API
Detection as ESX server VMware API
Volumes SNMP N/A SNMP
Interfaces SNMP SNMP (partial) SNMP
CPU VMware API
Memory VMware API
Total CPU
VMware API
(ESX details view)
Total memory
VMware API
(ESX details view)
Network traffic utilization

VMware API
(ESX details view)
Guest VM list
VMware API
(ESX details view)
Additional monitoring requirements

The SysObjectID on monitored devices must be also accessible from the SolarWinds Orion server.
If your devices do not use the default syslog port to send messages, you must also modify the
SolarWinds Orion server to listen to that port.
Some features, such as agents or Quality of Experience (QoE) monitoring, have extra or different
requirements on the host computers.
50
n Agent requirements
n Quality of Experience requirements
Agent requirements
Agent software is free. You remain bound by the limits of the license you own regardless of how
information is polled, either through an agent or another polling method.
n Windows agents run as a service.
Before you deploy agents to a target computer, review the following system requirements.
TYPE REQUIREMENTS
The following operating systems are supported for both 32-bit and 64-bit computers:
n Windows Server 2008

n Windows Server 2008 R2
n Windows Server 2008 R2 SP1
Operating n Windows Server 2012 R2
System
n Windows 7, Windows 7 SP1
n Windows 8, Windows 8.1
n Windows 10
Only Pro, Enterprise, and Ultimate workstation operating systems editions are
supported.
The following software packages are installed by the agent installer if necessary:
n Microsoft Visual C++ 2013 Redistributable Package for 32-bit or 64-bit

Other
software n .NET Framework 4.0 (You must install this manually if you are installing an agent on
Windows Core.)
n .NET Framework 4.5 (Required for Windows Server 2008 R2 SP1 and later.)
The VeriSign Root Certificate Authority (CA) must be current. This is required because the
agent software is signed using a VeriSign certificate. To install a certificate, see Certificates
Security and the agent.
After the agent is installed, it runs as the Local System account and does not require
administrative permissions to function.
If you want to deploy agents from the SolarWinds Orion server, the following requirements
Account must be met:
permissions n The account used for remote deployment must have access to the administrative
share on the target computer: \\<hostname_or_ip>\admin$\temp.
51
TYPE REQUIREMENTS
n User Account Control (UAC) must either be disabled on the target computer, or the
built-in Administrator account must be used.
Other remote or mass deployment methods do not have the same requirements.
HDD Approximately 100 MB of hard drive space on the target computer, for installation only
Agent resource consumption
RESOURCE CONSUMPTION
CPU Less than 1% on average under normal operating conditions (0.24% on average)
Memory 10 - 100 MB, depending on the number and types of jobs
Roughly 20% (on average) of the bandwidth consumed by the WMI protocol for transmission
Bandwidth of the same information
For example, Agent: 1.3 kB/s versus WMI at 5.3 kB/s
Storage 100 MB when installed
A single polling engine can support up to 1,000 agents.
Agent port requirements
For agent-initiated communications, port 17778 (inbound) must be open on SolarWinds Orion servers
running Windows Server 2012 or port 17791 on SolarWinds Orion server running Windows Server 2008 R2
SP1 and communication through the port must be allowed by the firewall. It is used continuously after the
agent is deployed. Communication is initiated outbound from the agent to the Orion server.
For server-initiated communications, port 17790 must be opened (inbound) on the remote computer.
n 135 (DCE/RPC Locator service) Microsoft EPMAP. This port must be open on the client computer
(inbound) for remote deployment.
n 445 Microsoft-DS SMB file sharing. This port must be open on the client computer (inbound) for
remote deployment.
Quality of Experience requirements
Before you deploy a Packet Analysis Sensor to a device to monitor QoE, review the following minimum
system requirements.
You will need administrative privileges for each node or switch.
Sensors cannot be installed on 32-bit computers and do not support communication over https.
52
Network Packet Analysis Sensors (NPAS)
HARDWARE/SOFTWARE REQUIREMENTS
Windows 7 or later, 64-bit
OS Windows Server 2008 or later, 64-bit
32-bit operating systems are not supported.
CPU Cores 2 CPU Cores + 1 CPU Core per 100 Mbps
Hard drive space 500 MB
1 GB + 1 GB per 100 Mbps

RAM
(2 GB + 1 GB per 100 Mbps recommended)
Network 1Gbps maximum throughput
For a physical monitored

switch: For a virtual monitored switch:
n SPAN n Promiscuous port groups

n Mirror port n vTap
n In-line tap
Port monitoring
Port monitoring requires at least one extra network interface to collect data from
the managed network interface, a server to monitor the copied traffic, and a
network cable to connect the mirrored port to the physical server.
View your vendor documentation for instructions about how to set up port
mirroring. You can create port mirrors for both physical switches and virtual
switches.
Server Packet Analysis Sensors (SPAS)
256 MB + 500 MB per 100 Mbps

RAM
(256 MB recommended + 500 MB per 100 Mbps)
53
Remote computer port requirements
See Agent requirements.
Configure the SolarWinds Orion server to use the correct syslog port
By default, SolarWinds Syslog Service listens for syslog messages on port 514 (UDP). If your devices use a
different port for sending syslog messages, consider reconfiguring the port on devices, or change the port
on which the service listens.
Running the Configuration Wizard will revert all changes made to

the SyslogService.exe.config file.
If you run the Configuration Wizard, you must repeat this procedure to restore the port setting.
1. Log in to the Orion Web Console as an administrator.

2. Go to Advanced Configuration settings. Copy /Admin/AdvancedConfiguration/Global.aspx,
and paste it into your browser address bar, after /Orion.
The address in the address bar should look as follows:
<your product server>/Orion/Admin/AdvancedConfiguration/Global.aspx
3. On the Global tab, scroll down to SyslogService.SyslogSettings, and enter the UDP port
number in the UDPListenPort entry.
4. Click Save.
Server sizing
Listed from the most important to the least important are the primary variables that affect scalability.
Number of monitored elements
An element is defined as a single, identifiable node, interface, or volume. Systems monitoring more
than 10,000 elements may require tuning for optimal performance. Monitoring some node types,
such as routers, place more load on the system.
Polling frequency
If you are collecting statistics every five minutes instead of the default nine minutes, the system will
have to work harder and system requirements will increase.
Number of simultaneous users
The number of simultaneous users accessing SolarWinds Orion directly impacts system
performance.
54
Recommendations
When planning a SolarWinds Orion installation, there are four main factors that limit your polling capacity:
n CPU
n Memory
n Number of polling engines
n Polling engine settings
Be aware of these variables, and consider the following SolarWinds recommendations:
Install your SolarWinds Orion product and SolarWinds Orion database on different servers
If you plan to monitor 2,000 elements or more, SolarWinds recommends that you install your product
and your database on different servers. Separate servers for the product and the database improve
the performance, as the product server does not perform any database processing, and it does not
have to share resources with the database server.
Use additional polling engines for 10,000 or more monitored elements
If you plan to monitor 10,000 or more elements, SolarWinds recommends that you install additional
polling engines on separate servers to help distribute the work load.
For more information about sizing SolarWinds Orion to your network, view the Scalability Engine
Guidelines (PDF), contact the SolarWinds sales team, or visit www.solarwinds.com.
For minimum hardware recommendations, see Orion server hardware requirements.
SQL server configuration best practices

The standard SQL environment for Orion Platform products contains the following components:
n A dedicated SQL Standard or Enterprise Server

n Directly attached (DAS), RAID 10 storage (I/O subsystem)
n LAN attachment between the main Orion server and any additional components
If there are more databases on a given SQL server, it is strongly recommended that you use
dedicated hard drives for the tempdb database. Use at least one hard drive for data files, and one
hard drive for the transaction log. All databases use the same tempdb, therefore the tempdb can
be the biggest bottleneck in the I/O subsystem.
Maximizing SQL server performance
When planning your SQL server configuration, consider the following information:
n SQL Express is only suitable for small SolarWinds Orion installations without NTA. NetFlow can be a
major factor in database sizing, depending on the incoming flow rates.
n WAN connections should never be used between the SQL server and the SolarWinds Orion server.
This includes any additional pollers.
n Do not install the SQL server on the Orion server.
55
n The performance of the SQL server is dependent on the performance of the I/O subsystem.
n The more disks there are in a RAID 10 array, the better.
n Many RAID controllers do not handle RAID 01 well.
Hardware settings for SQL servers
The following section contains the recommended hardware settings for SQL servers, taking into account
different scenarios and the number of logical disks you use.
Recommendations for maximum performance
COMPONENT RECOMMENDATION
n A dedicated RAID 1+0 hard drive for data files (.mdf, .ndf).
Orion database n A dedicated RAID 1+0 hard drive with fast sequential writing for
transaction files (.ldf).

SQL Server temporary
n A dedicated RAID 1+0 hard drive with fast sequential writing for
directory (tempdb) database
SQL Server host system

n A dedicated hard drive of any type.
(Windows)
Recommendations for four HDDs

n A dedicated hard drive for data files (.mdf, .ndf) and the transaction
directory (tempdb)
log (.ldf)
database
SQL Server host system n A dedicated hard drive of any type. This hard drive should be the
(Windows) slowest of the four available disks.
Recommendations for three HHDs
56
directory (tempdb)
n A dedicated hard drive for tempdb data files (.mdf, .ndf), tempdb
database and
transaction log (.ldf), and host system.
SQL Server host system
(Windows)
Recommendations for two HHDs
n Use the disk with the faster sequential writing for the host system and for the transaction log files
(.ldf).
n Use the other disk for data files (.mdf, .ldf), for the tempdb data files, and for the tempdb log files.
Recommendations for multi-CPU systems and the optimal settings of the I/O subsystem
On multi-CPU systems, the performance of some operations can be increased by creating more data files
on a single hard drive.
Every logical CPU is considered to be one CPU.
The following example shows the original settings of a system with 16 CPU cores:
n One hard drive for data with the SolarWindsOrionDatabase.MDF file in the Primary filegroup.
n One hard drive for the transaction log with the SolarWindsOrionDatabase.LDF file.
n One hard drive for the tempdb data with the tempdb.MDF file in the Primary filegroup.
n One hard drive for the tempdb transaction log with the tempdb.LDF file.
The previous settings can be improved in the following way:
n One hard drive for data, with the following files in the Primary file group:
n SolarWindsOrionDatabase01.MDF
n One hard drive for the transaction log with the SolarWindsOrionDatabase.LDF file.
n One hard drive for tempdb data, with the following files in the Primary filegroup:
n tempdb01.MDF
n tempdb02.MDF
n tempdb03.MDF
n tempdb04.MDF
n One hard drive for the tempdb transaction log with the tempdb.LDF file.
n Having more files in the filegroup help the SQL server to distribute the load generated by
57
multiple threads while working with files.
n The recommended ratio between the number of cores and the files in the filegroup is typically
4:1 or 2:1 (for example, 16 cores and four files, or 16 cores and eight files).
n The size and growth setting for all files in a filegroup must be set to identical values in order
to distribute the load evenly.
n For the transaction log, it is not effective to create more files, because the SQL server can only
use the first file.
n For the tempdb database, a RAM disk or an SSD disk can be used.
n An SSD disk can be used for data files, but it is not effective for the transaction log where
sequential access is most important.
Database file setting recommendations
n Pre-allocate as much disk space as possible to save time.

n Define an absolute auto-growth setting with a reasonable size (500 MB, 1 GB, and so on), instead of
an auto-growth percentage.
Memory setting recommendations
n Do not reserve all memory to the SQL server, because this can lead to a lack of memory for the host
operating system.
n Reserve 1 GB of memory to the host operating system if there are no additional services running on
the given host system.
n If additional resource-intensive services are running on the host operating system, reserve sufficient
memory for the host operating system. SolarWinds does not recommend such configuration.
CPU setting recommendations
n Ensure that power-saving technologies are disabled on the CPU.
Security enhancements and exceptions for SolarWinds Orion Platform products

By default, SolarWinds Orion Platform products use the http protocol instead of https. You can increase
the security of your data by using SSL or FIPS.
n Enable secure channels with SSL

n Enable FIPS
For best performance, SolarWinds also recommends creating an antivirus directory exclusion for the
SolarWinds install folder.
Enable secure channels with SSL
SolarWinds Orion Platform products support the use of Secure Sockets Layer certificates to enable secure
communications with the Orion Web Console.
58
Requirements
l Your server must have the required SSL certificate installed.

l Conduct secure SSL/TLS communications over port 443.
Due to security concerns, SolarWinds recommends that you disable SSL v3.0 and earlier.
1. Add a binding to https port 443 for the SolarWinds NetPerfMon site. For more information, consult
the Microsoft online documentation on setting up SSL.
2. Enable the Orion Web Console for SSL.
3. You can also configure the Orion Web Console to require SSL.
Configure the Orion Web Console for SSL
1. Log in to your SolarWinds Orion server using an account with administrative rights.
2. Shut down all SolarWinds services. Start the Orion Service Manager in the SolarWinds Orion >
Advanced Features program folder, and click Shutdown Everything.
3. Start the Database Manager from the SolarWinds Orion > Advanced Features program folder.
4. Expand the SQL servers, and navigate to SQL Servers > your SolarWinds Orion database
server > SolarWindsOrion > Websites in the left pane.
n If your SQL Server is not listed in the left pane, click Add Default Server.
n If your Orion database is not listed in the left pane, add it:
a. Click Add SQL Server.
b. Using the format Server/Instance, select or provide the SQL Server instance you are
using as your SolarWinds Orion database.
c. Select the login method, providing credentials as required.
d. Click Connect to Database Server.
5. Right-click the Websites table, and click Query Table.
6. Replace the default query with the following query, and click Refresh.
UPDATE dbo.Websites SET SSLEnabled=1 WHERE WebsiteID=1
7. Switch to the Orion Service Manager, and click Start Everything.
8. Change the Orion Web Console port.
a. Start the Configuration Wizard in the SolarWinds Orion > Configuration and Auto-Discovery
program folder.
b. Select Website, and click Next on the Welcome window.
c. Enter the SSL port number, and click Next.
Port 443 is typically reserved for SSL traffic.
d. Review the configuration summary, and complete the Configuration Wizard.
Configure the Orion Web Console to require SSL
1. In a text editor, open the web console configuration file, web.config, on your primary SolarWinds
server.
59
The default location of web.config is C:\Inetpub\SolarWinds\.
2. In the <system.web> section, add the line:

<httpCookies requireSSL="true" />
3. Locate the line:
<forms loginUrl="~/Orion/Login.aspx" />
4. Edit it to <forms loginUrl="~/Orion/Login.aspx" requireSSL=”true” />.
5. To enable the HTTPOnly flag for added security, locate the <httpCookies> tag, and edit it to the
following:
<httpCookies httpOnlyCookies="true" requireSSL="true" />
6. Save and close web.config.
Enable FIPS
FIPS (Federal Information Processing Standard) defines security and interoperability standards for
computers used by the U.S. federal government.
Monitored nodes and network discoveries must use FIPS-compliant authentication and privacy or
encryption methods.
FIPS-COMPLIANT METHODS
Authentication SHA1
Privacy or encryption AES128, AES192, AES256
SolarWinds recommends that you install all FIPS-compliant SolarWinds software on FIPS-compliant
servers and maintain all non-compliant SolarWinds software on non-compliant servers.
1. Configure the Orion Platform product server for FIPS compliance. See the Microsoft Support
knowledge base for more information.
2. Start the SolarWinds FIPS 140-2 Manager (SolarWinds.FipsManager.exe).
By default, SolarWinds.FipsManager.exe is located in the Install_Volume:\Program

Files (x86)\ folder.
60
3. Read the welcome text, and click Next.
The SolarWinds FIPS 140-2 Manager will confirm that the current configuration of your SolarWinds
products is FIPS-compliant.
n If an installed Orion Platform product is not FIPS-compliant, click Close, remove any non-
compliant Orion Platform products from the FIPS-compliant server, and run the FIPS 140-2
Manager again.
n If FIPS 140-2 is disabled, select Enable FIPS 140-2, and click Next.
n If the FIPS Manager provides a list of objects or saved network discovery definitions that are
not FIPS-enabled, complete the following steps.
To refresh the list of non-compliant objects after editing the credentials, restart the FIPS
140-2 Manager.
n Click the non-compliant monitored node, and edit its Polling Method to be FIPS-
compliant.
a. Select SNMPv3 as the SNMP Version.
b. Select FIPS-compliant Authentication and Privacy/Encryption methods, and
provide the passwords.
c. Click Submit.
n Click the non-compliant network discovery, and edit SNMP credentials to be FIPS-
compliant.
a. Confirm that all SNMP credentials are SNMPv3. Delete or edit any credentials that
are not FIPS-compliant SNMPv3.
b. Confirm that all SNMP credentials use FIPS-compliant Authentication and
Privacy/Encryption methods, and provide the passwords.
c. Complete the Network Sonar Wizard using the updated credentials.
4. Click Restart now to restart all relevant SolarWinds services.
Antivirus directory exclusions
Ensure that all Orion Platform products have access to all required files by excluding the following
directory, listed by operating system, from antivirus protection.
n Do not exclude executable files.

n SolarWinds assumes that C:\ is the default install volume.
Windows 2008
C:\ProgramData\SolarWinds\
SolarWinds Orion Platform products licensing

Orion Platform products are licensed additively, in terms of monitored nodes.
For example, if you purchase SolarWinds NPM with an SL100 license and SolarWinds SAM with an AL50
license, use the following to calculate how many nodes or components you can monitor:
n The NPM SL100 license monitors up to 100 nodes.

n The SAM AL50 license monitors up to 50 nodes and/or components.
61
When you purchase both licenses, you can monitor the performance of both interfaces and applications on
a total of 150 unique nodes or components because the SAM license adds 50 to the 100 nodes allowed
with your NPM license.
For more information, see the administrator guide of your specific Orion Platform product.
Activate your SolarWinds license
When you install your Orion Platform product, you are prompted to provide your licensing information
(software license key and customer data), and activate your product.
To postpone the activation, click Continue Evaluation. You can activate the license later, with the
License Manager.
Activate licenses with Internet access
1. On the Activate Product window, select I Have Internet Access...

2. Find your activation key in the customer portal, and enter it in the Activation Key field.
a. Browse to https://customerportal.solarwinds.com, and then log in using your Customer ID
and password, or your individual user account information.
If you do not know your SolarWinds Customer ID and password or individual profile
details, contact Customer Support and submit a ticket.
b. Under the Licensing Management section on the top bar, select License Management.
c. Browse to the SolarWinds product, and click the plus sign next to the product to display your
activation key.
d. Copy your unregistered activation key for the SolarWinds product to the clipboard, and paste
it into the Activation Key field in the Activate window.
3. If you are using a proxy server to access the Internet, select I Access the Internet Through a Proxy
Server, and enter the proxy address and port number.
4. Click Next.
5. Provide your customer data, and complete the Activation Wizard.
62
Activate licenses offline
1. On the Activate Product window, select This Server Does Not Have Internet Access, and click Next.
2. To finalize your registration, click Copy Unique Machine ID.
3. Paste the data into a new document in a text editor, and save the text document.
4. Transfer the document to a computer with Internet access. For example, transfer the document to a
shared location.
5. Log in to the SolarWinds customer portal and find your activation key:
a. Browse to https://customerportal.solarwinds.com from a computer with Internet access, and
then log in using your Customer ID and password, or your individual user account
information.
If you do not know your SolarWinds Customer ID and password or individual profile
details, contact Customer Support and submit a ticket.
b. Click License Management.

c. Browse to the SolarWinds product, such as Network Performance Monitor, and click
Manually Register License.
d. Provide the Unique Machine ID you transferred earlier, and download your license key.
e. Transfer the license key to a shared location.
6. Return to the offline computer where you have been running the activation wizard, and browse to
the shared License Key File location from the Activate Product window.
7. Click Next to continue, and complete the Activation wizard.
License Manager requirements

ITEM REQUIREMENT
SolarWinds License Manager must be installed on the same computer as your installed
Install products.
location
You must install License Manager on a computer with the correct time.
For instant license management, the computer must have internet connectivity.
Connectivity You can also manage licenses using offline activation and deactivation. You must have
online access to the SolarWinds Customer Portal from another computer.
.NET
.NET 4.5
Framework
Operating
system For evaluation purposes:
n Windows 7 SP1
n Windows 8 (except for Standard edition)
63
ITEM REQUIREMENT
n Windows 8.1 (except for Standard edition)
n Windows 10
n Microsoft Internet Explorer 8 or later

n Microsoft Edge
Browser
n Firefox 44.0 or later
n Chrome 48.0 or later
Install License Manager
Install License Manager on the computer with SolarWinds products installed. The License Manager can
only license products on that computer.
You must install License Manager on a computer with the correct time.
1. Start the SolarWinds License Manager Setup in the SolarWinds program folder.
If problems with License Manager occur, or if or the computer does not have access to the
Internet, download and install the latest version of License Manager from
http://solarwinds.s3.amazonaws.com/solarwinds/Release/LicenseManager/LicenseManager.z
ip
2. Click Next to accept the SolarWinds EULA, and click Install.
Activate licenses with the License Manager
With the License Manager, you can manage licenses for multiple SolarWinds products.
1. Start the License Manager in your SolarWinds program folder.
If the License Manager is not installed on the computer, install it first.
2. Click Activate next to the SolarWinds product, and complete the Activation Wizard.
n Activate licenses with Internet access
a. On the Activate Product window, select I Have Internet Access...
b. Find your activation key in the customer portal, and enter it in the Activation Key field.
a. Browse to https://customerportal.solarwinds.com, and then log in using your
Customer ID and password, or your individual user account information.
If you do not know your SolarWinds Customer ID and password or individual
profile details, contact Customer Support and submit a ticket.
b. Under the Licensing Management section on the top bar, select License
Management.
c. Browse to the SolarWinds product, and click the plus sign next to the product to
64
display your activation key.
d. Copy your unregistered activation key for the SolarWinds product to the
clipboard, and paste it into the Activation Key field in the Activate window.
c. If you are using a proxy server to access the Internet, select I Access the Internet
Through a Proxy Server, and enter the proxy address and port number.
d. Click Next.
e. Provide your customer data, and complete the Activation Wizard.
n Activate licenses offline
a. On the Activate Product window, select This Server Does Not Have Internet Access, and
click Next.
b. To finalize your registration, click Copy Unique Machine ID.
c. Paste the data into a new document in a text editor, and save the text document.
d. Transfer the document to a computer with Internet access. For example, transfer the
document to a shared location.
e. Log in to the SolarWinds customer portal and find your activation key:
a. Browse to https://customerportal.solarwinds.com from a computer with Internet
access, and then log in using your Customer ID and password, or your individual
user account information.
If you do not know your SolarWinds Customer ID and password or individual
profile details, contact Customer Support and submit a ticket.
b. Click License Management.

c. Browse to the SolarWinds product, such as Network Performance Monitor, and
click Manually Register License.
d. Provide the Unique Machine ID you transferred earlier, and download your
license key.
e. Transfer the license key to a shared location.
f. Return to the offline computer where you have been running the activation wizard, and
browse to the shared License Key File location from the Activate Product window.
g. Click Next to continue, and complete the Activation wizard.
3. Provide your customer data, and complete the Activation Wizard.
Deactivate and reactive licenses
If you decide to move your SolarWinds product to another server, you must deactivate the license on the
original computer, and reactivate it on the server with the new installation.
You can deactivate and reuse the licenses to install product versions that were released during your
maintenance period. You cannot deactivate and reuse licenses to install products that were
released after your maintenance period expired. To license these products, you must renew your
maintenance or re-license your product.
65
Deactivate, move, and assign licenses online
1. Log in to the computer where the licensed SolarWinds product is installed.
2. Start the License Manager in the SolarWinds program folder.
3. Select the products you want to deactivate on this computer, and click Deactivate.
You can deactivate more than one product at the same time.
In certain products, you can deactivate licenses by using the internal licensing tool of the product.
4. Complete the deactivation wizard.
5. Log in to the computer on which to install your products, and begin installation.
6. When asked to specify your licenses, provide the information. The license you deactivated earlier is
assigned to the new installation.
Deactivate, move, and assign licenses offline
1. Log in to the computer where the licensed SolarWinds product is installed.
2. Start the License Manager in the SolarWinds program folder.
3. Select the products you want to deactivate on this computer, and click Deactivate.
You can deactivate more than one product at the same time. The deactivation file will contain
information about each product.
In certain products, you can deactivate licenses by using the internal licensing tool of the product.
4. Complete the deactivation wizard, and save the deactivation file.
5. Log in to the SolarWinds Customer Portal, and navigate to the License Management page.
6. Select your product instance, and click Deactivate License Manually.
7. In the Manage License Deactivation page, locate the deactivation file you created in License Manager,
and click Upload.
The deactivated licenses are now available to activate on a new computer.
The new License Manager tool allows offline deactivation with a created file that can be
uploaded to the Customer Portal.
8. Log in to the computer on which to install your products, and begin installation.
9. When asked to specify your licenses, provide the information. The license you deactivated earlier is
assigned to the new installation.
Upgrade and synchronize licenses
If you have changed how your product is licensed, such as by increasing the number of objects you can
monitor, use the License Manager to apply the change to your products.
1. Start the License Manager from the SolarWinds program group.
2. Click Upgrade in the Action column next to the products for which you want to upgrade the license
on this computer.
3. Complete the Activation Wizard.
66
Synchronize licenses to the Customer Portal
For most Orion Platform products licenses, you can synchronize the data on your Customer Portal with the
data in the License Manager.
Synchronizing can include:
n Updating the maintenance end date

n Registering the license again, if it was reset
License synchronization takes place automatically once a day. If the automatic synchronization does not
occur, or you want to update your licenses immediately, you can synchronize your installed licenses with
the SolarWinds Customer Portal:
1. Start the License Manager from the SolarWinds program group.
2. Select the product, and click Synchronize.
3. Click Synchronize again in the Synchronize Licenses window.
The License Manager synchronizes with the Customer Portal and any updates in the Customer Portal are
reflected in the License Manager.
Additional SAM technology requirements

SolarWinds recommends installing your SolarWinds product on one server, and installing the Orion
database on its own SQL Server. Installations of multiple SolarWinds SAM servers using the same database
are not supported.
SolarWinds does not support installing SAM on domain controllers.
SAM technology requirements
n Requirements for monitoring virtual servers

n Requirements for virtual machines and servers
n Asset inventory and hardware health monitoring requirements
n AppInsight for SQL requirements and permissions
n AppInsight for Exchange requirements and permissions
n AppInsight for IIS requirements and permissions
n Requirements for the Windows Scheduled Task Monitor
n SNMP requirements for monitored devices
n FIPS support
n Quality of Experience requirements
67
SNMP requirements for monitored devices
SolarWinds SAM can monitor the performance of any SNMPv1, SNMPv2c, or SNMPv3 enabled device on
your network. Consult your device documentation or a technical representative of your device
manufacturer to acquire specific instructions for configuring SNMP on your device.
Additional SolarWinds SAM requirements
Enterprise-level SolarWinds SAM deployments with the potential for more than 1,000 monitors may need
additional computing resources above the standards required for SolarWinds common components.
Asset inventory and hardware health monitoring requirements
Asset inventory data collection can be enabled for both physical and virtual assets and functions
independently of hardware health monitoring. This means you do not need to have hardware health
monitoring enabled to have inventory data collected and displayed.
The following hardware supports Asset Inventory data collection:
n Dell servers with OpenManage Server Administrator Managed Node v7.2 or later
n HP servers with HP System Insight Manager v6.2 or higher
n IBM server with IBM Director (Common Agent, v6.3 or higher)
n Additional hardware not listed here may be supported with a limited amount of information
returned from the polling process.
The Asset Inventory feature supports the following operating systems and protocols and does not count
against your SAM component monitor license. Additionally, these nodes must be managed by SAM to
enable collection of Asset Inventory data:
Operating System Protocol
Windows SNMP, WMI
Linux SNMP
AIX (v7 and higher) SNMP
VMware ESX/ESXi v4.x and v5.x n CIM

n VMware API
n SNMP for VMware nodes not polled via CIM or the
VMware API
VMware API for ESX/ESXi hosts polled via HTTPS

vCenter.
Third-party software required for Asset Inventory information
HP
68
n HP ESXi Offline Bundle
n HP Management Agents for VMware ESX 4.x Only (Not for ESXi 4.x)
n HP ESXi Offline Bundle for VMware ESXi 5.0
HP/VMware
n HP Insight Management WBEM Providers for ESXi 5.0
Dell/VMWare
n OpenManage Support for VMware ESXi 5.x
IBM
n IBM Director v6.2x
VMware
n HP Insight Management WBEM Providers for ESXi 5.0
n Dell OpenManage Support for VMware ESXi 5.x
AppInsight for SQL requirements and permissions
AppInsight for SQL supports the following versions of Microsoft SQL Server:
Microsoft SQL Server Version Versions Supported
Microsoft SQL Server 2008 Without SP, SP1, SP2, SP3
Microsoft SQL Server 2008 R2 Without SP, SP1, SP2 SP3
Microsoft SQL Server 2012 Without SP, SP1
Microsoft SQL Server 2014
Microsoft SQL Server 2016
AppInsight for SQL data is collected at the same default five minute polling interval as traditional
application templates. Following are the requirements and permissions needed for AppInsight for SQL.
Important: AppInsight for SQL does not require named-pipes. However, it does require TCP. For
example, SAM uses TCP detection during discovery. You may receive an error message pertaining to
"named-pipes." This is the result of the last client protocol that is tried during connection to the
SQL server.
AppInsight for SQL permissions
The minimum SQL permissions required to use AppInsight for SQL are as follows:
69
n Must be a member of the db_datareader role on the msdb system database.
n Must have VIEW SERVER STATE permissions.
n View any definition.
n Connect permission to Master database.
n Execute permission on the Xp_readerrorlog stored procedure.
n Connect permission to the Msdb database.
n Must be member of db_datareader role in the MSDB database.
n Connect permission to all databases.
Notes:
n AppInsight for SQL supports both the SNMP and WMI protocols and uses SQL to gather information
about the application. Additional information is available for nodes managed via WMI.
n Agents do not work with AppInsight for SQL when the SQL server being monitored is in a cluster.
n SQL clusters cannot be polled with domain credentials via the Orion Agent because Agents do not
work with AppInsight for SQL when the SQL server being monitored is in a cluster.
Important: This following scripts make changes directly to the database. You should create a
database backup before running either of these scripts.
The following script configures permissions for a SQL account:
USE master
GRANT VIEW SERVER STATE TO AppInsightUser
GRANT VIEW ANY DEFINITION TO AppInsightUser
GRANT VIEW ANY DATABASE TO AppInsightUser
EXEC sp_adduser @loginame = 'AppInsightUser' ,@name_in_db =
'AppInsightUser'
GRANT EXECUTE ON xp_readerrorlog TO AppInsightUser
USE msdb
EXEC sp_adduser @loginame = 'AppInsightUser' ,@name_in_db =
'AppInsightUser'
EXEC sp_addrolemember N'db_datareader', N'AppInsightUser'
The following script configures permissions for a SQL account with Windows Authentication:
USE master
GRANT VIEW SERVER STATE TO "Domain\AppInsightUser"
GRANT VIEW ANY DEFINITION TO "Domain\AppInsightUser"
EXEC sp_adduser @loginame = 'Domain\AppInsightUser' ,@name_in_db =
'Domain\AppInsightUser'
GRANT EXECUTE ON xp_readerrorlog TO "Domain\AppInsightUser"
USE msdb
EXEC sp_adduser @loginame = 'Domain\AppInsightUser' ,@name_in_db =
'Domain\AppInsightUser'
EXEC sp_addrolemember N'db_datareader', N'Domain\AppInsightUser'
EXECUTE sp_MSforeachdb 'USE [?]; EXEC sp_adduser @loginame =
70
''Domain\AppInsightUser'', @name_in_db = ''Domain\AppInsightUser'''
AppInsight for Exchange requirements and permissions
AppInsight for Exchange works only with the Mailbox Role, which is used for data storage. All other
Exchange servers running different roles should use the Exchange application templates included with
SAM if you intend to monitor them. Data is collected at the same default five minute polling interval as
traditional application templates.
Following are the requirements and permissions needed for AppInsight for Exchange:
Microsoft Exchange Versions Supported:
n Microsoft Exchange Server 2010

n Microsoft Exchange Server 2013
AppInsight for Exchange Requirements and Permissions
n Local administrator permissions are needed for automatic configuration, but they are not needed for
monitoring once configuration is complete.
n To provide organization-wide capability, the service account (Domain User) needs to be a member of
the View-Only Organization Management group. Membership to this group gives the user object
read-only access to the entire Exchange environment, without providing any domain or local access
on the Exchange server. It also prevents possible abuse by an unauthorized user accessing the
account (e.g. modifying Exchange environment configuration, creating or deleting users, and so on.)
n In order to gather information, the user object must be assigned the Mailbox Search management
role within Exchange. In order for the account to be configured correctly, the account must be a
member of the Local Administrators group.
Note: For Exchange access, this is not required, but in order to modify Exchange and WinRM settings
on the server, as well as to poll performance counters, this additional level of permission is required.
n For Mailbox statistics, Hub Transport Servers need to be accessed via RPC.
PowerShell Requirements
n Exchange 2010 must have PowerShell 2.0 installed

n Exchange 2013 must have PowerShell 3.0 installed
n Permissions must be granted for PowerShell to be accessed
n PowerShell 2.0 is required for Windows 2012 (regardless of Exchange version)
For information on configuring PowerShell permissions, see Set PowerShell permissions.
Common Configuration Issues
n To add local administrative privileges to an Active Directory account, see Non-Domain Account.
n To find Exchange URL settings, see Find Exchange URL settings.
n To install PowerShell on the Exchange server, see Non-Domain Account.
71
AppInsight for IIS requirements and permissions
AppInsight for IIS data is collected at the same default five minute polling interval as traditional
application templates. Following are the requirements needed for AppInsight for IIS:
AppInsight for IIS requirements and permissions
n PowerShell 2.0 or higher must be installed on the IIS server.

n Administrator rights or equivalent credentials to the IIS server bring monitored is needed for
configuration. Non-administrative permissions for polling and monitoring is only achievable using
the optional Orion Agent.
n IIS 7.0 or higher must be installed.
n AppInsight for IIS supports the following versions of Microsoft operating systems and their
respective IIS versions:
Microsoft OS Version IIS Version Supported

Microsoft Windows 2008 IIS 7.0
Microsoft Windows 2008 R2 IIS 7.5
Microsoft Windows 2012 IIS 8.0
Microsoft Windows 2012 R2 IIS 8.5
Notes:
n If any prerequisite is missing, the application goes into an Unknown state.

n Some resources may not function properly in Internet Explorer 8 or earlier. Consider upgrading
Internet Explorer or using an alternate web browser such as Firefox or Chrome.
AppInsight for IIS technologies and ports
The following table outlines the technologies and ports used by AppInsight for IIS:
The IIS server must have the ports open on the managed nodes.
Technology Port Notes
RPC TCP port 135 SAM uses this port to establish WMI/RPC connections to the remote
Endpoint computer. RPC is required for getting performance counters
Mapper information via the ASP.NET resource.
WMI TCP ports 1025 - By default, Microsoft Windows uses a random port from this range
5000 or TCP ports for WMI communications. The default port range differs based on
49152 - 65535 the operating system. You must create a firewall exception on the
remote computer.
PowerShell TCP port 5986 This is a secure listener hosted in the WinRM service.
72
HTTP TCP, At least one If the connection is not allowed, the HTTP Monitor is hidden.
port mentioned in
the bindings of a
site.
HTTPS TCP. At least one If the connection is not allowed, the HTTPS Monitor will be hidden.
port mentioned in
the secure bindings
of a site.
SSL TCP. At least one If the connection is not allowed, the SSL Certificate Expiration Date
port mentioned in Monitor will be hidden.
the secure bindings
of a site.
SMB TCP port 445 Used for Site Directory Information and Log Directory Information.
(Windows
Shares)
Requirements for the Windows Scheduled Task Monitor
The WSTM supports monitoring tasks on the following operating systems:
n Windows 2003 R2 SP2

n Windows 2008
n Windows 2008 R2
n Windows 2012
n Windows 2012 R2
When SAM is installed on Windows 2003 R2 SP2, scheduled tasks on Windows 2008 or later cannot
be polled by the Windows Scheduled Task Monitor (WSTM). Only tasks from root directory can be
monitored. The WSTM will not work for tasks from every level of the Task Scheduler Library.
SNMP requirements for monitored devices
SolarWinds SAM can monitor the performance of any SNMPv1-, SNMPv2c-, or SNMPv3-enabled device on
your network. Consult your device documentation or a technical representative of your device
manufacturer to acquire specific instructions for configuring SNMP on your device.
Notes:
n To properly monitor devices on your network, you must enable SNMP on all devices that are capable
of SNMP communications.
n Unix based devices should use the configuration of Net-SNMP version 5.5 or higher that is specific to
the type of Unix-based operating system in use.
73
n SolarWinds SAM is capable of monitoring VMware ESX and ESXi Servers versions 3.5 and higher with
VMware Tools installed on virtual machines. For more information about enabling SNMP and
VMware Tools on your VMware device, consult your VMware documentation or technical
representative.
n If SNMPv2c is enabled on a device you want to monitor, by default, SolarWinds SAM attempts to use
SNMPv2c to poll the device for performance information. If you only want SolarWinds SAM to poll
using SNMPv1, you must disable SNMPv2c on the device to be polled.
Scale SAM for larger environments
Stackable Yes. For SAM 6.2 and higher. Two polling engines can be installed on a single server.
Pollers
Available?
Poller Yes, for SAM versions 5.5 and higher

Remotability
Available? Poller remotability is a feature that enables the local storage, using MSMQ, of
up to ~1 GB of polled data per poller in the event that the connection between
the polling engine and the database is temporarily lost.
Primary Poller ~8-10k component monitors per polling engine.

Limits
25-50 concurrent Orion Web Console users.
Scalability One APE for every 8-10k component monitors.

Options
Maximum of 150k component monitors per primary SolarWinds SAM installation (i.e.
1 SAM server + 14 APEs).
For more information about licensing, see Why are you licensing by monitors instead
of by servers?
WAN and/or Minimal monitoring traffic is sent between the primary SAM server and any APEs that
Bandwidth are connected over a WAN. Most traffic related to monitoring is between an APE and
Considerations the SolarWinds database. Bandwidth requirements depend on the size of the
relevant component monitor. Based on 67.5 kB / WMI poll and a 5 minute polling
frequency, the estimate is 1.2 Mbps for 700 component monitors. For more
information, see How do SNMP and WMI polling compare?
WMI is best suited for environments where latency is < 100ms.
Other WMI Security Blog

Considerations
74
SAM licensing model detailed
The SolarWinds SAM license you purchase is based on the number of allowed assigned component
monitors. A component monitor provides a statistic that you want to monitor in SolarWinds SAM. You can
have as many application templates and assigned monitors as you need, as long as the number of
assigned component monitors does not exceed the license count.
If you have more assigned component monitors than allowed by your license, the monitors that exceed
your license limit are not activated, and their component statuses are changed to "Not Licensed." You can
either disable some assigned component monitors to reduce your total assigned monitor count, or contact
SolarWinds about upgrading your SolarWinds SAM license.
How is Available Questions Answers

SAM License Tiers
licensed?
By the AL150 (Up to What is a The value returned by a component monitor is a

number of 150 Component measurement of application health and availability that
Component Component Monitor? needs to be monitored. It can be a process, a service, a
Monitors Monitors) performance counter, a port, an URL, a User Experience
Monitor, a Nagios script, and so on. An application typically
AL300
consumes 15-25 component monitors.
AL700
The Windows Scheduled Task Monitor consumes five (5)
AL1100 component monitors per Windows server.
ALX AppInsight for SQL consumes 50 component monitors per

(Unlimited database instance.
component
AppInsight for Exchange consumes 50 component monitors
monitors
per mailbox role server.
with
standard AppInsight for IIS consumes 30 component monitors per
polling monitored IIS server.
throughput).
Why Monitor-based pricing is flexible. Monitor-based pricing
Component provides a good correlation of price to value.
Monitors,
and not
devices?
Is it always Technically, it is based on highest number of Nodes,

on Volumes, and Component Monitors (refer to NPM licensing
component for Node & Volume definition), but in almost every case,
monitors? Component Monitors is the highest factor. There may be
some instances where Volumes or Nodes would be the
highest factor.
75
Asset Inventory data collection
Asset Inventory data collection does not count against your SAM component monitor license.
Windows Scheduled Task Monitor
The WSTM consumes five (5) license units per node.
Agents
Agent software is free. You remain bound by the limits of the license you own regardless of how you poll
information, either via an agent or another protocol.
AppInsight for SQL
When using AppInsight for SQL, 50 component monitors count against your licensed number of
component monitors, per SQL instance.
AppInsight for Exchange
When using AppInsight for Exchange, 50 component monitors count against your licensed number of
component monitors, per Exchange Server.
AppInsight for IIS

When using AppInsight for IIS, 30 component monitors count against your licensed number of component
monitors, per monitored IIS server
Important: The example below illustrates a situation where you would have 40 available component
monitors available, but have surpassed your allowed number of 300 monitors by 60. The
discrepancy is caused by AppInsight application implementations. AppInsight applications are
licensed as 50 monitors per application and cannot be partially licensed, as is the case with typical
applications.
SolarWinds SAM licenses do not have to mirror the license count of any other installed SolarWinds
product. For example, you can install SolarWinds SAM with a 150 component license on a
SolarWinds NPM server with an unlimited node license.
76
See the available component monitors remaining in your license
1. Log on to the SolarWinds Web Console with an administrator account.

2. Click Applications.
3. Click SAM Settings.
4. Click SAM License Summary.
Note: As an alternative to the previous procedure, you can also click License Details in the Settings
page to view the used and available component monitors.
Licensing Information
n When using your Customer ID and password, you can use your individual profile information.
n You can get your license information from the customer portal using the customer portal link:
https://customerportal.solarwinds.com/ instead of support.solarwinds.com
n If you do not know your CustomerID and/or password, navigate to
http://www.solarwinds.com/support/ticket/serviceticket.aspx and request the desired information.
n To get your activation key, navigate to the Customer Portal and click License Management, then click
the plus sign [+].
Deactivation
If you have deactivation information, you should step through the deactivation process a second time. You
no longer need your Customer ID and password. You will prompted multiple times to confirm that you are
sure you want to deactivate your product.
License Paths
The License Manager only works for people under active maintenance and can be downloaded from the
customer portal. You can activate or deactivate your products using the License Manager, as well as see all
products you have installed on that computer.
Install and configure Server & Application Monitor

Before you begin:
n Confirm that you have designated a SQL Server database instance for SolarWinds SAM.
Notes:
n If you are using an existing database or SQL account, the user account needs only to be in the
db_owner database role for the existing database.
n Confirm that the IIS Manager is not open while the Configuration Wizard is running.
n Know the SQL Server instance, and credentials, you want to use to store network data.
Note: The selected instance must support mixed mode or SQL authentication with strong passwords.
A strong password must meet at least three of the following four criteria:
n At least one uppercase and lowercase letter, one number, and one non-alphanumeric
character, #, %, or ^.
n If you are using SQL Express, specify your instance as local and use a strong password.
77
n If you are creating a new database, the user account must be a member of the dbcreator server role.
The sysadmin role and the sa user account are always members of dbcreator.
n If you are creating a new SQL account for use with SolarWinds SAM, the user account must be a
member of the securityadmin server role.
Note: The sysadmin role and the system administrator user account are always members of
securityadmin.
SolarWinds recommends that you perform upgrades during off-peak hours of network usage to
minimize the impact of temporary polling stoppage.
Configure Server & Application Monitor
1. Click Start > All Programs > SolarWinds Orion > Configuration and Auto-Discovery > Configuration
Wizard.
2. Click Next on the Welcome window of the Configuration Wizard and complete the wizard as
instructed. If prompted to stop services, click Yes.
3. When prompted, specify both the port through which you want to access the web console and the
volume and folder in which you want to install the web console files.
Notes: If you specify any port other than 80, you must include that port in the URL used to access the
web console. For example, if you specify an IP address of 192.168.0.3 and port 8080, the URL used to
access the web console is http://192.168.0.3:8080. By default, you can log in with User Name
Admin and no password.
4. When complete, if you have not discovered your network devices and added them to the Orion
database, the Network Discovery Wizard starts.
Run SolarWinds SAM

1. Click Start > All Programs > SolarWinds Orion > Orion Web Console.
2. The SolarWinds Web Console is displayed. You can log in by default by entering the name Admin
and no password. Then click Login.
Perform common tasks

Refer to the following sections for instructions on common tasks.
n Monitor large directories

n Monitor a specific URL
n Monitor IIS application pools
n Scan for applications worth monitoring
78
Install, upgrade, and move SolarWinds Server &
Application Monitor
Before your installation, you need the following information to successfully complete the wizard:
n An account with local administrative privileges

n Microsoft Internet Information Services (IIS) installed
n The Express Install option is only available in the evaluation version. The Full Install version does not
include SQL server.
Install Server & Application Monitor
1. Using an account with local administrative privileges, log in to the SolarWinds server on which you
want to install SolarWinds SAM and launch the SolarWinds executable.
Note: To avoid permissions issues, this account should not be a domain account, and it should not
be subject to any local or group policy restrictions.
2. Start the wizard and install all required components if prompted.
3. Complete the wizard as instructed. When complete, navigate to Hostname/Orion in your web
browser. You should see the Login screen.
4. Enter Admin in the User Name field (leaving the Password field empty) and then click Login.
Uninstall SAM from your server

1. Click Start > Control Panel > Add or Remove Programs, and then click SolarWinds Orion Server and
Application Monitor, and then click Remove.
2. Complete the SAM uninstall wizard.
3. In the Add or Remove Programs window, click SolarWinds Job Engine..., click Remove, then complete
the uninstallation of the SolarWinds Job Engine.
4. Complete the uninstallation of the SolarWinds Orion Information Service.
5. Click Start > Run and then enter regedit, and then click OK.
6. Expand HKEY_LOCAL_MACHINE > Software then delete both the SolarWinds and the
SolarWinds.net folders.
Note: If you are uninstalling Orion SAM from a 64-bit computer, expand HKEY_LOCAL_MACHINE >
Software > Wow6432Node, and then delete both the SolarWinds and the SolarWinds.net folders.
79
7. Delete the following:
n The SolarWinds folder from the Program Files folder on your main volume. Typically, the
Program Files folder is located at C:\Program Files\.
n The SolarWinds folder from the Program Files\Common Files folder on your main volume.
Typically, the Common Files folder is located at C:\Program Files\Common Files\.
n The SolarWinds website directory. Typically, the SolarWinds website directory is located in
C:\Inetpub\.
n The SolarWinds folder from the All Users\Application Data\ directory. Typically, this
SolarWinds folder is located in C:\Documents and Settings\All
Users\Application Data\.
n Using your SQL Server tools, delete your Orion database. The Orion database is typically
named NetPerfMon, and it can be found in the Databases folder of your SQL Server
management application.
n Using your SQL Server tools, delete your Orion database user. The Orion database user can
be found by expanding Security > Logins in your SQL Server management application.
80
Administer and implement SAM technologies
SAM offers the following technologies and features:
n Run SolarWinds SAM

n Creating component monitors and templates
n Managing AppInsight Applications
n Managing Groups and Dependencies
n Managing Quality of Experience
n Monitor SNMP traps
n Deploying Agents
n Managing Alerts
n Managing Reports
n Navigate to AppStack
n Manage Asset Inventory
n Manage audit events
n Managing Hardware Health
n Managing Virtual Machines
n Managing Processes, Services, Tasks, and Events in Real Time
n Managing Syslog Messages
n Managing Custom Properties
n Manage the Desktop Notification tool
Manage Orion Web Console

The Orion Web Console is an integral part of the Orion Platform products and can be configured for
viewing from virtually any computer connected to the Internet. You can customize the Orion Web Console
for multiple users and store individually customized views as user profiles.
To customize the Orion Web Console, you need administrator rights.
To access the administrator functions, click Settings in the top right of Orion Web Console views.
Log in to the Orion Web Console
1. Launch the Orion Web Console using either of the following methods:
n Start Orion Web Console in your SolarWinds Orion program folder.
n Launch a browser and enter http://ip_address or http://hostname, where ip_address
is the IP address of your SolarWinds Orion server, or where hostname is the domain name of
your SolarWinds Orion server.
81
2. Enter the user name and password, and click Login.
Until you set a password, you can log in as Admin with no password. After your first login,
change the Admin password. See Change account passwords.
Customize the Orion Web Console
You need the Allow Administrator Rights privilege.
My Dashboards
My Dashboards provide menu bars with shortcuts to Orion Web Console views. The default menu bars
include Home, and a menu bar for each installed Orion Platform product.
Click My Dashboards to show the default menus.
You can customize views and labels offered in default menus for individual users.
82
If you do not need to see all items in menu bars, and prefer navigating to display items in a menu
bar, click My Dashboards > Collapse.
Customize My Dashboards
Menu bars available in My Dashboards depend on the settings in your user account.
1. Find out which menu bar is assigned to Home, Network, or other product-specific tab for your user.
See Specify My Dashboard menu bars for users.
2. Add an Orion Web Console view or an external web page to the menu bar. The change will concern
all users who access the menu bar from My Dashboards. See Add items to My Dashboards.
To add a link to a details view for an important device, go to the view, copy the URL, and add it
as an extra item to the view.
3. To provide access to a specific set of links for specific users, create a menu bar, add the links and
assign the menu bar as the Home tab for the user(s).
Specify My Dashboard menu bars for users
The items users see in My Dashboards and in Alerts & Activity are specified in their user accounts.
Improve performance by setting the Home Page View to a view with a limited number of resources
on it.
1. Click Settings > All Settings in the menu bar.

2. In the User Accounts grouping, click Manage Accounts.
3. Select a user, and click Edit.
83
4. Scroll down to Default Menu Bars and Views, and select top menu bars from the lists.
5. Select Yes for the items the user will see in the Alerts & Activity menu bar.
6. Select an item and use the arrows to change the order of menu bars. Select an item from the list to
specify the default Home page view.
7. Click Submit.
The user can now use the specified links in My Dashboards and Alerts & Activity menu bars.
Add items to My Dashboards
1. Click My Dashboards > Configure.

2. Click Edit for a menu bar.
84
3. Drag available items from the left-hand column to Selected Items on the right.
Hover over any view title to read the description.

To change the order of menu items, drag and drop items in the Selected column.
4. Click Submit to save your changes.
You can also add links to node details views for specific nodes, or to external Internet pages
as a menu item.
a. Click Add below the Available items list, provide a name, URL and description for the
menu item, and click add.
b. Drag the new item to the Selected items column.
Add menu bars
When you have a list of items you want users to access from My Dashboards, create a menu bar.

2. Scroll to the bottom of the page, and click New Menu Bar.
3. Name the menu bar.
4. Drag views from the Available items column into Selected items.
85
5. Click Submit.
The new menu bar is created. You can now assign it to users who will see the items in My Dashboards.
Change the Orion Web Console color scheme

2. In the Customize Navigation & Look grouping, click Color Scheme.
3. Select a color scheme, and click Submit.
Change the Orion Web Console logo
1. Create a graphic to replace the SolarWinds logo.
The SolarWinds banner file is 271x48 pixels.
2. Place your graphic in the images directory.

The default location of the directory is C:\Inetpub\SolarWinds\NetPerfMon\.
4. In the Product Specific Settings grouping, click Web Console Settings.
5. Ensure the Site Logo box is selected, and click Browse to navigate to your logo.
6. Click Submit.
Use Orion Web Console breadcrumbs
As you navigate Orion Web Console views, you can use breadcrumbs to the pick other views that are on the
same or higher navigational level as your current view.
You cannot view breadcrumbs in wizards, dashboards, or full-page resources such as All Active Alerts.
1. Click a breadcrumb to open the view.

2. Click > next to a breadcrumb to open a clickable list of all views at the same navigation level. For
example, if you are on a Node Details view, clicking > displays a list of other monitored nodes.
Only the first 50 monitored nodes, listed in alphanumeric order by IP address, are displayed.
86
Customize breadcrumbs
1. Click > at an appropriate level in the breadcrumbs to open the drop-down.
2. Click Customize This List.
3. Select an option from the menu, and click Submit.
All items in the customized list will be identical for the selected criterion.
Customize resources
Resource configuration examples
Several resources that may be selected from the Add Resources page require additional configuration.
Display a Network Atlas map in the Orion Web Console
Network maps created with Network Atlas can give a quick overview of your network. Add a Network Atlas
map on a view.
1. Open a view where you want to add the map, and click Customize Page.
2. Click the plus sign in the column to open the Add Resource dialog.
3. Enter map in the Search box, and click Search.
4. Select Map, and click Add Selected Resources.
5. Click Preview to preview the map, and click Edit to customize the resource.
6. Select a map.
7. Specify the Zoom percentage at which you want to display the map.
If you leave the Zoom field blank, the map displays at full scale, based on the size of the
column in which the map displays.
8. Click Submit.
The map is added to the view.
Display a list of objects on a network map
1. Open the view where you want to add the list of objects on a map, and click Customize Page.
4. Select List of Objects on Network Map, and click Add Selected Resources.
6. Select a network map from the list of maps, and click Submit.
The view will now include a resource listing objects on the selected map.
87
Display a custom list of available maps
Clicking a map in the list opens the map in a new window.
1. Open the view where you want to add the list of maps, and click Customize Page.
4. Select Custom List of All Maps, and click Add Selected Resources.
5. Click Preview to preview the resource, and click Edit to customize the resource.
6. Select maps you want to include in your maps list.
7. Click Submit.
Display the Worldwide Map
The worldwide map provides a quick geographical overview of your network at any level from global down
to street.
to street.
1. Open the view where you want to add the Worldwide Map, and click Customize Page.
4. Select Worldwide Map, and click Add Selected Resources.
5. Click Preview, and if the map looks correct, click Done.
You have now added the Worldwide map to the view. Customize the world map now.
1. Click Edit in the Worldwide Map resource title bar.

2. Provide a Title and Subtitle for the map.
Titles and subtitles can be entered as either text or HTML.
3. Enter a value for Height. The default is 400 px.

4. Click Set Location and Zoom Level if you want to change the default location (the center of the map)
and zoom of the map.
To set the default zoom and location manually, click Advanced, and enter the latitude and longitude
of the default location and the zoom level.
5. To filter the groups and nodes to be displayed, click Group and/or Nodes, and enter a SWQL filter.
Click Examples to see a few SWQL filter samples.
6. Click Submit.
Display events received during a given time period
1. Open the view where you want to add the events summary, and click Customize Page.
3. Enter event in the Search box, and click Search.
88
4. Select Event Summary, and click Add Selected Resources.
6. Select the time period for displaying events in Time Period.
7. Click Submit.
Specify user-defined links
You can copy URLs of external websites or customized views from preview pages, and copy them to the
User Links resource.
1. Open the view where you want to add the links resource, and click Customize Page.
3. Enter links in the Search box, and click Search.
4. Select User Links, and click Add Selected Resources.
6. Enter the following information for each link you want to define:
a. A link Name and the URL of your link.
b. If you want your links to open in a new browser window, select Open in New Window.
Https URLs are not supported.
7. Click Submit.
Specify Custom HTML
When you have static information that you want to provide in the Orion Web Console, add the Custom
HTML resource on a view. This resource can also provide quick access to customized views.
1. Open the view where you want to add the custom resource, and click Customize Page.
2. Click the plus sign in a column to open the Add Resource dialog.
3. Enter html in the Search box, and click Search.
4. Select Custom HTML, and click Add Selected Resources.
5. Click Preview to preview the resource, and click Edit in the resource.
6. Enter HTML formatted content as required.
7. Click Submit.
Filter nodes
The Orion Web Console can maintain a customizable node list for your network. Node lists can be
configured for specific views using SQL query filters.
1. Open the view where you want to add the node list, and click Customize Page.
3. Enter nodes in the Search box, and click Search.
4. Select All Nodes - Table, and click Add Selected Resources.
89
6. To filter your node list by text or IP address range, provide the text or IP address range by which you
want to filter your node list in the Filter Text field:
n Type Home in the Filter Text field to list all nodes with "Home" in the node name or as a
location.
n Type 192.168.1.* in the Filter Text field to list all nodes in the 192.168.1.0-255 IP address
range.
7. Select the property for the filter text provided above:
n If you typed Home in the Filter Text area, select Node Name or Location to list nodes with
"Home" in the node name or as a location.
n If you typed 192.168.1.* in the Filter Text area, select IP Address to list only nodes in the
192.168.1.0-255 IP address range.
8. To apply a SQL filter to the node list, enter an appropriate query in the Filter Nodes (SQL) field.
By default, node list resources are designed to sort nodes alphabetically by node caption. This
configuration cannot be overwritten using a SQL filter, so ORDER BY clauses included in SQL
filters are redundant and will result in Custom SQL filter formatting errors.
9. Click Submit.
Group nodes within a view
configured for specific views with node grouping.
4. Select All Nodes - Tree, and click Add Selected Resources.
6. Select up to three criteria, in specified levels, for Grouping Nodes within your web console view.
7. Select whether you want to put nodes with null values In the [Unknown] Group or ungrouped At the
Bottom of the List.
9. Click Submit.
Add a Service Level Agreement Line to charts (SolarWinds NPM)
The Orion Web Console can display a service level agreement (SLA) line on any Min/Max/Average bps
chart. When you add a customer property named "SLA" and populate the field with your device SLA values,
the Orion Web Console displays the appropriate line on your charts.
n Interface data is only available in SolarWinds NPM.
90
n The SLA line may not appear immediately. It may take several minutes for the change to be
detected by the Orion Web Console.

2. In Node & Group Management, select Manage Custom Properties.
3. Click Add Custom Property.
4. Select Interfaces as the custom property object type, and click Next .
5. Click SLA in the list of predefined Property Templates, make any required changes to the fields
displayed, and click Next.
6. Click Select Interfaces.
7. Select and add all interfaces to which you want to apply the same service level, and then click Select
Interfaces.
8. Enter the SLA value (in bps) in the SLA column for each interface you want to label with SLA values.
For example, type 1544000 for a T1 interface (1.544 Mbps) or 225000 for a serial connection
running at 225 Kbps.
9. To enter a different SLA value for a different set of interfaces, click Add More.
10. Click Submit.
Browse to the Interface Details view of one of the interfaces you edited. The SLA line displays on any chart
showing Min/Max/Average bps.
Filter nodes in resources using SQL queries
When you are managing or monitoring large numbers of network devices, node list resources can easily
become very large and difficult to navigate. Filters are optional SQL queries that are used to limit node list
displays for easier resource navigation. SQL queries can be made on any predefined or custom properties.
For more information about defining custom properties, see Create a custom property.
If you have upgraded to Orion Platform version 2015.1.x or later, your custom SQL or SWQL query or
filter may no longer work correctly. For a list of database changes from Orion Platform version
2014.2 to version 2016.1, including new tables, column changes, or data constraint or data type
changes, see the Database Changes spreadsheet.
1. Click Edit in any node list resource.

2. Provide an appropriate SQL query in the Filter Nodes (SQL) field, and click Submit.
SQL Query Examples
configuration cannot be overwritten using a SQL filter, so order by clauses included in SQL filters
are redundant and will result in Custom SQL filter formatting errors.
91
n Filter the results to only show nodes that are not Up:
Status<>1
The following are valid status levels:
o 0 = Unknown (current up/down status of the node is unknown)
o 1 = Up (The node is responding to PINGs)
o 2 = Down (The node is not responding)
o 3 = Warning (The node may be responding, but the connection from the server to the Node is
dropping packets)
l Only show Cisco devices: Vendor = 'Cisco'
l Only show devices in Atlanta. (using a custom property named City):
City = 'Atlanta'
l Only show devices beginning with "AX3-": Caption Like 'AX3-*'
l Only show Nortel devices that are Down:
Vendor Like 'Nortel*' AND Status=2
l Only show devices ending in '-TX':
Vendor Like '*-TX'
Specify what a Custom Object resource displays
Custom Object resources can display performance data for any monitored objects.
You can graph data for multiple objects on the same chart, such as memory usage on all storage devices.
The resource can include a sum of all the series.
1. Click Edit in the resource.

2. Edit the resource Title and Subtitle.
3. Select an object type in Choose Object Type.
4. Select objects to be displayed in the resource:
a. Click Select Object.
b. In the Group By: field, select a grouping criterion.
Defined custom properties are listed for all grouping types.
c. Select objects (either a group, or expand a group and select individual child objects), and click
the green arrow ( ) to move the objects into the pane on the right.
d. Click Submit.
The selected objects will appear on the Edit Custom Object Resource page, together with
appropriate options.
5. Select a Chart to include in your custom object resource.
6. If you want to automatically display nodes related to the current view, select the option in Select
Object.
7. To limit the number of data series in the resource, select Limit Series, and select the number of
series to allow.
8. Select whether or not you want to Show Sum in Data Series.
92
9. Select the Time Period and Sample Interval.
10. To automatically hide the resource when there is no data for it to report, select Yes for the Auto-Hide
Resource option.
11. Click Submit.
Customize charts in the Orion Web Console
Use the customization options available in the chart to customize the data, layout and time frame shown
by the chart.
Available customization options depend on the chart.
Drop-down customization options
Some charts have drop-down menus that include the following options:
n View chart data over the Last 7 Days or over the Last 30 Days
n Select Edit Chart or click on the chart to open the chart resort in a new tab.
n View Chart Data as an HTML format document
n View Chart Data in Excel to see chart data in an Excel™-compatible format
Edit Resource page
If a chart has an Edit button, click it to get to the Edit Resource page. Edit titles, time periods, or other
details, and click Submit to go back to the view and see the changes applied in the chart.
Titles and subtitles
You can customize the title and subtitle for the resource and for the chart.
To change the chart labels, click Advanced, and enter a text or variable that displays as the chart title
or subtitle.
The default for the chart subtitle is ${ZoomRange], which shows the selected zoom range.
Other options depend on the chart type.
Calculated series: Show a trend line
Select the box to display a trend line on the graph. This shows potential future results as
extrapolated from collected historical data.
The trend lines are intended only as approximate predictions of future data.
Calculated series: Show the sum of all data series
Select the box if you want to display the sum of all data series in the form of stacked bars or
lines.
93
Calculated Series: Show the 95th percentile line
Select the box to show the 95th percentile line. This is a well-known statistical standard used
to discard maximum spikes, based on 5 minute data samples. The calculation gathers these
values every 5 minutes for however long you select, throwing away the top 5% so as to yield the
95th percentile value.
Maximum Number of Items to Display:
Enter the highest number of items you want to display in this chart.
Time periods: Default zoom range
Select the default range of data to be displayed from the drop-down list.
Time periods: Amount of historical data to load
Select the amount of historical data to load from the drop-down list.
Time periods: Sample interval
Select the sample interval to be used from the drop-down list. Each sample interval is represented
on a chart by a single point or bar. Data within a selected sample interval is summarized
automatically.
Custom Chart page
Click Export or click the chart to open the Custom Chart page in a new tab. You can change the chart
settings and click Refresh to see the changes applied in the same tab.
If the chart has a drop-down menu, you can also access the custom chart page by selecting the Edit
chart option.
Title, Subtitle, Subtitle #2
Enter a title and optional subtitles to be displayed above the chart.
Time Period: Select a Time Period
Select the time period that you want the chart to cover.
Alternatively, you can enter a specific time period for the chart.
Time Period: Beginning Date/Time
Enter the start date and time for the chart in one of the formats shown. If you do not enter a time,
this will default to 12:00:00 AM.
Time Period: Ending Date/Time
Enter the end date and time for the chart in one of the formats shown. If you do not enter a time,
this will default to 12:00:00 AM.
94
Sample Interval
Select the sample interval. Each sample interval is represented on a chart by a single point or bar.
Data within a selected sample interval is summarized automatically.
Chart Size: Width
Enter a custom width, in pixels, for this chart. The default is 640.
Chart Size: Height
Enter a custom height, in pixels, for this chart. Enter 0 to maintain the original width/height ratio.
Font Size
Select the font size for the chart from the drop-down list.
Trend Line: Show Trend
Select the box to display a trend line on the graph. This shows potential future results as
extrapolated from collected historical data.
Due to the broad array of factors that can affect the performance of devices, trend lines are
intended as approximate predictions of future data only.
Display Chart Data: Raw Data
Click to display or save the data being used in this report as an xls file.
Display Chart Data: Chart Data
Click to display the data in this report as a HTML table in the web browser.
Customize views
Orion Web Console views are configurable presentations of network information that can include maps,
charts, summary lists, reports, events, and links to other resources.
Customized views can be assigned to menu bars. With NOC View Mode enabled, views may be optimized
for display in Network Operations Centers.
To make views and graphs larger for larger screens, resize the columns dynamically (drag the
division bars) and use your browser zoom controls, such as <Ctrl>+<+> in Chrome.
Create views
You can customize the Orion Web Console for individual users by creating views.
You need Administrator Rights for creating views.
Plan what should be on a view before you create it.
95
OPTION ACTION
Select the appropriate object type, such as nodes, interfaces,
Identify objects to see on the view.
groups, applications, and so on.
View information for all objects of the

Select a Summary view.
selected object type.
View details for a selected object. Select a Details view.
Select information about the objects

Select resources.
you want to see.
Divide the information into several

Enable Left Navigation.
tabs.
Optimize the view for large screens or

Create a Network Operations Center (NOC) view.
mobile devices.
Limit what devices should be displayed

Add a limitation.
on the view.
Access the view from the Menu Bar. Add the view into the menu bar.
Create views
Check out this video on creating a new view.
1. Log in to the Orion Web Console, and click Settings > All Settings.
2. Click Add New View in the Views grouping.
3. Name the view, and select the view type.
4. Click Submit.
You have now created an empty view. The Customize view page opens automatically. Add resources that
contain the information you want to see.
The Type of View affects how the view is made accessible to users, and your choice may not be
changed later. For more information, see Specify views for device types.
After you have created a new view, the Customize page opens. For more information, see Add resources
and columns to views, and define subviews.
96
Add resources and columns to views, and define subviews
Administrators can edit views on the Customize page for the view. Click Customize Page on the view, or
access the page through Manage Views.

2. In the Views grouping, click Manage Views.
3. Select the view, and click Edit.
Add resources to the view
Check out this video on adding and customizing resources.
1. On the Customize page, click + next to the column that you want to add the resources.
To open the Customize view page, click Settings > All Settings > Manage Views. Select the view,
and click Edit.
97
2. Select resources in the middle pane, and click Add Selected Resources.
You can limit offered resources by criteria in the Group by list, or search for a resource in the
Search box.
98
3. Use the arrow icons next to the columns to move resources between columns.
4. Click Done.

The view should now be populated with the resources you selected.
n Resources already in your view are not marked in the list. You can add a resource on a view
more than once.
n Some resources may require additional configuration.
n Several options on the Add Resources page are added to the list of resources for a page, but
the actual configuration of a given map, link, or code is not added until the page is previewed.
Add columns
Resources on views are divided into columns.
On the Customize Page, click Add New Column.
99
You do not have to add resources here. You can click Done, and drag resources between the
columns on the view.
Change column width
To change a column width, position the cursor between the columns and drag the column border to
achieve the appropriate width.
Move resources on views
To move resources within a column or between columns on a subview, drag the handle at the top of the
resource to the new location.
Divide content into subviews
If there is too much information on the view, group and divide resources into subviews.
1. On the Customize view, select Enable Left Navigation.
To open the Customize view page, click Settings > All Settings > Manage Views. Select the view,
and click Edit.
100
2. Click Add Tab.
3. Type a name for the new tab, and click Update.
4. Select an icon, and add resources.
101
5. Click Done.
To save space on the views, click the double arrow button to minimize subviews.
When you are done with your changes, click Preview, and then click Submit.
102
Creating a Custom Summary View
The Orion Custom Summary View enables you to create a fully customized object-based view composed
solely of resources you have selected. The following procedure creates a custom summary view in the web
console.
To create or edit a custom summary view in the web console:
1. Click Home > Custom Summary.

2. Click Edit in any Custom Object Resource.
3. Provide a Title and Subtitle for the selected Custom Object Resource.
4. Choose an object type from the Choose Object Type dropdown.
5. Click Select Object.
6. On the Select Objects window, use the Group by selection field, as appropriate, to filter the list of
monitored objects.
7. Select one or more object types on which to base the selected Custom Object resource, and then
click the green right arrow to move all objects of the selected type into the Selected Objects window.
8. Select one or more objects on which to base the selected Custom Object resource, and then click
Submit.
9. The fields displayed and information required depend upon the object type selected. Complete
these fields as appropriate and click Submit.
Note: For more information about customizing available resource types, click Help in the header of any
resource on the Custom Summary view, and then click the corresponding resource type.
Add external website views
You can select any external website and add it to the Orion Web Console as a view.
You need Administrator Rights.
1. Log in to the Orion Web Console and click Settings > All Settings in the menu bar.
2. In the Customize Navigation & Look grouping, click External Websites.
3. Click Add.
4. Provide a Menu Title. This will be used for the website in the My Dashboards menu bar.
5. If you want to include a heading for the view, provide an optional Page Title.
6. Provide the URL of the external website, in http://domain_name format.
7. Select the Menu Bar to which you want to add the website link.
See My Dashboards.
If you select Admin as the menu bar, the website will be available from My Dashboards >
Home for administrators.
8. Click OK.

9. Click Preview to see the external website in the Orion Web Console.
103
Optimize views for TV screens or mobile devices
A Network Operations Center (NOC) view provides a single page view of critical statistics that can fit on a
TV screen or a mobile device. If you define multiple subviews, they rotate automatically on the screen, each
subview available as a separate slide.
Headers and footers are compressed in NOC views, increasing the available space to display resources.
Enable NOC Views

You can configure any Orion Web Console view to appear in the NOC view form.

2. Open a view, and click Customize Page in the top right corner of the view.
3. Select Enable NOC view mode.
4. If the view contains several subviews, select the rotation interval for the subview.
To get a direct link to a NOC view, use the Link to NOC View link.
5. Click Done & Go to NOC View.

You have created a NOC version of your view with a compressed header and footer, and without the
left navigation area.
Customize NOC Views

To add resources, remove resources, or add subviews on a NOC view, click the top-right icon, and select
Customize Page.
Exit NOC Views

Click the NOC Settings icon, and select Exit NOC Mode.
You will return to the default view with the full header, footer and left navigation.
Manage NOC Views
You can display a list of all NOC views defined in your Orion to get a better understanding of your NOC
views. From the NOC views list, you can easily add, edit or manage your NOC views.
1. Click Settings > All Settings.

2. In the Views grouping, click Created NOC views.
You can view NOC views from any view. Click Customize Page, and click List of created
NOC views in the NOC view section.
3. Manage the NOC views:

n To add a new view, click Add New View.
n To edit a NOC view, select the view, and click Edit.
n To disable a NOC view and maintain the default view, select the view and click Disable NOC.
Display subviews
If more subviews are defined for the view, you can see white circles in the top right corner. The currently
104
active tab is displayed in orange.
To display a subview, click the circle.
Move resources in NOC Views

If you want to move resources within a NOC view, you turn on the drag&drop mode.
1. Click the Settings icon in the top right corner of the NOC view, and select Enable Drag&Drop / Pause.
2. Drag and drop resources within the selected pane.
3. When you have finished repositioning the resources, click the Settings icon again, and select Disable
Drag&Drop / Resume.
Change the NOC view logo

You can hide the default SolarWinds logo on the NOC view, or use a customized image in the top left
corner of your NOC views.
Logo requirements:
n Supported image formats: .png, .jpg

n Maximum resolution: 900x200 px
To use a customized logo on your NOC views:
1. If you already are in a NOC view, click the NOC Settings icon and select Customize NOC View Logo.
2. To hide the logo, clear the NOC View Logo option.
3. To change the logo:
a. Make sure that NOC View Logo is selected.
b. Click the Browse button for NOC View Logo and navigate to the appropriate logo image.
By default, the SolarWinds logo is used on NOC views. It is available as SW_NOClogo.png in
/NetPerfMon/images on your Orion server.
4. Click Submit to apply your changes in the view.
Limit objects on a view
As a security feature, administrators can limit which devices are displayed on a view.
1. Click Settings > All Settings in the menu bar, and click Manage Views in the Views grouping.
2. Select a view, and click Edit.
You can also open the Customize View page from the view, by clicking Customize Page.
3. On the Customize View page, click Edit in the View Limitation area.
105
4. Select the type of view limitation you want to apply, and click Continue.
ORION W EB CONSOLE VIEW LIMITATIONS
Single Network Node Group of Nodes System Location Pattern
Node Name Pattern System Name Pattern Single Interface (SolarWinds NPM)
Machine Type Pattern Group of Machine Types Interface Status (SolarWinds NPM)
Hardware Single Hardware Interface Alias Pattern (SolarWinds NPM)

Manufacturer Manufacturer
System Location System Contact Pattern Group of Interfaces (SolarWinds NPM)
System Contact IP Address Pattern Interface Name Pattern

(SolarWinds NPM)
Group of Volumes Device Status Interface Type (SolarWinds NPM)
Single Machine Type Single Group Group of Groups
Group Name Pattern
5. Provide or select strings or options to define the device types that you want to include or exclude
from the selected view, and click Submit.
The asterisk (*) is a valid wildcard. Pattern limitations restrict views to devices for which the
corresponding fields include the provided string.
Copy views
When you want to create multiple views based on the same device type, create one view, and use it as a
template to create other new views.

2. In the Views group, click Manage Views.
3. Select the view you want to copy, and click Copy.
4. Edit the copied view. See Edit views.
Delete views

2. In the Views group, click Manage Views.
3. Select the view you want to delete, and click Delete.
Specify views for device types
In the Orion Web Console, you can specify views displayed for each type of device you have on your
network, such as routers, firewalls, or servers.

2. In the Views grouping, click Views by Device Type.
106
3. Select a Web View for the individual types of devices currently monitored on your network.
4. Click Submit.
When you click a device now, the view specified for the device type will be displayed.
Export views to PDF
Many views in the Orion Web Console can be exported to portable document format (.pdf).
The Export to PDF feature requires IIS Anonymous Access. Confirm that the IUSR_SERVERNAME user
is in the local Users group on your Orion server.
1. Open a view, and click Export to PDF in the top right corner of the view.
2. If you are prompted to save the .pdf file, click Save.
3. Navigate to a location, provide a file name, and click Save.
Orion Web Console and chart settings
The Web Console Settings page allows an Orion Web Console administrator to customize the Orion Web
Console user environment.

2. In the Product Specific Settings grouping, click Web Console Settings.
3. When you finish configuring the settings, click Submit.
The following settings are configured on this page:
n Web Console settings

n Auditing settings
n Chart settings
n Discovery, Worldwide Map and Active Alerts Settings
Web Console settings
Session Timeout
Provide the amount of time, in minutes, that Orion Web Console waits through user inactivity before
the user is logged out.
Windows Account Login
Select whether you want to enable or disable automatic login with Windows Active Directory
Credentials. With this feature enabled, the user can log in automatically.
Page Refresh
Specify the amount of time that passes before an Orion Web Console view reloads automatically
107
Site Logo
Select the box, and provide a path to a banner graphic that appears at the top of every Orion Web
Console page. See Change the Orion Web Console logo.
NOC View Logo
Select the box, and provide a path to a banner graphic that appears at the top of every NOC view.
Site Login Text
Provide a text all Orion Web Console users will see before they log in. Fill in up to 3500 characters.
HTML tags are allowed.
Help Server
Provide the URL of the server where online help for Orion Platform products is stored. The default
location is http://www.solarwinds.com.
If you are in an Internet-restricted network environment but require access to online help,
download the entire online help, copy it to a web server, and change the Help Server URL to
that of the web server. You can download the online help from the documentation page for
your product at https://support.solarwinds.com/Success_Center.
Status Rollup Mode
Specify how the availability status of nodes in node trees or on maps is displayed in the Orion Web
Console.
n Mixed Status shows Warning ensures that the status of a node group displays the worst
warning-type state in the group. If none of the group members have a warning-typed state but
the group contains both up and down nodes, a Mixed Availability warning state is displayed for
the whole group.
Examples:
Critical + Down = Critical,
Critical + Warning = Critical,
Up + Down = Mixed Availability.
n Show Worst Status ensures the worst state in a node group is displayed for the whole group.
Examples:
Up + Down = Down
Unreachable + Shutdown = Shutdown.
108
Child Status Rollup Mode
Specify how the status of any single node on the node tree or on a map is displayed.
n Select Show Worst Status to ensure that the worst status of the node group is displayed for the
whole group (e.g. red if any of the nodes are down).
n Select Show Worst Status (Interfaces only) to ensure that the worst status of any of the
interfaces on a selected node is displayed. Only if you have SolarWinds NPM installed.
n Select Show Worst Status (Applications only) to ensure that the worst status of any of the
applications on a selected node is displayed.
n Select Show only ICMP Status to only display up/down status for monitored interfaces.
Child Status Display Mode
Select whether you want to use a static or blinking icon to display the status of the children of any
single node on the node tree or on a map. By default, Orion uses a static icon to display the status of
child objects.
Integration Tips
Specify whether you want to show or hide the list of products in the How SolarWinds Products Work
Together section of the Settings page.
Drag and Drop Views
Turn on or off the ability to drag resources around on views.
Auditing settings
Select Enable Audit Trails to keep a record of all actions taken by Orion Web Console users. Depending on
the number of technicians or the activity level of your installation, this may increase the storage needs of
your database.
Chart settings
Chart Aspect Ratio
Chart Aspect Ratio is the height/width ratio for web console charts. This ratio should be set between
0.25 and 3.0 to avoid erratic display problems, though the performance of individual systems may
differ.
Thumbnail Aspect Ratio
Thumbnail Aspect Ratio is the height/width ratio for chart thumbnails.
95th Percentile Calculations
95th Percentile Calculations adds annotation lines to charts at the entered percentile. This value is
normally set to 95. See 95th Percentile Calculations.
109
Maximum Number of Data Series Displayed on Chart
The Maximum Number of Data Series Displayed on Chart setting determines the maximum number
of data series that will display on a chart at the same time. The default value for this setting is 10.
Show Data Points on Lines
The actual data points that are used to create a chart may be shown by checking Show Data Points
on Lines.
Font Size
Font Size sets the default relative size, Small, Medium, or Large, of the text that is displayed within
charts in the Orion Web Console. This setting is independent of your browser settings. The font
settings in your browser will affect resource headers and some resource contents.
Discovery, Worldwide Map and Active Alerts Settings
Notify About New Removable Volumes
Select the box if you want to be notified when removable volumes are added to your network and
discovered during network discovery.
You should configure the default send email action to receive notifications.
See Discover and add network devices.
Automatic Geolocation
Select the box to enable automatic geolocation on worldwide maps.
Active Alerts Refresh
Specify how often the active alerts grid page is refreshed.
Active Alerts Settings
Select how frequently you want the active alerts resource to refresh. Any alerts that trigger within the
refresh interval appear when the grid refreshes.
Administrative functions
View secure data
Sensitive network information, such as community strings, logins, and passwords, is not viewable in the
Orion Web Console.
If you have secured your network, you can display secure data in the Orion Web Console.

3. In the Thresholds & Polling grouping, click Polling Settings.
4. Scroll down to the Calculations & Thresholds area, and select Allow Secure Data On Web (Advanced).
110
This setting does not affect the display of custom reports that you export to the web. See Creating
Reports in the Web Console.
Handle counter rollovers
Specify a method that decides what happens if a polled value is less than the previous polled value.
Orion Platform products are capable of handling either 32-bit or 64-bit counters.
By default, counters are assumed to be 32-bit.
32-bit counters have a maximum value of 232, or 4,294,967,296.
64-bit counters have a maximum value of 264, or 18,446,744,073,709,551,616.

4. Scroll down to the Calculations & Thresholds area, and select the Counter Rollover method.
n If you use 32-bit counters, select Method 1.
This method detects a rollover, and calculates based on it.
First, the method checks whether the device rebooted and reset its counters to 0. In this case,
the last value is 0.
When it is a real rollover, we take the maximum value of the 32 or 64 bit number, take the
difference between the maximum and the last polled value, and add it to the current polled
value: (MaxValue - LastPolledValue) + CurrentPolledValue
n If you use 64-bit counters, select Method 2.
When a rollover is detected, Orion drops the poll and takes a new sample within 20 seconds.
The new data point is stored, throwing the first data point away.
In memory, we have the value from the previous poll (A) and the LastPolledValue (B). Because B
< A, we detect counter rollover. Orion drops the last poll and does a fast poll within 20
seconds. The value stored in the database is calculated as C-B.
Orion fully supports the use of 64-bit counters, but these counters can exhibit erratic
behavior in some implementations. If you notice peculiar results, disable the use of 64-
bit counters for the problem device, and contact the device manufacturer.
Configure web proxy settings
If your SolarWinds Orion server does not have Internet access, you can use a proxy server to allow the
Orion server to connect to certain pages and websites. Use a proxy server to:
n Access the thwack community

n Access the product blog
n Check for maintenance updates
n Access the ServiceNow® instance you integrated with your SolarWinds Orion server. For information
about integrating SolarWinds Orion with ServiceNow, see Integrate an Orion Platform product with
ServiceNow.
111
112
To configure web proxy settings:
1. In the Orion Web Console, click Settings > All Settings > Product specific settings > Proxy Settings.
2. Select Use the following settings, and specify the IP address and port number of the proxy server.
3. If the proxy server requires authentication, select the check box, and specify the user name and
password.
4. Enter a URL, and click Test connection to verify that you can reach the destination address through
the proxy.
5. Click Save.
Manage Users
Manage Orion Web Console user accounts
Users need an Orion Web Console account to perform actions in your SolarWinds product, such as
acknowledging alerts. Default account views and privileges are assigned in the account manager.
You may not need to grant all users accounts if they only need to review reports or access views. See Share
views with non-Orion Web Console users for more information.
Add users individually, add group accounts, or use Active Directory accounts. If a user is in multiple group
accounts, the permissions of the group highest on the Groups tab of the Account Manager are applied to
the user. By default SolarWinds uses MSAPI to authenticate Active Directory users, but you can
authenticate users with LDAP.
To prevent issues with accounts, make sure that your SQL Server does not have the no count
connection option enabled.
Create users
Check out this video on account permissions and limitations.
Before you begin, consider what tasks the user must perform, and what views and menu bars are most
suitable.
Users created using default settings can log in to the Orion Web Console and see information available in
views, resources, and reports. For administration and customization tasks, users need extra rights.
ACCESS
TASK
(SELECT YES FOR THIS OPTION OR DO AS INSTRUCTED)
Add and edit user accounts and reset passwords.
SolarWinds recommends that you do not Allow Administrator Rights

allow users to change their own Orion
Web Console account passwords.
113
ACCESS
TASK
Add, edit, and delete nodes. Allow Node Management Rights
Enable/disable monitoring elements. Allow Account to Unmanage Objects
Add, edit, schedule, and delete reports. Allow Report Management Rights
Allow Alert Management Rights
Add, edit, and delete alerts. To only allow some actions, keep No in Allow Alert
Management rights and Allow items in the Alerts
section as appropriate.
Customize views. Allow Account to Customize Views
Access only a set of devices (type, location,

Click Add Limitation and define the limitation.
department, and so on).
2. Click Manage Accounts in the User Accounts grouping, and click Add New Account on the Individual
Accounts tab.
3. Select Orion individual account, and click Next.
4. Provide the account credentials, and click Next.

5. On Define Settings, provide rights so that the user can perform assigned tasks, select default views
and menu bars, and then click Submit.
The user account is listed in the Individual Accounts tab.
114
Create users based on existing Active Directory or local domain accounts
Users can use their existing Active Directory credentials to log in to the Orion Web Console, so you do not
need to manage an extra user account.
n You must enable Windows Account Login in the Orion Web Console.
1. Click Settings > All Settings, and in Product Specific Settings, click Web Console Settings.
2. In Windows Account Login, select Enable automatic login, and click Submit.
n To maintain administrative privileges, individual and group Windows user accounts must be
defined in the same domain as the SolarWinds server they can access.
n Only Security AD groups are supported. Distribution Groups are not supported.
1. Log in to Orion Web Console, and click Settings > All Settings.
2. Click Manage Accounts in the User Accounts grouping, and click Add New Account.
3. Select Windows individual account or Windows group account, and click Next.
4. Provide the credentials for an account with administrative access to the Active Directory or local
domain, and click Next.
115
5. If a system account is available, you can use it. Select Use [Account Name] account to access Active
Directory or Local Domain, and click Test Active Directory.
You may need to specify the credentials manually.
6. To specify the credentials manually, select Specify credentials to access the Active Directory or Local
Domain, and provide the credentials.
7. Search for the Active Directory or local domain account.
To search for all users or groups in the domain, enter domain name\* and click Search.
8. Select the appropriate users in the Add Users area, and click Next.
9. On Define Settings, provide rights so that the user can perform assigned tasks, select default views
and menu bars, and then click Submit.
Users can now log in to the Orion Web Console using their local domain or Active Directory credentials.
If you use Active Directory, users can also automatically login with their Windows credentials.
Change account passwords
When you Server & Application Monitor Getting Network Performance Monitor Getting
log in to the Started Guide Started Guide
Orion Web User accounts User accounts
Console for How user accounts work How user accounts work
the first time, Create a user Create a user
SolarWinds Enable Active Directory Windows Use Active Directory credentials
recommends authentication for users
that you Change account passwords Change account passwords
change the
password for the Admin account.
Only users with administrator rights can change the password.
2. Click Manage Accounts in the User Accounts grouping.
116
3. Select a user, and click Change Password.
4. Enter and confirm the new password, and click Change Password.
Enable users to authenticate through LDAP
You can choose to have all of your AD users authenticate through LDAP. The SolarWinds Orion server does
not need to be added to the Windows domain with this authentication method.
We do not support Anonymous authentication through LDAP.

3. Click Advanced AD Settings in the User Accounts grouping.
4. Toggle Authenticate Active Directory Users via LDAP.
5. Enter your LDAP server information and select the authentication method that matches what is used
in LDAP.
Click Discover DN to fill in the distinguished name (DN) of the AD domain automatically. If the
DN field does not populate, verify that the Directory Server Address is correct.
Windows individual accounts now use LDAP. If you created Orion Web Console accounts that use Active
Directory or local accounts and those accounts cannot authenticate through LDAP, those accounts cannot
login.
If you disable this selection, Windows users or group members created while it was enabled cannot login.
Define what users can access and do
Each user or group account can have different privileges applied to it, such as the ability to modify alert
definitions or delete nodes.

4. Select an account, and click Edit.
117
5. Specify the login options.
LOGIN OPTION SETTING
Set Account Enabled to Yes.

Disabling an account does not delete it. Account
Should the user be able to log in immediately? definitions and details are stored in the
SolarWinds Orion database and can be enabled
later.
Should the user be able to log in only

Specify the expiration date.
temporarily?
Select Yes for the Disable Session Timeout

option. Session timeouts are global and set in
Should the user be logged in indefinitely even Web Console Settings.
if the browser is closed?
By default, new user accounts are configured to
timeout automatically.
118
6. Specify what tasks the user should be able to do.
ACCESS
TASK
Add and edit user accounts and reset

passwords. Allow Administrator Rights
SolarWinds recommends that you Granting administrator rights does not assign the
do not allow users to change their Admin menu bar to a user. For more information, see
own Orion Web Console account Set default menu bars and views for users.
passwords.
Add, edit, and delete nodes. Allow Node Management Rights
Create, edit, and delete maps in the

Network Atlas. Allow Map Management Rights
Allow Report Management Rights

Add, edit, schedule, and delete reports. To only allow access to some reports, select the report
category the user can access.
Allow Alert Management Rights
To only allow some actions, keep No in Allow Alert
Management rights and Allow items in the Alerts
Add, edit, and delete alerts. section as appropriate.
To only access some alerts, select the category the
user can access, or No Limitation.
Allow Account to Customize Views

Customize views. By default, customized view creation is not allowed.
Changes made to a view are seen by all other users
that have been assigned the same view.
Enable/disable monitoring elements. Allow Account to Unmanage Objects
Acknowledge and clear events, advanced Allow Account to Clear Events, Acknowledge Alerts and
alerts, and Syslogs. Syslogs.
7. If you want the user to use additional browser functions, such as right-click menu options, set Allow
Browser Integration to Yes.
Right-click menu options also depend on installing the SolarWinds Desktop Toolset and
running the Toolset Integration Tray application on each client computer.
8. Provide the maximum Number of Items in the Breadcrumb List.
To show all available items in breadcrumb drop-downs, set this option to 0.
9. Click Submit.
New account settings are applied when a user next logs in.
The user account also controls the default menu bars and views, and how much of your network they can
access through the Orion Web Console.
119
Set default menu bars and views for users
on it.

7. Click Submit.
New account settings are applied when a user next logs in.
120
You can set default view for feature-specific views, such as hardware health or F5, or for product-specific
view, such as VSAN or Application Details.
Limit users to specific network areas
Account limitations ensure that Orion Web Console users only view the network objects that are relevant to
their job duties.
You can use account limitations in the following ways:
n Limit customer views to specific network nodes

n Limit views by department or functional area
n Limit views by device type or device role
n Limit views based on the geographic location of devices
Predefined account limitations use built-in SolarWinds Orion properties to limit user access. For greater
flexibility, you can create your own account limitations in the Account Limitation Builder, based on custom
properties.
Restrict user access to network areas by applying limitations
Account limitations restrict user access to specific network areas or withhold certain types of information
from designated users.
To limit user access, apply a limitation on the user account, and specify the network area the user can
access. Depending on the limitation, you can use logical operators and wildcards.
Pattern limitations can have a negative impact on performance and are error prone.
If the default limitations are not enough, you can create limitations based on custom properties, and
apply them on user accounts.
n Group limitations are not applied until after the group availability is calculated.
n Because SolarWinds NetFlow Traffic Analyzer (NTA) initially caches account limitations, it may
take up to a minute for account limitations to take effect in SolarWinds NTA.

4. Edit an individual or group account.
a. Click Add Limitation in the Account Limitations section.
b. Select the type of limitation to apply, and click Continue.
c. Define the limitation, and click Submit.
The limitation will be added to the Edit Account page.
5. Click Submit.
When the user logs back in, the account respects the limitations applied to it.
121
Patterns for limitations
When restricting user access to network areas, you can specify the limitation with patterns using OR, AND,
EXCEPT, and NOT operators with _ and * as wildcards if the limitation allows pattern matching.
Patterns are not case sensitive.
You may also group operators using parentheses, as in the following example.
(*foo* EXCEPT *b*) AND (*all* OR *sea*) matches seafood and footfall, but not football
or Bigfoot.
Create limitations based on custom properties
You can define the part of a monitored network that users can access based on custom properties, and
create custom limitations. Custom limitations are added to the list of available limitation types that you can
apply on individual user accounts. After you create the limitation, you must edit accounts to use the
limitation, and then select how the account is restricted.
n Before you start, plan how you want to limit the user access, and create custom properties.
n This procedure requires access to the computer that hosts the SolarWinds Orion server.
1. Click Start > All Programs > SolarWinds Orion > Grouping and Access Control > Account Limitation
Builder.
2. Click Start on the splash screen.
3. Click Add Limitation.
4. Select a Custom Property. The fields are populated automatically based on your selection.
5. Choose a Selection Method.
This is the selection format that will appear when you are choosing values for the account
limitation in the Orion Web Console.
Pattern matching is the most powerful selection, but it is also the selection most prone to
errors when restricting access and impacts performance.
6. Click OK.
Your account limitation is added to the top of the table view. You may now apply the limitation on user
accounts to restrict user access to monitored objects in the Orion Web Console.
Delete account limitations
Deleting a limitation makes it unavailable for future use in the Orion Web Console. If the limitation is
applied to user accounts, the accounts will remain limited.
This procedure requires access to the computer that hosts the SolarWinds Orion server.
1. Start the Account Limitation Builder in the SolarWinds Orion > Grouping and Access Control program
folder.
122
2. Click Start on the splash screen.
3. Click the row of the limitation that you want to delete.
Use <Shift+Click> to highlight multiple consecutive rows or <Ctrl+Click> to highlight multiple

non-consecutive rows.
4. Click Edit > Delete Selected Limitations.
The limitation is now unavailable for limiting user accounts in the Orion Web Console.
Configure automatic login
You can log in automatically to the Orion Web Console using any of the following methods.
Use a Windows Active Directory Account
Create users based on active directory or local domain accounts, and enable automatic login for
users logged in to the server. See Create users based on existing Active Directory or local domain
accounts.
Windows authentication must be enabled in the Configuration Wizard and the Web Console
Settings. See Enable Windows Authentication with Active Directory.
Automatically log in with Windows Pass-through Security
Users can be authenticated through Windows Security, with no need to log in with separate
credentials. For more information, see Log in with Windows pass-through security.
Share content to non-SolarWinds users with the DirectLink account
If the DirectLink account is active, any URL referring directly to an Orion Web Console page will
bypass the login page by logging the user into the DirectLink account. See Share views with non-
Orion Web Console users.
Pass-through user credentials in a URL
See Automatically login by passing your credentials through the URL.
Users are authenticated in the following priority:
1. Windows Active Directory Authentication when enabled

2. The Account or User ID and Password passed on the URL
3. The Account or User ID and Password entered on the login.aspx page
4. The Windows User if Pass-through Security is enabled
5. The Windows Domain to which the User belongs, for example, Development\Everyone
6. A DirectLink Account
Enable Windows Authentication with Active Directory
The Orion Web Console can authenticate Active Directory users and users who are members of Active
Directory security groups by using MSAPI or LDAP. By default, Windows individual or group accounts use
MSAPI to authenticate accounts.
123
You can only use one authentication protocol at a time. All Windows accounts are authenticated through
MSAPI or LDAP, depending on which one is enabled.
SolarWinds offers a free analyzer tool for Active Directory that provides instantaneous visibility into
effective permissions and access rights. The tool provides a complete hierarchical view of the
effective permissions access rights for a specific file folder (NTSF) or share drive. Download it for
free from here: http://www.solarwinds.com/products/freetools/permissions_analyzer_for_active_
directory/.
Authenticate users through MSAPI
1. Enable the Orion Web Console to use automatic Windows Authentication.
program folder.
b. Select Website, and click Next.
c. Provide the appropriate IP Address, Port, and Website Root Directory, and select Yes - Enable
Automatic Login Using Windows Authentication.
d. Click Next, and complete the Configuration Wizard.
2. Log in to the Orion Web Console using the appropriate domain and user, providing Domain\User
name or Username@Domain as the User Name.
3. Run the Configuration Wizard and enable Windows authentication.
4. Login to the Orion Web Console, and navigate to Settings > All Settings. In Web Console Settings,
select Enable automatic login in the Windows Account Login drop-down.
Supported Active Directory Scenarios
The following Active Directory login scenarios are supported for SolarWinds products using the latest
version of the Orion Platform.
NETWORK ATLAS AND

WEB CONSOLE LOCAL LOGIN UNMANAGE
SCENARIO
LOGIN SUPPORTED? REQUIRED? UTILITY LOGIN
SUPPORTED?
Login with "Orion Server" domain
No
AD account
Yes LogonFallback must Yes
be enabled.
Group AD account
124
NETWORK ATLAS AND
WEB CONSOLE LOCAL LOGIN UNMANAGE
SCENARIO
LOGIN SUPPORTED? REQUIRED? UTILITY LOGIN
SUPPORTED?
Login with trusted domain AD user
Login with trusted domain AD

Group User

Group AD account (group user
belongs to trusted domain)1
Login with trusted domain Group No

AD account (group user belongs to No
"Orion Server" domain)2
Yes, when LDAP is N/A

Login with AD user or Group user enabled
from a foreign AD forest No, without an
Additional Website3
Notes:
1. Use a group account from the domain where the Orion Platform product server is located. This
group contains a user from the trusted domain. Log in with this user.
2. Use a group account from the domain where the Orion Platform product server is located. This
domain is trusted by the domain in which the Orion server is located. This group contains a user
from the domain of the Orion server. Log in with this user.
3. Active Directory authentication is performed by the web service. If you need to authenticate users
from an AD forest other the one to which your primary SolarWinds server belongs, you must have an
Additional Web Server in the AD forest wherein the users to be authenticated exist.
Enable LogonFallback
LogonFallback must be enabled when the Active Directory user of the Orion Web Console does not have
local login rights to the web server.
1. Locate the file web.config on the server hosting your Orion Web Console.
The default location is c:\inetpub\SolarWinds\.
2. Create a backup of web.config.
3. Locate row <add key="LogonFallback" value="false" />.
4. Set value="true".
125
5. Save web.config.
6. Restart your SolarWinds website in Internet Information Services Manager.
Log in with Windows pass-through security
To authenticate users through Windows pass-through security, IIS NT Security must be enabled on your
server.
Pass-through security can be configured to employ Domain security, Local computer security, or both
Domain and Local computer security at the same time.
The Orion Platform account credentials must match the credentials used for the Domain or Local computer
security.
n This procedure requires access to the computer that hosts the SolarWinds Orion server.
n When authenticating users with Windows Security, ensure your Orion server uses the NetBIOS
domain name, instead of the fully qualified domain name.
1. If you are using NT Domain Authentication Format for pass-through accounts, create these pass-
through accounts in the Orion Web Console Account Manager using Domain\UserID as the User
Name. For example:
n Washington\Edward
n StLouis\Bill
2. If you are using Local Computer Authentication Format for pass-through accounts, create these
accounts in the Orion Web Console Account Manager using Computer\UserID as the User Name. For
example:
n SolarWindsS2\Edward
n Server3\JonesR
3. Start the Internet Information Services Manager, enable Windows Authentication for the SolarWinds
NetPerfMon website, and restart Internet Services.
Log in to the Orion Web Console using the Windows account credentials you have already established.
Share views with non-Orion Web Console users
Any URL referring directly to a Orion Web Console page bypasses the login screen, logging the user into
the DirectLink account. If the DirectLink account does not exist, users are directed to the login page.
n The DirectLink account is created like any other account, and it can include custom views and
account limitations.
n If you embed a view in another website, you may need to either disable cross-frame (X-Frame)
protection in your IIS configuration, or add the website to the X-Frame-Options header in IIS.
SolarWinds enables cross-frame protection by default to decrease security risks. Consult
microsoft.com for more information.
126
4. Click Add New Account.
5. Type DirectLink as the User Name.
6. Type a Password, confirm it, and click Next.
7. Edit DirectLink account options. See Define what users can access and do.
8. Click Submit.
Users can now look at views without an account on the Orion Web Console.
Automatically login by passing your credentials through the URL
Create a favorite or bookmark that includes your Orion individual account user name and password as
parameters within the URL.
HTTP requests are not encrypted, so account information sent in HTTP requests are not secure. For
more information about enabling HTTPS on your Orion Platform product server, consult
www.microsoft.com.
Create a favorite with a link in the following form to pass the login information:
http://DOMAIN/Orion/Login.aspx?AccountID=USER&Password=PASSWORD
Provide the hostname or IP address of your SolarWinds Orion server as the DOMAIN. Provide your Orion
user name as the USER, and then provide your Orion user account password as the PASSWORD.
127
Discover and add network devices
When you install your Orion Platform product, you must identify the devices you want to monitor, and add
them to the SolarWinds Orion database.
l To automatically discover and add a larger number of devices across your enterprise, use the
Network Sonar Discovery and Network Sonar Results Wizards.
l To add individual objects for monitoring, add single nodes using Node Management in the Orion
Web Console.
128
Discover your network with the Discovery Wizard
Check out this video on object discovery.
Before you begin:
n Enable the networking devices you want to monitor for SNMP.

n Enable Windows devices for WMI.
The first time you discover your network, SolarWinds recommends adding a limited number of edge
routers or switches, firewalls and load balancers (if you have them), and critical physical or virtual servers
and hosts.
Add nodes with high latency one at a time.
1. If the Discovery Wizard does not start automatically after configuration, click Settings > Network
Discovery.
2. Click Add New Discovery, and then click Start.
3. On the Network panel, if this is your first discovery, add a limited number of IP addresses.
As you scale your implementation, you can use the following scanning options.
Option Description
Use this option when you want Orion to scan one or more IP ranges.
IP Ranges If you have many IP ranges to scan, consider adding multiple discovery jobs rather
than including all ranges in a single job.
Use this option to scan every IP address in a subnet. SolarWinds recommends

scanning at most a /23 subnet (512 addresses max).
Subnets
Scanning a subnet returns everything that responds to ping, so we recommend only
scanning subnets where the majority of devices are objects you want to monitor.
Use this option for a limited number of IP addresses that do not fall in a range.
IP
Since a network discovery job can take a long time to complete, SolarWinds
Addresses
recommends using this option when you are first starting out.
Use this option to scan an Active Directory Domain Controller.
Active Using Active Directory for discovery is particularly useful for adding large subnets
Directory because Orion can use the devices specified in Active Directory instead of scanning
every IP address.
129
4. If the Agents panel appears, you enabled the Quality of Experience (QoE) agent during installation.
The QoE agent monitors packet-level traffic. If there are any nodes using agents, select the Check all
existing nodes check box.
This setting ensures that any agents you deploy, including the one on your Orion server, are up-to-
date. If there are no nodes using agents, you can leave this option unchecked.
5. On the Virtualization panel, to discover VMware vCenter or ESX hosts on your network:
a. Check Poll for VMware, and click Add vCenter or ESX Credential.
b. Select <New credential> and provide required information.
If you do not add the host credentials, Orion still discovers the virtual machines (VMs) on
the host. However, you will not be able to see the relationships mapped between the
VMs and hosts.
130
6. On the SNMP panel:
a. If all devices on your network require only the default SNMPv1 and SNMPv2 public and
private community stings, click Next.
b. If any device on your network uses a community string other than public or private, or if you
want to use an SNMPv3 credential, click Add Credential and provide the required information.
7. On the Windows panel, to discover WMI or RPC-enabled Windows devices, click Add New Credential
and provide the required information.
SolarWinds recommends that you monitor Windows devices with WMI instead of SNMP.
131
8. On the Monitoring Settings panel, SolarWinds recommends manually setting up monitoring the first
time you run discovery. This allows you to review the list of discovered objects and select the ones
you want to monitor.
When you scale monitoring, you can configure discovery to automatically start monitoring objects it
finds.
9. On the Discovery Settings panel, click Next.

10. Accept the default frequency and run the discovery immediately.
Discovery can take anywhere from a few minutes to a few hours, depending on the number of
network elements the system discovers.
132
Add nodes using Active Directory
Query your Active Directory Domain Controller to add nodes quickly and efficiently. Your SolarWinds Orion
server can use the devices specified in AD instead of scanning every IP address in the subnet.
Create scheduled discoveries to discover and import any new servers and workstations that have
been added to AD automatically.
1. Click Settings > Network Discovery, and click Add New Discovery.
2. On Network Selection, click Add Active Directory Controller to query.
3. On the Add Active Directory DC pop-up, enter your domain controller’s IP address/hostname and
credentials, and click Next.
4. Select the organizational units (OUs) you want to scan for nodes, and click Finish.
By default, all OUs are selected, but only servers will be added. Add workstations by clearing
the Import servers only check box below the OUs.
On the Network Selection page, you will see the OUs you have added. You can add additional AD
controllers, or any other IP addresses that you need before continuing with discovery.
5. Complete the Network Discovery.
133
Credentials for Active Directory discovery
When you use Active Directory discovery to add nodes, you must provide the credentials of a Domain
Administrator user.
The credentials you provide are added to the discovery wizard as Windows credentials automatically.
If the Active Directory credentials are not same as the Windows credentials for monitoring the node, add
credentials for WMI monitoring in the Windows Credentials step.
134
Automatically add discovered nodes
Automatic monitoring means you do not have to go through the Discovery Import wizard every time you
run a discovery. It is useful when you have configured your discovery to find similar nodes or network
devices.
1. Click Settings > Network Discovery, and add a discovery, or select an existing one and click Edit.
2. Click through the Discovery Wizard to the Monitoring Settings page.
3. Choose to include devices that only respond to ICMP (ping). If you decide to exclude devices that only
respond to ICMP, your discovery list may be smaller than you expect and you must add those devices
manually.
4. On Monitor Settings, select Automatically monitor based on my, and click Define Monitoring Settings.
5. Select the interfaces properties you want to apply to any discovered nodes and click Next. You can
also create advanced filters for interfaces under Advanced selection options.
Tips for choosing interfaces

n Only monitor access ports that should always be up. Do NOT monitor desktop access
ports because these ports will show an error state when everyone goes home for the
day (for example).
n For switches, routers & firewalls, select Up trunk ports and wireless access ports.
n For servers, select Up interfaces.
n Use Advanced Filtering Options for existing interface descriptions to choose your most
interesting ports, such as 'uplink', 'WAN', etc.
135
6. Choose the types of volumes you want to monitor.
Tips for choosing volumes

n For switches, routers, and firewalls, select Flash memory, and RAM.
n For servers, select RAM, Virtual Memory, Fixed Disk, Mount Points (*nix systems), or
Network Disk (Windows).
n We do not recommend monitoring CDs, removable disks, or floppy disks (CDs always
show '100% full,' and removable disks disappear and display as unknown).
n Other and Unknown volumes cannot be identified on import, so you may need to take
additional actions to identify them.
7. If SAM is installed, you choose the applications you want to monitor.
8. Click Finish.
9. Continue configuring your discovery. When the discovery is run, your monitoring settings will be
applied to any discovered devices, and anything that matches will be imported and monitored
automatically.
136
Add discovered devices to SolarWinds NPM
Check out this video on running a network discovery and adding devices.
After the Network Sonar Wizard discovers your network, the Network Sonar Results Wizard opens, allowing
you to import network elements into SolarWinds NPM your SolarWinds product. Nodes that are discovered
do not count against your license count. Only nodes that you have added to the SolarWinds Orion
database count against your license.
When you manually run discovery, by default, the system automatically selects all network elements to be
monitored. You must clear the check boxes for elements you do not want monitored.
If you are discovering your network for the first time, SolarWinds recommends that you monitor a
small number of devices.
1. If the Network Sonar Results Wizard does not open automatically, click the Scheduled Discovery
Results tab, select nodes you want to monitor, and then click Import Nodes.
2. Ensure the device types you want to monitor are selected, and click Next.
If a device appears as unknown vendor, it means that the credentials could not be validated.
As a result, the product can only detect if the device is up or down, and cannot collect any
other data. To resolve this issue, verify the SNMP configuration on the device. If the
credentials still cannot be validated, and you have an active SolarWinds contract, contact
technical support.
137
3. Ensure the interfaces you want monitor are selected, and click Next.
SolarWinds recommends that you do not monitor VoIP interfaces or NULL interfaces.
By default, SolarWinds NPM imports interfaces that are discovered in an Operationally Up

state. However, because interfaces may cycle off and on, you can also select Operationally
Down or Administratively Shutdown states for import.
4. Ensure the volume types you want to monitor are selected, and click Next.
SolarWinds recommends that you do not monitor compact disks or removable disks.
138
5. Review the list of elements to be imported, and click Import.
6. When the import completes, click Finish.

7. Click the My Dashboards > Summary to begin exploring your network.
139
Choose the polling method to use
Select a polling method to monitor nodes in the way that best suits your environment.
External Node (No Status)
The node is not polled, and no data is collected from the node. The node is included in your environment
and used to monitor an application or another element on the node. This method allows you to build a
more complete map of your network environment within your SolarWinds Orion Platform product.
Status Only: ICMP
Limited information is gathered using Internet Control Message Protocol (ICMP) or ping. This polling
method is used to monitor status and measure the average response time and packet loss percentage for
managed devices.
Use this method when you need limited information or to monitor devices that do not support SNMP or
WMI.
This polling method requires that you enable ICMP on your nodes. Consider adjusting any network
intrusion detection systems or your firewalls to allow for the ICMP traffic.
Most Devices: SNMP & ICMP
This method allows you to query the Management Information Base (MIB) and performance indicators that
are tied to specific Object Identifiers (OIDs) in addition to polling the device status, average response time,
and packet loss percentage. This method is suitable for SNMP-enabled devices such as routers, switches,
and computers. You must provide the appropriate SNMP community strings for SNMP v1 or v2c, or SNMP
v3 credentials.
Your devices must have ICMP and SNMP enabled to use this polling method. If you want to poll with a
specific version of SNMP, you must disable all other versions on the device.
Consider adjusting any network intrusion detection systems or your firewalls to allow for the ICMP
traffic.
Windows Servers: WMI and ICMP
This polling method can only be used for Windows computers. Windows Management Instrumentation
(WMI) is a proprietary technology used to poll performance and management information from Windows-
based network devices, applications, and components.
When used as an alternative to SNMP, WMI can provide much of the same monitoring and management
data currently available with SNMP-based polling with the addition of Windows specific communications
and security features.
Your devices must have WMI and ICMP enabled to use this polling method. You can use WBEMTest.exe,
which is included on every computer that has WMI installed, to test the connectivity between your
SolarWinds Orion server and your Windows computer.
140
Due to specific characteristics of WMI polling requests, polling a single WMI enabled object uses
approximately five times the resources required to poll the same or similar object with SNMP on the
same polling frequency. Consider adjusting any network intrusion detection systems or your
firewalls to allow for the ICMP traffic.
Windows Servers: Agent
An agent is software that provides a communication channel between the SolarWinds Orion server and a
Windows computer. Agents are used to communicate the information that SolarWinds plug-ins collect to
the SolarWinds Orion server.
Information collected by plug-ins depend on the type of plug-in installed on the agent. For example, the
Quality of Experience plug-in collects packet traffic, while a SAM plug-in collects application data used to
monitor the applications. Agents automatically download the plug-ins for all installed products.
This polling method is most useful in the following situations:
n When host and applications are behind firewall NAT or proxies

n Polling node and applications across multiple discrete networks that have overlapping IP address
space
n Secure encrypted polling over a single port is required
n Support for low bandwidth, high latency connections
n Polling nodes across domains where no domain trusts have been established
n Full end-to-end encryption between the monitored host and the poller
141
Import nodes from a list of IP addresses
Import devices from a seed file in the Network Sonar Discovery wizard.
Enter one IP address or host name per line.
See the Network Performance Monitor Getting Started Guide for more information about network
discovery.
1. Open the seed file.

2. Log in to the Orion Web Console, and click Settings > Network Discovery.
3. Click Add New Discovery to create a new discovery, or select a discovery and click Edit.
4. Click Specific Nodes in the Selection Method menu.
5. Copy and paste the IP addresses or host names of the devices from your seed file into the field.
6. Click Validate to confirm that the provided IP addresses and host names are assigned to SNMP-
enabled devices.
7. If the Agents panel appears, you enabled the Quality of Experience (QoE) agent during installation.
Select Check All Existing Nodes box if there are nodes using agents. See Check nodes polling with
agents for changes.
8. If you intend to import VMware vCenter or ESX servers and you must supply new VMware credentials
to discover these servers in your seed file:
a. Select Poll for VMware, and click Add vCenter or ESX Credential.
b. Select <New credential> and provide required information.
c. Click Next.
9. On the SNMP panel, ensure required SNMP credentials are defined, and click Next.
10. To discover any WMI- or RPC-enabled Windows devices, click Add New Credential, provide the
required information, click Add, and click Next.
11. Complete the discovery and import the devices.
The Network Sonar Results Wizard opens with the results of your discovery.
142
Manage scheduled discovery results
The Scheduled Discovery Results tab of Network Discovery provides a list of all recently discovered,
changed, or imported devices on your monitored network. Results are compared between discoveries, and
listed on this tab.
1. Log in to the Orion Web Console and navigate to Settings > Network Discovery.
2. Click Scheduled Discovery Results.
3. Filter the results the left pane.
4. Update your SolarWinds Orion database to include changed or discovered nodes by selecting all
nodes to update or to add, and clicking Import Nodes.
5. Ignore devices in future discoveries by selecting the nodes to ignore, and clicking Add to Ignore List.
143
Minimize SNMP processing load during discoveries using the Discovery Ignore
List
Network discoveries often find devices you do not intend to monitor. Add the devices you do not want to
monitor to the Discovery Ignore List to minimize the SNMP load associated with discovering devices not
meant for monitoring.
1. Log in to the Orion Web Console, and navigate to Settings > Network Discovery.
2. Click Scheduled Discovery Results.
3. Select devices you want to ignore, and click Add to Ignore List.
Use items in the Status and Group by lists to help you find devices.
The selected devices will not be discovered by the discovery.
Add ignored devices back to discovery
1. Log in to the Orion Web Console, and navigate to Settings > Network Discovery.
2. Click the Discovery Ignore List, and select the objects you want to monitor.
3. Click Remove from Ignore List.
4. Confirm that you want to stop ignoring selected items by clicking OK.
The devices removed from the list will be included in the discovery again.
144
Manage devices in the Orion Web Console
In the Orion Web Console, you can add and remove devices, quickly view and edit device properties from
the Node Management view.
You need node management rights.
Access the Node Management view in two ways:
n Click Settings > Manage Nodes.

n Click Manage Nodes in the All Nodes resource.
The All Nodes resource is included on the Orion Summary Home view by default, but you can
include it on any other view.
145
Stop monitoring devices
Deleting a node also deletes all its applications, interfaces, and volumes. An individual event may
be recorded for each deleted network object.

2. Click Settings > Manage Nodes.
3. Select the object, and click Delete.
To find a monitored application, interface, or volume, expand the parent node, and select the
object.
n To find a node, use the filter and search tools above the node list.
n To group found nodes, select a property in the Group By list.
To delete multiple interfaces on different nodes, use the search tool above the table to find
the nodes, and select the interfaces.
4. Click OK to confirm deletion.
146
View node data in tooltips
Hover over a monitored node in the Orion Web Console to view an immediate status overview of the
device.
N ODE DATA IN TOOLTIPS
Node Status Current status of the node (Up, Down, Warning, Unmanaged, or Unreachable).
Polling IP
The IP address currently assigned to the selected node.
Address
Machine Type The vendor icon and vendor description of the selected node.
Average
The measured average response time of the selected node as of the last node poll.
Response Time
The percent of all transmitted packets that are lost by the selected node as of the
Packet Loss
last node poll.
The percent of available processing capacity on the selected node that is currently
CPU Load
used as of the last node poll.
The percent of available memory on the selected node that is currently used as of
Memory Used
the last node poll.
147
Edit node properties
Only edit node properties in a single browser tab to prevent database errors and data losses.
You need Node Management Rights.
Available properties depend on the Orion Platform products you have installed.

2. Locate the node for which you want to edit properties.
To find the node, use the filter and search tools above the nodes list.
3. Select the node, and click Edit Properties.
Edit the node name, web address, and which view opens when you double-click the node
1. To rename the node, type the new name in the Name field.
Changing the node name only affects the way the node is identified on charts and graphs in the
Orion Web Console. It does not impact the node as it is referenced on the network.
2. To change the view which displays details about this node, select the View Type from the list.
3. To change the template for the address used in the Node Details resource that allows you to
navigate to the node from the resource, scroll down to Web Browse Template, and change the
default http://{{HrefIPAddress}}.
4. Click Submit.
Edit polling settings
1. To change the polling IP address, type the new IP address, or click Select IP Address and select the
new IP address.
Changing the IP address affects data collection. Change the IP address only if it changed on
your network to continue collecting the statistics without reconfiguring the node.
2. To dynamically assign the IP address of the selected node, select Dynamic IP Address (DHCP or
BOOTP), provide the DNS Hostname, and select the IP Address Resolution format.
If the device is dual-stack, IPv4 resolution will be used by default.
3. Change the polling method for the node.

4. If you are using SNMP to poll the selected node, you can:
a. Edit the SNMP Version and SNMP Port.
b. If you have high-speed interfaces, and you are experiencing frequent counter rollovers,
confirm that the monitored device supports 64-bit counters, and select Allow 64-bit Counters.
Some vendor implementations of 64-bit counters produce faulty data. If you notice
erratic or incorrect data, clear the box to disable 64-bit counters.
148
c. Edit the Community Strings (for SNMPv1 and SNMPv2c) or Credentials, Privacy and
Authentication settings (for SNMPv3).
Changing the community string or SNMP port affects data collection. Do not change the
IP address, community string, or SNMP port unless they have changed on your network.
Changing the SNMP port applies to statistics polls, Universal Device Pollers (UnDPs), and
SNMP trap collection. See "Monitoring MIBs with Universal Device Pollers" for
information about UnDPs and "Monitoring SNMP Traps" for information about traps.
d. Click Test to test your provided SNMP settings.

5. To change the existing polling intervals, provide new intervals in the Node Status Polling, Collect
Statistics and Poll for Topology Data fields.
6. If there are multiple polling engines in your environment and you want to change the polling engine
that polls the node, click Change Polling Engine.
7. Click Submit.
Edit dependencies or custom properties
1. To add, edit, or delete an existing dependency that includes the node, click Manage Dependencies
and adjust the dependencies.
2. Provide values for custom properties on the node. If you cannot see the required custom property,
click Manage Custom Properties to create or manage custom properties.
3. Click Submit.
Add what additional data you want to poll on the node
1. If the node is a UCS Manager and you want to poll for UCS data, select Poll for UCS, provide the Port
on which the UCS manager listens and credentials.
Click Test to verify that the credentials are valid for the selected UCS Manager.
2. If you have SolarWinds User Device Tracker (UDT) installed and the node has UDT ports attached, you
can poll Layer 3 data. Select Poll Layer 3 Data from Device, and enter the Layer 3 Polling Interval.
Select Disable VRF Context Polling, if required.
3. If SolarWinds SAM is installed, you can monitor Active Directory users that log in to your network.
Select Active Directory Domain Controller, and provide the following information.
a. Select the credential to be used, or select <New Credential>, and define the credential.
Administrator credentials are needed only for installing agents.
b. Click Test to validate.

c. Enter the Domain Controller Polling Interval to be used. The default is 30 minutes.
4. To poll for VMware, select Poll for VMware, provide the vCenter or ESX Server credentials, and click
Test. See Monitor virtual infrastructure in the Orion Web Console for more details.
5. If the node is an F5 device and you want to monitor load balancers, select Poll for i5 Control, and
provide the credentials.
6. Click Submit.
149
Customize alerting thresholds
Be informed when polled values for a metric on the node reach unwanted values by specifying custom
thresholds for the node.
1. Scroll down, select Override Orion General Thresholds for the metric, and adjust the default values.
2. Click Submit.
150
Promote a node from ICMP to SNMP monitoring
Orion Platform products only use ICMP to poll devices for status, average response time, and packet loss.
If a node which you added to the SolarWinds Orion database as an ICMP only node also supports SNMP,
and you want to start collecting additional statistics, change the polling method to SNMP.

3. Select Nodes from the Show drop-down list, and locate the node which you want to edit.
4. Select the node, and click Edit Properties.
5. In the Polling Method section, select Most Devices: SNMP and ICMP.
6. Select the version of SNMP to use. The default is SNMPv2c.
7. If you have installed multiple polling engines, select the Polling Engine you want to use to collect
statistics from the added node. This option is not displayed if you are only using one polling engine.
8. If the SNMP port on the added node is not the Orion default of 161, enter the actual port number.
9. If the added node supports 64-bit counters and you want to use them, select Allow 64-bit Counters.
If you notice erratic or incorrect data when using 64-bit counters, clear the Allow 64 Bit
Counters box for the device, and contact the hardware manufacturer.
10. For SNMPv1 or SNMPv2c, enter the Community String and, optionally, the Read/Write Community
String. Click Test to validate the strings.
The Community String is a password to authenticate data sent between the management
station and the device. The default is usually "public". Use the strings configured on the
device.
11. For SNMPv3, provide the credentials and click Test to validate the credentials. See the vendor
documentation for your network device for further information.
12. Click Submit.
151
View the resources and statistics monitored on a node
Resources monitored on a node include interfaces and volumes. The status of objects is signified by an
icon. The List Resources view also lists statistics monitored on the node.

2. Locate the node to view:
n Use the search tool above the node list.
n Select a Group By option, and expand the group including the node to view.
3. Select the node, and click List Resources on the Node Management toolbar.
The interfaces and volumes for this nodes are displayed, showing which are being currently monitored.
152
Suspend collecting data for monitored nodes
Monitored devices are regularly polled for operational status. Collected statistics are displayed in the
Orion Web Console.
You can temporarily suspend data collection on individual nodes, or resume data collection as necessary.
If you suspend collecting data for a node, data collection will also be automatically suspended for all
interfaces and volumes on the selected node.
Suspending data collection is helpful when you need to perform maintenance on a node or its
components, such as upgrading firmware, installing new software, or updating security. Suspend polling
data for the node while the device is down for maintenance to maintain the accuracy of data and prevent
unnecessary alert messages.

3. Locate the node(s).
4. Select the nodes, and click Unmanage.
5. Provide start and end times and dates for your management suspension, and click OK.
Data for the selected node and monitored resources on the node will be suspended for the specified
time period.
Resume data collection for nodes
On Manage Nodes, select the node, and click Remanage.
Information for the selected node, all monitored interfaces and volumes on it will be collected again.
153
Poll and rediscover devices immediately
Devices are polled for statistics and status regularly, as specified in the Polling Settings. See "Orion Polling
Settings". Discoveries run according to their schedule.
You can poll a device or rediscover a node manually at any time.

3. Select the node or interface you want to poll or rediscover.
4. To poll the selected node or interface, click More Actions > Poll Now.
5. To rediscover the selected node, click More Actions > Rediscover.
154
Troubleshoot Windows Server memory over 100%
When Orion Platform products poll a Windows server for CPU load and memory utilization, they pull the
amount of physical memory to define the 100% level. Then they total the amount of memory in use by each
allocation to compute what percentage of the physical memory is in use. This can result in memory
utilization readings over 100%, as many applications pre-allocate memory and swap before it is actually
needed.
Workaround
Add physical memory as a volume for monitoring these servers. When monitored as a volume, the
values will be more in line with your expectations.
155
Manage groups and dependencies
Dependencies and groups help you organize how data about your network is presented in the Orion Web
Console.
You can manage Orion objects such as nodes, volumes, applications, interfaces, and even other groups as
groups. By using groups, you can logically organize monitored objects, and use the groups as the basis of
alerts. For example, you can group nodes from the same location and create alerts and reports about the
status of the group.
By defining dependencies between objects, you can better represent the status of objects on your network.
Without dependencies, all monitored objects on an unresponsive monitored node report as down. By
establishing dependencies, the child objects are displayed as Unreachable instead of down. This prevents
false down object alerts.
156
Groups
A group is a collection of monitored objects, such as a group of nodes from the same location, or group of
all nodes owned by a department.
You can group other groups into groups.
Nesting a group within another does not create a strict parent/child relationship. You can include
any group as a member in any number of other groups.
157
Create groups
Select objects you want the group to contain, or specify group members using a dynamic query based on
shared properties. Objects added through dynamic queries are automatically added or removed from the
group.

2. In the Node & Group Management grouping, click Manage Groups.
3. Click Add New Group.
4. Click Advanced to set the Status Rollup Mode, how often objects refresh in the group, or any custom
properties.
To create custom properties, click Manage Custom Properties in a new tab. See Custom
properties.
5. Manually or automatically select objects for this group.
n Select the check box next to the object to select object manually.
n Automatically select group members based on shared properties by clicking Add Dynamic
Query and creating conditions.
Click Preview to verify that the dynamic query is selecting the intended objects.
6. Click Create Group.
The new group is listed on the Manage Groups page and can be used in other parts of the product,
including alerts and dependencies.
158
Edit groups
You can edit the properties of an existing group, or add and remove objects.

3. Select a group you want to edit, and click Edit Properties.
4. Edit the Name and Description of the group.
5. Click Advanced.
6. To change the display of the group status, select the Status Rollup Mode. See Set the group status
based on the status of the group members.
7. To change the refresh frequency for objects in the group, enter the value into the Refresh Frequency
field.
8. If Custom Properties are created for groups, you can define values for them here, and click Next.
To create custom properties, click Manage Custom Properties in a new tab. See Creating
Custom Properties.
9. To add or remove the group members, click Add & Remove Objects.
10. To manually select objects for this group:
a. From the Show Only drop-down list, select the type of Orion object to add as a group
member.
b. From the Group by drop-down list, select how you want to group these objects, or select [No
Grouping] to display all.
c. Select the objects, and click Add to Group.
11. To dynamically select group members based on shared properties:
a. Click Add Dynamic Query.
b. Type a name for the query in the Dynamic Query Object Name field.
c. Select an Orion object type.
d. Click Add Condition, and select the property, argument, and value for each condition you
want to use.
e. Click Preview to verify that the dynamic query is selecting the intended objects.
f. Click Save.
12. To edit an existing query:
a. Select a dynamic query, and click Edit Dynamic Query.
b. To edit the query name, edit the Dynamic Query Object Name field.
c. To edit the object type, select the new object type from the Orion Object Is drop-down list.
d. To edit a query condition, edit the property, argument, and value as required.
e. Click Preview to verify that the edited dynamic query is selecting the intended objects.
f. Click Save.
13. To remove an object or query from a group, select the query or object, and click Remove.
159
14. Click Submit to save the edited objects and queries.
15. Click Submit again to save the group.
160
Delete groups

3. Select a group, and click Delete.
161
Set the group status based on the status of the group members
The status of a group is determined on the status of the group members.
The Show Best Status selection is useful for displaying groups that are defined as collections of redundant
or backup devices.
OBJECT STATES GROUP STATUS
(Up, Warning, Down) (Up)
(Up, Down) (Up)
(Warning, Down, Unknown) (Warning)
The Show Worst Status selection ensures that the worst status in a group of objects is displayed for the
whole group.
(Up, Warning, Down) (Down)
(Warning, Up) (Warning)
(Warning, Down, Unknown) (Down)
The Mixed Status Shows Warning selection ensures that the status of a group displays the worst warning-
type state in the group. If there are no warning-type states, but the group contains a mix of up and down
states, then a Mixed Availability ( ) warning status is displayed for the whole group.
(Critical)
(Critical)
(Mixed Availability)
162
Mirror network object dependencies in the Orion Web Console
Dependencies are parent-child relationships between network objects that allow you to account for
constraints on the network. The constraints can be the result of the design of a specific device, such as
interfaces on a switch or router, or the result of the physical architecture of the network itself.
For example, when a parent object, such as a switch, goes down or becomes unresponsive all interfaces on
the switch will also be unresponsive, even though they may be working.
To account for this situation, the Unreachable status is used for the interfaces, because their parent node
reports as down, and their own status cannot be determined.
Enable Auto Dependencies in the Polling Settings page to create 1:1 parent-child node
dependencies automatically. You can choose to ignore dependencies created this way in the
Manage Dependencies view.
163
Create a dependency between network objects

2. In the Node & Group Management grouping, click Manage Dependencies.
3. Click Add New Dependency.
4. Select the parent object or group, and click Next.
To define a dependency so that the reported states of child objects depend on the status of
multiple parent objects, create a group including all parent objects, and select it on this view.
164
5. Type a Dependency Name, select the child entities, and click Next.
To define a dependency so that the reported states of multiple child objects depend on the
status of one or more parent objects, create a group including all child objects, and select it
on this view.
6. Review the settings for the dependency. If there are active alerts on child objects, they are listed on
this view.
7. Click Submit.
The dependency appears on the Manage Dependencies page.
You can also display the dependency on custom views in the Orion Web Console.
165
Edit a dependency between network objects
Automatic Dependencies cannot be edited.
1. Click Settings, and click Manage Dependencies in the Node & Group Management grouping.
2. Select a dependency, and click Edit.
3. Select the parent object or group, and click Next.
To define a dependency so that the reported states of child objects depend on the status of
multiple parent objects, create a group including all parent objects, and select it on this view.
For more information, see Create groups.
4. Edit the Dependency name.
5. Select the child object or group, and click Next.
To define a dependency so that the reported states of multiple child objects depend on the
status of one or more parent objects, create a group including all child objects, and select it
on this view.
6. Review the settings for the dependency. If there are active alerts on child objects, they are listed on
this view. If the parent object is down, the listed alerts might be suppressed. See View active alerts
on child objects when the parent object is down.
7. Click Submit.
166
Delete a dependency between network objects
Automatic Dependencies cannot be deleted.
2. Select the dependency, and click Delete.
3. Click Yes to confirm.
167
View active alerts on child objects when the parent object is down
When a parent object is down and the dependent child objects are Unreachable, alerts based on polled
statistics are not triggered.
Alerts based on default or custom property values are not affected.
If a child object can be polled using a different route, it is polled as usually, its status does not switch to
Unreachable, and alerts are not suppressed.
You can display active alerts on child objects manually at any time.
2. Select the dependency that includes the child object on which the alerts are active, and click Alerts
on Child.
168
Discover applications in your environment
SolarWinds SAM can scan nodes and automatically assign the Application Monitors it deems suitable for
each scanned node. You control the nodes to be scanned, the application templates used in the scan, and
the scanning parameters that determine a match.
In larger environments, adding many applications at once can take a great deal of time. You may
need to log in with an administrator account to perform this action.
Access Application Discovery

On the Web Console, click Settings > All Settings > Discovery Central > Discover Applications.
Select nodes to scan

Click [+] to expand the node groups, and then select the nodes you want to scan, then click
Next.
Select applications
1. To adjust the template assignment criteria, expand Advanced Scan Settings and move the slider to
the desired setting:
n Minimal Match-At least one component must match to assign the template.
n Partial Match-Some of the components must match to assign the template.
n Strong Match-Most of the components must match to assign the template.
n Exact Match-All of the components must match to assign the template.
2. When you are finished selecting applications, click Next.
Enter credentials
Some application templates require credentials either to access restricted resources, or to run
within the context of a specific user. To scan for these templates, add the necessary
credentials to the list. If a template you are scanning for requires credentials, the credentials
in this list are tried in the order in which they appear.
Warning: Credentials are tried several times over the course of a scan, so an incorrect
password is likely to lock out an account. To avoid potential account lockouts that affect
actual users, SolarWinds recommends that you create and use service accounts. A
service account is an account created specifically for the purpose of providing
credentials to use for SolarWinds monitoring. With service accounts, no actual user is
affected by an account lockout if a password should be entered incorrectly.
If you have domains sharing user names with different passwords, SolarWinds recommends
that you run separate application discoveries for each domain.
169
When you are finished entering credentials, click Next.
Review and start the scan
Review the summary for the scan. If the automatic discovery matches templates that are
already assigned to the node, by default the template is not assigned a second time. If you
want to assign duplicate templates, select Yes, Assign Anyway from the Do you want to assign
duplicates list.
Click Start Scan to begin the scan. The scan runs in the background. A banner message
appears near the top of the screen, SAM scan in progress.
To view the progress of the scan, click More Details in the banner message. From this screen
you can see the progress of the scan, cancel the scan, or go to the Application Summary
screen.
You are notified by a message near the top of the screen when scanning is complete. Click
More Details to see the results of the scan. Click Application Summary to display the summary
page.
170
Add application monitors to nodes
After adding individual nodes, you are prompted to add applications for monitoring the desired
application(s) on the new node as described below.
Add a node from the web console by clicking Settings > All Settings > Add a Node.
1. Use the Show Only list to select the desired category for the Application Monitors you want to add.
2. Select the Application Monitor(s) you want to assign.

3. Select or enter the appropriate credentials, and then click Next.
4. On the Change Properties page, modify any of the information as needed, such as the Node Status
Polling interval (in seconds) and the Collect Statistics Every frequency (in minutes).
5. Click OK, Add Node.
171
Customize the application details view
Applications inherit the custom view setting from their templates in the same way as other template
settings.
You may need to log in with an administrator account to perform this action.
1. On the Web Console, click Settings > All Settings > SAM Settings > Manage Application Monitors.
2. Find an assigned Application Monitor without a Custom View.
3. Return to Applications > SAM Summary then click the Application Monitor to view its application
details page.
4. Click Customize Page, then proceed with your customizations.
Custom application details view
You can select and create a custom application details view. This custom view is applied at the template
level. Applications inherit the custom view setting from their templates in the same way as other template
settings.
2. Select an Application Monitor and then click Edit Properties.
3. Click Modify Template Settings in the field Custom Application Details View.
4. Select Yes, use <TemplateName> Details View in the field Custom Application Details View
5. Click Submit, then click the name of the assigned Application Monitor to view its application details
page.
6. Click Customize Page and proceed with your customizations.
After creating a customized application details view for a template, you can change the Custom
Application Details View setting in the template properties to switch between the default view and the
custom view.
Select a view for a template
1. On the Web Console, click Settings > All Settings > SAM Settings > Manage Templates.
2. Select a template and then click Edit.
3. If you want applications based on this template to use the default view, set Custom Application
Details View to No, use Default Application Details View.
4. If you want applications based on this template to use the custom view, set Custom Application
Details View to Yes, use <TemplateName> Details View, where TemplateName is the name of the
selected template.
5. Click Submit.
172
Select a view for an application
2. Select an Application Monitor and then click Edit Properties.
4. If you want this application to use the default view, set Custom Application Details View to No, use
Default Application Details View.
5. If you want this application to use the custom view, set Custom Application Details View to Yes, use
<TemplateName> Details View, where <TemplateName> is the name of the selected template.
6. Click Submit.
173
Viewing node and application data in tooltips
Most object within SAM allow you to view information when you hover the mouse over an object. These are
known as tooltips.
Node Tooltips
Hover To see…
over…
Node Current status of the node (up, down, warning, unplugged, or unmanaged)
Status
SolarWinds SAM now supports the ability to include applications in calculation of
node child status. So if node is up, but application on that device is down, you will see
a child status icon indicating there is a problem.
IP The IP address currently assigned to the selected node

Address
Machine The vendor icon and vendor description of the selected node
Type
Average The measured average response time of the selected node as of the last node poll
Response
Time
Packet The percent of all transmitted packets that are lost by the selected node as of the last node
Loss poll
CPU Load The percent of available processing capacity on the selected node that is currently used as
of the last node poll
Memory The percent of available memory on the selected node that is currently used as of the last
Used node poll
# of Number of running VMS and total VMS

Running
VMS
ESX Host Status of the ESX Host

Status
Application Tooltips
Hover over… To see…
174
App Name The name of the application.
App Status The status of the application (up, down, unknown, warning, or critical).
Server Status Operational status of the server (up, down, warning, unplugged, or
unmanaged).
Components with List of the components with problems and their statuses.
Problems
175
Enable SolarWinds SAM data in the Node Details view
1. On the web console,click Settings > All Settings > Manage Views > Node Details > Edit.
2. Click [+] next to the column in which you want to display SAM resources.
3. Click [+] to expand the Node Detail Reports category, and then check the resources you want to add.
4. Click Submit, then click Done.
5. Navigate to a node with which you have associated an application and review the new resources.
176
Customize SAM Application Summary views
Create a filtered Applications Summary view based on the default SAM Application Summary view.
1. On the Web Console, click Settings > All Settings > Manage Views > SAM Application Summary and
then click Copy.
2. Select Copy of SAM Application Summary and then click Edit.
3. Click Edit in the View Limitation section, then select a view limitation and click Continue.
4. Enter the view limitation criteria and then click Submit.
5. Name this summary view and then click Update and then click Done.
Add a summary view menu item to the menu bar in the Applications tab:
1. On the Web Console, click Settings > All Settings > Manage Views.
2. Select the summary view you want to add and then click Edit > Preview.
3. On the preview page, make note of the URL field of the browser.
4. Click Settings > All Settings > Customize Menu Bars, then click Edit in the Admin Menu Bar section.
5. Scroll to the bottom of the Available Items list and then click Add.
6. Name the menu item, then enter the URL of the summary view and click OK.
7. Drag the new menu item from the Available Items list to the Selected Items list and then click
Submit.
177
Monitor network events in the web console
SolarWinds SAM automatically logs all events that occur to any monitored devices on your network. These
events are then displayed in the SolarWinds Web Console, so you can view and acknowledge them as your
network management policies require.
The Network Event Log is maintained as part of the Nightly Database Maintenance plan defined
within the Database Settings area of the SolarWinds Polling Setting page in the SolarWinds Web
Console. Records are kept for the number of days specified Events Retention field (the default is 30
days).
View event details in the web console
1. Click Start > All Programs > SolarWinds > SolarWinds Web Console.
2. Log in to the SolarWinds Web Console, and then click Events in the Views toolbar.
3. Filter the objects or events to which you want to limit your view in the Filter Devices area.
4. Click Refresh to complete your events view configuration.
Acknowledge events in the web console
1. Click Start > All Programs > SolarWinds > SolarWinds Web Console.

2. Log in to the SolarWinds Web Console, and then click Events in the Views toolbar.
3. Provide appropriate filter criteria for the displayed events.
4. Click Refresh to ensure that all selected view criteria take effect.
5. Check individual events to acknowledge or click Select All.
6. Click Clear Selected Events.
178
SolarWinds logs network events and lists them in the readily customizable Events view of the Web Console.
Events are shown in order of occurrence, and they may be viewed by device, date and time, and event or
device type.
days).
1. On the Web Console, click Alerts & Activity > Events.

2. Select the desired filter options, and then click Refresh to complete your events view configuration.
179
Acknowledge events in the web console
This procedure clears events in the web console by having you acknowledge them.
1. On the web console, click Alerts & Activity > Events.

2. Provide appropriate filter criteria for the displayed events. For more information, see View event
details in the web console.
3. Click Refresh to ensure that all selected view criteria take effect.
4. Check individual events to acknowledge or click Select All.
180
Manage nodes, applications, and settings from the web
console
You can manage SolarWinds SAM nodes, groups, accounts, alerts, views, and settings. You can also manage
the navigation and look of SolarWinds SAM and view information about available product updates.
You may need to log in with an administrator account to perform these actions.
Manage nodes from the web console

On the Web Console, click Settings > All Settings > Manage Nodes.
Unmanage nodes
1. On the Web Console, click Settings > All Settings > Manage Nodes.
2. Select the nodes to unmanage, and then click Unmanage.
3. Follow the prompts as needed.
Edit node properties

2. Check the object to edit, then click Edit Properties.
3. Edit the node as needed, then click Submit.
View node resources

2. Check a node to view from the list, and then click List Resources on the Node Management toolbar.
Add nodes for monitoring
1. On the Web Console, click Settings > All Settings > Manage Nodes > Add Node.
2. Provide the host name or IP Address of the node to add in the host name or IP Address field.
3. Select the polling method for monitoring and enter the appropriate credentials as needed, then click
Next.
4. Complete the wizard as instructed. When complete, the added node appears in the All Nodes
resource.
Delete nodes from monitoring
Warning: Deleting nodes from monitoring in the web console automatically stops monitoring of all
applications and volumes on the deleted nodes.
181
2. Locate the node to delete using either of the following methods:
n Use the search tool above the node list to search your Orion database for the node to delete.
n Select an appropriate Group by: criterion, and then click the appropriate group including the
node to delete.
3. Check the node to delete in the list, and then click Delete on the toolbar.
Manage nodes and applications (Advanced)

Delete applications or volumes from monitoring
1. Locate the object to delete using either of the following methods:
n Use the search above the node list to search your Orion database either for the object to
delete or for its parent object to delete.
n Select a Group by: criteria, and then click the appropriate group including the parent node of
the object to delete.
2. If you have a list of node results, click [+] to expand the parent node of the object to delete.
3. Check the object to delete, and then click Delete on the toolbar, then click OK to confirm deletion.
Promote a node from ICMP to SNMP monitoring
Before you begin:
n If you have defined any custom properties for monitored nodes, you need to provide appropriate
values for the promoted node in the Custom Properties.
n If you plan to use SNMPv3 to monitor the promoted node, you need to provide the following
SNMPv3 credential settings:
n SNMPv3 User name and Context
n SNMPv3 Authentication Method and Password/Key
n SNMPv3 Privacy/Encryption Method and Password/Key
Note: Read/Write SNMPv3 Credentials are optional, but the public Community String is
required
Promoting the node
2. Check the node to promote, click Edit Properties, and then select Most Devices: SNMP and ICMP.
3. Select the SNMP Version for the promoted node. SolarWinds uses SNMPv2c by default.
4. Enter the appropriate credentials, then click Validate SNMP to confirm your SNMP settings. When
done, click Submit, and then click OK.
Promote a node to WMI monitoring
2. Check the node to promote, click Edit Properties, and then select Windows Servers: WMI and ICMP.
182
3. Enter the appropriate WMI credentials.
4. Click Test to confirm your settings. When done, click Submit, and then click OK.
Set node management states
Setting a node to an unmanaged state automatically suspends the management on the selected node.
Changing the management state of a node
2. Check the node to change, and then click Unmanage or Remanage, as appropriate for the selected
node.
3. If you selected Unmanage, you must provide start and end times and dates for your management
suspension, and then click OK.
Unscheduled node polling and rediscovery

Performing an unscheduled poll or rediscovery
2. Check the node to poll or rediscover, and then select the appropriate action from More Actions drop
down menu.
Unmanage a node using the Unmanage Scheduling Utility
Before you begin:
n The Unmanage Scheduling Utility can be found at Start > SolarWinds Orion > Advanced Features >
Unmanage Scheduling Utility.
1. Select either New Task or open an existing task by clicking Edit Task, then click Add Items.
2. Click on the Web tab and select the items to schedule to be stopped by checking the check box next
to the item name.
3. Click Add, then select the length of time you would like the selected item to be stopped.
4. Click OK. Optionally, click Save Task to save your selections for future use.
Viewing the details of a selected item's schedule
1. Check the item and its details appear in the Task Item Properties pane.
2. You can change the settings of the item's schedule by selecting an item and clicking Set Duration.
3. You can delete an item from the unmanage schedule by selecting it and clicking Delete Checked
Items.
It is possible to create a conflict of schedules if you choose the same item to be stopped using both
the web console and the Unmanage Scheduling Utility with different durations.
183
Access nodes using HTTP, SSH, and Telnet
The SolarWinds Web Console supports the use of HTTP, SSH, and Telnet protocols for remote device access
if associated applications like PuTTy and FiSSH on your SolarWinds server are properly registered. Launch
remote access applications from any Details view as follows:
n To browse directly to the viewed device using a web browser, click .

n To open a secure shell (SSH) to a monitored device, click .
n To open a Telnet session with a monitored device, click .
Before you begin:
n This function only works with Microsoft's Internet Explorer.

1. Enable toolset integration on your user account. On the Web Console, click Settings > Accounts then
select an account, then click Edit.
2. Set Allow Browser Integration to Yes.
3. Open the Node Details view for the server you want to view remotely.
4. There you will see the following toolbar in the top tight corner of the web console:
184
Manage SAM settings and general thresholds
Settings are broken into specific sections, making them easier to control.
Adjust SAM account settings
1. On the Web Console, click Settings > All Settings > Manage Accounts.
2. Select an account to edit by checking its box, then click Edit.
3. Select the desired options, and then click Submit.
Set SolarWinds general thresholds
1. On the Web Console, click Settings > All Settings > SolarWinds Thresholds.
2. Provide values for Error Level, High Level, or Warning Level for the selected thresholds.
185
Certificate Credentials Library
The Certificate Credentials Library allows you to import and store certificates for use at a later time.
Typically, you need to associate credentials with component monitors and templates to enable them to
retrieve application data. For added security, SAM offers the ability to store certificates in the Certificate
Credentials Library.
Certificates can be used for authentication with Linux devices monitored in SAM. Linux, Unix, and Nagios
script monitors also support certificate based authentication.
The PEM format (OpenSSH) is supported.
186
Understand the Credentials Library
You typically need to associate credentials with component monitors to enable them to retrieve application
data. For example, to use a WMI monitor, you must provide valid domain or computer credentials. Or, if
your web server requires credentials, you must provide the appropriate credentials to access the
protected sections of your site.
You can work with credentials by:
n Adding credentials to the Credentials Library for use later. See the section Adding Credentials to the
n Creating credentials on the spot (Quick Credentials) when editing templates and component
monitors. See the section Using Quick Credentials.
n Editing credentials. See the section Editing Credentials in the Credentials Library.
n Deleting credentials. See the section Deleting Credentials from the Credentials Library.
Set up a user account on a SQL server
1. Open Enterprise Manager.

2. In the console tree, double-click Microsoft SQL Servers, click SQL Server Group, and then
SQLComputerName (Windows NT).
3. Double-click Databases, and then double-click your database of choice.
4. Right-click Users, and then click the New Database User menu.
5. Next to Login name, type:
domain\username
6. Next to User name, type your user name.
7. Select the Public check box, and then select all of the following objects:
n db_owner
n db_accessadmin
n db_securityadmin
n db_ddladmin
n db_datareader
n db_datawriter
n db_backupoperator
Important: Do not select db_denydatareader or db_denydatawriter. These objects allow

members to deny Read or Write permissions to data in the database.
For more information, see http://technet.microsoft.com/en-us/library/cc787483%28v=ws.10%29.aspx
Notes:
n SolarWinds Server & Application Monitor uses the same SNMP credentials that you entered during
node discovery. There is no need to specify additional credentials for SNMP operations.
187
n SolarWinds SAM stores credentials encrypted in the database.
n The ability to Inherit Windows credentials from node is available in the drop down list.
188
Add, edit, and delete credentials within the Credentials Library
Add credentials to the Credentials Library
1. On the Web Console, click Settings > All Settings > SAM Settings > Credentials Library > Add New
Credential.
2. Provide a name for the credential set. SolarWinds Server & Application Monitor displays this name in
the Credential for Monitoring field of monitors that accept credentials.
3. Provide the user name and password, and then confirm the password and click Submit. If you are
providing windows credentials for accessing and harvesting information through WMI, ensure you
provide the account name in the following syntax: domainOrComputerName\user name for domain
level authentication or User Name for workgroup level authentication.
You can assign credentials to all the associated components of a template or application monitor.
Edit credentials in the Credentials Library
1. From the Credentials Library, click Edit for the desired credential.
2. Modify the information as needed and then click Submit.
Delete credentials from the Credentials Library
1. On the Web Console, click Settings > All Settings > SAM Settings > Credentials Library.
2. Click Delete for the desired credential.
3. Click OK to confirm the deletion.
189
Add a certificate to the library
Adding a certificate to the Certificate Library stores the certificate for later use.
1. On the Web Console, click Settings > All Settings > SAM Settings > Certificate Credentials Library.
2. Click Add New Credential, then enter a name in the Credential Name field.
3. Enter a User Name then click Browse… to load a private key from a file.
4. Enter a password in the Private key content password field.
5. Select the Private key type: either RSA or DSA then click Submit to save the certificate credential to
the library.
190
Assign certificate credentials
There are two ways to assign Certificate Credentials; when assigning a template to a node, and when
editing a template directly.
Before you begin, choose the right method
n If every node uses unique private keys, then editing the application after it has been assigned is the
best option. Use, When assigning a template to a node.
n If most or all of your nodes use the same private key, then you should edit the credentials directly in
the template. Use, Edit a template directly.
Certificate library fields required when new credentials are added
n Credential Name: User-defined text that is used to identify the credential for later use in templates.
n User Name: The user who is associated with the public key certificate on the target computer.
n Key: Text content of the private certificate file in Privacy Enhanced Mail (PEM) format.
n Key type: The algorithm the certificate used to generate the certificate pair. (This can be found as
part of the header. For example, e.g. "--- BEGIN RSA PRIVATE KEY---.")
n Key password: The password used to protect the certificate file
The Credentials Library differs from the Certificate Credentials Library. The Credentials Library
stores credentials for later use. The Certificate Credentials Library is used by SAM to configure
components, which uses certificate authentication. (For example, A Linux Script Monitor
authenticated using SSH.)
When assigning a template to a node
1. Assign a template to a node.

2. When asked to choose credentials, select the Inherit credentials from template option.
3. Click Assign Application Monitors and then edit the template by clicking Edit next to the name of the
template, as shown.
4. From here, you can select one or more Linux/Unix/Nagios script component monitors to edit by
checking the boxes to the left of each monitor and then clicking Multi-Edit.
5. Check the Authentication Type box and select User name and PrivateKey from the drop down menu.
6. Check the Credential for Monitoring box and select the credentials you want to use from the drop
down menu, and then click Save.
191
Edit a template directly
1. Select the template you want to edit.

2. Change the Authentication Type option to User name and PrivateKey for each component monitor
that should use this authentication type.
3. From the Credential for Monitoring field drop down menu, select the credentials you want to use
with your monitors, and then click Submit.
192
Use Quick Credentials
Create and assign credentials using Quick Credentials when editing a template or application monitor.
1. If the credential you want to assign does not exist, create it by following these instructions:
a. Select <New Credential> in the Choose Credential field.
b. Type a name for the new credential in the Credential Name field.
c. Type the user name for the credential in the User Name field.
d. Type the password in the Password field, and type it again in the Confirm Password field.
2. To assign an existing credential, select the credential from the Choose Credential field.
3. Click Set Component Credentials to set this credential as the credential for all the components in the
Application Monitor or template.
The ability to Inherit Windows credentials from node is available in the drop down list.
Anywhere you have the option to specify credentials for an application template or
component monitor, you also have the the option to utilize the existing WMI credentials
already used to manage the host.
193
Configure and manage the web console
n Administrative Functions of the Orion Web Console
n Customize views
n Use Orion Web Console breadcrumbs
n Installing Network Atlas on a Remote Computer
194
Administrative Functions of the Orion Web Console
The following sections describe the primary administrative functions performed by an Orion Web Console
administrator.
l Change account passwords

l Web Console Administration
l View secure data
l Handle counter rollovers
l Search syslogs, traps and objects monitored in the Orion Web Console globally
195
Manage accounts and limitations
SolarWinds Web Console user accounts, permissions, and views are established and maintained with the
SolarWinds Account Manager. When Advanced Customization is enabled on the SolarWinds Website
Settings page, you can use Account Manager to customize menu bars and views for different users.
Before you begin:
n This guide assumes that Advanced Customization has been enabled. If it has not been enabled, the
range of options available on the pages referenced in the following sections is much more limited.
n To prevent issues with web console accounts, your SQL Server should not be configured with the No
Count connection option enabled. The No Count option is set in the Default Connection Options
area of the Server Properties > Connections window of SQL Server Management Studio.
Create accounts
1. On the Web Console, click Settings > All Settings > Manage Accounts > Add New Account.
2. Select the type of account to add, and then click Next.
a. For a SolarWinds individual account, provide a User Name and a Password then define user
settings and privileges.
b. For a Windows individual account, provide the User Name and Password for a user that has
administrative access to your Active Directory or local domain, then in the Search for Account
area, enter the User name of the Active Directory or local domain user for whom you want to
create a new web console account, and then click Search. In the Add Users area, select the
users for whom you want to create new web console accounts, and then click Next.
c. For a Windows group account, provide the User Name and Password for a user that has
administrative access to your Active Directory or local domain, then in the Search for Account
area, enter the Group name of the Active Directory or local domain group for which you want
to create a new web console account, and then click Search. In the Add Users area, select the
users for whom you want to create new web console accounts, and then click Next.
When the new account is created, the Edit User Account view displays, showing all configurable account
options.
Edit user accounts
The Edit User Account page provides options for configuring web console user accounts. On the Edit User
Account page, administrators can disable an account, set an account expiration date, grant administrator
and node management rights, set user view limitations, define a default menu bar, and set several other
defaults defining how a user account views and uses the SolarWinds Web Console.
196
2. Select an account, then click Edit.
3. Make your changes as needed, then click Submit.
Set account limitations
2. Select and account then click Edit > Add Limitation.
3. Make your changes as needed, then click Continue > Submit.
Delete an account limitation
2. Select and account, the click Edit.
3. From the Account Limitation sections, click Delete to the right of the limitation you want to delete.
197
Set the default account menu bars and views
2. Select and account then click Edit.
3. Scroll down to Default Menu Bar and Views and make your selections. When done, click Submit.
198
Enable Windows Authentication with Active Directory
The Orion Web Console can authenticate Active Directory users and users who are members of Active
Directory security groups by using MSAPI or LDAP. By default, Windows individual or group accounts use
MSAPI to authenticate accounts.
You can only use one authentication protocol at a time. All Windows accounts are authenticated through
MSAPI or LDAP, depending on which one is enabled.
SolarWinds offers a free analyzer tool for Active Directory that provides instantaneous visibility into
effective permissions and access rights. The tool provides a complete hierarchical view of the
effective permissions access rights for a specific file folder (NTSF) or share drive. Download it for
free from here: http://www.solarwinds.com/products/freetools/permissions_analyzer_for_active_
directory/.
Authenticate users through MSAPI
1. Enable the Orion Web Console to use automatic Windows Authentication.
program folder.
b. Select Website, and click Next.
c. Provide the appropriate IP Address, Port, and Website Root Directory, and select Yes - Enable
Automatic Login Using Windows Authentication.
d. Click Next, and complete the Configuration Wizard.
2. Log in to the Orion Web Console using the appropriate domain and user, providing Domain\User
name or Username@Domain as the User Name.
3. Run the Configuration Wizard and enable Windows authentication.
4. Login to the Orion Web Console, and navigate to Settings > All Settings. In Web Console Settings,
select Enable automatic login in the Windows Account Login drop-down.
199
Notifications in the Orion Web Console
Click the bell icon in the top-right corner to display unread notifications.
Notifications include the following messages:
n If you configured the Orion Web Console to check for product updates, an announcement displays
when an update, such as any upgrade, service pack, or hotfix becomes available.
n If you configured the Orion Web Console to store blog posts, new and unread posts to the Orion
Product Team Blog are announced in the notification bar.
n If you configured a scheduled discovery, results display in the notification bar when the discovery
completes.
n If you are monitoring any VMware ESX or ESXi Servers, the notification bar displays the number of
ESX nodes found during any discovery, and inform you if any discovered ESX nodes require
credentials.
n If you are monitoring Hyper-V nodes, the notification bar informs you when Hyper-V servers were
found during a discovery.
200
Log in for the first time as an Administrator
1. Launch the Orion Web Console using either of the following methods:
n Start Orion Web Console in your SolarWinds Orion program folder.
n Launch a browser and enter http://ip_address or http://hostname, where ip_address
is the IP address of your SolarWinds Orion server, or where hostname is the domain name of
2. Enter Admin as your User Name, and click Login.
Until you set a password, you can log in as Admin with no password. After your first login,
change the Admin password. See Change account passwords.
201
View and configure the SolarWinds web console message center
The Message Center provides a single, customizable view in the web console where, in a single table, you
can review all events, alerts, traps and Syslog messages on your network.
View and configure the message center
1. On the Web Console, click Alerts & Activity > Message Center.

2. Use the Filter Messages area to filter the messages you want to review.
3. Click Refresh to update the list of displayed messages.
Suppress events
There is no option within SAM to suppress event types from the web console; however, suppression can be
accomplished by modifying the database directly using Microsoft SQL Server Management Studio. You can
suppress specific events based on the event type. In order to do this, refer to the Microsoft SQL Server
Management Studio documentation.
202
Change account passwords
When you Server & Application Monitor Getting Network Performance Monitor Getting
log in to the Started Guide Started Guide
Orion Web User accounts User accounts
Console for How user accounts work How user accounts work
the first time, Create a user Create a user
SolarWinds Enable Active Directory Windows Use Active Directory credentials
recommends authentication for users
that you Change account passwords Change account passwords
change the
password for
the Admin account.
Only users with administrator rights can change the password.
3. Select a user, and click Change Password.
4. Enter and confirm the new password, and click Change Password.
203
View secure data
Sensitive network information, such as community strings, logins, and passwords, is not viewable in the
Orion Web Console.
If you have secured your network, you can display secure data in the Orion Web Console.

4. Scroll down to the Calculations & Thresholds area, and select Allow Secure Data On Web (Advanced).
This setting does not affect the display of custom reports that you export to the web. See Creating
Reports in the Web Console.
204
Manage counter rollovers
The Counter Rollover setting configures SolarWinds SAM to properly handle counter rollovers. SolarWinds
SAM is capable of handling either 32-bit or 64-bit counters, but, by default, SolarWinds SAM assumes
counters are 32-bit. 32-bit counters have a maximum value of 232, or 4,294,967,296, and 64-bit counters, if
they are supported by your network devices, have a maximum value of 264, or 18,446,744,073,709,551,616.
Note: The 32-bit counters option is designated as Method 1 in the Counter Rollover field on the SolarWinds
Polling Settings page.
Designating the type of counter used by SAM
1. On the web console, navigate to Settings > All Settings > Polling Settings.
2. If you are using 64bit counters, select Method 2 in the Counter Rollover field in the Calculations &
Thresholds area.
Notes:
n If Method 2 is selected, SolarWinds SAM intentionally skips a poll if a polled value is less than
the previous polled value to permit counting to 264.
n SolarWinds fully supports the use of 64-bit counters; however, these 64-bit counters can
exhibit erratic behavior in some implementations. If you notice peculiar results when using
these counters, disable the use of 64-bit counters for the problem device and contact the
device manufacturer.
3. If you are using of 32bit counters, select Method 1 in the Counter Rollover field in the Calculations &
Thresholds area.
Note: If Method 1 is selected, when a rollover is detected, the time between polls is calculated as (232
– Last Polled Value) + Current Polled Value.
205
Enabling and using Integrated Remote Desktop
Before you begin:
n This function will only work with Microsoft's Internet Explorer.

n You may need to log in with an administrator account to perform this action.
1. Enable Toolset integration on your user account. On the Web Console, click Settings > All Settings
> Accounts, select an account, then click Edit.
2. Set Allow Browser Integration to Yes.
4. Click the last button located at the top right of the Node Details view.
Note: Depending on the security settings of your browser, you may be asked to install an ActiveX
control for remote desktop viewing. Follow all prompts to install this required control.
5. Verify the Server IP address or host name, select an appropriate Screen Size, and then click Connect.
206
Use Orion Web Console breadcrumbs
As you navigate Orion Web Console views, you can use breadcrumbs to the pick other views that are on the
same or higher navigational level as your current view.
You cannot view breadcrumbs in wizards, dashboards, or full-page resources such as All Active Alerts.
1. Click a breadcrumb to open the view.

2. Click > next to a breadcrumb to open a clickable list of all views at the same navigation level. For
example, if you are on a Node Details view, clicking > displays a list of other monitored nodes.
Only the first 50 monitored nodes, listed in alphanumeric order by IP address, are displayed.
Customize breadcrumbs
1. Click > at an appropriate level in the breadcrumbs to open the drop-down.
2. Click Customize This List.
3. Select an option from the menu, and click Submit.
All items in the customized list will be identical for the selected criterion.
207
Customize views
Orion Web Console views are configurable presentations of network information that can include maps,
charts, summary lists, reports, events, and links to other resources.
Customized views can be assigned to menu bars. With NOC View Mode enabled, views may be optimized
for display in Network Operations Centers.
To make views and graphs larger for larger screens, resize the columns dynamically (drag the
division bars) and use your browser zoom controls, such as <Ctrl>+<+> in Chrome.
208
Create and edit custom views and view limitations
You can customize the SolarWinds Web Console and views for individual users by logging in as an
administrator and creating new views.
In environments where security is a priority, SolarWinds recommends against providing a view

where users may change their own web console account passwords.
Create a new view
1. On the Web Console, click Settings > All Settings > Manage Views and then click Add.
2. Enter the Name of New View, then select the Type of View.
Note: The Type of View selected affects how the view is made accessible to users, and your choice
may not be changed later.
3. Click Submit.
After you have created a new view, the Customize Your View page opens.
Edit views
2. Select the view you want to customize from the list, and then click Edit.
Note: Click Edit under View Limitation to access.
3. Make your changes as needed. When done, click Done.
Configure view limitations
As a security feature, the web console gives administrators the ability to apply device-based view
limitations. The following views and limitations are available:
Managed Views that Available Limitations

Support Limitations
SAM Application Details Single Network Node System Contact Pattern
SAM Component Details Group of Nodes Single Machine Type
SAM Summary Node Name Pattern Single Hardware Manufacturer
Cluster Details System Name Pattern IP Address Pattern
Current Top 10 Lists Group of Machine Types Group of Volumes
209
Custom Summary Machine Type Pattern Single Group
Datacenter Details Hardware Manufacturer Group of Groups
ESX Host Details Device Status Group Name Pattern
Group Details System Location Application Name Pattern
Group Summary System Location Pattern Group of Application Names
Node Details System Contact Specific Applications
SolarWinds Summary Home
Customize Problem Areas
Virtual Center Details
Virtualization summary
Volume Details
Enable a view limitation
2. Select the view to which you want to add a limitation, and the click Edit.
3. In the View Limitation area of the Customize View page, click Edit.
4. Select the type of view limitation you want to apply, and then click Continue.
5. Provide or check appropriate strings or options to define the device types to include or exclude from
the selected view, and then click Submit.
Note: The asterisk (*) is a valid wildcard. Pattern limitations restrict views to devices for which the
corresponding fields include the provided string.
Copy views
2. Select the view you want to copy, and then click Copy.
Delete views
2. Select the view you want to delete, and then click Delete.
210
Assign views by device type
1. On the Web Console, click Settings > All Settings > Views by Device Type.
2. Select available Web Views for the different types of devices that Orion is currently monitoring or
managing on your network.
3. Click Submit.
Export views to PDF
Before you begin:
n The Export to PDF feature requires IIS Anonymous Access. Confirm that the IUSR_SERVERNAME user
is in the local Users group on your Orion server.
1. Open the web console view to export, and then click Export to PDF in the top right corner of the
view.
2. Navigate to an appropriate location, provide an appropriate file name, and then click Save.
Configure the Available Product Updates view
1. On the Web Console, click Settings > All Settings > Available Product Updates.
2. The Check for Product Updates option can be enabled or disabled. Make you selection, then click
Save Settings.
Create a Custom Summary view
1. On the Web Console, click My Dashboard > Home > Custom Summary.
2. Click Edit in any Custom Object Resource, then provide a Title and Subtitle for the selected Custom
Object Resource.
3. Click Select SolarWinds Object. On the Select a network object window, use the Show only and
Group by selection fields, as appropriate, to filter the list of monitored objects.
4. Select the SolarWinds object on which you want to base the selected Custom Object resource, and
then click Select SolarWinds object.
5. Select the type of information you want the custom resource to display about the selected object,
and then customize the resource, as needed.
6. When done, click Submit.
Note: For more information about customizing available resource types, click Help in the header of
any resource on the Custom Summary view, and then click the corresponding resource type.
Customize SAM tabbed sub-views
211
Sam allows you to add vertical tabs on any page in the web console, allowing you to customize the data you
view.
2. Check Enable Left Navigation. The following screen appears:
3. To add a tab, click Add tab.
At this point, you can customize each sub-view tab with its own resources just as you would for any other
view.
Manage the web console appearance
Change the web console color scheme
1. On the Web Console, click Settings > All Settings > Color Scheme.
2. Select the desired color scheme, and then click Submit.
Change the web console site logo
Before you begin:
n The SolarWinds banner file is 271x48 pixels at 200 pixels/inch.

n The SolarWinds.com End User License Agreement prohibits the modification, elimination, or
replacement of either the SolarWinds.com logo and link on the menu bar or the SolarWinds
copyright line at the bottom of the page.
212
1. Place your graphic in the images directory.
Note: By default, it is in C:\Inetpub\SolarWinds\NetPerfMon\.
2. On the Web Console, click Settings > All Settings > Web Console Settings.
3. Type the new logo image name as a replacement for SolarWinds.Logo.jpg in the Site Logo URL field.
Change the web console color scheme
1. On the Web Console, click Settings > All Settings > Color Scheme.
2. Select the desired color scheme, and then click Submit.
Change the web console site logo
Before you begin:
n The SolarWinds banner file is 271x48 pixels at 200 pixels/inch.

n The SolarWinds.com End User License Agreement prohibits the modification, elimination, or
replacement of either the SolarWinds.com logo and link on the menu bar or the SolarWinds
copyright line at the bottom of the page.
1. Place your graphic in the images directory. By default, it is in

C:\Inetpub\SolarWinds\NetPerfMon\.
2. On the Web Console, click Settings > All Settings > Web Console Settings.
3. Type the new logo image name as a replacement for SolarWinds.Logo.jpg in the Site Logo URL field.
213
Manage and edit NOC views
SAM offers a Network Operations Center (NOC) view that hides console tools while automatically rotating
through custom views. NOC view mode enables you to customize views for optimal display on large
network operations center screens. Once you click on an object in NOC view mode, you are taken out of
NOC view mode and then taken to that object's details page.
While in the NOC view you can easily exit and edit the NOC view from the web console by the menu
provided in the upper right-hand corner of the web console, as shown:
Enable NOC views
1. On the Web Console, click Settings > All Settings > Created NOC Views.
2. Select an existing view, then check Enable NOC.
Add NOC views
1. On the Web Console, click Settings > All Settings > Created NOC Views > Add New View.
2. Name then add the desired view. When done, click Submit.
3. If not already done so, check Enable NOC View Mode, then click Done & Go to NOC.
Add AppStack to a NOC view
Viewing the AppStack Environment in a NOC view can only be achieved by first adding a new NOC view,
and then creating and applying an AppStack filter for this new view. Once complete, the AppStack resource
becomes part of the NOC view with the filter already applied.
2. Select a NOC view, click Edit, then check Enable Left Navigation.
214
3. Click Add Tab, add a name for the tab in the field provided, and then click Update. The new tab
appears in the column to the left.
4. Add the AppStack Environment resource to a column by clicking the green [+], then selecting
AppStack Environment from the pop-up dialog.
5. Click Add Selected Resources.
215
6. If not already done so, check Enable NOC View Mode, and then click Done.
7. Click Environment> AppStack.

8. Filter your AppStack Environment according to you needs. When done, click Apply Filter.
9. Save the Layout as AppStack Environment, which was added earlier.
10. View the NOC by navigating to My Dashboards > Home > Show in NOC Mode.
Edit NOC views
2. Check the desired view to edit, and then click Edit.
3. Make your changes, and then click Done & Go to NOC.
Disable NOC views
1. On the Web Console, click Settings > All Settings > Created NOC Views, as shown:
2. Check the desired view to edit, and then click Disable NOC.
3. Confirm the dialog to have your view removed from the list.
216
Applying node filters
1. From the web console. click Edit in any node list resource.
2. Provide an appropriate SQL query in the Filter Nodes (SQL) field, and then click Submit.
Following are a few example filters with associated SQL queries.
Note: By default, node list resources are designed to sort nodes alphabetically by node caption. This
configuration cannot be overwritten using a SQL filter, so order by clauses included in SQL filters are
redundant and will result in Custom SQL filter formatting errors.
Filter the results to only show nodes that are not Up:
Status<>1
The following are valid status levels:
0 = Unknown (current up/down status of the node is unknown)
1 = Up (The node is responding to PINGs)
2 = Down (The node is not responding)
3 = Warning (The node may be responding, but the connection from the server to the Node is dropping
packets)
Only show Cisco devices: Vendor = 'Cisco'
Only show devices in Atlanta. (using a custom property named City):
City = 'Atlanta'
Only show devices beginning with "AX3-": Caption Like 'AX3-*'
Only show Nortel devices that are Down:

Only show devices ending in '-TX': Vendor Like '*-TX'
217
Customize SAM views and tabbed sub-views
SAM allows you to add vertical tabs on any page in the web console, allowing you to customize the data
you view.
Create a tabbed sub-view for easier navigation
2. Check Enable Left Navigation. The following screen appears:
3. To add a tab, click Add tab.

4. At this point, you can customize each sub-view tab with its own resources just as you would for any
other view.
Create a filtered Applications Summary view
2. Select SAM Application Summary and then click Copy.
3. Select Copy of SAM Application Summary and then click Edit.
4. Click Edit in the View Limitation section, then select a view limitation and click Continue. For example,
Application Name Pattern.
5. Enter the view limitation criteria and then click Submit. For example: *Oracle*
6. Enter a new name for this summary view and then click Update. For example: SAM Oracle
218
Application Summary
7. Click Done.
Add a Summary view menu item to the menu Bar in the Applications tab
2. Select the summary view you want to add and then click Edit. For example: SAM Oracle Application
Summary.
3. Click Preview, then on the preview page, make note of the URL field of the browser. For example,
http://SolarWinds/SolarWinds/SummaryView.aspx?viewid=27
4. Click Settings > Customize Menu Bars, then click Edit in the Admin Menu Bar section.
5. Scroll to the bottom of the Available Items list and then click Add.
6. Enter a name for the menu item. For example: Oracle
7. Enter the URL of the summary view, then click OK.
8. Drag the new menu item from the Available Items list to the Selected Items list and then click
Submit.
Customize the default Application Details view
Applications initially share a generic, default application details view. You can add, remove, or rearrange
resources in this default view, or you can create completely new views that you can apply to groups of
applications according to their templates.
Default Application Details view
Application Details Processes and Services
Last 25 Application Events Components
Active Application Alerts Application Availability
Node Details CPU Load & Memory Statistics
Availability Statistics
Customize the default SAM Application Details view
1. Navigate to an application monitor:

a. On the Web Console, click Settings > All Settings > SAM Settings.
b. Click Manage Application Monitors, then find an assigned Application Monitor without a
Custom View.
c. Return to Applications > SAM Summary.
219
2. Click the application monitor to view its application details page, then click Customize Page.
3. Proceed with your customizations.
Customize the Application Details view
You can select and create a custom application details view. This custom view is applied at the template
level. Applications inherit the custom view setting from their templates in the same way as other template
settings.
Customize an Application Details view for an assigned application monitor
2. Check the check box next to an Application Monitor and then click Edit Properties.
4. Select Yes, use <TemplateName> Details View in the field Custom Application Details View, where
TemplateName is the name of the selected Application Monitor template, then click Submit.
5. Click the name of the assigned Application Monitor to view its application details page, then click
Customize Page.
6. Proceed with your customizations.
After creating a customized application details view for a template, you can change the Custom
Application Details View setting in the template properties to switch between the default view and the
custom view.
Select custom Application Details views
For each template or application based upon a template, you can select either the default application
details view or the template's custom details view.
Select a view for a template
2. Check the check box next to a template and then click Edit.
3. Set Custom Application Details View to either Yes or No, Use Default Application Details View.
4. Click Submit.
Select a view for an application
2. Check the box next to an Application Monitor and then click Edit Properties.
220
4. Set Custom Application Details View to Yes or No, use Default Application Details View.
5. Click Submit.
221
Customize object resources in the SolarWinds web console
The SolarWinds Web Console provides a Custom Object resource that enables you to configure any of a
wide array of resources to display performance data for any specific monitored objects.
Edit a custom object resource

1. Click Edit in the header of a Custom Object resource.
2. Edit the resource Title and Subtitle as appropriate.
3. Click Select SolarWinds Object to select an appropriate monitored object. When done, click Submit.
Select custom objects and resources

1. Click Edit in the header of a Custom Object resource.
2. Click Select SolarWinds Object.
3. In the Show only: field, select the type of object you want to monitor in the Custom Object resource.
4. In the Group by: field, select an appropriate object grouping criterion.
Note: Defined custom properties are listed for all grouping types.
5. Click the object to monitor in the list on the left, and then select it in the main pane grouping
criterion.
6. Click Select SolarWinds Object.
7. Select the desired resource type in the Select Object Resource field, and then configure options as
required.
Available Custom Resources

A Custom Object resource may be configured to provide the same data as any of a number of SolarWinds
Web Console resources for a selected network object:
Notes:
n Resource availability is dependent on the SolarWinds products installed.

n For more information about any available custom resource, click Help in the resource title to view the
corresponding help topic.
222
Add external website views
You can select any external website and add it to the Orion Web Console as a view.
You need Administrator Rights.
1. Log in to the Orion Web Console and click Settings > All Settings in the menu bar.
2. In the Customize Navigation & Look grouping, click External Websites.
3. Click Add.
4. Provide a Menu Title. This will be used for the website in the My Dashboards menu bar.
5. If you want to include a heading for the view, provide an optional Page Title.
6. Provide the URL of the external website, in http://domain_name format.
7. Select the Menu Bar to which you want to add the website link.
See My Dashboards.
If you select Admin as the menu bar, the website will be available from My Dashboards >
Home for administrators.
8. Click OK.

9. Click Preview to see the external website in the Orion Web Console.
223
My Dashboards
My Dashboards provide menu bars with shortcuts to Orion Web Console views. The default menu bars
include Home, and a menu bar for each installed Orion Platform product.
Click My Dashboards to show the default menus.
You can customize views and labels offered in default menus for individual users.
If you do not need to see all items in menu bars, and prefer navigating to display items in a menu
bar, click My Dashboards > Collapse.
224
Customize My Dashboards
Menu bars available in My Dashboards depend on the settings in your user account.
1. Find out which menu bar is assigned to Home, Network, or other product-specific tab for your user.
See Specify My Dashboard menu bars for users.
2. Add an Orion Web Console view or an external web page to the menu bar. The change will concern
all users who access the menu bar from My Dashboards. See Add items to My Dashboards.
To add a link to a details view for an important device, go to the view, copy the URL, and add it
as an extra item to the view.
3. To provide access to a specific set of links for specific users, create a menu bar, add the links and
assign the menu bar as the Home tab for the user(s).
Specify My Dashboard menu bars for users
on it.

225
7. Click Submit.
Add items to My Dashboards

2. Click Edit for a menu bar.
3. Drag available items from the left-hand column to Selected Items on the right.
Hover over any view title to read the description.

To change the order of menu items, drag and drop items in the Selected column.
4. Click Submit to save your changes.
You can also add links to node details views for specific nodes, or to external Internet pages
as a menu item.
226
a. Click Add below the Available items list, provide a name, URL and description for the
menu item, and click add.
b. Drag the new item to the Selected items column.
Add menu bars
When you have a list of items you want users to access from My Dashboards, create a menu bar.

2. Scroll to the bottom of the page, and click New Menu Bar.
3. Name the menu bar.
4. Drag views from the Available items column into Selected items.
5. Click Submit.
The new menu bar is created. You can now assign it to users who will see the items in My Dashboards.
227
Configure the web console and backup
SolarWinds SAM has the ability to create, restore, and clear your web console configuration
See the following sections for more information:
Create a web console configuration backup

Note: The SolarWinds Web Configuration Backup/Restore utility does not create a backup of the Orion
database. As a result, configuration backups do not retain any of the network device data or statistics for
any monitored network objects.
1. Locate and run the OrionWebBackup.exe utility, typically located at C:\Program Files (x86)
\SolarWinds\Orion.
2. Click Create Backup.
3. Name your backup and click Save.
Restore a web console configuration backup

Warning: Do not restore web console configurations from any version of SolarWinds SAM prior to the
version currently installed.
\SolarWinds\Orion.
2. Select a Backup file from the list.
3. Choose either Merge or Overwrite for the restoration process.
4. Click Restore Backup.
Clear a web console configuration

Warning: Clearing a web console configuration deletes all existing user accounts, account and view
settings, and menu bar customizations. SolarWinds recommends you create a backup of your current
SolarWinds Web Console configuration before you clear it to confirm that no issues arise as a result of the
deletion of your web console customizations.
\SolarWinds\Orion.
2. Click File > Clear Web Configuration.
3. Click Yes to confirm the deletion of your current web console configuration.
228
Resource configuration examples
Several resources that may be selected from the Add Resources page require additional configuration.
Display a Network Atlas map in the Orion Web Console
Network maps created with Network Atlas can give a quick overview of your network. Add a Network Atlas
map on a view.
1. Open a view where you want to add the map, and click Customize Page.
4. Select Map, and click Add Selected Resources.
6. Select a map.
7. Specify the Zoom percentage at which you want to display the map.
If you leave the Zoom field blank, the map displays at full scale, based on the size of the
column in which the map displays.
8. Click Submit.
The map is added to the view.
Display a list of objects on a network map
1. Open the view where you want to add the list of objects on a map, and click Customize Page.
4. Select List of Objects on Network Map, and click Add Selected Resources.
6. Select a network map from the list of maps, and click Submit.
The view will now include a resource listing objects on the selected map.
Display a custom list of available maps
Clicking a map in the list opens the map in a new window.
1. Open the view where you want to add the list of maps, and click Customize Page.
4. Select Custom List of All Maps, and click Add Selected Resources.
6. Select maps you want to include in your maps list.
7. Click Submit.
229
Display the Worldwide Map
to street.
to street.
1. Open the view where you want to add the Worldwide Map, and click Customize Page.
4. Select Worldwide Map, and click Add Selected Resources.
5. Click Preview, and if the map looks correct, click Done.
You have now added the Worldwide map to the view. Customize the world map now.
1. Click Edit in the Worldwide Map resource title bar.

2. Provide a Title and Subtitle for the map.
Titles and subtitles can be entered as either text or HTML.
3. Enter a value for Height. The default is 400 px.

4. Click Set Location and Zoom Level if you want to change the default location (the center of the map)
and zoom of the map.
To set the default zoom and location manually, click Advanced, and enter the latitude and longitude
of the default location and the zoom level.
5. To filter the groups and nodes to be displayed, click Group and/or Nodes, and enter a SWQL filter.
Click Examples to see a few SWQL filter samples.
6. Click Submit.
Display events received during a given time period
1. Open the view where you want to add the events summary, and click Customize Page.
3. Enter event in the Search box, and click Search.
4. Select Event Summary, and click Add Selected Resources.
6. Select the time period for displaying events in Time Period.
7. Click Submit.
Specify user-defined links
You can copy URLs of external websites or customized views from preview pages, and copy them to the
User Links resource.
1. Open the view where you want to add the links resource, and click Customize Page.
230
3. Enter links in the Search box, and click Search.
4. Select User Links, and click Add Selected Resources.
6. Enter the following information for each link you want to define:
a. A link Name and the URL of your link.
b. If you want your links to open in a new browser window, select Open in New Window.
Https URLs are not supported.
7. Click Submit.
Specify Custom HTML
When you have static information that you want to provide in the Orion Web Console, add the Custom
HTML resource on a view. This resource can also provide quick access to customized views.
1. Open the view where you want to add the custom resource, and click Customize Page.
3. Enter html in the Search box, and click Search.
4. Select Custom HTML, and click Add Selected Resources.
6. Enter HTML formatted content as required.
7. Click Submit.
Filter nodes
configured for specific views using SQL query filters.
4. Select All Nodes - Table, and click Add Selected Resources.
6. To filter your node list by text or IP address range, provide the text or IP address range by which you
want to filter your node list in the Filter Text field:
n Type Home in the Filter Text field to list all nodes with "Home" in the node name or as a
location.
n Type 192.168.1.* in the Filter Text field to list all nodes in the 192.168.1.0-255 IP address
range.
7. Select the property for the filter text provided above:
n If you typed Home in the Filter Text area, select Node Name or Location to list nodes with
"Home" in the node name or as a location.
n If you typed 192.168.1.* in the Filter Text area, select IP Address to list only nodes in the
192.168.1.0-255 IP address range.
231
9. Click Submit.
Group nodes within a view
configured for specific views with node grouping.
4. Select All Nodes - Tree, and click Add Selected Resources.
6. Select up to three criteria, in specified levels, for Grouping Nodes within your web console view.
7. Select whether you want to put nodes with null values In the [Unknown] Group or ungrouped At the
Bottom of the List.
9. Click Submit.
Add a Service Level Agreement Line to charts (SolarWinds NPM)
The Orion Web Console can display a service level agreement (SLA) line on any Min/Max/Average bps
chart. When you add a customer property named "SLA" and populate the field with your device SLA values,
the Orion Web Console displays the appropriate line on your charts.
n Interface data is only available in SolarWinds NPM.

n The SLA line may not appear immediately. It may take several minutes for the change to be
detected by the Orion Web Console.

2. In Node & Group Management, select Manage Custom Properties.
4. Select Interfaces as the custom property object type, and click Next .
5. Click SLA in the list of predefined Property Templates, make any required changes to the fields
displayed, and click Next.
6. Click Select Interfaces.
232
7. Select and add all interfaces to which you want to apply the same service level, and then click Select
Interfaces.
8. Enter the SLA value (in bps) in the SLA column for each interface you want to label with SLA values.
For example, type 1544000 for a T1 interface (1.544 Mbps) or 225000 for a serial connection
running at 225 Kbps.
9. To enter a different SLA value for a different set of interfaces, click Add More.
10. Click Submit.
Browse to the Interface Details view of one of the interfaces you edited. The SLA line displays on any chart
showing Min/Max/Average bps.
233
Integrating and enabling SolarWinds Engineer’s Toolset
Before you begin:
n The first time the Toolset tools are accessed, a security warning may be displayed. Click Yes to allow
the Toolset integration.
Configure a Toolset integration

1. Right-click any monitored object displayed within the SolarWinds Web Console, then click Settings,
then click SNMP Community String.
Note: The first time you launch a tool requiring an SNMP community string from the right-click
menu, the SNMP Community String window displays.
2. Click Menu Options, and then configure the right-click menu as needed. Right-click any monitored
object displayed within the SolarWinds Web Console.
3. Click Automatic Menu Items, and then check either or both, if available, of the options listed.
Note: These options expand the list of available menu items by incorporating menu links to MIB
browser bookmarks and Real Time Interface Monitor saved reports, respectively.
Add programs to a Toolset integration menu

Before you begin:
n To add an external script to the Toolset Integration menu, save the script in an appropriate location
on the install volume of your SolarWinds server (e.g. <InstallVolume>:\\Scripts\).
n To add an external application to the Toolset Integration menu, install the application in an
appropriate location on the install volume of your SolarWinds server (e.g.
<InstallVolume>:\\Application\).
1. Open SWToolset.MenuOptions in a text editor.

Note: By default, SWToolset.MenuOptions is located in the following folder:
<InstallVolume>:\\Program Files\SolarWinds\Common\.
2. Save a copy of SWToolset.MenuOptions as SWToolset_Old.MenuOptions.
3. Add the following line between the <MenuOptions></MenuOptions> tags of the
SWToolset.MenuOptions file:
<MenuOption Visible="TRUE" Title="ApplicationName" BeginGroup="FALSE"

HasSubMenu="FALSE"
ExecString="<InstallVolume>:\\Application\ExecutableFile" Icon="" Extra=""
Parent="" Required="4"/>
Note: The string supplied for Title is the name for the added script or application that will
display in the menu. The string supplied for the ExecString is the path to the script or
application executable file.
4. Save the new SWToolset.MenuOptions to automatically update the Toolset Integration menu.
234
235
Schedule tasks to be stopped using the Unmanage Scheduling utility
The Unmanage Scheduling Utility can be found by clicking Start > SolarWinds Orion > Advanced Features >
Unmanage Scheduling Utility.
Schedule tasks to be stopped
1. Select either New Task or open an existing task by clicking Edit Task, then click Add Items.
2. Click on the Web tab and select the items you want to schedule to be stopped by checking the check
box next to the item name.
3. Click Add, then select the length of time you would like the selected item to be stopped.
4. Click OK. Optionally, click Save Task to save your selections.
View the details of a selected item's schedule
1. Check the item and its details will appear in the Task Item Properties pane.
2. You can change the settings of the item's schedule by selecting an item and clicking Set Duration.
3. You can delete an item from the unmanage schedule by selecting it and clicking Delete Checked
Items.
It is possible to create a conflict of schedules if you choose the same item to be stopped using both
the web console and the Unmanage Scheduling Utility with different durations.
236
Monitor your network
View events, alerts, traps, and syslogs in the Orion Web Console Message
Center
The Message Center provides a view where you can see all events, alerts, traps, and Syslog messages on
your network.
1. Click Alerts & Activity > Message Center.

2. To display messages for specific devices, select device properties in the Filter Devices area.
3. In the Filter Messages area, select the Time period for the messages you want to review, and provide
the number of messages you want to show.
4. To show all messages, including messages that have been acknowledged, select Show Acknowledged
in the Filter Messages area.
5. To display only certain types of messages, select the messages to be displayed.
6. Click Apply to update the list of displayed messages.
Monitor hardware health

Hardware is monitored by polling nodes and using the Hardware Monitoring Agent software provided by
your hardware manufacturer. Monitor hardware from VMware hosts, HP ProLiant, Dell PowerEdge, and the
IBM X-Series after installing their monitoring software.
Monitor the health of the following Server Blade Chassis without the need for additional software:
n HP C7000
n HP C3000
n Dell M1000e
Hardware monitoring is achieved by polling via SNMP or WMI, depending upon the node. For SNMP and
WMI nodes, hardware monitoring must be enabled manually through the Orion Web Console.
If you run a scheduled Network Sonar Discovery of your existing servers, any servers that support
hardware health information are collected the next time the discovery runs.
Monitoring your hardware's health does not count against your allotted licenses.
Only administrators can enable hardware health monitoring.
Add server hardware monitoring
There are two ways for administrators to add server hardware monitoring for nodes; through the Add
Node wizard, and through the Node Details group of the Node Details page.
237
Add Node Wizard
From the Add Node wizard, the option to display Hardware Health of Servers is available after a node has
been defined. Check this box to enable hardware health monitoring.
Manually add hardware monitoring
1. On the Web Console, click My Dashboards > Home.

2. In the All Nodes resource, click the node you want to monitor.
3. Click List Resources.
4. Select Hardware Health Sensors, and click Submit.
To disable hardware monitoring, navigate back to this screen and uncheck Hardware Health of
Servers, then click Submit.
Hardware monitoring and VMware
Hardware monitoring is automatically enabled for VMware ESX and ESXi servers. Monitoring of VMware
servers uses the CIM protocol which should be enabled by default after the installation of ESX/ESXi hosts.
If installing Hardware Monitoring Agent software on a VMware host, hardware information will be detected
by SAM and the check box to monitor Hardware Health of Servers will be displayed, even where hardware
information might already be collected via the vCenter using the VMWare API. When this option is
displayed for a VMware host, checking it will not change the hardware polling method when Poll for
VMware is also selected.
If you are polling your hosts though the vCenter, you will not see the hardware option listed when you click
List Resources as these nodes tend to be ICMP. This information is automatically collected by Orion, when
available, through the VMware API. You will need to ensure you have the vCenter Hardware Status plug-in
enabled on your V-Center for this information to be available though the VMware API, as shown below:
238
Port 5989 must be opened when polling VMware servers using the CIM protocol.
If you run a scheduled Network Sonar Discovery of your existing servers, Orion will automatically collect
any servers that support hardware health information the next time the scheduled discovery runs.
Access hardware monitoring agent software
Each vendor’s hardware monitoring agent software includes a web server that operates on a unique port.
Server Blade Chassis (HP C7000, HP C3000, and Dell M1000e) does not use hardware monitoring
agent software.
Navigating to https://{remote.ip.address}:{Port} successfully will validate that the agent

software is installed. Refer to the table below for the list of ports used by each vendor:
Vendor: HP Dell IB
Port: 2381 1311 423
For example: Navigating to https://10.186.16.100:1311 in your web browser will take you to
the Dell OpenManage Server Administrator page on the remotely monitored host.
Hardware Details
Once you have chosen the hardware you want to monitor, the Hardware Health Details group appears on
the Node Details page and looks similar to the following illustration, providing general information about
your hardware and its status:
239
This view will be hidden if hardware monitoring is disabled.
Current hardware health status
The current status of your hardware's health can be determined by the Current Hardware Health
grouping, as shown below. The status for most items will read OK, Warning, or Critical, depending upon
the set threshold values and the returned values. The icon colors for each item will change between green,
yellow, and red, respectively. Gray icons indicate a status of Unknown, which suggests a polling failure.
You can click on the [+] and [-] icons to expand and collapse a particular tree branch of hardware that is
being monitored. When collapsed, the top level view (or roll-up status) of each hardware item will display
the worst status of an item in that branch.
240
The default temperature measurement is in degrees, Fahrenheit (ᵒ F). To change this to Celsius (ᵒ C),
On the Web Console, click Settings > Manage Accounts > Select Account > Edit. The Temperature
Unit drop down menu can be found under the Server & Application Monitor Settings category.
Hardware Health Overview chart
This resource provides a status overview of your monitored hardware's health. Mousing over each pie
segment will provide a tooltip with more detailed information.
Clicking a server icon in the Overview Chart will bring up a list of the servers with the indicated status, as
shown below. From here, you can navigate to the Details page of each server by clicking any icon in the list.
Change hardware health threshold values
Hardware thresholds can be enabled, disabled, or modified via the Manage Hardware Sensors screen.
1. On the Web Console, click Settings > All Settings > Manage Hardware Sensors.
2. To enable or disable objects from being monitored, select the objects, then click either Enable or
Disable.
3. To modify hardware thresholds, check the objects, then click Edit Thresholds.
4. Choose from the following three options:
a. Use Orion defaults: Use the built-in Orion logic for translating sensor reading to status.
b. Force to Up: Ignore sensor readings when calculating status. The status is always Up.
c. Set custom thresholds: Create your own logic for mapping sensor readings to Orion status.
Note: Threshold modification may not be available for certain objects where information is
not available.
d. Complete the logic form for both the Warning threshold and the Critical threshold as needed
to satisfy your requirements.
241
5. Click Submit.
Additionally, some values can be configured through the Hardware Monitoring Agent Software installed on
your hardware. Dell OpenManage Server Administrator is one such example. The illustration below shows
how threshold values for the temperature can be changed from the default values using Dell's software.
Different default thresholds exist for different items in the Hardware Monitoring Agent Software. Some of
these thresholds may be accessible and open to editing, some may not. Consult your Hardware Monitoring
Agent Software user guide for specific information about editing thresholds.
Different default thresholds exist for different items in the Hardware Monitoring Agent Software. Some of
these thresholds may be accessible and open to editing, some may not. Consult your Hardware Monitoring
Agent Software user guide for specific information about editing thresholds.
Hardware Health Chart
This chart allows you to visualize multiple hardware statistics simultaneously. The advantage of this view is
that you can easily see how your hardware objects are performing over a given period of time in relation to
one another.
Tabs at the top of the chart allow you to quickly navigate between different groups of hardware, allowing
you to see the performance and status of an entire group of the same hardware on a single page.
242
This view is hidden if hardware monitoring is disabled.
Customize the Hardware Health chart
Click Edit at the top-right of the chart to be taken to the following screen. You can customize the following
user-specific aspects of the chart display:
n Sample Interval: This is the interval of time that will be displayed on the chart.
n Title: This will give a title to display for your chart.
n Subtitle: This will give a subtitle to display for your chart.
n Temperature Display: This allows you to set the temperature units. This will affect all charts that
display temperature for the current user.
n Time Period for Chart: This allows you to select the span of time the chart will display.
Click Submit to save the settings.
Clicking the chart itself opens a screen which allows you to edit settings pertaining to the Hardware
Chart. Click Submit to save the settings.
243
The Raw Data button will deliver the chart data by downloading an Excel spreadsheet. The Chart
Data button displays the data in a web page.
244
Monitor virtual infrastructure in the Orion Web Console
SolarWinds Integrated Virtual Infrastructure Monitor (IVIM) is the feature that enables
virtual monitoring directly from the Orion Web Console.
It is available as a feature of SolarWinds NPM or SolarWinds SAM, in integration with

SolarWinds VMAN, or as a standalone solution.
IVIM monitors the following:
n ESXi and ESX Server version 4.1 or later

n VMware vSphere version 4.1 or later
n Microsoft Hyper-V Server versions 2008 R2, 2012, 2012 R2
Prerequisites to monitoring virtual infrastructure
n SolarWinds NPM or SolarWinds IVIM is installed.

n SNMP on your virtual servers is enabled.
n VMware Tools are installed on all virtual machines you want to monitor.
If your virtual machines are on monitored ESXi and ESX servers, VMware
Tools are not a requirement but provide access to additional
information, such as IP addresses.
n ESX credentials on ESX servers are created.

n You virtual infrastructure is discovered.
Requirements for monitoring Microsoft Hyper-V, VMware ESXi, and ESX Servers
SNMP must be enabled on all ESXi and ESX servers. For more
SNMP
information, consult your ESX or ESXi server vendor documentation.
ESXi and ESX Server version 4.1 or later

Virtualization
VMware vSphere version 4.1 or later
software
Microsoft Hyper-V Server versions 2008 R2, 2012, 2012 R2
245
VMware Tools must be installed on all virtual machines you want to

monitor.
VMware
tools If your virtual machines are on monitored ESXi and ESX servers,
VMware Tools are not a requirement but provide access to
additional information, such as IP addresses.
For more information about requirements, see IVIM Minimum Requirements

in the SolarWinds Virtual Manager documentation.
The following methods are used by SolarWinds Orion to monitor VMware ESX Servers
and their component features.
Datacenter VMware API
ESX cluster VMware API
Virtual Center VMware API
Detection as ESX server VMware API
Volumes SNMP N/A SNMP
Interfaces SNMP SNMP (partial) SNMP
CPU VMware API
Memory VMware API
Total CPU
VMware API
(ESX details view)
Total memory
VMware API
(ESX details view)
Network traffic utilization

VMware API
(ESX details view)
246
Create ESX server credentials for SolarWinds Orion products
Guest VM list
VMware API
(ESX details view)
Create ESX server credentials for SolarWinds Orion products
For polling performance data, you must create credentials on your ESX Servers for the
SolarWinds Orion polling engine.
To create the credentials, log in to the ESX server, and create a user. For more
information, consult your vendor documentation.
Credentials created for the polling engine must have read-only rights as a
minimum.
Enabling SNMP on VMware ESXi and ESX Servers
SolarWinds Orion uses SNMP to poll performance data from VMware ESXi and ESX
Servers. In order to make this performance data available to SolarWinds Orion, you
must enable SNMP on your ESXi and ESX Servers.
Note: VMware only makes a limited amount of information available to SNMP queries
for VMware ESXi and ESX Servers version 4.0 and higher. To access additional
information on these versions, NPM utilizes the VMware API.
n Enabling SNMP on VMware ESXi

n Enabling SNMP on ESX Server version 3.5
n Enabling SNMP on ESX Server Version 4.0
Enabling SNMP on VMware ESXi
The following procedure enables SNMP on VMware ESXi.
Note: The vSphere command line interface (CLI) is required, but it is not packaged
with your ESXi Server. Download it from VMware, as indicated.
To enable SNMP on VMware ESXi:
1. Download the VMware vSphere command line interface from the VMware
Download Center (http://downloads.vmware.com/d/).
247
2. Install the VMware vSphere command line interface.
3. Use the vSphere CLI to view your ESXi server SNMP settings, as indicated in the
following procedure:
a. In the Perl\bin directory of your vSphere installation, execute the
following script:
perl ..\..\bin\vicfg-snmp.pl --server ip_address –s
Notes:
l C:\Program Files\VMware\VMware vSphere CLI\Perl\bin is the
default location of the vSphere Perl\bin directory.
l Replace ip_address with the IP address of your ESXi server, and
replace cstring with the community string you are adding. For
most environments, the community string public should be
sufficient.
b. Enter an appropriate user name at the prompt.
Note: For most environments, root should be sufficient.
c. Enter the associated password at the prompt.
4. Use the vSphere CLI to enable SNMP on your ESXi server, as indicated in the
following procedure:
a. In the Perl\bin directory of your vSphere installation, execute the
following script to add an appropriate community string:
perl ..\..\bin\vicfg-snmp.pl --server ip_address -c cstring
Note: Replace ip_address with the IP address of your ESXi server, and
replace cstring with the community string you are adding. For most
environments, the community string public should be sufficient.
b. Enter an appropriate user name at the prompt.
c. Enter the associated password at the prompt.
d. In the Perl\bin directory of your vSphere installation, execute the
following script to enable SNMP:
perl ..\..\bin\vicfg-snmp.pl --server ip_address –E
Note: Replace ip_address with the IP address of your ESXi server.
e. Enter an appropriate user name at the prompt.
f. Enter the associated password at the prompt.
5. Reboot your ESXi server to allow settings to take effect.
248
Enabling SNMP on VMware ESXi and ESX Servers
Enabling SNMP on ESX Server version 3.5
The following procedure enables SNMP on ESX Server version 3.5.

Note: For more information about ESX Server 3.5 and ESX Server MIBs, see the
VMware document "Basic System Administration - ESX Server 3.5, ESX Server 3i
version 3.5, VirtualCenter 2.5".
To enable SNMP on ESX Server version 3.5:
1. Log in to your ESX Server using an account with administrative privileges, and
then open snmpd.conf in a text editor.
Notes:
l The default location for snmpd.conf is root/etc/snmp/snmpd.conf.
l To use the default text editor, nano, in a default ESX Server version 3.5
environment, enter nano /etc/snmp/snmpd.conf at the prompt.
2. Locate the rocommunity setting and replace the default community string
public with an appropriate read-only community string for your environment.
Note: Use commas to separate multiple community strings.
3. Save snmpd.conf, and then close your editor.
Note: If you are using nano, press Ctrl+X to close nano, and then enter Y to
save snmpd.conf.
4. Enter chkconfig snmpd on to enable SNMP on when you reboot your ESX
Server.
5. Enter esxcfg-firewall -e snmpd to allow SNMP through the ESX Server
firewall.
6. Enter service snmpd start to start the SNMP service.
7. Confirm that SNMP polling is enabled on your ESX Server by entering the
following command:
snmpwalk -v1 -c cstring localhost .1.3.6.1.4.1.6876 | grep 6876.1
Note: Replace cstring with the community string you provided above.
8. After entering the snmpwalk command, your ESX Server should return
information similar to the following:
SNMPv2-SMI::enterprises.6876.1.1.0 = STRING: "VMware ESX
Server"SNMPv2-SMI::enterprises.6876.1.2.0 = STRING: "3.5.0"SNMPv2-
SMI::enterprises.6876.1.3.0 = OID: SNMPv2-
SMI::enterprises.6876.60.1.3.5.0SNMPv2-SMI::enterprises.6876.1.4.0 =
STRING: "153875"
249
Note: The MIB OID SNMPv2-SMI::enterprises.6876.1.4.0 returns the build
number for your product, so it may not be the same as the build number
displayed above.
Enabling SNMP on ESX Server Version 4.0
The following procedure enables both the system default SNMP daemon snmpd and
the proprietary VMware SNMP daemon vmware-hostd on VMware ESX Server
version 4.0.
To enable SNMP on ESX Server version 4.0:
1. Log in to your ESX Server using an account with administrative privileges.
2. Open snmp.xml in a text editor.
Notes:
l The default location for snmp.xml is root/etc/vmware/snmp.xml.
l To use the default text editor, nano, in a default ESX Server version 4
environment, enter nano /etc/vmware/snmp.xml at the prompt.
3. Locate the communities tag, and then replace the default community string
public with an appropriate read-only community string for your environment.
Note: Use commas to separate multiple community strings.
4. Locate the enable tag, and then confirm it is set to true.
5. Locate the port tag and confirm it is set to 171.
6. Locate the targets tag and confirm it is set to 127.0.0.1@162/cstring.
7. Save snmp.xml, and then close your editor.
save snmp.xml.
8. Enter service snmpd stop to confirm that the SNMP service is stopped.
9. Open snmpd.conf in a text editor.
Notes:
l The default location for snmpd.conf is root/etc/snmp/snmpd.conf.
l To use the default text editor, nano, in a default ESX Server version 4
environment, enter nano /etc/snmp/snmpd.conf at the prompt.
10. Edit snmpd.conf to include the following two lines:
view systemview included .1.3.6.1.4.1.6876
proxy -v 1 -c cstring 127.0.0.1:171 .1.3.6.1.4.1.6876
250
Edit VMware Credentials in the Orion Web Console
11. Save snmpd.conf, and then close your editor.
save snmpd.conf.
12. Enter service mgmt-vmware restart to restart the mgmt-vmware service.
13. Enter service snmpd start to start the SNMP service.
14. Enter chkconfig snmpd on to enable SNMP when you reboot your ESX Server.
15. Enter esxcfg-firewall -e snmpd to allow SNMP through the ESX Server firewall.
16. Confirm that SNMP polling is enabled on your ESX Server by entering the
following command:
snmpwalk -v1 -c cstring localhost .1.3.6.1.4.1.6876 | grep 6876.1
17. After entering the snmpwalk command, your ESX Server should return
information similar to the following:
SNMPv2-SMI::enterprises.6876.1.1.0 = STRING: "VMware ESX"SNMPv2-
SMI::enterprises.6876.1.2.0 = STRING: "4.0.0"SNMPv2-
SMI::enterprises.6876.1.4.0 = STRING: "208167"
Note: The OID SNMPv2-SMI::enterprises.6876.1.4.0 returns your product
build number, so it may not be the same as the build number above.
Enabling SNMP on ESX Server Version 5.0
VMware has provided a document outlining the required steps to enable the native
SNMP agent on ESX Server version 5.0 and higher. For instructions on enabling the
native SNMP agent on VMware ESX Server versions 5.0 and higher, see the VMware
knowledge base article "Configuring SNMP Traps in ESXi/ESX (1008065)".
Edit VMware Credentials in the Orion Web Console
If credentials for a VMware account change on the device, update the credentials in
the Orion Web Console.

3. In the Node & Group Management section, click Manage Virtual Devices.
4. Click the VMware Credentials Library tab.
5. Select the credential you want to update, and click Edit Credential to make the
necessary changes.
251
Add virtual servers for monitoring
Hyper-V nodes, VMware vCenter, ESX servers, and virtual machines which you want to
monitor must be added to the SolarWinds Orion database.
Add the nodes using Network Sonar Discovery.

2. Launch Network Discovery in the Orion Web Console through Settings >
Network Discovery > Add New Discovery.
3. On the Virtualization page, select Poll for VMware, and if the vCenter or ESX
Credentials are not listed, add them.
4. On the Windows page, add Windows credentials for accessing Hyper-V nodes.
5. Complete the wizard and import the results.
Assess the status of the virtual environment
The Virtualization Summary view shows the overall status of your virtualized
infrastructure.
1. Log in to the Orion Web Console.

2. Click My Dashboards > Home > Virtualization in the menu bar.
252
View ESX host details
View ESX host details
Click an ESX Host server in the Virtualization Summary page to open the ESX Host
Details view.
Assign credentials to virtual servers
If you did not provide the credentials within the Network Sonar Discovery, or when
adding the node to the database, assign credentials based on the server vendor.
VMware ESX or vCenter accounts used as credentials must have read-only

permissions as a minimum.
Assign credentials to Hyper-V servers
1. Click Settings > All Settings > Manage Virtual Devices.
2. On the Virtualization Polling Settings page, select Hyper-V.
3. Select a Hyper-V server from the list, and click Edit Properties.
253
4. Under Polling Method > Windows Servers, choose a credential, or select New
Credential, and specify a new credential set.
5. Click Test to verify the credential set, and click Submit.
Assign credentials to VMware servers
1. Click Settings > All Settings > Manage Virtual Devices.
2. On the Virtualization Polling Settings page, select VMware.
3. Select a VMware server from the list, and click Assign ESX Credential.
4. Choose an existing credential, or specify a new credential set.
5. Click Test to verify the credential set, and click Assign Credential to assign it to
the VMware server.
254
Monitoring Quality of Experience
On the Quality of Experience (QoE) dashboard you can monitor traffic on your network. QoE uses Packet
Analysis Sensor to provide packet-level traffic information about key devices and applications.
255
Benefits of QoE
With QoE, you can:
n Compare statistics, such as network response time (TCP Handshake) and application response time
(Time to First Byte) to determine if a bottleneck is on the application or the network.
n Use data volume trends to pinpoint traffic anomalies and investigate the cause.
n Monitor risky types of traffic, for example, traffic that might bypass firewalls or lead to data leaks.
Complete to following to start monitoring traffic on your network:
1. Deploy Packet Analysis Sensors (network, server, or both) to Windows nodes.
2. In the Orion Web Console, specify the nodes and applications for which you want to collect traffic.
Packet Analysis Sensors does not automatically discover nodes and applications. You must
indicate the nodes and applications to monitor before you will see traffic data in the web
console.
3. Allocate CPU cores and memory for the traffic load for each sensor.
Traffic data is captured using packet analysis sensors. These sensors collect packets using either a
dedicated Windows SPAN or Mirror port monitor or directly on your Windows server. Packet Analysis
Sensors capture packets from the local network interface (NIC) and then analyze collected packets to
calculate metrics for application performance monitoring. These metrics provide information about
application health and allow you to identify possible application performance issues before they are
reported by end-users.
With the ability to analyze packet traffic, QoE provides real observed network response time (NRT) and
application response time (ART). In addition, Packet Analysis Sensors can classify and categorize traffic for
over 1000 different applications by associated purpose and risk-level.
For more information about specific implementations of QoE, see Aggregation with access to network
(NPAS).
256
Quality of Experience requirements
Before you deploy a Packet Analysis Sensor to a device to monitor QoE, review the following minimum
system requirements.
You will need administrative privileges for each node or switch.
Sensors cannot be installed on 32-bit computers and do not support communication over https.
Network Packet Analysis Sensors (NPAS)
1 GB + 1 GB per 100 Mbps

RAM
(2 GB + 1 GB per 100 Mbps recommended)
For a physical monitored

switch: For a virtual monitored switch:
n SPAN n Promiscuous port groups

n Mirror port n vTap
n In-line tap
Port monitoring
Port monitoring requires at least one extra network interface to collect data from
the managed network interface, a server to monitor the copied traffic, and a
network cable to connect the mirrored port to the physical server.
View your vendor documentation for instructions about how to set up port
mirroring. You can create port mirrors for both physical switches and virtual
switches.
Server Packet Analysis Sensors (SPAS)

OS
Windows Server 2008 or later, 64-bit
257
256 MB + 500 MB per 100 Mbps

RAM
(256 MB recommended + 500 MB per 100 Mbps)
Remote computer port requirements
See Agent requirements.
258
Packet Analysis Sensor Licensing
QoE is available without limitation or license for SolarWinds Network Performance Monitor and SolarWinds
Server and Application Monitor.
259
Viewing Packet Analysis Sensor Licensing Details
260
Purchasing Additional QoE Licenses
261
Activating Additional Licenses
262
How SolarWinds Packet Analysis Sensors Work
SolarWinds provides two types of Packet Analysis Sensors to monitor and analyze your network traffic.
n Packet Analysis Sensors for Networks (network sensor) to collect and analyze packet data that flow
through a single, monitored switch for up to 50 discrete applications per node.
n Packet Analysis Sensor for Servers (server sensor) to collect and analyze packet data of specific
applications that flow through a single node.
After a sensor is deployed and configured, it captures packets and analyzes them to calculate performance
metrics for the monitored applications. An included communication agent allows the sensor to send back
sampled packet data to the Orion server, which includes volume, transactions, application response time,
and network response time for each application on a node. The packet data are then saved to the Orion
database. The information is used to populate your QoE dashboard. You can configure how long you retain
the packet data in the Database Settings section of the Polling Settings screen.
Network Packet Analysis Sensor (NPAS)
Your network administrator must create a dedicated SPAN, mirror port, or in-line tap monitor on the
physical or virtual switch before you can deploy or configure a network sensor.
After you deploy and configure the network sensor to the node monitoring the switch, the sensor captures
all packets that flow through the switch and categorize the packets by application.
Packets that correspond to monitored applications are analyzed for Quality of Experience metrics, such as
response times or traffic volume. Data is then sent to the Orion server using the SolarWinds
communication agent.
Server Packet Analysis Sensor (SPAS)
A server sensor (SPAS) can monitor:
n a packet traffic on a single node.

n up to 50 applications per node.
A SPAS captures packets to and from the node. It identifies packets that are sent to or from the monitored
application and analyzes them for Quality of Experience metrics, such as response time or traffic volume.
Data is then sent to the Orion server using the SolarWinds communication agent.
263
Limitations to Packet Analysis Sensors
The number of nodes you can monitor is limited by the data throughput per node, the number of cores,
and the amount of RAM available on the monitoring server.
Review the sensor limitations in the table.
SENSOR LIMITATIONS VALUE
Maximum throughput (NPAS and SPAS) 1 Gbps
Maximum number of nodes per sensor (NPAS) 50 nodes
Maximum number of node/application pairs

50,000 pairs
(NPAS and SPAS)
Maximum number of sensors deployed on your network 1,000 sensors
Maximum number of applications per node/sensor

1,000 applications per node
(NPAS and SPAS)
The system requirements increase for every 100 Mbps of traffic.
264
Deploying Packet Analysis Sensors
Common Packet Analysis Sensor deployment scenarios
After you install your Orion platform product, deploy network sensors on a server dedicated to monitoring
a network switch.
265
You can also deploy server sensors directly on physical or virtual servers, or workstations.
If you selected QoE during the installation, an agent is already on your SolarWinds Orion server
collecting data about applications that SolarWinds Orion is using.
Based on how you want to aggregate the returned QoE metrics, there are three main deployment
scenarios per sensor type.
AGGREGATION LEVEL SENSOR DEPLOYMENT CONFIGURATION

I HAVE ACCESS TO MY NETWORK (NPAS)
Deploy an NPAS to a port mirror that monitors
Per application Automatic
all traffic to and from the application
Deploy an NPAS to a port mirror that monitors Add a sampling of endpoints to

Per site
all traffic to and from the site the NPAS as managed nodes
Deploy an NPAS to a port mirror that monitors Add all of the endpoints to the
Per client
all traffic to and from the site NPAS as managed nodes
266
AGGREGATION LEVEL SENSOR DEPLOYMENT CONFIGURATION
I HAVE ACCESS TO MY APPLICATION SERVERS (SPAS)
Deploy the SPAS directly on the application
Per application Automatic
server
Per site Deploy the SPAS to select endpoints Automatic
Per client Deploy the SPAS to all endpoints Automatic
n When deploying both network and server sensors on the same network, ensure that you do
not monitor the same node with multiple sensors. This impacts the QoE metrics.
n All monitored nodes must be managed by your Orion Platform product before they can be
monitored by sensors.
n Applications and nodes are detected by default if the node is managed by your
SolarWinds Orion server. If packet data is not collected, navigate to Settings > All Settings, and
click on QoE Settings. Click Manage Global QoE Settings, and activate the auto-detect option.
You can also manually monitor applications and managed nodes or ignore them.
Aggregation per application
This deployment scenario provides a broad indication of the overall response time between computers
and the monitored application.
267
Aggregation with access to network (NPAS)
n Create a port mirror, SPAN, or network tap on the switch with all the network traffic to or from
the application.
n You can monitor multiple applications using the same NPAS.

2. Click QoE Settings > Manage QoE Packet Analysis Sensors > Add Packet Analysis Sensor.
3. Select the Network option, and then click Add Nodes.
4. Choose the node with the port mirror, SPAN, or network tap setup to monitor your network switch.
5. Assign and test the credentials for the selected node.
6. Click Add Nodes and Deploy Agents to deploy the network sensor to the node.
268
Aggregation with access to application servers (SPAS)

3. Select the Server option, and then click Add Nodes.
4. Choose the nodes with the application you want to monitor.
5. Assign and test the credentials for each node.
6. Click Add Nodes and Deploy Agents to deploy a sensor on the node.
Aggregation per site
This deployment scenario provides an aggregated response time per monitored site or network to the
application. For example, the response time from your Detroit office to your datacenter is one second, but
the response time from Boston to your datacenter is seven seconds. If you used the aggregation per
application deployment method, the response time for the application is four seconds.
This method requires you to identify users who best represent how the application is used. You then use
the users' computers as data points to monitor with Packet Analysis Sensors.
269
Aggregation per site with access to network (NPAS)
the application.
n Identify a sample set of users whose computers are monitored by the NPAS.

270
Aggregation per site with access to application servers (SPAS)
Identify a sample set of users whose computers are monitored by the SPAS.

4. Choose the nodes with the application you want to monitor.
6. Click Add Nodes and Deploy Agents to deploy a sensor on the node.
Aggregation per computer
This deployment scenario provides highly granular response times for the application because metrics for
each computer are recorded.
One or two workstations can experience long response times, which may not be caught when aggregated
per site or per application.
This method requires all workstations to be managed within your Orion Platform product.
271
Aggregation per computer with access to network (NPAS)
the application.

272
Aggregation per computer with access to application servers (SPAS)

4. Select the all user computers to monitor.
6. Click Add Nodes and Deploy Agents to deploy an agent on the node.
273
Deploying a Network Sensor
Before you begin
n Data from sensors is directed to the polling engine assigned to the node when the sensor was
deployed.
n A high number of applications or nodes can cause performance issues with the sensors.
The network sensor must be installed on a Windows computer that is monitoring the switch's SPAN or
mirror port.
Install the network sensor

3. Select Network, and click Add Nodes.
4. Move the node that monitors your switch to the Selected Nodes panel, and click Add Selected Nodes.
Make sure you select the Windows machine that is monitoring the SPAN or mirror port of the
switch.
5. Assign and test the credentials for the node, and click Submit.
6. Click Add Nodes and Deploy Agents.
When the sensors are successfully deployed, a message is displayed in Notifications.
Deploying the sensor and receiving the first set of data can take several minutes. When the
deployment is finished, select the sensor on the Manage Quality of Experience (QoE) Packet Analysis
Sensors page, click Edit Sensor, and verify the selected NIC.
274
Monitor website traffic based on domains
After you deploy a network sensor, you can filter application traffic based on domain names instead of all
http traffic.

2. Click QoE Settings > Manage Global QoE Settings.
3. Set the HTTP application domain detection level.
4. Set the Auto-detect QoE applications option to Active, and click Submit.
QoE can automatically detect the first 50 applications, or you can add specific applications.
Discovered applications have the "No Risk" Risk Level and the "Both Business and Social" Productivity
Rating associated with them. To modify the Risk Level and Productivity Rating, click QoE Settings > Manage
(QoE) Applications, and edit the application.
Use the Global QoE Settings page to disable monitoring or discovery of multiple applications. Select
the applications, and click Disable Monitoring or Disable Discovery.
When sensor deployment is complete, the installation wizard displays a message.
To specify manually which nodes and applications to monitor, see Monitor QoE Applications and Nodes.
Nodes are automatically detected and added by default.
275
Deploying a Server Sensor
These sensors monitor all the application traffic into and out of the server they are installed on.
After you deploy a server sensor to the application node, the sensor monitors packets to and from the
node, identifies the application or the URL, and analyzes the packets for QoE metrics, such as response
time or traffic volume.
To deploy a server sensor:

2. Click QoE Settings > Manage QoE Packet Analysis Sensors, and click Add Packet Analysis Sensor.
3. Select Server, and click Add Nodes.
4. Move the Windows nodes that will host the server sensors to the Selected Nodes panel, and click
Add Selected Node.
5. Assign and test credentials for each node, and click Submit.
6. Click Add Nodes and Deploy Agents. QoE auto-discovers the applications on the servers.
Notes:
n Deployment may take some time and will run as a background process.
n QoE automatically chooses settings, including the interface to capture traffic data and limits to
memory and CPU, during agent deployment. You can change these settings once deployment is
complete by selecting the sensor and clicking Edit.
n When installation is complete, a message is displayed in the notification bar.
n You can confirm the deployment status on the Manage QoE Packet Analysis Sensors page.
To specify manually which applications to monitor, see Monitoring QoE applications. Applications are
automatically detected and added by default.
276
Removing a Sensor
Removing a sensor from a node is a two steps process. First delete the sensor using the Web Console, and
then remove the communication agent directly from the node.
To delete the sensor using the Web Console:
1. In the Orion Website Administration page, navigate to Settings > QoE Settings.
2. Click Manage QoE Packet Analysis Sensors.
3. Select the node.
4. Click Delete Sensor.
5. Click Delete when prompted.
To remove the agent directly from the node:
1. Logon to the node with administrative credentials.

2. Navigate to Control Panel > Programs and Features.
3. Select SolarWinds Agent.
4. Click Uninstall.
5. Follow the onscreen prompts to completely uninstall the agent.
277
Monitor QoE Applications and Nodes
By default, nodes and applications are automatically monitored by QoE when you deploy a Network or
Server Sensor. You can modify this behavior and automatically filter which nodes or applications are
monitored.
See Global QoE Settings for more information on how you can change these settings.
Server Sensors automatically monitor the top 50 applications on the node they are installed on
based on the global settings. You can change which applications are monitored after the sensor is
deployed.
For more information, refer to the following topics:
n Manage Global QoE Settings

n Monitoring QoE applications
n Defining nodes for a network sensor
n Ignoring applications or nodes
n Defining Custom HTTP Applications
278
Manage Global QoE Settings
You can control how Packet Analysis Sensors behave by changing the settings on this page. Settings are
distributed to sensors regularly when the agent is updated. You can manually update an agent from the
Manage Agents page.
QoE Applications
Control how you monitor QoE applications for both Network Packet Analysis Sensors and Server Packet
Analysis Sensors.
Auto-detect QoE applications
Use this to detect and monitor traffic associated with all applications that fulfill the auto-detection
rules defined on this page. This is active by default. You must select applications manually when this
option is disabled.
Note: If you automatically detect nodes, you should also automatically detect applications.
HTTP application domain detection level
Choose how granularly QoE breaks up http traffic to monitor.
n Top level (http://*) - Monitor all http traffic.

n Second level (http://hostname/*) - Separate and monitor http traffic based on domains.
n Third level (http://hostname/path1/*) - Separate and monitor http traffic based on the domain and
1st level directory within each domain.
Add auto-detected applications that are
Further refine the applications that are monitored by choosing to monitor all application traffic
sources, traffic destinations, or all application traffic. Packet sources and destinations are based on
the source or destination IP address included in the packet.
n Transaction destinations (servers) - Monitor applications that receive traffic based on the destination
IP address of the packet.
n Transaction sources (client) - Monitor applications that generate traffic based on the source
n Either a source or destination - Monitor all application traffic.
For each node, include top X application that have at least Y% of total QoE traffic.
Filter the number of applications that are monitored to applications that generate a certain amount
of network traffic.
Nodes with QoE Traffic
Control how you monitor QoE nodes for Network Packet Analysis Sensor.
279
Auto-detect QoE nodes
Use this to detect and monitor the first 50 nodes with network traffic. This is active by default. You
must select nodes manually when this option is disabled.
Note: If you automatically detect nodes, you should also automatically detect applications.
Add auto-detected monitored nodes that are
Further refine the nodes that are monitored by choosing to monitor all nodes that are traffic sources,
traffic destinations, or all nodes that generate or receive network traffic. Packet sources and
destinations are based on the source or destination IP address included in the packet.
n Transaction destinations (servers) - Monitor nodes that receive traffic based on the destination
n Transaction sources (client) - Monitor nodes that generate traffic based on the source IP address of
the packet.
n Either a source or destination - Monitor all traffic.
280
Monitoring QoE applications
Applications are automatically monitored when traffic is detected by the Packet Analysis Sensor. However,
you can manually select specific applications to monitor. QoE installs with the ability to monitor over 1000
pre-defined applications, including FTP, RDP, CIFS, SQL, and Exchange. You can also define your own
custom HTTP applications.
Notes:
n Because of the hardware requirements needed to process large amounts of traffic, SolarWinds
recommends that you preferentially monitor business-critical nodes and applications. For more
information about recommended hardware specifications, see Quality of Experience requirements.
n You should not assign more than 50 applications to a single node due to potential performance
issues. However, you can monitor up to 1000 applications.
Monitoring applications automatically
While QoE sensors automatically detect and monitor applications by default, the settings may have
changed or you may have upgraded from a previous version of QoE that does not automatically monitor
applications.
Note: Only applications that meet the criteria selected in QoE Applications are monitored automatically.
To monitor application traffic automatically:

3. In the Settings grouping, click QoE Settings.
4. Click Manage Global QoE Settings.
5. Select Active in Auto-detect QoE applications.
6. Change other settings to refine the number of applications you automatically monitor. See Global
QoE Settings for more information on the settings.
7. Click Submit.
Monitoring applications manually
You may choose to add monitored applications manually to QoE.
To select specific applications for monitoring:

281
4. Click Manage QoE Applications.
Notes:
n Applications are only listed if there are monitored nodes. You must first add a Network or
Server Sensor before you can enable any applications. For more information, see Aggregation
with access to network (NPAS).
n Applications listed with the Enabled/Disabled toggle "ON" are currently being monitored on
at least one node.
n Applications can be disabled (the Enabled/Disabled toggle "OFF") which means that no traffic
for the application is currently collected on any node.
5. Click Add New .
6. Select Choose a pre-configured application.
Note: Applications that are already enabled will not appear in the list.
7. Use the Search or Group By options to find the application you want to monitor, select it, and then
click Next.
8. On the Configure Application view, edit the Category, Risk Level, or Productivity Rating as
necessary, and then click Next.
9. On the Configure Data Collection view, choose the node(s) you want to monitor for this type of
traffic.
Note: Only nodes that have already been specified as nodes to monitor on the Manage QoE Nodes
page appear in this list.
10. Click Next.
11. Review your choices on the Summary page, then click Finish.
Your newly enabled application will appear on the Manage QoE Applications page in alphabetical order.
282
Defining nodes for a network sensor
Nodes are automatically detected and monitored when network traffic is detected either originating from
or terminating at a node. However, you can manually specify the nodes instead. After the network sensor
has been successfully deployed, add applications and nodes to monitor. For information about adding
applications, see Monitoring QoE applications.
Note: You can monitor up to 50 nodes per network sensor.
Adding nodes automatically
While Network Sensors automatically detect and monitor nodes by default, the settings may have changed
or you may have upgraded from a previous version of QoE that does not automatically monitor nodes. QoE
automatically monitors the first 50 nodes with traffic.
Notes:
n Automatic node discovery may not be 100% accurate due to devices with the same IP addresses in
your network.
n Only nodes that meet the criteria selected in Nodes with QoE Traffic are added automatically.
To monitor nodes automatically:

4. Click Manage Global QoE Settings.
5. Select Active in Auto-detect QoE nodes.
6. Change other settings to refine the number of nodes you automatically monitor. See Global QoE
Settings for more information on the settings.
7. Click Submit.
Adding nodes manually
You may choose to add monitored nodes manually to a Network Sensor. If a node is already monitored and
you want to monitor it with a different sensor, you must delete the node from the original sensor before
you can add it to the new network sensor.
To add nodes for a network sensor to monitor:
1. Navigate to the Manage QoE Sensors page.

2. Expand the Network sensor that you want to add a node to.
3. Click the Add Node to Monitor button.
283
4. On the Create QoE Node page, choose the managed nodes you want to monitor with this network
sensor.
5. Click Next.
6. On the Select QoE Applications page, choose the applications you want to monitor for these nodes.
See Monitoring QoE applications for more information.
7. Click Next.
8. Review your selections on the Summary page.
9. Click Finish.
View the nodes and applications selected by expanding the Network Sensor you just configured.
284
Ignoring applications or nodes
You can ignore traffic generated by applications or from a specific node.
Ignoring applications
If you decide that you no longer want to monitor an application, you can disable discovery or monitoring
for that application in the Manage QoE Applications page.
Note: These settings are on a global level. You cannot turn application discovery or monitoring on or off for
specific sensors.
To ignore network traffic from an application:

4. Click Manage QoE Applications.
5. Toggle Monitoring or Discovery ON or OFF .
Use the following table to determine which combination of settings you want to use.
MONITORING ON MONITORING OFF
DISCOVERY ON Applications can be automatically Applications can be automatically

discovered and application traffic is discovered, but application traffic is not
monitored monitored
DISCOVERY OFF Applications cannot be automatically Applications cannot be automatically

discovered, and application traffic is discovered, and application traffic is not
monitored monitored.
Ignoring nodes
You can permanently ignore all traffic from specific nodes that you monitor on a network sensor. This is
often used to reassign a node to a different network sensor.
Note: You cannot add a node back to its original network sensor.
To ignore all network traffic from a node:

285
4. Click Manage QoE Packet Analysis Sensors.
5. Select a network sensor, and click Edit.
6. Select the node you want to remove, and click Delete.
286
Defining Custom HTTP Applications
In addition to choosing from pre-defined applications, you can also define custom HTTP applications, and
then add them to nodes you are monitoring.
To create a custom HTTP application:
1. Navigate to Settings, then select Manage QoE Applications.

2. Click Add New .
3. On the Select Application page, select Create a new HTTP application, then click Next.
4. On the Configure Application page, enter the name and description of the application you’re
creating, then choose the Category, Risk Level, and Productivity Rating appropriate for the
application.
5. Set the URL Filter. This specifies the HTTP application traffic to monitor. When you choose which
filter to use in the drop-down, notice that the example changes to indicate how the accompanying
text field will be used.
For example, selecting Hostname contains changes the help text to http://*...*/path/pageCore--
sw5.html. Any text you enter will be included in the filter where the “…” appears.
6. Enter the hostname or URL for your filter, then click Next.
7. On the Specify Nodes page, choose the node(s) you want to monitor for this type of traffic. Only
nodes that have already been specified as nodes to monitor (on the Manage QoE Nodes page) will
appear in this list.
8. Click Next. Review your choices on the Summary page, then click Finish.
9. Your new application will appear on the Manage QoE Applications page in alphabetical order.
287
Advanced Sensor Configuration
Sensors cannot be edited until they are fully deployed. You are notified when your sensor is deployed, or
you can check the Manage QoE Packet Analysis Sensors page. The status of completely deployed and
working sensors is Up.
When you click Edit Sensor, you can configure:
n the monitored interface

n the allocated CPU cores and memory
288
Configuring the Monitored Interface
When you deploy a sensor, the first available interface is monitored for traffic. Once the sensor is installed,
you can go back and change the monitored interface, as indicated in the following procedure.
To change the interface monitored by a sensor:
1. Click Settings > QoE Settings > Manage QoE Packet Analysis Sensors.
2. Select the sensor to edit.
3. Click Edit Sensor.
4. Select the desired interface from the Interface to capture QoE data drop-down list.
5. Click Save.
289
Configuring the Number of CPU Cores and Allocated Memory
When a sensor is deployed, QoE automatically allocates one CPU core and 256 MB of memory to the
sensor. After the sensor is installed, you can change the allocated CPU cores and memory.
For sensors, the memory usage scales with the traffic load. The more flows that are going on the line, the
more memory you need.
NUMBER OF
CPU CORES GUIDELINES
1 Not Recommended
2 Suitable for 100 Mbps links
3-4 Gigabit links with low utilization
5-6 Gigabit links with medium utilization
7+ Gigabit links with high utilization
To change the sensor thresholds:
1. Click Settings > QoE Settings > Manage QoE Packet Analysis Sensors.
2. Select the sensor to edit.
3. Click Edit Sensor.
4. In the Memory field, select the number of GB you want to allocate to the sensor.
Note: If you allocate less than the recommended amount of memory, you may see reduced
performance.
5. In the CPU Cores field, select the number of CPU cores you want to allocate to the sensor.
Note: If you allocate fewer than the recommended number of CPU cores, you may see reduced
performance.
6. Click Save.
290
Configuring Thresholds
You can modify the application response time (ART), network response time (NRT), volume, and transaction
thresholds that are used to alert you to irregularities in your network.
Note: It is best to allow the sensors to collect a few days' worth of data before setting thresholds.
To change the number of CPU cores and memory allocated to the sensor:
1. Click Settings > QoE Settings > Manage QoE Applications.

2. Select the application to edit.
3. Click Edit.
4. Click Next, and then click Next again.
5. On the Summary page, click the plus sign by Thresholds.
6. Select Override Orion General Thresholds next to each data type.
7. Change the threshold. You can use specific thresholds or you can use a dynamic threshold based on
the baseline established. The default baseline is seven days, which is configurable in the Orion
Polling Settings page.
8. Click Finish.
291
Packet Analysis Sensor Agents
The software that provides a communication channel between your SolarWinds server and the monitored
object to which you have deployed your Packet Analysis Sensor is called an agent. Agents are used to
provide packet-level traffic information about key devices and applications that you specify. The agent
runs as a service, and it has a relatively small footprint (under 100MB installed).
For more information, see:
n Windows agent deployment
n Agent settings
n Manage agents, connections, and deployment status
292
SolarWinds Orion agents
An agent is software that provides a communication channel between the Orion server and a Windows or
Linux computer. Agents are used to provide information about key devices and applications that you
specify. This can be beneficial in the following situations:
n Polling hosts and applications behind firewall NAT or proxies.

n Polling node and applications across multiple discrete networks that have overlapping IP address
space.
n Secure, encrypted polling over a single port.
n Support for low bandwidth, high latency connections.
n Polling nodes across domains where no domain trusts have been established.
n Full ,end-to-end encryption between the monitored host and the main poller.
You can monitor servers hosted by cloud-based services such as Amazon EC2, Rackspace, Microsoft Azure,
and other Infrastructure as a Service (IaaS).
After deployment, all communication between the SolarWinds Orion server and the agent occur over a
single fixed port. This communication is fully encrypted using 2048-bit TLS encryption. The agent protocol
supports NAT traversal and passing through proxy servers that require authentication.
Java Management Extensions (JMX) polling is not supported using an agent.
293
Agent settings
The Agent Settings page provides access to all of the settings and tools needed to install and manage
agents. Additional agent settings can be found in the Windows Control Panel.
Navigate to the Agent Settings page

2. Under Product Specific Settings, click Agent Settings.
n Manage Agents: Opens the Manage Agents page from which you can add a new agent, edit,
update, or reboot an existing agent.
n Download Agent Software: Opens the Agent Downloads page from which you can mass
deploy or manually install an agent.
n Define Global Agent Settings: Opens the Global Agent Settings page from which you can allow
automatic agent registration and allow automatic agent updates.
Adjust the Global Agent Settings
Click Define Global Agent Settings.
n Allow automatic agent registration: Select this option to automatically register the agent and verify
communication with the Orion Server. If this option is disabled, you can register any waiting agents
by clicking Settings > All Settings > Manage Agents > Add Agent > Connect to a previously installed
agent.
n Automatically create node: Agents are automatically registered as Orion nodes.
n Allow automatic agent updates: Select this option to automatically upgrade the agent software when
updates are available. This process pushes a new version of the agent to client computers over the
agent communication channel. No extra ports or permissions are needed. Once the agent receives
the new version, it updates itself. This process does not require rebooting.
If automatic updates are disabled and a new version of the software is installed on the server,
outdated agents may not be able to communicate with the server. Ensure all agent versions
match the version of the server.
n XX Hours: Control the length of time the agent displays as being new in the Manage Agents list.
294
Server-initiated communication
All communication between your SolarWinds Orion server or additional polling engine and the agent is
initiated by the server, and the agent does not initiate communication to your SolarWinds Orion server.
You must have a direct route from the server with the agent installed to your SolarWinds Orion server or
additional polling engine. To use this communication method, port 17790 must be open on the firewall of
the remote host to retrieve information from the agent.
This communication method is also known as a passive agent.
295
Agent-initiated communication
All communication between your Orion server or additional poller and the agent is initiated by the agent,
and your SolarWinds Orion server does not initiate communication with the agent. You do not need to
have a direct route from the server with the agent installed to your SolarWinds Orion server or additional
poller. To use this communication method, port 17778 must be open on the SolarWinds Orion server
firewall to receive information from the agent.
This communication method is most useful when the agent is installed on a network separated from your
Orion server by one or more NAT devices, and you have no easy way to connect the two.
This communication method is also known as an active agent.
296
Windows agent deployment
SolarWinds Orion products supports three methods of deploying an agent to a client computer running
Windows.
n Push the agent software from the Orion Server to one or more client computers.
n Mass deploy the agent software to multiple computers using a mass deployment technology, such as
Group Policy.
n Manually install the agent on a client computer.
Agents do not work with AppInsight for SQL when the SQL Server being monitored is in a cluster.
297
Deploy Windows agent software via server push
Select this method of deployment to perform a network-wide deployment from the SolarWinds Orion
server. This method does not require downloading additional files. In order for this deployment method to
succeed, the SolarWinds Orion server must be able to communicate with the client computers.

2. Under Node & Group Management, click Manage Agents.
3. Click Add Agent.
4. Select how you would like to add the agent.
Deploy the agent on my network
Select this method to install the agent on multiple client computers.
1. On the Deploy Agent on Network page, enter the IP address or host name of the Windows computer
where you want the agent to be installed, or select nodes from the list, and then click Next.
This field does not accept ranges. Only add computers that are not nodes in the system.
2. On the Agent Settings page:

a. Select the computer you selected in the previous step, and click Assign Credentials
b. Select a credential from the list, or enter new credentials, and click Submit.
You can assign credentials to multiple locations or nodes by selecting multiple entries.
3. Click Deploy Agent.
When the connection is successful, the agent displays in the agent list on the Manage Agents page.
Connect to a previously installed agent
Select this method to connect to agents that were configured with server-initiated communication, or if
Allow Automatic Agent Registration is not enabled. When you connect to an agent, you first need to select
the communication mode that was chosen when the agent was installed. If the communication mode is
server-initiated (passive), a shared secret was required during installation. This secret must be entered
again here.
1. On the Add Agent page, enter a name for the Agent.
2. Select the agent communication mode.
3. For Server-initiated communication:
a. Enter the IP address or hostname where the agent is located.
b. Enter the shared secret.
c. Optional: Expand Advanced and adjust the following settings as needed:
a. Change the agent port number. This is the port the agent uses for listening.
b. Use a proxy. Selecting a proxy and enter the proxy URL.
c. Use proxy authentication, and enter credentials.
4. For Agent-initiated communication, select the agent from the Agent list.
298
5. Select Allow automatic agent updates to upgrade the agent automatically when upgrading to new
versions of Orion Platform modules that support the agent.
Disabling this option requires you to manually upgrade agents after upgrading your Orion
Platform products.
6. Click Submit.

299
Deploy the Windows agent manually
Selecting this method of deployment may be helpful in troubleshooting connectivity issues with another
form of agent deployment. This method is also helpful when the Orion server cannot communicate directly
with the endpoint where the agent will be installed, such as in the case of Active Agent mode.

2. Under Product Specific Settings, click Agent Settings > Download Agent Software.
3. Click Windows, and click Next.
4. Click Install Manually, and click Next.
5. Click Download .MSI.
6. Download and copy the MSI file to the client machine, and execute it.
7. In the installation wizard, select Agent Initiated Communication or Orion Server Initiated
Communication.
8. Enter the SolarWinds Orion server IP address or hostname, and the SolarWinds Orion administrator
account credentials.
When installation is successful, the agent displays in the agent list on the Manage Agents page.
300
Mass deploy a Windows agent
If you are already using a mass-deployment technology, this deployment method is an easy way to get
agents on a large number of computers.
Polling engine selection is important. When you click Download .MST, the MST file created includes the
polling engine IP address and other vital information. When you deploy the agent using the MSI file, along
with the MST file on the managed node, the agent will be installed and pointed to the correct polling
engine.
Generate and download the .MST file

4. Click Mass Deploy to Multiple Machines, and click Next.
5. Select the agent communication mode. This information is included in the MST file.
n For agent-initiated communication, enter the polling engine you want the agent to use. You
may need to manually enter the polling engine information if the IP address is different from
what the SolarWinds Orion server reports. This happens when the monitored host is behind a
NAT or proxy device. In these cases, enter the IP address of the SolarWinds Orion server or
the additional polling engine as it is accessible from the host where the agent will be
installed.
a. To use an existing polling engine, select Use Connection Details from Polling Engine,
and then select a polling engine from the list.
b. To manually enter the polling engine IP address, select Enter Connection Details
Manually, and then enter the host name and IP address. The IP address is required. Use
the host name and IP address of the polling engine that you can access from the client.
n For server-initiated communications, enter your agent communication port number. The
default port is 17790.
6. Click Download .MSI, and save the file.
7. Click Download .MST, and save the file.
Add the MST file to a Group Policy
1. Copy the MSI and MST files to a shared network location that is accessible to the hosts where you
want to deploy the agent software.
2. Configure the permissions on the shared location to ensure that all required users and computers
have Read access to the installation files.
3. Locate the container in Active Directory (a site, a domain, or an organizational unit (OU)) where you
want to advertise the application and access the container properties.
4. Add the modification for the application package. For more information, search for "Add or remove
modifications for an application package" at technet.microsoft.com.
5. After you complete the setup, the agent is deployed and registered by Orion (if auto-registration is
enabled as defined in the Agent settings page).
301
When the installation is successful, the agent displays in the agent list on the Manage Agents page.
What is an MST file?
A Microsoft Transform (MST) file is a collection of specified changes applied to a base Windows Installer
package file at the time of deployment. It is an overlay on top of an existing MSI file that defines what
specific components or features of an application get installed. The MST file modifies the Microsoft
Installer package.
After the software you want to install is packaged in the Windows Installer package format, you can use
MST files to customize the software for your organization, such as installing only specific features. The
modular design of Windows Installer packages simplifies deployment. When you apply transforms to an
MSI file, Windows Installer can dynamically add or modify data in the installation database to customize
the installation of the application. Additional information on creating MST files can be found on
technet.microsoft.com.

1. Share a folder containing the MST and MSI files with proper permissions.
2. Create a Group Policy object. In Advanced Options, add the Software installation policy selecting the
network path for Agent MSI/MST.
The agent is deployed at login and is registered by Orion (if auto-registration is enabled).
302
Deploy with a Gold Master Image
Use a Gold Master Image when you want to maintain a master image that is copied when a new server is
provisioned. This is useful for virtual machines, physical servers, and cloud instances. Whenever a new
server is brought online using this image, the agent will already be installed.
Install an agent offline

4. Click Distribute via a Golden Master Image, and click Next.
5. Select the agent communication mode. This information is included in the MST file.
n For agent-initiated communication, enter the polling engine you want the agent to use. You
may need to manually enter the polling engine information if the IP address is different from
what the SolarWinds Orion server reports. This happens when the monitored host is behind a
NAT or proxy device. In these cases, enter the IP address of the SolarWinds Orion server or
the additional polling engine as it is accessible from the host where the agent will be
installed.
a. To use an existing polling engine, select Use Connection Details from Polling Engine,
and then select a polling engine from the list.
b. To manually enter the polling engine IP address, select Enter Connection Details
Manually, and then enter the host name and IP address. The IP address is required. Use
the host name and IP address of the polling engine that you can access from the client.
n For server-initiated communications, enter your agent communication port number. The
default port is 17790.
6. Click Download .ZIP, and save the file.
7. Extract the contents of the ZIP file, and double-click setup.bat.
8. Follow the instructions in the installation wizard.
Enable server-initiated communication on deployed agents

If you are deploying a server-initiated agent, take the following steps to enable agent communication with

3. Click Add Agent > Connect to a previously installed agent > Next.
4. Enter a name for the agent, and click Server-initiated communication.
5. Enter the IP address of the node where the agent is deployed, and the port number for the agent.
The default port is 17790.
6. Click Submit.
303
Deploy a Windows agent with Patch Manager
You can only perform this deployment method if you have successfully configured Patch Manager to push
software in your environment.
Download the installation files

5. Select the communication method and enter the required information. For more information, see
Mass deploy a Windows agent.
6. Download and save the MSI and MST files to a location on your Patch Manager server.
Record the Latest Version value under the MSI file download. This is needed when creating a
package in Patch Manager.
Optional: Rename the SolarWinds agent files to SolarWinds Agent <version> for easier
tracking.
Build the package
1. Launch SolarWinds Patch Manager.

2. In the navigation pane, expand Administration and Reporting > Software Publishing, and then click
SolarWinds, Inc. Packages.
3. From the SolarWinds, Inc. Packages action pane, click New Package. This launches the Patch Manager
Package Wizard.
304
4. In the package information screen, enter the following general information for the package:
n Package Title: SolarWinds Orion Agent (version number) MSI
n Description: SolarWinds Orion Agent
n Classification: Tools
n Vendor: SolarWinds, Inc.
n Product: Orion Agent (This must be entered the first time)
n Severity: None
n Impact: Normal
n Reboot Behavior: Can request reboot
All other fields can be left empty.
5. Click Next.
Add deployment rules
1. On the Prerequisite Rules window, click Add Rule.

2. Select Windows Version as the Rule Type, and enter the following information:
3. Click OK to save this rule, and click Next.

4. On the Select Package window, select the Package Type as a Microsoft Installer File (.msi), and then
select I already have the content for the package locally on my network.
5. Click the browse icon and locate the MSI file for the SolarWinds Orion agent. The Download URL field
will automatically populate.
305
6. The GUID product code is extracted from the MSI file and displayed for review. Copy the GUID
product code that you will use later.
The GUID is detected from the installer. Use the one displayed in your environment.
7. Select Includes additional files with the package, and click the button to the right to open the
Package Content Editor.
8. In the Package Content Editor, click Add Files, and browse to the MST File for the SolarWinds Orion
agent.
9. Click OK to close the Package Content Editor. To confirm that you want to add these files to the cache,
click Yes.
10. Select None for the Binary Language.
11. In the Command Line field, enter: TRASNFORMS=(MST FILE NAME)
Example: TRANSFORMS=SolarWinds_Agent_1.5.0.951.mst
12. Click Next.

13. On the Applicability Rules window, click Add Rule > Create MSI Rule.
14. Select Rule Type: Product Installed, and select Not Rule.
15. Enter the product code without the braces, and leave all other fields empty.
16. On the Installed Rules window, click OK to save the rule, and then click Next.
17. Click Add Rule > Basic Rule.
18. For the Rule Type, select File Version with Registry Value. Enter the following values:
a. Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SolarWinds\Agent
b. Registry Value: InstallDir
c. Comparison: Equal To.
d. Version: Version number of the agent
306
19. Click OK to save the rule, and click Next. Review the Summary Page, and enter notes at the bottom.
20. Click Next to save, and click OK.
When the file packaging and uploading completes, a Package Saved dialog displays.
Publish the package
1. In the SolarWinds, Inc. Packages view in Patch Manager, select the SolarWinds Orion Agent package
that you created.
2. In the SolarWinds Orion Agent action pane, click Publish Packages.
3. Accept the default selections, or choose a specific Windows Server Update Services (WSUS) server for
publication, and then click Next.
4. You are notified when the package publishes.
5. Click Finish to close the Publishing Wizard.
The package for the SolarWinds Orion agent is packaged and published to your WSUS server.
307
Deploy on Windows Core Servers
If you are installing the agent on a Windows Core Server, you must install the .NET Framework 4.0. Also
install the latest Windows service pack and critical updates.
Prerequisites to installing an agent on Windows Core
n Start WoW64.
n Start the .NET 2.0 layer.
n Start the .NET 2.0 layer for WoW64.
n Download and install the .NET framework from www.microsoft.com.
By default, no web browser is installed with Windows Core. Consider transferring the necessary files
with FTP or a flash drive.
Once the .NET Framework is installed, you may need to reboot the host server. The agent can then be
deployed to the host server and operate normally.
308
Deploy Windows agents in the cloud
Agents can be deployed in the cloud for use with Amazon Web Services, Microsoft Azure, and other third-
party cloud infrastructure services.
309
Manually deploy a Windows agent on Amazon Web Services
You can manually deploy agents to a virtual machine using Remote Desktop Connection.
Requirements for manual agent deployment

n Agent-initiated communication: The poller must have a public IP address which is visible from the
node with the agent installed. Port 17778 must be open on the poller.
n Server-initiated communication: The node with the agent installed must have a public IP address.
Port 17790 must be open.
You can manually deploy the agent in one of two ways:
Install through the command prompt

5. Download the MSI and MST files.
6. Run a command prompt as administrator context.
7. Enter the following command:
msiexec /i "SolarWinds-Agent.msi" TRANSFORMS="SolarWinds-Agent.mst"
Deploy the agent manually using the interactive wizard

Following the instructions in Deploy the Windows agent manually.
310
Automatically deploy a Windows agent on Amazon Web Services

6. Log in to your AWS S3 account.
7. Create a bucket and upload the MSI and MST files.
8. Create a PowerShell script to use on each virtual machine where you want to install the agent. This
script will run on each virtual machine when it is launched for the first time, downloading and
executing the agent.
9. Log in to your Amazon Web Services account.
You can perform the following steps through the API or AWS command line interface.
10. Create an instance, and paste your PowerShell script under Advanced Details in the User Data text
box. Select the As Text option.
11. For instances that are already created, take the following steps:
a. Stop the instance where you want to deploy the agent
b. Right-click the instance and click Instance Settings > View/Change User Data.
c. Paste you PowerShell script in the text box as Plain Text.
311
Automatically deploy a Windows agent on Microsoft Azure

6. Upload the MSI and MST files to your Azure Blob Storage.
7. Create a PowerShell script to use on each virtual machine where you want to install the agent. This
script will run on each virtual machine when it is launched for the first time, downloading and
executing the agent.
8. Add your PowerShell script to virtual machines manually on the last step of the Create a Virtual
Machine wizard in the Azure management portal.
This step can also be accomplished via the API or AWS command line interface.
312
Certificates and the agent
The Verisign Root Certificate Authority (CA) must be current. This is required because the agent software is
signed using a Verisign certificate. If your certificate is not current, you must download the Root CA
certificate and install it to the Local Computer\Trusted Root Certification Authority store on
the server hosting the agent.
For more information, search for "Add the Certificates Snap-in to an MMC" at technet.microsoft.com.
313
Manage agents, connections, and deployment status
Check agent connection and deployment status on the Manage Agents page.

Manage Agents toolbar options
n Add Agent: Takes you to the Add Agent page, where you can deploy the agent on a network, or
connect to a previously installed agent.
n Edit Settings: Takes you to the Edit Agent Settings page, where you can adjust the agent name and
automatic updating.
n Delete: Deleting an agent from within this toolbar or the Manage Nodes page provides you the
option to remotely uninstall the agent.
n Choose Resources: Displays a list of resources and statistics to monitor. This is only available for
agents that are deployed on nodes.
n For a Single Agent: Takes you to the List Resources page to choose items on the node you wish
to monitor.
n For Multiple Agents: From here, SolarWinds Orion discovers available resources on the agents
you have selected using Network Sonar Discovery. You can choose items on the nodes you wish
to monitor.
n Manage as Node: This will manage the agent as a new node by navigating to the Add Node page
with pre-configured agent details.
n More Actions:
n View installed agent plug-ins: Displays a dialog detailing the node the agent is deployed on,
the agent status, connection status, plug-in status, and plug-in version.
n View installed plug-ins report: Generates a report detailing the following: Node Status, Agent
DNS Name, Automatic Update enabled, Connection Status, Agent Status, Agent Version, Plugin,
Plugin status, and Plugin Version.
n Retry agent installation: Attempts to install the agent in the event of a file transfer timeout due
to network connectivity issues.
n Reboot Agent Machine: Reboots the server that hosts the selected agent.
This button is disabled by default. It is enabled when the installation of an agent

requires a system reboot.
n Update: Updates the agent software to the latest version available.
This button is disabled by default. It becomes enabled when:

n Automatic updates for the agent is disabled.
n The selected agent requires an update.
n Reconnect to passive agent: The server tries to re-establish the connection to the passive agent
when the connection is lost and automatic reconnection fails. This can also be used for
connecting to an agent that was deleted but not uninstalled.
314
Manage Agents table columns
COLUMN HEADER DESCRIPTION

Agent/Node Name or IP address of the listed node.
Current status of the listed agent.
Agent Status can be as follows:
n Connected/OK: Everything is working.

n Unknown: The agent is connected but no communication is received.
n Update Available: The agent version is older than the version on server and
should be updated.
n Update in Progress: The agent is currently being updated.
Agent Status
n Reboot Required: The agent needs to be rebooted in order to finish the
installation of plugins.
n Reboot in Progress: The agent is currently being rebooted. Once reboot is
complete, the agent should finish installation of plugins.
n Reboot Failed: The agent cannot be rebooted. It may be temporarily offline or
there may be some other issue.
n Plugin Update Pending: A plugin on the agent has an older version than the
one that is on the server and should be updated.
Current connection status of the listed agent.
Connection status can be as follows:
n Connected/OK: The agent is connected.

n Unknown: The agent management service is not running.
n Service not Responding: The agent management service is running, but the
agent is not connected.
Connection Status n Deployment Pending: An agent deployment is going to start, but has not
started.
n Deployment in Progress: The agent is being deployed to the target node.
n Deployment Failed: Agent deployment failed.
n Invalid Response: The status displayed if the agent responds in an unexpected
manner.
n Waiting for Connection: The agent was approved, but has yet to connect to the
SolarWinds Orion server.
Registered On Date when the agent was added to the agent management system.
Agent communication type:

Mode n Agent-initiated: The agent initiates the connection to the agent management
system.
315
n Server-initiated: The agent behaves as a web server and the agent
management system initiates the connection.
Version of the agent software. This is helpful in determining which agents should be
Version
updated.
316
Edit agent settings
Editing the configuration of an agent may be necessary if you experience problems and want to collect
diagnostics.

3. Select an agent, and click Edit Settings.
Agent settings and troubleshooting options
n Agent Name: change the display name displayed in Orion.

n Communication type: choose whether the agent uses server-initiated or agent-initiated
communication.
n Allow automatic agent updates: choose whether the Orion server can update the agent software to
the latest version available.
n Troubleshooting:
n Log level: the amount of detail saved to the log.
n Diagnostics: click Collect new diagnostics, and then Download to save to your local disk. Send
the zip file to our support team if requested.
317
Track your polling method
If nodes are using different polling methods, you may want to keep track of the polling method of each
node to troubleshoot issues more easily. There are several methods you can use to identify the polling
method of nodes:
n Node Details page: View individually

n Application Details page: View individually
n Manage Nodes page: View as a list
n Create a report to identify agent usage
Identify the polling method from the Node Details page
1. From the web console, click My Dashboards > Home.

2. In the All Nodes resource, expand a node tree and click a node to go to the Node Details page.
3. In the Polling Details resource, locate the Polling Method.
Identify the polling method from the Application Details page
1. From the Orion Web Console, click My Dashboards > Applications.

2. In the All Applications resource, expand an application tree and click an application to go to the
Application page.
3. In the Application Details resource, click Management > Edit Application Monitor.
4. Expand the Advanced heading to located the Preferred Polling Method.
Identify the polling method from the Manage Nodes page

2. Under Node & Group Management, click Manage Nodes.
3. If not already visible, add the Polling Method field by clicking >> in the upper-right of the table.
Create a report to identify agent usage
1. From the web console, navigate to Reports > All Reports.

2. Type agent in the Search box.
3. Click Agent Inventory to view the report.
318
View the status of agent plug-ins

3. Select an agent, and click More Actions > View installed agent plug-ins.
STATUS MEANING
The plug-
in is The plug-in is installed, working correctly, and communicating with no problems.
installed
The plug-in is waiting to be deployed. It may be waiting for the computer it is installed on to
Installation
reboot, or because some other process on the remote host has interrupted the installation
Pending
process.
The status is unknown due to networking interruptions, communication problems with the
Unknown
agent, or because the plug-in is no longer installed.
Error The plug-in may have installed incorrectly or failed to load.
In Progress The plug-in is either being installed or uninstalled.
If you think a plug-in should be available and cannot find it in the list, you may need to check your
purchased products or manually update your agent. New plug-ins and updates to existing plug-ins are
installed when an agent is updated. It may take a few minutes before the status changes.
319
Edit agent settings in the Windows Control Panel
If the agent loses connectivity to the SolarWinds Orion server, or is unable to connect after being manually
installed, you can configure its settings in the Windows Control Panel. This enables the agent to reconnect
to the SolarWinds Orion server.
1. Open Orion Agent Settings in the Control Panel.

2. Select the Agent Communication Mode.
3. Edit the Connection Settings.
The Agent Shared Secret is provided for security. When you install the agent, you must set a
shared secret. When the SolarWinds Orion server connects to the agent, it verifies the secret
to connect.
4. Click OK to save your changes.
320
You can connect to agents that you installed previously or modify the assigned polling engine of the agent.
The steps are different depending on the agent communication mode. You should confirm the agent
communication mode before connecting.
Connect to an agent using agent-initiated communication

3. Click Add Agent.
4. Click Connect to a previously installed agent, and click Next.
5. Enter the name of the agent you want to connect to, and select Agent-initiated communication.
6. Select the agent from the Agent list.
7. Expand Advanced to change the proxy.
8. Select Allow automatic agent updates.
Disabling this option requires you to upgrade agents manually after upgrading your
SolarWinds products and modules.
9. Click Submit.

Connect to an agent using server-initiated communication

3. Click Add Agent.
5. Enter the name of the agent you want to connect to, and select Server-initiated communication.
6. Enter the IP address or hostname where the agent is installed.
7. Expand Advanced to change the port number, assign the agent to a different poller, or use a proxy to
connect to the agent.
Disabling this option requires you to upgrade agents manually after upgrading your
SolarWinds products and modules.
9. Click Submit.

321
Change agent communication modes
When you want to change how the agent communicates back to the SolarWinds Orion server, you must
uninstall and redeploy the agent with the new communication method. Ensure that you loose as little data
as possible, and prevent alerts or node down notifications, by changing the polling method before you
remove the agent.
Change the polling method
1. Click My Dashboards > Home

2. In the All Nodes resource, click the node to go to its Node Details page.
3. In the Management resource, click Edit Node.
4. Under Polling Method, click Windows Servers: WMI and ICMP.
5. Enter your WMI credentials, and click Submit.
Delete the agent

3. Select the agent to uninstall, and click Delete.
Install the agent in the new mode

3. Click Add Agent.
4. Click Deploy the agent on my network, and click Next.
5. Under Select from Existing Nodes, select the node, and then click Next.
6. Enter credentials, and select the communication mode.
n Active: (Agent-initiated communication) The agent initiates communication with the server on
port 17778. This port must be open on the server firewall so the agent can connect. No
change to the agent firewall is required.
n Passive: (Server-initiated communication) The agent waits for requests from the server on a
specified port. This port must be open on the firewall on the agent computer so the server
can connect. No change to the server firewall is required.
7. Click Deploy agent.
Restore the polling method

4. Under Polling Method, click Windows & Linux Servers: Agent.
5. Click Submit.
322
Change the agent port
1. On the computer with the deployed agent, edit the following configuration file using a text editor:
C:\Program Files (x86)
\SolarWinds\Orion\AgentManagement\SolarWinds.AgentManagement.ServiceCore.dl
l.config
2. Change the port number on the following line:
<agentManagementServiceConfiguration messagingPort="17778" />
3. Save the file.
4. Restart the SolarWinds Orion Module Engine service.
n If you installed the agent manually, you can change the port number during installation
through the wizard in the web console.
n If you deployed the agent from the server, the port number is set automatically.
n If you used the MST file for mass deployment, you must download a new MST file from the
server after you change the port number.
Change the port on deployed agents
1. Logon to the computer with the deployed agent.

3. Enter a new port number, and click OK.
323
Agent polling method
An agent is software that provides a communication channel between the Orion server and a Windows or
Linux computer. Agents are used to provide information about key devices and applications that you
specify. For more information about the polling method, see Choose the polling method to use.
When the Agent Polling Method is selected, an agent is deployed to the node and installed using the
credential you selected. After the agent is installed, it operates under a local account.
324
Check nodes polling with agents for changes
Agent discovery has an option to keep nodes updated that use agents. Select this option so the Orion
server can find new volumes, interfaces, and other objects on nodes that are polled by an agent.
While normal discovery finds new nodes and adds them to the SolarWinds Orion server, this is not true for
nodes using the agent. Agent discovery is an extension to the standard discovery process.
A discovery profile may contain:
n Nodes using both the agent and non-agent nodes

n Non-agent nodes
n Agent nodes
325
View network events in the Web Console
All events that occur to monitored devices on your network are automatically logged and displayed in the
Orion Web Console. You can view and remove them as your network management policies require.
326
Filter the displayed logged events in the Web Console
Network events are logged and shown in the order they occur in the Events view of the Orion Web Console.
You can choose how long network events are kept in the Events Retention field in Orion Polling
Settings under Database Settings.
1. Click Events in the Views toolbar in the Orion Web Console.
2. Filter events by object, event type, or time period.
3. In the Show X Events field, provide the maximum number of events to view. Showing a large number
of events, such as a 1000, can negatively impact performance.
4. To show events that have already been cleared, select Show Cleared Events.
5. Click Refresh.
327
Remove events from the Web Console
Clearing an event removes the event from the Events view.
Cleared events are not removed from the event log and can still be used for reporting.
1. Click Alerts & Activity > Events in the menu bar.

2. Select individual events to clear or click Select All.
Syslogs and traps

Monitor Syslog messages
Syslog messages are received by the SolarWinds Syslog Service, which listens for incoming messages on
UDP port 514. Received messages are decoded and stored in the SolarWinds Orion database. The
SolarWinds Syslog Service can handle large numbers of simultaneously incoming Syslog messages from all
your monitored devices.
A SolarWinds installation can process approximately 1 million Syslog messages per hour, which is
about 300 Syslog messages per second. You can process more by increasing your hardware
requirements over the minimum requirements.
You can view Syslog messages in the Orion Web Console or in the Syslog Viewer application.
Before you begin
n Confirm that your network devices are configured to send Syslog messages to the SolarWinds Orion
server IP address. For proper configuration of network devices, refer to the documentation supplied
by the device vendor.
n Ensure UDP port 514 is open for IPv4 and IPv6.
n The message must be formatted according to the Request for Comments (RFC) requirements.
n If a long message is split into smaller parts, these parts should be formatted to not be skipped.
SolarWinds recommends setting up Enable RFC Relay in the service to true to allow the
service to restructure the message by adding the default facility, severity, or date.
328
Configure the SolarWinds Orion server to use the correct syslog port
By default, SolarWinds Syslog Service listens for syslog messages on port 514 (UDP). If your devices use a
different port for sending syslog messages, consider reconfiguring the port on devices, or change the port
on which the service listens.
Running the Configuration Wizard will revert all changes made to

the SyslogService.exe.config file.
If you run the Configuration Wizard, you must repeat this procedure to restore the port setting.

2. Go to Advanced Configuration settings. Copy /Admin/AdvancedConfiguration/Global.aspx,
and paste it into your browser address bar, after /Orion.
The address in the address bar should look as follows:
<your product server>/Orion/Admin/AdvancedConfiguration/Global.aspx
3. On the Global tab, scroll down to SyslogService.SyslogSettings, and enter the UDP port
number in the UDPListenPort entry.
4. Click Save.
Syslog message priorities
At the beginning of each Syslog message, there is a priority value. The priority value is calculated using the
following formula:
Priority = Facility * 8 + Severity
Syslog facilities
The facility value indicates which machine process created the message. The Syslog protocol was originally
written on BSD Unix, so Facilities reflect the names of UNIX processes and daemons.
If you are receiving messages from a UNIX system, consider using the User Facility as your first
choice. Local0 through Local7 are not used by UNIX and are traditionally used by networking
equipment. Cisco routers, for example, use Local6 or Local7.
329
NUMBER SOURCE NUMBER SOURCE
0 kernel messages 12 NTP subsystem
1 user-level messages 13 log audit
2 mail system 14 log alert
3 system daemons 15 clock daemon
4 security/authorization messages 16 local use 0 (local0)
5 messages generated internally by Syslog 17 local use 1 (local1)
6 line printer subsystem 18 local use 2 (local2)
7 network news subsystem 19 local use 2 (local3)
8 UUCP subsystem 20 local use 2 (local4)
9 clock daemon 21 local use 2 (local5)
11 FTP daemon 23 local use 2 (local7)
Syslog severities
The following table provides a list of Syslog severity levels with descriptions and suggested actions for
each.
NUMBER SEVERITY SUGGESTED ACTIONS
0 Emergency A "panic" condition affecting multiple applications, servers, or sites. System

is unusable. Notify all technical staff on call.
1 Alert A condition requiring immediate correction, for example, the loss of a

backup ISP connection. Notify staff who can fix the problem.
2 Critical A condition requiring immediate correction or indicating a failure in a

primary system, for example, a loss of a primary ISP connection. Fix CRITICAL
issues before ALERT-level problems.
3 Error Non-urgent failures. Notify developers or administrators as errors must be

resolved within a given time.
330
4 Warning Warning messages are not errors, but they indicate that an error will occur
if required action is not taken. An example is a file system that is 85% full.
Each item must be resolved within a given time.
5 Notice Events that are unusual but are not error conditions. These items might be
summarized in an email to developers or administrators to spot potential
problems. No immediate action is required.
6 Informational Normal operational messages. These may be harvested for network

maintenance functions like reporting and throughput measurement. No
action is required.
7 Debug Information useful to developers for debugging an application. This

information is not useful during operations.
331
Syslog facilities
The facility value indicates which machine process created the message. The Syslog protocol was originally
written on BSD Unix, so Facilities reflect the names of UNIX processes and daemons.
If you are receiving messages from a UNIX system, consider using the User Facility as your first
choice. Local0 through Local7 are not used by UNIX and are traditionally used by networking
equipment. Cisco routers, for example, use Local6 or Local7.
NUMBER SOURCE NUMBER SOURCE
0 kernel messages 12 NTP subsystem
1 user-level messages 13 log audit
2 mail system 14 log alert
3 system daemons 15 clock daemon
5 messages generated internally by Syslog 17 local use 1 (local1)
6 line printer subsystem 18 local use 2 (local2)
7 network news subsystem 19 local use 2 (local3)
8 UUCP subsystem 20 local use 2 (local4)
9 clock daemon 21 local use 2 (local5)
11 FTP daemon 23 local use 2 (local7)
Syslog severities
The following table provides a list of Syslog severity levels with descriptions and suggested actions for
each.
0 Emergency A "panic" condition affecting multiple applications, servers, or sites. System

is unusable. Notify all technical staff on call.
1 Alert A condition requiring immediate correction, for example, the loss of a

backup ISP connection. Notify staff who can fix the problem.
332
2 Critical A condition requiring immediate correction or indicating a failure in a

primary system, for example, a loss of a primary ISP connection. Fix CRITICAL
issues before ALERT-level problems.
3 Error Non-urgent failures. Notify developers or administrators as errors must be

resolved within a given time.
4 Warning Warning messages are not errors, but they indicate that an error will occur
if required action is not taken. An example is a file system that is 85% full.
Each item must be resolved within a given time.
5 Notice Events that are unusual but are not error conditions. These items might be
summarized in an email to developers or administrators to spot potential
problems. No immediate action is required.
6 Informational Normal operational messages. These may be harvested for network

maintenance functions like reporting and throughput measurement. No
action is required.
7 Debug Information useful to developers for debugging an application. This

information is not useful during operations.
View Syslog messages in the Orion Web Console
The Syslogs view displays a list of all the Syslog messages generated by monitored network devices. The
messages are listed by time of transmission, with the most recent at the top of the list.
1. Log in to the Orion Web Console, and click Alerts & Activity > Syslog in the menu bar.
2. To filter Syslog messages so that only messages relevant for specific devices are displayed:
n To view messages for a specific Syslog-enabled network object, select it in the Network Object
list.
Only objects that have sent a Syslog message to the Orion server will be listed in this
field.
n To view messages for a specific device, provide the IP address in the IP Address field.
n To view messages for a specific device type, select it in the Type of Device list.
n To view messages for a specific vendor, select the vendor in the Vendors list.
333
3. To select which Syslog messages should be displayed:
n To view only messages with a severity, select the severity. See Syslog severities.
n To view messages for a facility, select the facility. See Syslog facilities.
n To view messages of a type, type the string into the Message Type field.
n To view only messages containing a pattern, provide the string in the Message Pattern field.
You can use the following wildcards:
Asterisk (*)
Use * before or after the pattern string if the provided pattern is not the
beginning, the end or the full message.
Underscore (_)
Use _ as a placeholder for one character.
n To view Syslog messages from a specific period of time, select either a period of time or enter
custom Beginning and Ending Date/Times.
n Type the number of Syslog messages you want to view into Number of Displayed Messages.
n To view cleared and acknowledged Syslog messages, select Show Cleared Messages.
4. Click Refresh to update the Syslog messages list with your settings.
Syslog messages matching the selected criteria display in a list beneath the search area.
Click Hide or Show in the top-right corner of the view to remove or restore the Syslog messages
search criteria area.
Click the Hostname or Message to open the Device Details view for the device.
To print the resulting list, click Printable Version.
Clear Syslog messages in the Orion Web Console

2. Click Alerts & Activity > Syslogs in the menu bar.
3. Define what you want to see in the Syslog messages table, and click Refresh.
4. Select the messages you want to acknowledge, and click Clear Selected Messages.
The messages are cleared. You can see cleared messages when you select the Show Cleared Messages
box.
View and acknowledge Syslog messages in the Syslog Viewer
Syslog Viewer collects Syslog messages from your network and presents them in a readily reviewable and
searchable list so that you can easily monitor your network.
1. Click Start > All Programs > SolarWinds Orion > Syslog and SNMP Traps > Syslog Viewer.
2. Click View > Current Messages.
3. Acknowledge current messages:
n Right-click any message, and select Acknowledge Selected.
n Add an Acknowledged column to the Syslog Viewer, and select the messages that you want to
acknowledge. See Configure Syslog Viewer.
334
Search for Syslog messages in the Syslog Viewer
In the Syslog Viewer, you can search through collected Syslog messages and format search results.
1. Click View > Search Messages.

2. Enter the search criteria.
3. Click Search Database.
4. To group messages for easier navigation, select the type of grouping from the Grouping list.
You can acknowledge messages both in the search results and in the Current Messages view.
See Configure Syslog Viewer.
5. To limit the number of displayed message, enter or select a number in the Maximum Number of
Messages to Display field.
6. To view messages that meet your search criteria as they arrive, select a number for the Auto Refresh
Every number of seconds field.
Auto Refresh is only available when you are viewing current messages. The Date/Time Range
must be set to Today, Last 24 Hours, Last 2 Hours, or Last Hour.
Configure Syslog Viewer
2. Click File > Settings.
3. Click the General tab in the Syslog Server Settings window.
4. Adjust the Maximum Number of Messages to Display in Current Messages view slider to set the
number of messages you want to display.
5. To Automatically Refresh the Current Messages View, select the option, and set the refresh rate with
the middle slider.
6. Adjust Retain Syslog Messages for How Many Days to set the length of time Syslog messages should
stay in the database.
This setting significantly affects the database size and performance.
7. Click the Displayed Columns tab.

8. Use the arrow keys to select and order the fields of information you want to see in the Current
Messages view.
Acknowledging Syslog messages is easier if you add the Acknowledged column to your view.
9. To wrap Syslog message text in the Current Messages view, select Word Wrap Long Messages.
10. If you do not expect to use the Syslog Viewer as your primary viewer for Syslog messages, select the
Message Parsing tab, and select what should be removed:
n Remove embedded Date/Time from Syslog Messages
n Remove Message Type from Syslog Messages
n Remove Domain Name from DNS Lookups.
335
Removing the added data from each record helps you reduce the size of your SolarWinds
Orion database.
Configure received Syslog messages to trigger alerts
The Syslog Viewer can trigger alerts when received Syslog messages match defined rules.
Syslog rules may not be applied to nodes in an unmanaged state.
3. Click Alerts/Filter Rules.
4. To create a rule, click Add New Rule.
5. To edit a rule, select the rule, and click Edit Selected Rule.
6. On the General tab, complete the following steps:
a. Provide or edit the Rule Name.
b. Select Enabled.
c. Select the servers from the Apply this Rule To list.
d. Enter the IP addresses or subnets to which this rule applies in the Source IP Addresses area.
7. To limit the rule only to messages from specific hosts, domains, or host name patterns, click the DNS
Hostname tab, and enter a DNS Hostname Pattern.
The DNS Hostname Pattern rule is case-sensitive.
To use regular expressions, select Use Regular Expressions in this Rule.

8. To limit the rule only to specific message types or texts within a Syslog message, go to the Message
tab, and enter rules for Message Type Pattern and Syslog Message Pattern.
9. To apply specific severity or facility types, go to the Severity / Facility tab, and select the severity and
facility types.
By default, all message severities and facilities are selected. See Syslog message priorities for
information about severities and facilities.
10. To apply the rule only during a specific period of time, select the Time of Day tab, select Enable Time
of Day Checking, enter the time period, and select the days of the week on which to apply the rule.
Messages received outside the specified time frame will not trigger alerts.
Enabling Time of Day checking creates more overhead for the CPU.
11. To suppress alert actions until a specified number of messages arrive that match the rule, complete
the following procedure:
a. Select the Trigger Threshold tab, and select Define a Trigger Threshold for this Rule.
b. Enter option values.
When Suspend Further Alert Actions For is selected, alert actions are not sent until the
specified amount of time has expired. When the time period expires, only new alerts are
sent. All alerts suppressed during the time period are discarded.
336
12. Configure Syslog alert actions on the Alert Actions tab:
a. To create an action for the rule, click Add New Action.
b. To edit an action for the rule, select the action, and click Edit Selected Action.
c. Configure the action.
Syslog alerts use a unique set of variables.
d. To delete an action, select the action, and click Delete Action.
e. Use the arrow buttons to set the order in which actions are performed.
Actions are processed in the order listed, from top to bottom.
f. Click OK to save all changes and return to Syslog Viewer Settings.
13. Use the arrow buttons to arrange the order in which the rules are applied.
Rules are processed in the order they appear, from top to bottom.
Forward Syslog messages
The Syslog message forwarding action allows you to forward received Syslog messages. Additionally, if you
have WinPCap version 3.0 or later installed on your SolarWinds Orion server, you can forward Syslog
messages as spoofed network packets.
The following procedure assumes you are editing a Forward the Syslog Message alert action. For
more information, see Configure received Syslog messages to trigger alerts.
1. Provide the hostname or IP address of the destination to which you want to forward the received
Syslog message.
2. Provide the UDP Port you are using for Syslog messaging.
The default is UDP port 514.
3. Specify what IP address should be used for the source device in the syslog message. By default, the
device IP is replaced by the SolarWinds Orion server IP address.
a. To designate a specific IP address or hostname as the Syslog source, select Retain the
Original Source Address of the Message, select Use a Fixed Source IP Address, and provide
the IP address or hostname.
b. To keep the original IP address of the Syslog source device, select Retain the Original Source
Address of the Message, select Spoof Network Packet, and select the Network Adapter.
4. Click OK to complete the configuration.
Monitor SNMP traps
If you monitor a large number of devices, where each device may have many connected objects of its own,
requesting information from each device is impractical. You can set up the SNMP Trap Server, and each
managed device can notify it about any issues by sending a trap message.
You can monitor SNMP traps with SolarWinds NPM or SolarWinds SAM.
SNMP traps are received by the SolarWinds Trap Service, which listens for incoming trap messages on UDP
port 162, and then decodes, displays, and stores the messages in the SolarWinds Orion database.
337
The SolarWinds Trap Service can receive and process SNMP traps from any type of monitored network
device, and can handle large numbers of simultaneously incoming traps.
A SolarWinds installation can process approximately 500 traps per second. Higher capacity can only
be achieved with significant hardware improvements over minimum SolarWinds requirements.
You can view SNMP traps either in the Orion Web Console or in the Trap Viewer application. The Trap
Viewer application allows you to configure trap-specific alerts, to view, filter, and search for traps.
Before you begin
n Configure devices to send SNMP traps to the IP address assigned to the Orion server. For more
information about proper configuration, refer to the documentation supplied by the vendor of your
devices.
n Make sure the UDP port 162 is open for IPv4 and IPv6.
n When you use SNMPv3 for polling a device and receiving traps from it, confirm that the same
authentication type (auth, noauth, or priv) is configured for both polling and traps.
View SNMP traps in the Orion Web Console
You can also search trap messages using the Global Search feature. For more information, see
Search syslogs, traps and objects monitored in the Orion Web Console globally.
1. Log in the Orion Web Console.

2. Click Alerts & Activity > Traps in the menu bar.
3. To display only traps relevant for a specific device, specify the device:
n To display only traps for a device, select the device in the Network Object field.
n To view traps for certain device type, select the device type in the Type of Device field.
4. Define what traps you want to view:
n To view only traps of a designated type, select the type in the Trap Type field.
n To view only traps originating from a specific IP address, type the IP Address in the Source IP
Address field.
n To view only traps with a designated community string, select the string in the Community
String field.
n To view only traps from a specific period of time, select the time period from the Time Period
menu.
5. Confirm the number of traps displayed in the Number of Displayed Traps field.
6. Click Refresh to update the Traps view with your new settings.
View current traps in the Trap Viewer
1. Click Start > All Programs > SolarWinds Orion > Syslog and SNMP Traps > Trap Viewer.
2. Click View > Current Traps.
3. Click a column header to order listed traps by the selected trap characteristic.
338
4. Configure the Trap Viewer by clicking and dragging columns to order the presentation of trap
characteristics.
Search for traps in the Trap Viewer
You can search collected trap messages and format the search results list in the Trap Viewer.
2. Click View > Search Traps.
3. Enter search criteria, and click Search Database.
4. To group messages for easier navigation, select the type of grouping from the Grouping list.
5. To limit the number of displayed messages, enter or select a number in the Maximum number of
messages to display field.
6. To view messages that meet your search criteria as they arrive, select a number for the Auto Refresh
Every number seconds field.
Auto Refresh is only available when you are viewing current messages. The Date / Time Range
must be set to Today, Last 24 Hours, Last 2 Hours, or Last Hour.
7. To hide the search criteria pane, toggle the pane open and closed by clicking the double up arrows
in the top right of the page.
Configure Trap Viewer
3. On the General tab, configure the Trap server settings:
a. Position the top slider to set the Maximum Number of Traps to Display in Current Traps
View.
b. If you want to Automatically Refresh the Current Traps View, select the option, and position
the middle slider to set the refresh rate.
c. Position the Retain Trap Messages For How Many Days slider to set the length of time that
traps remain in the database.
4. On the Displayed Columns tab, use the arrow keys to select and order the fields of information you
want to see in the Current Traps view.
5. If you do not need the domain name in your trap messages, select Remove Domain Name from DNS
Lookups on the Message Parsing tab.
Selecting this option can slightly reduce the size of your database.
Configure Trap Viewer filters and alerts
In the Trap Viewer, you can filter trap messages, and configure actions that trigger when received trap
messages match defined rules.
With the exception of the asterisk (*) and underscore (_) wildcards, SolarWinds recommends against
using non-alphanumeric characters in filter definitions.
339
Trap rules are not applied to unmanaged nodes.
2. Click File > Settings, and click the Alerts / Filter Rules tab.
3. Click Add Rule or click Edit Rule.
4. Click the General tab, and select Enabled.
5. Select the servers from the Apply This Rule To list.
6. Apply the rule to specific messages.
n Click DNS Hostname, and enter a DNS Hostname Pattern to apply the rule to messages from
specific hosts, domains, or hostname patterns.
The DNS Hostname Pattern rule is case-sensitive.
n Click Trap Details, and enter a Trap Details Pattern to apply the rule based on the Trap Details
field.
n Click Community String, and enter the patterns in the Community String Pattern field to apply
the rule to specific community strings.
7. Click Conditions to define the what triggers the rule.
n Select object identifiers and comparison functions from the linked context menus.
n Click Browse (…) to insert conditions.
8. Click Time of Day > Enable Time of Day Checking to apply the rule during a specific period of time.
Messages received outside the specified time frame will not trigger alerts.
Enabling Time of Day checking creates more overhead for the CPU.
9. Click Trigger Threshold > Define a Trigger Threshold for this Rule to suppress alert actions until a
specified number of traps arrive that match the rule.
When Suspend Further Alert Actions For is selected, alert actions are not sent until the
specified amount of time has expired. When the time period expires, only new alerts are sent.
All alerts that are suppressed during the time period will never be sent.
10. Click Alert Actions.

n Associate the rule with a new action by clicking Add New Action, and then selecting an action
from the list to configure.
n Edit an existing action for the rule.
11. Use the arrow buttons to set the order in which actions are performed.
Actions are processed in the order they appear, from top to bottom.
12. Click OK to save all changes and return to Trap Viewer Settings.
13. Use the arrow buttons to arrange the order in which the rules are applied.
Rules are processed in the order they appear, from top to bottom.
Trap messages are now filtered by the rules and alert actions are triggered when the rule conditions are
met.
340
What is a Trap Template?
Trap templates are used to format your trap templates. You can use SolarWinds macros or variables in the
OID Value and ValueName attributes or call values from your MIB.
The templates are placed in the following locations:
n /SolarWinds/Common/Orion-Detailed-Alert.trap
n /SolarWinds/Common/Orion-Generic-Alert.trap
n /SolarWinds/Orion/ForwardSyslog.trap
The following table describes the OIDs section of the Orion Generic Alert trap template. This is the section
you modify to display the information you want in your trap messages.
TEMPLATE OID LINE INFORMATION RETURNED

OID OID="1.3.6.1.2.1.1.3.0" MIB="RFC1213-MIB"
This line displays how long the
Name="sysUpTime.0" Value="0" DataType="67"
ValueName="0" HexValue="" device has been up.
OID OID="1.3.6.1.6.3.1.1.4.3.0" MIB="SNMPv2-MIB"

Name="snmpTrapEnterprise.0" This line displays the enterprise
Value="1.3.6.1.4.1.11307" DataType="6" associated with the trap.
ValueName="enterprises.11307" HexValue=""
OID OID="1.3.6.1.4.1.11307.10.1" MIB="SNMPv2-SMI" When the template is used in an

Name="enterprises.11307.10.1" alert, this line displays the alert
Value="${AlertMessage}" DataType="4" message associated with the
ValueName="${AlertMessage}" HexValue="" triggered alert.
Add more information by adding another OID element and incrementing the OID.
341
Integrate an Orion Platform product with ServiceNow
Integrate your Orion Platform product with ServiceNow® to automatically open new ServiceNow tickets
based on critical events defined in your Orion Platform product.
The integration with ServiceNow allows for two-way communication between your Orion Platform product
and ServiceNow. By integrating the two systems, you can:
n Automatically create incidents in ServiceNow and assign them to the correct tech or group
n Synchronize the acknowledgment of alerts and tickets in SolarWinds Orion and ServiceNow
n Update, close, and reopen tickets
n Suppress ticket storms
You can integrate one Orion Platform product with multiple ServiceNow instances.
The integration requires NPM 12.0, SAM 6.3, or any other Orion Platform product running Core version
2016.1 or later.
Before you begin
Before you can configure the integration details in your SolarWinds Orion product, check the prerequisites
and configure your ServiceNow instance.
n The communication between the SolarWinds server and the ServiceNow instance uses HTTPS port
443. Open this port for outbound communication.
n For minimum hardware and software requirements, see the administrator guide of your product.
n Download the ServiceNow integration application from the ServiceNow app store.
n Install the integration app and configure your ServiceNow instance for the integration.
342
Install and configure the SolarWinds Alert Integration application in ServiceNow
The SolarWinds Alert Integration application enables the communication between your SolarWinds server
and the ServiceNow instance.
After downloading the SolarWinds Alert Integration application from the ServiceNow store, deploy the
application in ServiceNow.
1. Navigate to your downloaded system applications.

2. Locate the SolarWinds Alert Integration application, and click Install.
When the installation is complete, the caption of the Install button will change to Installed.
After the installation is complete, SolarWinds recommends that you create a ServiceNow integration user
with Web service access only.
Create a ServiceNow integration user with Web service access only
1. Navigate to the user administration section in ServiceNow, and create a new user.
2. Provide a user ID, a password, and other required information.
3. Specify that the new user should have Web service access only.
4. Edit the newly created user, and add the x_sow_intapp.integration_user role to the role list.
After installing the integration application and creating an integration user, you can now configure the
integration with ServiceNow in your SolarWinds Orion server.
343
Configure an Orion Platform product with ServiceNow
After completing the configuration of the integration in ServiceNow, you can configure the integration to
be able to automatically create, update, and resolve alerts that were raised in your Orion Platform product
in your ServiceNow® instance.
1. In the Orion Web Console, click Settings > All Settings.
2. In the Alerts & Reports group, click ServiceNow Instances.
3. Click Add Instance.
4. Enter a name and the URL for the ServiceNow instance.
5. Enter the ServiceNow credentials:
n Username
The user name of the account that is configured for the SolarWinds integration role.
n Password
6. Test the connection to your ServiceNow instance. If the connection is not working, you receive
descriptive messages to help you solve the issue.
7. If you are accessing your ServiceNow instance through a HTTP proxy, select Use a HTTP proxy server,
and click the Configure your HTTP proxy settings link to edit the details. For more information, see
Configure web proxy settings.
8. Click Save.
344
Manage SAM technologies
The following topics detail SAM-specific technologies.
n Work with application monitor templates

n Manage Asset Inventory
n Manage AppStack
n Manage processes, services, tasks, and events in real time
n Manage audit events
n Manage SolarWinds SAM polling engines
n Manage AppInsight applications
n Manage the Desktop Notification tool
345
Work with application monitor templates
This section discusses the many operations you can perform in SolarWinds SAM regarding the use and
management of Application Monitor templates. The topics include:
n Scan nodes for applications

n Manually assign application monitors
n Create a new template
n Add tags
n Create a template for a custom application
346
Creating component monitors and templates
The following diagram illustrates the work flow involved in creating an application to be monitored by
SolarWinds Server & Application Monitor.
347
Requirements for component monitors and templates that use WMI
Microsoft Windows by default uses a random port between 1024 and 65535 for WMI communications. You
must create firewall exceptions to allow TCP/UDP traffic on ports 1024 - 65535 or the component monitors
and templates that use WMI will not work.
The following component monitors use WMI
n Performance Counter Monitor

n Process Monitor – WMI (if script uses WMI access)
n Windows Event Log Monitor
n Windows PowerShell Monitor (if script uses WMI access)
n Windows Script Monitor
n Windows Service Monitor (if script uses WMI access)
The following templates use WMI
n Active Directory 2003-2008 Services and Counters

n Active Directory 2008 R2 - 2012 Services and Counters
n Apache (Windows)
n APC PowerChute Agent (Windows)
n AppInsight for Exchange
n AppInsight for IIS
n AppInsight for SQL
n BizTalk Server 2010-2013 Adapters Performance Counters
n BizTalk Server 2010-2013 Host Throttling Performance Counters
n BizTalk Server 2010-2013 Message Box and Orchestrations Performance Counters
n BlackBerry Delivery Confirmation
n Blackberry Enterprise Server
n BlackBerry Enterprise Server 10 Services (Windows)
n CiscoWorks LAN Management Solution
n Citrix XenApp 5.0 Core WMI counters
n Citrix XenApp 5.0 ICA Session WMI counters
n Citrix XenApp 5.0 Presentation Server WMI counters
n Citrix XenApp 5.0 Services
n Citrix XenApp 6.0 Core counters
n Citrix XenApp 6.0 ICA Session
n Citrix XenApp 6.0 Presentation Server
n Citrix XenApp 6.0 Services
n Distributed File System (DFS)
n Errors in Application Event Log
348
n Exchange 2007 Client Access Role Counters (Advanced)
n Exchange 2007 Edge Transport Role Counters (Advanced)
n Exchange 2007 Hub Transport Role Counters (Advanced)
n Exchange 2007 Mailbox Role Counters (Advanced)
n Exchange 2007 Unified Messaging Role Counters (Advanced)
n Exchange 2007-2010 Client Access Role Services and Counters (Basic)
n Exchange 2007-2010 Common Performance Counters
n Exchange 2007-2010 Edge Transport Role Service and Counters (Basic)
n Exchange 2007-2010 Hub Transport Role Service and Counters (Basic)
n Exchange 2007-2010 Unified Messaging Role Service and Counters (Basic)
n Exchange 2010 Edge Transport Role Counters (Advanced)
n Exchange 2010 Hub Transport Role Counters (Advanced)
n Exchange 2010 OWA Form Login (PowerShell)
n Exchange 2010 Unified Messaging Role Counters (Advanced)
n Exchange 2013 Client Access Role Services and Counters (Basic)
n Exchange Active Sync Connectivity
n Exchange Server 2000 and 2003
n File Count Script
n GoodLink Server for Microsoft Exchange
n Group Policy Object (System and Application Logs)
n Helix Universal Media Server (Windows)
n Internet Information Service (IIS) 6
n JD Edwards EnterpriseOne Server Manager (Windows)
n Kaspersky Security Center Antivirus
n Kiwi Syslog Server
n Log Parser (PowerShell)
n Microsoft DirectAccess 2008 R2
n Microsoft DirectAccess 2012
n Microsoft DirectAccess 2012 R2
n Microsoft DirectAccess 2012-2012 R2 (Health with PowerShell)
n Microsoft Dynamics CRM 4.0 Events
n Microsoft Dynamics CRM 4.0 Statistics
n Microsoft Dynamics CRM 2011 Events
n Microsoft Dynamics CRM 2011 Statistics
n Microsoft Forefront Endpoint Protection 2010 Client
n Microsoft Forefront Endpoint Protection 2010 Server
349
n Microsoft Forefront Threat Management Gateway 2010
n Microsoft IIS SMTP Server
n Microsoft Lync Server 2013 (Edge Role)
n Microsoft Lync Server 2013 (Front-End Role)
n Microsoft Lync Server 2013 (Mediation Role)
n Microsoft Lync Server (Edge Role)
n Microsoft Lync Server (Front-End Role)
n Microsoft Lync Server (Mediation Role)
n Microsoft Message Queuing Events
n Microsoft Message Queuing Performance
n Microsoft Network Policy Server Events
n Microsoft Network Policy Server RADIUS Proxy
n Microsoft Network Policy Server RADIUS Server
n Microsoft Routing and Remote Access 2008-2012 R2
n Microsoft Routing and Remote Access 2008-2012 R2 (Events)
n Microsoft System Center Configuration Manager 2012
n Microsoft System Center Operations Manager 2012 (Agent)
n Microsoft System Center Operations Manager 2012 (Management Server)
n Microsoft Windows Internet Name Service (WINS) Events
n Microsoft Windows Internet Name Service (WINS) Statistic
n Microsoft Windows Server 2003 Failover Cluster
n Microsoft Windows Server 2008 R2-2012 R2 Failover Cluster (Advanced)
n Microsoft Windows Server 2012-2012 R2 Failover Cluster
n MongoDB (Windows)
n Novell GroupWise Message Transfer Agent (Windows)
n Novell GroupWise Post Office Agent (Windows)
n Office 365 User Statistics with PowerShell
n Orion Server
n Remote Desktop Services Licensing
n Server Clock Drift (PowerShell)
n SharePoint Server 2010
n SharePoint Server 2013
n SharePoint Server (MOSS) 2007
n SharePoint Services (WSS) 3.0
n SolarWinds Failover Engine
n SolarWinds NetFlow Traffic Analyzer
350
n SolarWinds Web Performance Monitor (WPM) Player
n SQL Server 2005 Analysis Services
n SQL Server 2008 R2 Reporting Services
n SQL Server 2008 Reporting Services
n SQL Server 2008-2012 Reporting Services (Events)
n SQL Server 2012 Reporting Services
n Squid (Windows)
n Streaming Media Services 2008
n Symantec Backup Exec Remote Agent
n Symantec Backup Exec Server
n Symantec Endpoint Protection Client
n Symantec Endpoint Protection Server
n Symantec NetBackup Client
n Symantec NetBackup Server
n Terminal Licensing Server
n Trend Micro OfficeScan Client
n Trend Micro OfficeScan Server
n Trend Micro Server Protect (Windows)
n UniData Database (Windows)
n Veeam Backup and Replication Server
n VMware vCenter Server 5.5
n Websense Web Security
n Windows 2003-2008 FTP Service
n Windows 2008 R2 - 2012 FTP Service
n Windows DHCP Server
n Windows DNS Server
n Windows Network Load Balancing
n Windows Print Services
n Windows Remote Desktop Services (Session Host Role)
n Windows Server 2003 Domain Controller Security
n Windows Server 2003-2012 Services and Counters
n Windows Server 2008-2012 Domain Controller Security
n Windows Update Monitoring
351
Create and manage templates
You can create a new template or manage existing templates by using the commands on the SAM Settings
page.
Scan nodes for applications using Application Discovery
1. On the Web Console, click Settings > All Settings > SAM Settings > Scan Nodes for Applications.
2. Follow the instructions in the Wizard .
Create templates
1. On the Web Console, click Settings > All Settings > SAM Settings > Manage Templates > Create New
Template.
2. Name the template, add application monitors as desired, and then click Submit.
Create a custom template (Example)
The following procedure creates a SolarWinds SAM Application Monitor template that monitors a locally
installed SQL Server instance. The template is simplified by using the Windows Service component
monitors, a TCP port monitor for your SQL Server, and an HTTP monitor for the local Web Console.
Create an application template with the following component monitors:
n TCP port component monitor to monitor port 1433, the port through which SolarWinds
communicates with the SQL Server.
n Service component monitors for the following windows services:
l SolarWinds Alerting Engine
l SolarWinds Network Performance Monitor
l SolarWinds Job Engine
l SolarWinds Job Scheduler
l SolarWinds Module Engine
l SolarWinds Syslog Service
l SolarWinds Trap Service
HTTP component monitor to monitor port 80, the port through which you access the SolarWinds Web
Console.
Create a SolarWinds SAM application template
1. On the Web Console, click Settings > All Settings > SAM Settings > Create New Template.
2. Name your template, and then click Add Component Monitor, expand the Network Protocol
Component Monitors list, and then check TCP Port Monitor.
3. Click Submit.
352
4. Click Rename and then name the TCP port monitor, and then click OK.
5. Ensure the Port Number field corresponds to the port used to communicate with the SolarWinds SQL
Server instance. By default, this is port 1433.
6. Click Add Component Monitor, then expand the Process and Service Component Monitors, and then
check Windows Service Monitor and click Submit.
7. Click Rename, name the SolarWinds Alerting Engine monitor, then click OK.
8. Enter or select the credential set to use when accessing the Windows service information.
9. Enter the name of the SolarWinds Alerting Engine service in the Net Service Name field.
Repeat the steps as needed for the following SolarWinds Windows services
n SolarWinds Network Performance Monitor

n SolarWinds Job Engine v2
n SolarWinds Job Scheduler
n SolarWinds Module Engine
n SolarWinds Syslog Service
n SolarWinds Trap Service
11. Click Add Component Monitor then expand the User Experience Component Monitors list, and then
check HTTP Monitor.
12. Click Rename, name the HTTP port monitor, then click OK.
13. Ensure the Port Number field corresponds to the port you use for the SolarWinds Web Console port,
then click Submit.
Assign a template to a node
2. Check the template(s) to assign, and then click Assign to Node.
3. Specify the node(s) to monitor and then click Next.
4. Enter or select the appropriate credentials.
5. Click Assign Application Monitors.
Edit templates
2. Check an application template and click Edit.
3. Specify the values for the Polling Frequency and Polling Timeout fields.
Note: Setting a polling frequency below 30 seconds can result in erratic monitor behavior.
4. Click Add Component Monitor, and then expand the component groups and all the component
monitors to add.
5. Click Submit.
6. Configure the component monitor settings, and then click Submit.
353
Copy templates
After successfully creating a complicated template, instead of having to recreate it over for a similar
application, consider copying the template. This will allow you to only modify those properties that differ.
2. Check an application template and then click Copy.
Export templates
2. Check an application template and then click Import/Export > Export as File, then click Save.
Import templates
2. Click Import/Export > Import > Browse, then select the template file, then click Open.
3. Click Submit.
Note: If you import a template with the same name as one of your existing templates, the name of
the imported template is modified by appending (n) to the name, where n is an integer.
Delete templates
Before you begin:
n Deleting a template also deletes all of its assigned applications, both modified and unmodified.
n To speed user interface interaction, data is not immediately removed from the database, but
systematically updated every few minutes in the background.
2. Check the template(s) to delete and then click Delete.
3. Confirm deletion by clicking Yes.
Tag templates
2. Select the templates to tag, then click Tags > Add existing tag(s) > Submit.
Remove tags
2. Select the templates to tag, and then click Tags > Remove tag(s) > Submit.
354
Multi-Edit templates
Multiple component monitors within a template can be edited simultaneously. As indicated by the toolbar,
multiple monitors can be selected to: Assign Credentials, Test, Set Test Node, Disable, and Delete. The
monitors selected do not to be of the same type when performing a multiple monitor edit. When
performing a multiple monitor edit, the correct buttons will become enabled and/or disabled based on
your selection.
The Multi-Edit button allows you to change the options of two or more monitors of the same type,
simultaneously. To enable the Multi-Edit button, two or more monitors of the same type must be selected.
Once multiple monitors of the same type are selected, the Multi-Edit button becomes enabled. In the
illustration below, three monitors (Services) are checked and the Multi-Edit button is enabled:
Different types of monitors will have different options available for editing.
355
Create a new template
SolarWinds SAM allows you to create new templates by bundling component monitors together. There are
two ways of creating a template from scratch. The traditional method allows you to create any kind of
template. The browsing method only creates templates monitoring services, processes, and performance
counters.
Apply a template to a node
1. On the Web Console, click Settings > All Settings > SAM Settings.
2. Under Application Monitor Templates, click Manage Templates.
3. Locate your template and click Assign to Node.
4. Select the Windows nodes you want to monitor for the operating system on the left pane, click the
green arrow to move it to the right pane, and click Next.
5. Choose the credentials, click Assign Application Monitors, and click Done.
Create a new template
1. On the Web Console, click Settings > All Settings > SAM Settings > Create a new template.
2. Name the template and specify values for Polling Frequency and Polling Timeout.
Note: Setting a polling frequency below 30 seconds can result in erratic monitor behavior.
3. Click Add Component Monitor then expand the component groups and check all the component
monitors to add.
Note: You can select multiple component monitors of the same type to be added by entering a
number in the field next to the check box for the component monitor and then checking the check
box.
4. Click Submit then configure the component monitor settings, and then click Submit.
356
Work with Multi-Edit templates
Multiple component monitors within a template can be edited simultaneously. The monitors selected do
not to be of the same type when performing a multiple monitor edit. When performing a multiple monitor
edit, the correct buttons become enabled or disabled based on your selection.
Once the Multi-Edit button is pressed, a pop-up window is dispalyed with editing options specific to the
type of monitor selected. For example, the Fetching Method for the three Services selected can be changed
from RPC to WMI.
Different types of monitors have different options available for editing.
Order components
When editing a template, the green arrows to the right of each component monitor, highlighted below, lets
you to change the order of each monitor. This new order is respected only on the All Applications resource
and the Application Details resource.
Copy a template
2. Select the application template you want to copy, and then click Copy.
Delete a template
2. Select the application template you want to copy, and then click Delete.
3. Confirm by clicking Yes.
Tag a template
Tags are descriptive labels that help you classify and sort your application templates on the Manage
Application Monitor Templates page. The application templates included in SolarWinds SAM have already
been tagged with several descriptive labels you can modify as you see fit.
Add tags
2. Select the templates you want to tag, then click Tags.
3. Click Add existing tag(s) or select the tags from the list.
4. Type the tags, separating multiple tag entries with commas, then click Submit.
357
Remove tags
2. Select the templates you want to tag, then click Tags > Remove Tags.
3. Select the tags from the list, then click Submit.
358
Manually assign application monitors
The quickest way to assign Application Monitors to nodes is through the Add New Application Monitors
Wizard, but you can also assign them through the Manage Templates page.
Assign a template using the wizard
1. On the Web Console, click Settings > All Settings > SAM Settings > Manually Assign Application
Monitors.
2. Select the Application Monitor template to apply, and then click Next.
3. Select the server nodes to which you want to apply the Application Monitor template, and then click
Next.
4. Select existing credentials or create new credentials, then click Assign Application Monitors.
Assign a template through the Manage Application Monitor Templates page
2. Select the tag by which to filter the templates, then select the template you want to assign.
3. Click Assign to Node, then select the server nodes to which you want to apply the Application
Monitor template, and then click Next.
4. Select existing credentials or create new credentials, then click Assign Application Monitors.
5. Review the information for the assigned Application Monitor and then click Done.
359
Manage component monitors within templates
You can manage individual component monitors that have been assigned to collect data on a single object
such as a process, port, or performance counter.
1. From the web console, click Settings > All Settings > SAM Settings > Create New Template.
2. Name the template then click the Add Component Monitors drop down menu.
3. Select a method for adding component monitors.
4. The browsing method opens the Component Monitor Wizard. Add component monitors as needed.
5. Click Submit.
The new template is added to the list of Application Monitor Templates.
Create a new template with assigned component monitors
Assign component monitors to a node

1. On the Web Console, click Settings > All Settings > SAM Settings > Manage Assigned Component
Monitors.
2. Select the component type or assigned Application Monitor component monitors to list.
360
3. Select the component monitors to assign to a node, and then click Assign to Node.
4. Name the application and specify the polling frequency and polling timeout period.
5. Click Next, and select the nodes that you want to assign the Application Monitor. Click Next.
6. Enter or select the appropriate credentials, and click Assign Application Monitors.
Copy assigned component monitors to an assigned application monitor

Monitors.
2. Select the component type or assigned Application Monitor whose component monitors to list.
3. Select the component monitor(s) to copy to an assigned Application Monitor, then click Copy to
Assigned Application Monitor.
4. Select the Application Monitor(s) to copy to and then click Submit.
5. Click OK.
Copy assigned component monitors to an application monitor template

Monitors.
2. Select the component type or assigned Application Monitor whose component monitors you want to
list.
3. Select the component monitor(s) to copy to an assigned Application Monitor, then click Copy to
Application Monitor Template.
4. Select the template(s) to copy to and click Submit.
5. Click OK.
Edit assigned application monitors

Monitors.
2. Select the component type or assigned Application Monitor whose component monitors you want to
edit.
3. Select the component monitor whose assigned Application Monitor you want to edit.
4. Click Edit Assigned Application Monitor.
5. Edit the settings and then click Submit. The edited Application Monitor is displayed in the list of
Assigned Application Monitors.
Delete assigned application monitors

Monitors.
2. Select the component type or assigned Application Monitor component monitor(s) to delete.
3. Select the component monitor(s) to delete.
4. Click Delete, then click Yes to confirm deletion.
361
Work with templates and groups
n Assign an application template to a group

n Unassign application monitors from a group
Following are frequently asked questions and answers concerning templates and groups.
Question Answer
If I assign a template to a group and then I Nothing will happen since the application has already
add a node that already has the same been created.
template assigned to it, what happens?

If I assign a template to a group that is OS Yes. The logic is that members of the group get assigned
specific, such as the Microsoft Windows to the template.
Server 2003 Failover Cluster template, and
then I add a Windows Server 2012 R2 server
to the group, will the 2003 specific temple be
added to the 2012 R2 node?

What happens if I add a Linux template to a The application will be created but the status will be
Windows group? reported as Unknown.

If I delete a group that has applications This depends on whether or not you unchecked the
assigned to it, what happens to the templates default behavior of the group found in Advanced
that were assigned via the group? Do they get section. By default, the answer is yes. All members will
removed from those nodes? be removed and therefore all of the applications on
them will be removed.

If I have a node in two different groups that No. If you remove a node from the first template, the
share application templates, will the node get application is not removed and it is marked as assigned
362
assigned to copies of the same template? to the second node.

Can I assign credentials to a node and have There is no credential associated with a group; however,
all of the templates assigned to that group you can select Inherit Credentials from Node when using
use that credential? WMI or an agent. The new application created from the
template will use credentials from the node that is
assigned to.
363
Assign an application template to a group
Assigning an application template to a group is more efficient than applying the template to individual
nodes one at a time. Before you begin, a group must be created. To create a group, see Create groups.
Nested groups are not supported. AppInsight applications cannot be assigned to groups.
Application assignment to a group happens in the background and can take some time to be
created depending on the size of the application.
1. On the web console, click Settings > All Settings > SAM Settings > Manage Templates > Application
Monitor Templates.
2. Select an application template and then click, Assign to Group.
364
3. Select a group from the Available Groups column, click the green arrow, and then click Next.
Note: By default, the template is assigned to those nodes in the group that are running a server
operating system. This can be changed in the Advanced section at the bottom of the page. When a
node is removed from a group, the application is deleted from the node by default. You can override
this by selecting No under the Advanced section.
4. Select your credentials and then click, Assign Groups.

5. Click Done.
Your application templates are now assigned to a group.
To view the applications within a group, in the web console, click My Dashboards > SAM Summary and
then click a group in the Application Templates Assigned to Group resource.
365
You can create dynamic groups and assign templates to these groups. For example, a dynamic
group can be created for all Windows computers and the Windows Update template can be applied
to the nodes of the group dynamically.
Got questions? See the FAQs on this feature at Work with templates and groups.
366
Unassign application monitors from a group
1. On the web console, click Settings > All Settings > SAM Settings > Manage Templates > Application
Monitor Templates.
2. Select the application monitor you want to unassign from the group, and then click the link in the
Assigned To column.
3. On the Template Assignments page, click the Group tab and then click Unassign > Yes, Unassign.
4. Click Close.
367
Manage assigned application monitors
You can manage Assigned Application Monitors by referring to the following sections:
n Edit an individual application

n Unmanage assigned application monitors
n Remanage assigned application monitors
n Delete assigned application monitors
368
Edit an assigned application monitor
You can override the template inheritance relationship by editing the components of an assigned
Application Monitor. Any modifications you make to an application’s components or component properties
are independent from the template. New components that you add to the application are not governed by
the original template used to create the application. Modified component properties override the original
template settings.
Edit an individual application

2. Click the group containing the application you want to edit.
3. Check the application you want to edit, and then click Edit Properties.
4. Click Override Template for each polling setting and specify the new value.
5. Expand the component you want to modify, and then click Override Template and specify new
values.
6. To add components unique to this specific application, click Add Component Monitor then
click Submit to apply your changes..
You can select multiple component monitors of the same type to be added by entering a number in
the field next to the check box for the component monitor and then checking the check box.
369
Unmanage assigned application monitors
2. Click the group containing the application to unmanage, select the applications to unmanage, and
then click Unmanage.
3. Specify the date/time to begin and end the period when the application is unmanaged, then click
OK.
370
Remanage assigned application monitors
2. Click the group containing the application to remanage.
3. Check the application(s) to remanage, and then click Remanage.
371
Delete assigned application monitors
2. Click the group containing the application to delete.
3. Check the application(s) to delete, and then click Delete, then click Yes to confirm.
372
Use the JMX component monitor wizard
Creating a standard template for this monitor is not practical because of the amount of variables in any
one specific environment. However, adding this monitor to your environment has been made simple with
the use of a wizard driven interface.
Only values that return numerical data can be monitored. String data is not supported at this time.
Non-numerical data is shown without a check box.
Add a JMX component monitor

1. On the Web Console, click Settings > All Settings > SAM Settings > Component Monitor Wizard.
2. Select JMX Monitor from the drop down list and then click Next.
3. For Server IP Address, click Browse, then select the node you want to monitor.
4. Add the Port number, Protocol type, URL path, and Credentials for the remaining fields.
5. Click Next. The following MBean selection screen appears:
6. Expand the folders by clicking the arrows (or [+]) to expand the tree view folder structure. From here
you can drill down to select the attributes you want by checking them.
7. Click Next.
373
Configure the SOAP monitor
The are two ways to configure the SOAP monitor:
n Loading a WSDL file.

n Manually entering XML.
Load WSDL Files
The SOAP monitor within SAM currently supports the WSDL schema, which must be exposed on a URL.
Once the WSDL file is successfully loaded, the file is parsed automatically and the fields, highlighted
below, populates. Once the WSDL file has been successfully loaded, you can specify values for the
available arguments. There are two types of arguments, simple, and complex.
A simple argument is one where you can define the value directly. A complex argument (e.g. structures,
classes, list, and so on) must be user-defined in the XML format. It is recommended that complex
arguments be used only by experienced users.
The Advanced Settings are read-only and displays additional information. Because the SOAP
envelope is based on the WSDL schema, the Advanced Settings values should not be changed.
The SOAP XML field contains the SOAP envelope which is generated by the WSDL and dynamically
changes as you make changes to the SOAP settings. In this field you can check what is to be sent to the
web service.
Important: If changes are made to any of the base SOAP settings, the content of the SOAP XML is
re-generated and your changes become lost.
374
Manually Enter XML
The following is an example of a Complex argument and would be placed in the Parameters field.
SAM automatically takes the code and place it where it belongs in the envelope:
<tempPhoneNumber
xmlns:ns2="http://schemas.xmlsoap.org/soap/encoding/"
xsi:type="ns2:Array" ns2:arrayType="ns1:TemporaryPhoneNumber[3]">
<item xsi:type="ns1:TemporaryPhoneNumber">
<startDate xsi:type="xsd:int">37060</startDate>
375
<endDate xsi:type="xsd:int">37064</endDate>
<phoneNumber xsi:type="xsd:string">+1-212-5551234</phoneNumber>
</item>
</item>
</item>
</tempPhoneNumber>
XML can also be entered manually by typing or pasting XML.
376
Script custom component monitors
Ten output pairs can be returned when using script monitors. A usage example using the PowerShell
script monitor might go like this:
Imagine you have an Exchange PowerShell script. With multiple values returned, you can get a mail traffic
report broken down by day, hour, message size, and number of recipients.
If you exceed the maximum number of allowed output pairs of ten, the remainder above the tenth
output pair is ignored.
The following sections provide information and guidance to help you create some of the more complicated
types of component monitors.
n Adapt an existing Perl script to a Linux/Unix Script component monitor in a new template
n Field Descriptions
n Return Codes
n What needs to be monitored
For general information about the settings for each component monitor, click the More Information help
link in the SolarWinds SAM component monitor description.
SolarWinds fully supports scripts written and provided by the company; however, we do not provide
customer support for custom scripts written by outside sources. SolarWinds does provide sample
scripts that we do support located at: C:\Program Files\SolarWinds\Orion\APM\Sample-
Script Monitors.
For information on using Data Transformations, refer to the following sections:
n Conversion value
n Available data transformations
377
Create a Linux or Unix script monitor
Linux and Unix Script component monitors allow you to execute a command line script that can return
statistical data. When collecting information for this monitor, SAM runs the script with the credentials
defined with the Credential Library.
A maximum of 10 output pairs can be monitored per script monitor. More than 10 defined pairs
results in a failure of the monitor.
Adapt an existing Perl script to a Linux/Unix Script

component monitor in a new template
1. On the Web Console, click Settings > All Settings > SAM Settings > Create a new template, and then
name the template
2. Click Add Component Monitor, expand the Custom Component Monitors group, and then select
Linux/UnixScript Monitor.
3. Click Submit then select credentials with SSH permissions in the Credential for Monitoring field.
4. Type a valid working directory in the Script Working Directory field
5. Click Edit to open the script dialog and enter your script into the Script Body field.
6. Type the Linux command that runs the script in the Command Line field. It should be similar to the
following: perl ${SCRIPT} arg1 arg2.
Note: {SCRIPT} is replaced by the actual file name of the script after it’s deployed to the target
node. (A temporary file is created in temp directory for the script).
7. Click Get Script Output. SAM then tests the script by executing it and parse its output, then return
the values.
8. Click Save, then specify the critical and warning thresholds and click Submit.
Here is a sample Perl script using the Linux/Unix component monitor returning multiple output pairs, in
this case, two:
The code in red shows where the output pairs are defined.
#!/usr/bin/perl
if (@ARGV[0] =~ /\bhelp\b/)
{
print "MemoryUsage.pl SNMPver community hostname\n";
print "SNMPver - version of SNMP protocol\n";
print "community - community name of SNMP protocol\n";
print "hostname - Target host\n";
378
exit 1;
}
# Get hostname and trim newline
$localhost = `hostname`;
$localhost =~ s/\s*$//g;
$hostname = shift ||
$localhost;$community = shift || "public";
$version = shift || "v1";
$results = "";
$MIB_TotalMemory = "UCD-SNMP-MIB::memTotalReal.0";
#$MIB_TotalMemory = "UCD-SNMP-MIB::memTotalReal.0";
$outres = "snmpget -$version -c $community $hostname $MIB_TotalMemory |";
open(OUTMEM,$outres) || die "Unable read pipe\n";
while ($line = <OUTMEM>) {
if ($line =~ /\bINTEGER\b/) {
$indval = index($line,"=");
$indval=inde($line,":",$indval);
$val = substr($line,$indval+1,length($line) - $indval);
$val =~ s/[a-zA-Z\/\n ]//
print "Message.1: Available memory at host \"$hostname\": $val in
kB\n";
print "Statistic.1: $val\n";
print "Message.2: Again, the available memory at host \"$hostname\":
$val in kB\n";
print "Statistic.2: $val \n";
exit 0;
}
}
print "Statistic: 0\n";
exit 1;
Below is the output from this script:
379
Linux/Unix scripts
Linux/Unix scripts are uploaded by SSH and then run on the target node using the string from the
Command Line field.
You can use the following variable in the command line field:
${SCRIPT}
Replaced with the script body.
You can use the following variables in the script body field:
${IP}
Replaced with the target node’s IP address.
${USER}
Replaced with the user name from the credential.
${PASSWORD}
Replaced with the password from the credential.
Example Scripts
There are several sample scripts installed with SolarWinds SAM you can use to create Linux/Unix script
component monitors. These sample scripts are installed on your SolarWinds SAM server, in the folder:
C:\Program Files\SolarWinds\Orion\APM\SampleScriptMonitors\LinuxScripts
Scripts Must Report Status Through Exit Codes
Scripts must report their status by exiting with the appropriate exit code:
Exit Code Meaning
0 Up
1 Down
2 Warning
3 Critical
Any other value Unknown
For example, if you want to inform SolarWinds SAM that a Script reports Up status, you would exit the
script using code similar to the following, where 0 reports Up: Wscript.quit(0)
Scripts with Text Output
Scripts report additional details by sending text to the script’s standard output.
380
SAM supports multiple values returned by a script using the following format.
Statistic.Name1: xMessage.Name1: abc

Statistic.Name2: yMessage.Name2: abc
Detail Required Meaning

Type
Statistic Yes A numeric value used to determine how the monitor compares to its set
thresholds. This must be an integer value, (negative numbers are supported).
Statistic.Name1: 123Statistic.Name2: 456
Message No An error or information message to be displayed in the monitor status details.

Note: Multi-line messages are supported. To use this functionality print each line
using a separate command. For example:
Message.Name1: abc
Message.Name2: def
There is a limit of ten Statistic and Message pairs for the script. These can be placed anywhere in the
script output. The Statistic and Message names you give must contain valid letters and/or numbers.
Sample output:
# Script comment: This shows two pairs. Ten pairs are possible.
Statistic.CPU: 31.08
Message.CPU: svchost.exe cpu usage
Statistic.RAM: 1234.56
Message.RAM: svchost.exe ram usage
381
Create a Windows Script monitor
This component monitor runs a Windows script on the SolarWinds SAM server and then processes the
script's exit code and text output. This monitor has the ability to return up to ten pairs, i.e.: 10 statistic
values + 10 [optional] messages. This is best used in conjunction with theMultiple Statistic Chart.
A maximum of 10 output pairs can be returned. If you exceed the maximum allowed, remove the
excess output pairs or they will simply be ignored.
Statistic
The statistic for this component monitor is the value returned by the script.
Script Monitor Formatting
At least one message and statistic is required. The statistic must be a valid integer and be able
to be converted to double, otherwise it is handled as Not as Number (NaN)There is no
maximum length for the message; however, only alphanumeric characters and the underscore
are allowed.
Field Descriptions
Description
This field provides a default description of the monitor. You have the ability to override the default
description by adding to or replacing the text, which will then be automatically saved. The variable to
access this field is ${UserDescription}.
Component Type
This describes the type of monitor you are using.
Enable Component
This option determines whether or not the component is enabled. Disabling this component leaves it
in the application as deactivated and does not influence application availability or status.
Credential for Monitoring
Select a Windows credential that is both a user who can log on to the SolarWinds SAM server, and
has sufficient rights on the target node (which may be the SAM server itself, depending upon your
application) to do whatever the script needs to do. For example, if the script does something with
WMI, the credentials also need WMI rights on the target node. If the credential you need is not
already present in the credentials list, use the Quick Credentials section to add a new credential.
Script Engine
This field allows you to specify the scripting language to be used. The default value is vbscript. Below
is a list of scripting engines that the Windows Script Host supports:
382
Name File Extensions Availability
VBScript .vbs Installed by default
JScript .js Installed by default
PerlScript .pls Freeware
ooRexxScript .rxs Freeware
PythonScript .pys Freeware
TclScript .tcls Freeware
ActivePHPScript .phps Freeware
RubyScript .rbs Freeware
Object Rexx engine Commercial
Delphi scripting engine Commercial
VBscript runs locally on the SAM server only. PowerShell uses WINRM that runs over TCP ports 5985
and 5986. All Linux, Unix, and Nagios script monitors use SSH over TCP Port 22.
Roll-Up
This option allows you to choose how you would like the monitor to report the returned results based
on the output provided by the script. With the ability to have multiple values returned, selecting how
your scripts report back to you offers more flexibility. The default selection is “Show worst status."
Script
This field allows you to enter the script you want to run on the target node. To enter your script, click
the Edit button that reveals the script editing window.
Script Arguments
This field is in the script editing window and allows you to specify arguments to pass to the script.
You may include the variables ${IP}, ${USER}, and ${PASSWORD}, which are replaced respectively
by the IP address of the target node, the credential user name, and the credential password.
Body
This field is in the script editing window and allows you to enter your script via typing or pasting.
User Notes
This field allows you to add notes for easy reference. You can access this field by using the variable,
${UserNotes}.
383
Creating a Windows Script Monitor
You can create a Windows Script monitor to have SolarWinds SAM run a script using Windows Script Host.
Windows Script Host comes with VBScript and Jscript, but can be extended with other scripting languages.
Scripts run on the SolarWinds SAM server and use the credentials you specify. The script must both return
an exit code and output a text string containing a statistic value conforming to the specifications described
later in this section.
Format the Statistic value to use the same decimal separator as the SolarWinds SAM server. The
SolarWinds SAM server uses the decimal separator set by its Microsoft Windows regional settings.
Adapt an existing Visual Basic script to a Windows Script Monitor in a new

template
1. On the Web Console, click Settings > SAM Settings > Create a New Template, then name the
template.
2. Click Add Component Monitor, then expand the Custom Component Monitors group, and then
check WindowsScript Monitor.
3. Click Submit, and then select credentials with the appropriate permissions to run the script on the
SolarWinds SAM server, and that also has appropriate permissions to do whatever else the script
requires.
4. Copy the Visual Basic script into the Script Body field.
5. Type any script arguments into the Script Arguments field.
6. Specify the critical and warning thresholds, then click Submit.
Macros for Script Arguments
Specify script arguments in the Script Arguments field if needed. You can use the following variables as
script arguments:
${IP}
This is replaced with the target node’s IP Address.
${USER}
This is replaced with the user name from the credential set.
${PASSWORD}
This is replaced with the password from the credential set.
Scripts Must Report Status Through Exit Codes
Scripts must report their status by exiting with the appropriate exit code:
Exit Code Meaning
384
0 Up
1 Down
2 Warning
3 Critical
Any other value Unknown
For example, if you want to inform SolarWinds SAM that a VBScript reports Up status, you would exit the
script using code similar to the following, where 0 reports Up:
Wscript.quit(0)
Scripts with Text Output
Scripts report additional details by sending text to the script’s standard output. SAM supports multiple
values returned by a script using the following format.
Statistic.Name1: xMessage.Name1: abc
Statistic.Name2: yMessage.Name2: abc
Detail Required Meaning

Type
Statistic Yes A numeric value used to determine how the monitor compares to its set
thresholds. This must be an integer value, (negative numbers are supported).
Statistic.Name1: 123Statistic.Name2: 456
Message No An error or information message to be displayed in the monitor status details.

Note: Multi-line messages are supported. To use this functionality print each line
using a separate command. For example:
Message.Name1: abc
Message.Name2: def
There is a limit of ten Statistic and Message pairs for the script. These can be placed anywhere in the
script output. The Statistic and Message names you give must contain valid letters and/or numbers.
Sample output
# Script comment: This shows two pairs. Ten pairs are possible.
Statistic.CPU: 31.08Message.CPU: svchost.exe cpu usage
Statistic.RAM: 1234.56Message.RAM: svchost.exe ram usage
385
Example Scripts
Below is a sample vbscript that returns two values; the total number of files in a folder, and twice the total
number of files in the same folder. The code that represents these two values are bold, To use this script,
copy and paste the following code into the Script Body field. In the Scripts Arguments field, type in
C:\Windows, or any other folder you want to monitor.
Option Explicit
On Error Resume Next
Dim lstArgs, path, fso, objDir, objFiles, objFiles2
Set lstArgs = WScript.Arguments
If lstArgs.Count = 1 Then
path = Trim( lstArgs( 0 ))
Else
WScript.Echo "Message: Usage: wscript.exe filelist.vbs [pathToFiles]" &vbCRLF &"
[pathToFiles] Local or UNC Path"
WScript.Echo "Statistic: 0"
WScript.Echo "Message: Usage: wscript.exe filelist.vbs [pathToFiles]" &vbCRLF &"
[pathToFiles] Local or UNC Path"
WScript.Quit( 1 )
End If
Set fso = Wscript.CreateObject( "Scripting.FileSystemObject" )
If fso.FolderExists( path ) Then
Set objDir = fso.GetFolder( path )
If( IsEmpty( objDir ) = True ) Then
WScript.Echo "Message: Object Not Initialized"
WScript.Echo "Statistic: 0" WScript.Quit( 1 )
End If
Set objFiles = objDir.Files
If( IsEmpty( objFiles ) = true) Then
WScript.Echo "Message: Object Not Initialized"
WScript.Quit( 1 )
End If
WScript.Echo "Message.Total: " & CInt( objFiles.Count ) & " files in this folder."
WScript.Echo "Statistic.Total: " & CInt( objFiles.Count )
386
WScript.Echo "Message.Twice: " & CInt( objFiles.Count*2 ) & " = twice the number
of files in this folder."
WScript.Echo "Statistic.Twice: " & CInt( objFiles.Count*2 )
WScript.Quit( 0 )
Else
WScript.Echo( "Message: Folder Not Found" )
WScript.Quit( 1 )
End If
There are several examples of Windows Script component monitors included in templates. These include:
File Count, File Modified, LDAP Connection Monitor, Run 3rd Party Application, and Windows Event Log
Count.
Sample scripts are installed on your SolarWinds SAM server, in the folder:
C:\Program Files\SolarWinds\Orion\APM\SampleScriptMonitors\WindowsScripts
387
Create a Nagios script monitor
This component uses SSH to upload a Nagios script to a Linux or Unix server, runs the Nagios script on the
server and then processes the script's exit code and text output. This monitor has the ability to return
multiple values.
A maximum of 10 output pairs can be monitored per script monitor. More than 10 defined pairs
results in a failure of the monitor.
Return Codes
Nagios determines the status of a host or service by evaluating the return code. The following table shows
a list of valid return codes, along with their corresponding service or host states.
Return Code Service State Host State
0 OK Up
1 Warning Up or Down/Unreachable†
2 Critical Down/Unreachable
3 Unknown Down/Unreachable
___________________
†If the Use Aggressive Host Checking option is enabled, return codes of 1 will result in a host state of Down, otherwise
return codes of 1 will result in a host state of Up.
Nagios scripts must exit with a valid return code and a line of text output. The exit code determines the
status of the component. If the exit code is 0 (OK), the component status may be further modified by
thresholds from the optional statistics. To return up to ten optional statistics, separate the statistics from
the status message with the pipe (|) symbol using the following syntax:
statusMessage [|'statisticName'=value]
Below is an example of valid output with a status message and two statistics:
The script ran. | 'CPU%'=75.2 'MemoryRemainingInKB'=600784
Statistic
The statistic for this component monitor is the value returned by the script. For more information, see
http://nagios.sourceforge.net/docs/3_0/pluginapi.html.
Field Descriptions
Description
388
Component Type
Enable Component
Authentication Type
Select Username and Password or User Name and Private Key.
Select a credential that can access the Linux or Unix server over SSH and that has sufficient rights to run
scripts. If the credential you need is not already present in the credentials list, use the Quick Credentials
section to add a new credential. Certificates are also supported.
Port Number
This field allows you to specify the port number used for the SSH connection. The default value is 22.
Script Working Directory
This field allows you to specify the working directory of the script process.
Check Type
This determines how the return code is evaluated.
Status Roll-Up
This option allows you to choose how you would like the monitor to report based on the output
provided by the script. The default selection is “Show worst status."
Command Line
This field is in the script editing window and allows you to specify the shell command run after the
SSH connection is established. The default command line value perl ${SCRIPT} arg1 arg2 attempts to
run in a Perl interpreter the script defined in the Body field using the parameters arg1 arg2.
The length of the Command Line field is limited to 266 characters for Solaris systems, minus the
length of the ${SCRIPT} variable after being resolved to a file name such as the following: APM_
937467589.pl. Since the length of the file name will typically be around 16 characters, this means
that the actual user Command Line input cannot be longer than 266 - 16, or 250 characters (not
including the length of the 9 characters for the “${SCRIPT}" variable itself). If you need to pass a
longer command line to the target node, you can create a shell script on the target node (for
example: myscript.sh) that contains the long command line and place the call to this script in the
Command Line field, for example: /opt/sw/myscript.sh
Body
389
User Notes
${UserNotes}.
390
Create a Windows PowerShell monitor
With this, you can create a monitor that runs a Windows PowerShell script to monitor specific performance
information for troubleshooting a Windows process that may be having issues.
excess output pairs or they will simply be ignored. You may need to log in with an administrator
account to perform this action.
What needs to be monitored
The process you want to monitor is lsass.exe, which enforces security on the system for users who are
logging on, changing passwords, and so forth. In particular, you want to monitor the average number of
read operations performed to check for spikes.
You decide to use the Windows PowerShell monitor to run a PowerShell script that uses the Get-WmiObject
call to measure the average ReadOperationCount for the lsass.exe process and monitor its value.
1. On the Web Console, click Settings > All Settings > SAM Settings > Create a New Template
2. Name the template, for example, Lsass.exe PowerShell Monitor.
3. Click Add Component Monitor, then expand the Custom Component Monitors group, and then
select WindowsPowerShell Monitor and click Add.
4. Select the Credential for Monitoring with appropriate permissions to run the script on the
SolarWinds SAM server, and that also has appropriate permissions to do whatever else the script
requires (in this case, to get the average number of read operations performed on the target node).
5. Select the Execution Mode to use:
n Local Host can run scripts only locally, that is, on the SolarWinds SAM server.
n Remote Host can execute scripts remotely (on the remote target node to which the Windows
PowerShell monitor is assigned) using the Windows Remote Management (WRM) system
component. WRM should be configured separately to get it working with the Windows
PowerShell monitor.
6. Copy the following PowerShell script, which uses the Get-WmiObject call to measure the average
ReadOperationCount for the lsass.exe process, into the Script Body field:
$avg = Get-WmiObject win32_process -ComputerName '${IP}' -Credential

'${CREDENTIAL}' | Where-Object {$_.Name -eq "lsass.exe" } | Measure-
Object -property ReadOperationCount -Average; Write-Host 'Statistic: '
$avg.Averageexit(0)
The PowerShell code does the following:
a. Reads the average ReadOperationCount information for the process lsass.exe from the
computer whose IP address is specified by the variable ${IP} using the credential specified by
the variable ${CREDENTIAL} .
391
Note: The user name from the Credential for Monitoring that is specified is stored
automatically in the ${CREDENTIAL} variable by the monitor. Therefore the ${CREDENTIAL}
variable should not be placed in the Script Arguments field, since it is set automatically. When
the script is run by PowerShell, since no password has been provided, it prompts for a password
and the password from the Credential for Monitoring that is specified is provided automatically
by the Windows Powershell monitor.
b. Writes the statistic information gathered by the script.

c. Exits the script.
Note: The script does no error checking.
7. Enter the following Script Arguments:

Use the token ${IP} and the IP address will be filled in with the IP address of the target node. You
can then access the value in the script body using the variable ${IP} .
For example, if you type the following for Script Arguments:
${IP}
The PowerShell script will be able to access the IP address for the target node using the variable
${IP} in the script body.
8. Select Run the script under specified account to enable impersonation with the component's
credentials. (This works only in local script execution mode.)
9. Select Count Statistic as Difference to change the statistic to be the difference in query values
between polling cycles.
10. Change the Statistic Warning Threshold to, greater than 800.
11. Change the Statistic Critical Threshold to, greater than 1000.
12. Click Set test node. Browse the tree view, select the desired target node for the PowerShell script,
and then click Select.
13. Click Test, and then click Submit.
14. Click All in the Select tag to filter by list, and then locate the Lsass.exe PowerShell Monitor.
15. Select Lsass.exe PowerShell Monitor and then click Assign to Node.
16. Expand the tree view and select the target node, and then click Next.
17. Select Inherit credentials from template, and then click Test to confirm the credentials and
component monitor against the test node.
18. Click Assign Application Monitors and then click Done.
Troubleshooting the Lsass.exe PowerShell Monitor

Verify that you are entering the user name and password of an administrator-level account. If you think
you have entered an incorrect credential, correct the mistake and then retest.
Make sure that the RPC server is available and that the Windows PowerShell execution policy is not set to
Restricted (the default setting). You can check the execution policy by entering the following command at
the PowerShell command prompt:
Get-ExecutionPolicy
392
If you are having trouble using the Windows PowerShell Monitor, see the following KB article for some
useful tips:
https://support.solarwinds.com/success_center/Server_%26_Application_Monitor_(SAM)/Problems_using_
the_Orion_APM_Windows_PowerShell_Monitor
393
Application Monitor Thresholds
Thresholds are markers that indicate certain levels have been reached. Many component monitors used in
SAM applications have thresholds that can be adjusted and set.
Once set, thresholds can act as trigger points. For example, if you are monitoring CPU usage, a Critical
threshold set at 90% would be typical. You can use this threshold as a trigger to send an email alert to
inform you of the Critical status once that threshold has been breached.
Normally, an administrator would need to monitor applications for several weeks in order to collect
enough data to be used as a baseline. Once a baseline has been established, the administrator can make
an educated guess how to set Warning and Critical thresholds for the component monitors. Note, if
thresholds are set too low, the administrator would be getting alerts all the time. If set too high, problems
can occur without the administrator's knowledge.
Baseline data, as well as Warning and Critical thresholds for application monitors, can be gathered and
calculated automatically. The option to enter thresholds manually remains available.
By default, I/O thresholds of Windows Service Monitors are not set.
For more information, refer to the following sections:
n Threshold Adjustments at the Template Level

n Change the amount of data used in baseline calculations
n Multi-Value scripts and thresholds
n Apply baseline thresholds at the template level
n Apply baseline thresholds at the application level
n View the Latest Baseline Details Page
394
Inheriting Thresholds
Thresholds can be adjusted at the template level or on the individual component monitor level of an
application.
Threshold Adjustments at the Template Level

If adjusting thresholds on the template level, either manually entered or calculated using baseline data,
any changes made trickles down to the component monitor level for applications based on this template.
This means the component monitors within the application inherit the changes made in the template.
Threshold Adjustments at the Component Monitor Level

If you change thresholds at the component monitor level, only thresholds of the individual component
monitor is affected. Thresholds on the parent template, or other applications based on that parent
template, is not be affected.
395
Multi-Value scripts and thresholds
The format for using the threshold macros with multi-value scripts is as follows:
n ${Threshold.Warning.DisplayName}
n ${Threshold.Critical.DisplayName}
396
Apply baseline thresholds at the template level
Applying and editing thresholds at the template level affect all applications that are based on that
template. Thresholds can be used based on calculated baseline data or you can create your own
thresholds based on your needs.
2. Select a template and click Edit from the toolbar.
3. Select a component monitor, click [+] to expand the monitor details.
4. Select Use thresholds calculated from baseline data:
Once this box is checked, the Warning and Critical fields automatically populate with the macro,
${USE_BASELINE}. This macro can be used when configuring alerts.
5. Select the options for sustained thresholds, and then click Submit.
You can edit multiple component monitors and their thresholds if the monitors are the same type
and thresholds are available. Multi Edit only become available when the selected component
monitors are the same type, as shown. After you click Multi Edit, select Statistic Threshold > Use
thresholds calculated from baseline data. Edit thresholds, click Save > Submit.
397
398
Apply baseline thresholds at the application level
1. On the Web Console, click My Dashboards > Applications > SAM Summary.

2. From the All Applications resource, expand the tree and then click an application.
3. From the Application Details resource, click Edit Application Monitor.
4. If selecting only one Component Monitor, click [+] to expand the monitor details.
a. Click Override Template.
Note: The current values for the thresholds appear in the Warning and Critical fields
b. Click Use Latest Baseline Thresholds, as shown:
c. When applied, the values change and a blue icon appears indicating that baseline thresholds
are being used.
5. If selecting more than one component monitor, use the check boxes to select the monitors you want
to edit, and then click Multi-Edit.
a. Click Multi-Edit.
Note: Multi-Edit only becomes available when the selected component monitors are of the
same type.
b. Check the Statistic Threshold check box on the pop-up window, then check the Use
thresholds calculated from baseline data.
Note: Once the second box is checked, the Warning and Critical fields automatically populate
with the macro, ${USE_BASELINE}.
399
6. Click Save, then click Submit.
400
Adjust threshold settings and apply baseline data
In general, baseline data is calculated on demand; however, seven days of data is the recommended
minimum amount of data needed for baseline calculations to be considered accurate.
Baseline data for macros, such as ${USE_BASELINE}, are automatically calculated during nightly
database maintenance.
Once thresholds are calculated and applied to component monitors, the thresholds remain static until
manually re-applied. This is not a moving baseline that is calculated nightly based on the last seven days
of data. A moving baseline would mask data spikes and other anomalies that need to be highlighted.
Thresholds set manually may yield more desirable results if you are familiar with the nuances of
your environment.
Change the amount of data used in baseline

calculations
1. On the Web Console, click Settings > All Settings > SAM Settings > Data & Database Settings.
2. Enter a number of days, and then click Submit.
The value for the Baseline Data Collection Duration field cannot exceed the value defined for the
Detail Statistics Retention field (located at the top of the Data & Database Settings section).
Apply baseline thresholds at the template level

1. On the Web Console, click Settings > All Settings > SAM Settings > Manage Templates .
2. Check a template and click Edit from the toolbar.
401
3. If selecting only one component monitor, click [+] to expand the monitor details.
a. Click Use Latest Baseline Thresholds, as shown:
Note: Once this box is checked, the Warning and Critical fields automatically populate with
the macro, ${USE_BASELINE}.
b. Select the options for sustained thresholds, if desired:
4. If selecting more than one component monitor, select the monitors you want by checking the boxes
next to their names.
same type.
b. Check Statistic Threshold on the pop-up window, then check the Use thresholds calculated
from baseline data.
Note: The Use thresholds calculated from baseline data check box does not become available
until Statistic Threshold has been checked.
Note: Once Use thresholds calculated from baseline data is checked, the Warning and Critical
fields automatically populate with the macro, ${USE_BASELINE}.
Apply baseline thresholds at the application level


402
4. If selecting only one Component Monitor, click [+] to expand the monitor details.
a. Click Override Template.
Note: The current values for the thresholds appear in the Warning and Critical fields
b. Click Use Latest Baseline Thresholds, as shown:
c. When applied, the values change and a blue icon appear indicating that baseline thresholds
are being used.
5. If selecting more than one component monitor, use the check boxes to select the monitors you want
to edit, and then click Multi-Edit.
same type.
b. Check the Statistic Threshold check box on the pop-up window, then check the Use
thresholds calculated from baseline data.
Note: Once the second box is checked, the Warning and Critical fields automatically populate
with the macro, ${USE_BASELINE}.
Use latest baseline details

403
4. Find a component monitor in the list and click [+] to expand the monitor details.
5. Click Override Template, then click Latest Baseline Details.
Edit capacity planning thresholds

1. On the Web Console, click a node to navigate to the Node Details page for that node.
3. Click Manage Orion General Thresholds.
4. The Capacity Planning options appear under each object:
5. Make your selections, then click Submit on both the Orion General Thresholds screen and the Edit
Properties screen.
For more information, see Application Monitor Thresholds.
404
View latest baseline details
Details about how baseline data, as well as Warning and Critical thresholds are calculated, can be found
on the Latest Baseline Details page. This page details the data collection and calculation process using
several graphs and tables.
View the Latest Baseline Details Page


2. In the All Applications resource, expand the tree and then click an application.
4. Find a component monitor in the list and click [+] to expand the monitor details.
5. Click Override Template click Latest Baseline Details.
405
Change between 32-bit and 64-bit polling
Using AppInsight applications with 32-bit polling on 64-bit computers via an agent prevents certain
performance counters from collecting information and should be changed to 64-bit polling.
Changing this at the application level
2. Select an AppInsight Application (Exchange, SQL, IIS) and then click Edit Application Monitor.
3. Expand Advanced, and then click Override Template.
4. In the Platform to run polling job field, change the value to x64.
5. Click Submit.
Changing this at the template level
2. Select an AppInsight application and click Edit.
3. Expand Advanced, and in the Platform to run polling job on field, change the value to x64.
406
4. Click Submit.
407
Scan nodes for applications
SolarWinds SAM can scan nodes for you and automatically assign the Application Monitors it deems
suitable for each scanned node. You control the nodes to be scanned, the application templates used in
the scan, and the scanning parameters that determine a match.
Use the application discovery
1. On the Web Console, click Settings > All Settings > SAM Settings > Click Scan Nodes for Applications.
2. Follow the instructions in the Select Nodes Wizard.
3. Follow the instructions in the Select Applications Wizard.
4. Follow the instructions in the Enter Credentials Wizard.
5. Follow the instructions in the Review & Start Scan Wizard.
6. Follow the instructions in the Add UX Monitors Wizard.
Select Nodes
Click [+] in the list to expand the node groups and to select the nodes you want to scan.
Select Applications
To keep the time it takes to scan to a minimum, we recommend you initially scan for only a limited number
of application templates. To see more application templates, select a different template group from the
Show Only list.
To adjust the template assignment criteria, expand Advanced Scan Settings and move the slider to the
desired setting:
Exact Match
All the components must match to assign the template.
Strong Match
Most of the components must match to assign the template.
Partial Match
Some of the components must match to assign the template.
Minimal Match
At least one component must match to assign the template.
408
Enter Credentials
Some application templates require credentials either to access restricted resources, or to run within the
context of a specific user. To scan for these templates, add the necessary credentials to the list. If a
template you are scanning for requires credentials, the credentials in this list are tried in the order in
which they appear.
Warning: Credentials are tried several times over the course of a scan, so an incorrect password is
likely to lock out an account. To avoid potential account lockouts that affect actual users, we
recommend you create and use service accounts. A service account is an account that is created
specifically for the purpose of providing credentials to use for SolarWinds monitoring. With service
accounts, no actual user is affected by an account lockout if a password should be entered
incorrectly.
If you have domains sharing user names with different passwords, we recommend you run separate
application discoveries for each domain.
Review & Start Scan
Review the summary for the scan. If the automatic discovery matches templates that are already assigned
to the node, by default the template is not assigned a second time. If you want to assign duplicate
templates, select Yes, Assign Anyway from the Do you want to assign duplicates list.
Click Start Scan to begin the scan. The scan runs in the background. You are notified by a message near
the top of the window when scanning is completed. Click View results to see the results of the scan.
Add UX Monitors
You cannot scan for user experience (UX) monitors, but you can assign them to nodes manually. Adding
monitors from this page does not affect your scan.
409
Common Tasks with SolarWinds SAM
n Monitoring Internal and External Web Site Performance

n Monitor IIS application pools
n Scan for applications worth monitoring
n Monitor VMware performance counters using an application monitor
n Monitor and restart stopped Windows services
n Create a Windows PowerShell monitor
n Monitor large directories
410
Create your first application and alert
After applied to a node, a template becomes an application, which is comprised of component monitors,
also known as performance counters. Applications created from templates are used to report metrics
based on your needs.
Create a WMI monitor
1. On the Web Console, click Settings > All Settings > SAM Settings > Create a New Template.
2. Name the template and click Add Component Monitor.
3. Select WMI Monitor, click Add.
4. Select credentials or Inherit Credentials from Node.
5. In the Query field, enter a WQL query to return a statistic to be reported.
6. Enter thresholds or select Use thresholds calculated from baseline data.
7. Click Submit.
Apply the WMI monitor template
2. Locate your template and click Assign to Node.
3. Select the Windows node from the left pane, click the green arrow to move it to the right pane, and
click Next.
4. Choose the credentials, click Assign Application Monitor, then click Done.
Alert on the WMI application via email
1. On the Web Console, click Alerts & Activity > Alerts > Manage Alerts.
2. Click Add New Alert and name the alert.
3. On the Properties tab, enter required information, and click Next.
411
4. For the Trigger Conditions, complete the section as shown:
Important: Add the second trigger condition by clicking [+]. The first trigger condition tests for Status
(Down), the second for the specific application instance (indicated by 1 Object).
5. For Trigger Actions, click Add Action, select Send an Email/Page, then click Configure Action.
6. Enter the required information, click Next and complete the wizard as instructed, then click Submit.
7. Review and edit the Reset Actions and the Summary, then click Submit.
8. The Manage Alerts page indicates the alert was created successfully.
412
Scan for applications worth monitoring
1. On the Web Console, click Settings > All Settings > SAM Settings > Scan Nodes for Applications.
2. Select nodes by clicking [+] to expand the node groups, then select the nodes you want to scan, and
then click Next.
3. Select applications to find, and then click Next.
4. Enter the credentials for the servers you are scanning, and then click Start Scan.
5. Click View SAM Summary Page, then click View results after the SAM scan is complete.
413
Monitor a specific URL
1. On the Web Console, click Settings > All Settings > Add a Node.
2. Enter the Hostname or IP Address you want to monitor (for example, www.google.com).
3. Select External Node: No Status, and then click Next.
4. From the Show only: drop-down, select Web Pages.
5. Check Web Link and select Inherit credentials from Template.
6. Click Test, and then click Next.

7. On the Change Properties page, make any changes, and then click OK, Add Node.
8. Navigate to the Node Details page to review the results. To do this, click My Dashboards > Home, and
then drill down to your specific node in the All Nodes resource.
414
Monitor VMware performance counters using an application monitor
1. On the Web Console, click Settings > All Settings > SAM Settings > Component Monitor Wizard.
2. Select a VMware performance counter, then click Next.
3. Enter the IP address of the VMware node you want to browse, or click Browse, select the node from
the list, and then click Select.
4. Select or enter the appropriate credentials, then click Next.
5. Select whether you want to monitor A single system or Multiple systems.
6. Choosing A single system provides specific counters that apply to the target system only, choosing
Multiple systems provides more generic counters that can be applied to multiple systems.
Note: Choosing Multiple systems provides only aggregate performance counters (without instances).
Therefore, the Application Monitor created based on them can be considered as generic and
assigned to different ESX/vCenter target hosts. In this case, monitors in the application created
contain the special ${VMWARE_ENTITY_NAME} variable in the Entity Name field of the monitor.
When the monitor runs, this variable is resolved to the first available entity on a target host with the
desired Entity Type (for example, the first Host System).
8. Select the desired VMware Entity to monitor, then select the desired Performance Object (group) to
monitor.
9. Select the counters to monitor for the selected Performance Object, then click Next.
10. From the Edit Properties page you can modify settings as desired. When done, click Next.
Add components to the application monitor
1. Click [+] next to Component list to expand the list of counters or counters to be added.
2. Select New Application Monitor. Then enter a name for the new Application Monitor, then click Next,
then OK, Create.
3. Click View SAM Summary Page. Your new VMware monitor appears in the tree view for the All
Applications resource. The polling results for the new monitor are updated after a few minutes.
n Cluster Compute Resource (only available if the VMware vCenter Performance Counter Monitor type
is selected) – Data object that aggregates the computation resources of its associated Host System
objects into one single computation resource for use by virtual machines. The cluster services such
as HA (High Availability), DRS (Distributed Resource Scheduling), and EVC (Enhanced vMotion
Compatibility), enhance the usefulness of this single computation resource. This Entity Type is
specific to vCenter systems.
n Host System – Managed object type that provides access to a virtualization host platform.
415
n Resource Pool – Represents a set of physical resources which may be a single host, a subset of a
host's resources, or resources spanning multiple hosts. You can subdivide Resource pools by
creating child resource pools. In order to run, a virtual machine must be associated as a child of a
resource pool. In a parent/child hierarchy of resource pools and virtual machines, the root resource
pool is the single resource pool that has no parent pool.
n Virtual Machine – Managed object type for manipulating virtual machines, including templates that
can be repeatedly deployed as new virtual machines. This object type provides methods for
configuring and controlling a virtual machine.
416
Monitor and restart stopped Windows services
Create the monitor
1. On the Web Console, click Settings > All Settings > SAM Settings > Component Monitor Wizard
2. Select Windows Service Monitor, and then click Next.
3. Enter the IP address of the Windows node you want to browse, or click Browse, select the node from
the list, then click Select.
4. Enter or select the appropriate credentials, then click Next.
5. Check the services to monitor, adjust thresholds as needed, then click Next.
6. Ensure that New Application Monitor Template Name is selected and then enter a name for your
new template, then click Next.
7. Select the desired nodes to monitor and then click Next.
8. Click OK, Create, to create the assigned Application Monitor.
Create an alert that restarts any stopped Windows services and sends an email
1. On the Web Console, click Alerts & Activity > Alerts > Manage Alerts.
2. Click Add New Alert > Configure Alerts.
3. Scroll to the bottom of the list in the Manage Alerts dialog, and check the box for Restart a service.
4. To send an e-mail notification for the service restart:
a. Highlight Restart a Service and click Edit.

b. Select the Trigger Actions tab and then click Add New Action.
c. Select Send an E-Mail / Page and click OK.
d. Complete the e-mail info and click OK.
e. Click OK.
5. Click Done.
For more information about restarting Windows services with an alert action, see Adding Alert Actions.
417
Monitor large directories
1. On the Web Console, click Settings > All Settings > SAMSettings > Create a New Template.
2. Name the template, click Add Component Monitor, then expand the Custom Component Monitors
group, select Windows Script Monitor, then click Submit.
3. Select credentials with appropriate permissions to run the script on the SolarWinds SAM server.
4. Copy the following Visual Basic script to get the directory size into the Script Body field:
Dim folderPath
folderPath = WScript.Arguments(0)
Set fs=WScript.CreateObject ("Scripting.FileSystemObject")
Set folder= fs.GetFolder(folderPath)
WScript.Echo "Message: Folder " &folderPath & " is " & folder.Size & "
bytes large"
WScript.Echo "Statistic: " & folder.Size
6. Enter the UNC path name for the directory to monitor into the Script Arguments field.
Use the variable ${IP} for the IP address of the target node to which the monitor is assigned when
the Windows Script monitor runs.
7. Specify the critical and warning thresholds for the desired directory size, then click Submit.
8. Create an assigned Application Monitor by assigning the Large Directory Monitor template to the
node.
a. On the Web Console, click Settings > All Settings > SAM Settings > Manually Assign Application
Monitors.
b. Select All in the Show only list, click Large Directory Monitor and then click Next.
c. Click Manually Assign Application Monitors and Select All in the Show only list.
d. Click Large Directory Monitor and then click Next.
e. Locate and select the desired node and then click Next.
f. Enter itadmin in the Credential Name field and then enter your credentials.
g. Click Test, click Assign Application Monitors, and then click Done.
The Visual Basic code does the following:
a. Reads the first argument passed to the UNC path name for the directory to monitor and stores it in
FolderPath.
Creates the Scripting.FileSystemObject and stores it in fs.
a. Retreives the folder name from the saved command line argument and stores it in folder.
b. Displays the message with the folder name and the folder size.
c. Displays the statistic (folder size in bytes).
418
The script does no error checking.
419
Monitor IIS application pools
SolarWinds SAM can monitor five instances, for example, of w3wp.exe, differentiated by application pools
separately if you specify the application pool names in the component monitors.
1. From the SolarWinds Web Console, click Settings.

2. Add the web server to the Orion database.
a. Click Add a Node then enter the hostname or IP address of the Intranet web server.
b. Check the ICMP (Ping only) check box and then click Next.
c. From the Add Application Monitors page, click Next.
d. From the Change Properties page, Click OK, Add Node.
3. Find the wp3w.exe process on the web server.
a. From the SolarWinds Web Console, click Settings > All Settings > SAM Settings > Component
Monitor Wizard.
b. Select Process Monitor - WMI as the monitor type, and then click Next.
c. Click Browse, select the web server, and then click Select.
d. Enter WebServerAdmin in the Credential Name field.
e. Enter your credentials in the fields provided, then click Next.
f. Click the last page button to view the last page, then check the check box next to w3wp.exe,
and then click Next.
g. Change Monitor Name to Webpool1, then enter webpool1 in the Command Line Filter field.
h. Change the CPU Warning Threshold to greater than 40, then Change the CPU Critical
Threshold to greater than 50.
i. Click Add Another Component. After creating the monitors for all five w3wp.exe instances,
click Next.
j. Select New Application Monitor and enter Web Server Application Pools as the Application
Monitor Name, and then click Next.
k. Select the web server node, and then click Next, then click OK, Create.
420
Manage Asset Inventory
The Asset Inventory dashboard lets you maintain a current and detailed inventory of your environment's
hardware and software. Automatic inventory data collection benefits those interested in tracking asset
depreciation, gathering information for insurance purposes, or managing and maintaining your
infrastructure.
n Enable and disable the Asset Inventory dashboard

n Asset Inventory data collection
n Add server hardware monitoring
421
Enable and disable the Asset Inventory dashboard
The Asset Inventory sub-view is automatically displayed for each node supported. You can enable Asset
Inventory data collection for an individual node via the Add Node Wizard or by navigating through the
Management resource.
The Asset Inventory option is available only if the node supports Asset Inventory polling.
Enable Asset Inventory data collection via the Management Resource
1. Navigate to the Node Details view by clicking any node.

2. From the Management resource, click List Resources.
3. Select the Asset Inventory box to enable Asset Inventory data collection.
The option to display Asset Inventory information may not be available if the node does not have a
supported operating system.
Disable Asset Inventory data collection by un-checking this box.
422
Asset Inventory data collection
Asset Inventory data collection is automatically enabled during the Network Sonar Discovery and/or the
upgrade process.
Data collected for Asset Inventory purposes uses less than 100KB of database space per node. For a larger
environment consisting of roughly 1,000 servers, the total Asset Inventory data should total just under
100MB.
Required sub-views are enabled by default for nodes with Asset Inventory enabled.
Inventory data does not need to be collected with the same degree of regularity as status information,
therefore, the impact on your polling engine is minimal. Asset Inventory data collection occurs once daily.
This data collection interval can be configured to suit your needs.
Change the Default Asset Inventory Collection Period
1. On the Web Console, click Settings >All Settings > Orion Polling Settings.
2. Adjust the number of days for the Default Asset Inventory Poll Interval field.
Note: 1 is the minimum allowable value for this field.
3. Click Submit.
423
Manage AppStack
n Navigate to AppStack
n Use AppStack
n The AppStack environment
424
Navigate to AppStack
1. On the Web Console, click My Dashboards > Environment.

2. You are taken to the AppStack Environment view.
425
Use AppStack
Using AppStack as a troubleshooting tool is fairly straightforward. Simply navigate to the AppStack
Environment view, and then click on an object to see what is related to that object. To investigate further,
navigate to the Details page of the object or any related object.
For example, the illustration below displays all objects in the current environment. The application,
MSSQLSERVER, is in a Critical state, as indicated by its icon. To see what this application is related to, click
the MSSQLSERVER icon.
Locate objects related to an object
1. On the Web Console, click My Dashboards > Environment.

2. Click any object, in this example, MSSQLSERVER.
3. Once an object is selected, related objects will be highlighted by the fading of unrelated objects, as
shown:
Hide unrelated objects completely from view
426
1. Once an object is selected, click Spotlight in the upper right-hand corner of the view.
Navigate to the details page of an object for further investigation
1. Click the icon of the selected object to the left of the doughnut chart, or double-click the larger icon
in the main view.
2. From the Details page, investigate the cause for the Critical status.
427
Manage processes, services, tasks, and events in real time
n The Real Time Process Explorer
n The Service Control Manager
n The Windows Scheduled Task Monitor
n The Real Time Event Log Viewer
428
The Real Time Process Explorer
The Real Time Process Explorer (RTPE) is available for WMI and SNMP monitored nodes. The advantage of
the RTPE is that you no longer need to physically or remotely log in to a computer and run the Task
Manager to retrieve that machine's vital statistics. Information for monitored and unmonitored processes
is displayed directly through SAM using the RTPE.
Notes:
n Only SAM administrators can end processes as well as enable and disable the RTPE.
n The User Name and Command Line columns are hidden by default.
n Using the RTPE on a node monitored via ICMP, which has no working component, requires you to
select Windows credentials manually. Consider promoting the selected node to SNMP or WMI to
avoid this prompt.
429
Access the Real Time Process Explorer from the application details page
Manager to retrieve that machine's vital statistics.
Pop-ups must be enabled for the Real Time Process Explorer to be viewed.
1. On the Web Console, click My Dashboards > SAM Summary page.

2. In the All Applications group, click an Application.
3. Locate the Management resource and click Real-Time Process Explorer.
The Real Time Process Explorer can also be accessed from the Component Details page and Node
Details page.
430
Monitor unmonitored processes
Processes currently monitored by SAM are indicated by the application icon and name of the assigned
application. Processes that are not currently monitored by SAM are indicated by the [+] symbol, followed
by the words, Start monitoring.
Have SAM start monitoring a process
1. From the RTPE, click Start monitoring.

2. From the Edit Properties section of the Component Monitor Wizard you can begin setting up the
selected component monitor.
431
Use the Real Time Process Explorer
Different information is displayed in the RTPE depending on which protocol you use to monitor a node.
The table below shows the differences in the information gathered based on the protocol used.
Monitored Process: WMI SNMP
Name Yes Yes
Process ID Yes Yes
Assigned Application Yes Yes
CPU usage Yes Yes
Physical Memory Yes Yes
Virtual Memory Yes No
Disk I/O Yes No
User Name Yes No
Command Line Yes* Yes*
Polling interval Five seconds Up to two minutes
Windows servers update their SNMP statistics every two minutes. It takes two updates to these statistics to
provide an accurate calculation. Data displayed in the RTPE via SNMP can take up to four minutes to
display.
* Information on certain processes may not be exposed which can result in certain rows being
blank.
By default, all available columns, with the exception of the User Name and Command Line, are
shown for the top ten running processes. Each column can be sorted, added, or removed by clicking
the column head and then clicking the drop down arrow.
Show all running processes
Click Show All in the bottom-left of the window.
Show a set number of running processes
Change the number in the text box next to the Show All button
Pause polling
If available, click Pause Polling in the top-left of the window.
432
End processes
Check the boxes next to the processes you want to end and then click End Process. This option
is only available when the RTPE is using a WMI connection.
Start polling
Click Start Polling in the top-left of the window.
For Windows-based nodes, change the credentials by clicking the Use Different Credentials button to bring
up the credential library dialog box.
Clicking Refresh will re-poll the running processes.
433
Real Time Process Explorer alerts
Three alerts are included with the Real Time Process Explorer
n High CPU Percent Utilization with Top 10 Processes
This alert sends an email when the CPU utilization is greater than 80%.
n High Physical Memory Utilization with Top 10 Processes
An alert is sent when physical memory usage is at or above 90%.
n High Virtual Memory Utilization with Top 10 Processes
An alert is sent when virtual memory usage is at or above 90%.
These alerts can be found in the Alert wizard. For more information, see Adding Alerts.
Alerts may lag if you are monitoring hardware via SNMP. It takes two updates to these statistics to
provide an accurate calculation, meaning an alert can take up to four minutes to reach its recipient.
To expedite this process, change the protocol to WMI, which updates every five seconds. Also,
consider adjusting the trigger time to a value greater than two minutes.
434
Real Time Process information in top 10 alerts
SAM provides additional troubleshooting information for high CPU, memory, and virtual memory by
sending email alerts. This is done by utilizing the Top Offending Processes metric running on the server at
the time of the alert.
Find the executable path SolarWinds.APM.RealTimeProcessPoller.exe and its command line

arguments below.
Command line argument syntax:

SolarWinds.APM.RealTimeProcessPoller.exe -n=<NodeID> [-
count=<NumberOfProcesses>] [-sort=<SortBy>] [-timeout=<PollingTimeout>]
[-alert=<AlertDefID>]
Command line argument variables
Variable Definition
-n ID of a Node (NodeID), which is polled.
-count The number of processes to show.
-sort The criteria used for the selection of top processes.
Process:
n CPU - Processor time. This is the default value if the command line argument is
not specified.
n PhysicalMemory - Process physical memory.
n VirtualMemory - Process virtual memory.
n DiskIO - Process disk I/O per second.
-timeout Timeout for polling in seconds.
-alert The AlertDefID of associated triggered alert. If this argument is provided, then alert notes
are updated with the results from polling.
-activeObject The ActiveObject property of the associated triggered alert. If this argument is not
provided, NodeID is used.
Example 1
This example returns the top 20 processes with the highest virtual memory consumption running on
the host with node ID 123.
SolarWinds.APM.RealTimeProcessPoller.exe -n=123 -count=20 -sort=VirtualMemory -

timeout=300
Example 2
This example uses the Execute an External Program alert action:
435
SolarWinds.APM.RealTimeProcessPoller.exe -n=${NodeID} -alert=${AlertDefID}
Example 3
This example uses the Execute an External Program alert action for an alert defined for the Volume
object type:
SolarWinds.APM.RealTimeProcessPoller.exe -n=${NodeID} -alert=${AlertDefID} -
activeObject=${NetObjectID} -sort=VirtualMemory
436
The Service Control Manager
The Service Control Manager (SCM) is similar to the Real Time Process Explorer, except with the SCM you
manage the services of monitored Windows nodes instead of processes. The advantage of the SCM is that
you no longer need to physically, or remotely, log in to a Windows computer to view and control its
services. Information for running and stopped services is displayed directly through SAM using the Service
Control Manager.
Services viewed in the Service Control Manager are polled every 25 seconds using WMI.
437
Access the Service Control Manager (SCM) from the Node Details page

2. In the All Nodes group, click a node.
3. On the Node Details page, the Service Control Manager button can be found at the bottom of each
Top 10 list, as highlighted below:
The Service Control Manager button is not available on the Node Details page in situations where
Top 10 lists are hidden. Clicking Service Control Manager opens the SCM in a new window and the
services are sorted alphabetically.
Pop-ups must be enabled in your browser to view the Service Control Manager.
438
Use the Service Control Manager
The Service Control Manager (SCM) shows all the services that are on the monitored computer. Hovering
the mouse over the row of any service will give you detailed information about that service.
Start and stop a service
1. Click the row of a service to select it.

2. At the top of the window, select Stop Service, Start Service, or Restart service.
Services monitored by SAM are indicated by the application icon and name of the assigned application.
Services that are not monitored by SAM are indicated by the [+] symbol, followed by the words, Start
monitoring this service.
Monitor a service with SAM
1. Click Start monitoring this service in the row of the service to monitor.
2. The Edit Properties section of the Component Monitor wizard opens. Begin customizing the selected
component monitor.
The table below shows the default settings for the Service Control Manager:
Action Description Default Setting
Service Job Life Time This is used to specify how long the information for a service 3 minutes
exists.
Service Poll Interval This is used to specify the refresh frequency of the 25 seconds
information reported by the service.
Service Action Job This reports the timeout for a service. 3 minutes
Timeout
By default, all available columns are shown.
439
The Windows Scheduled Task Monitor
The Windows Scheduled Task Monitor (WSTM) is a resource designed to provide you with quick visual
access to the status of scheduled tasks configured on your Windows nodes.
Only tasks from root directory can be monitored. The WSTM will not work for tasks from every level
of the Task Scheduler Library.
The WSTM comes with an alert that will notify you of any task execution failures, as well as web-based
reports that show all scheduled tasks configured across all servers in your environment. Additionally, there
is a dedicated Task Failure Report you can view on-screen or have emailed to you.
This resource is hidden when the WSTM is not being monitored on a node.
440
Requirements for the Windows Scheduled Task Monitor
The WSTM supports monitoring tasks on the following operating systems:
n Windows 2003 R2 SP2

n Windows 2008
n Windows 2008 R2
n Windows 2012
n Windows 2012 R2
Notes:
n When SAM is installed on Windows 2003 R2 SP2, scheduled tasks on Windows 2008 or later cannot
be polled by the Windows Scheduled Task Monitor (WSTM).
n The WSTM consumes five license units per node.
n Only tasks from root directory can be monitored. The WSTM will not work for tasks from every level of
the Task Scheduler Library.
441
Enable the Windows Scheduled Task Monitor
1. On the Web Console, click Settings > Manage Nodes.

2. Click [+] Add Node and then select the Windows Servers: WMI and ICMP option and enter the
credentials.
3. Click Next and then select Windows Scheduled Tasks.
4. Complete the wizard as instructed.
The Windows Schedule Tasks option is checked when tasks are already being monitored, is
unchecked by default when at least one task is found on the target machine, or is hidden when a
task is not found on the target machine.
442
Access the Windows Scheduled Task Monitor
1. On the Web Console, click My Dashboards > Home > All Nodes resource.
2. Expand the Windows tree by clicking Windows, and then click a Windows node to be taken to the
Node Details page for that node.
3. On the Node Details page, find the Windows Scheduled Task resource, as shown:
When monitored, the Windows Schedule Task Monitor resource is only on the Node Details view of
the monitored server.
443
Understand the Windows Scheduled Task Monitor
Only tasks from root directory can be monitored. The WSTM will not work for tasks from every level of the
Task Scheduler Library.
n Hovering over any item in the Task Name column will provide detailed information about the listed
task.
n Sort the display by clicking the head of each column.
n From Edit Settings, at the bottom of the resource, you can:
n Change the polling frequency
n Change the polling timeout period
n Change credentials
n Add custom notes
444
Alert using Windows Scheduled Task Monitor macros
This alert is associated with the Windows Scheduled Task Monitor and can be used in alerting.
Alert me when task last run result is non successful
445
Windows Scheduled Task Monitor returned status codes
Below is a list of status codes and their meanings that may appear in the WSTM resource:
Hex Status
Description
Code
(0x0) The operation completed successfully.
(0x1) Incorrect or unknown function called.
(0x2) File not found.
(0xA) The environment is incorrect.
(0x41300) The task is ready to run at its next scheduled time.
(0x41301) The task is currently running.
(0x41302) The task will not run at the scheduled times because it has been disabled.
(0x41303) The task has not yet run.
(0x41304) There are no more runs scheduled for this task.
One or more of the properties that are needed to run this task on a schedule have not
(0x41305)
been set.
(0x41306) The last run of the task was terminated by the user.
(0x41307) Either the task has no triggers or the existing triggers are disabled or not set.
(0x41308) Event triggers do not have set run times.
(0x4131B) The task is registered, but not all specified triggers will start the task.
The task is registered, but may fail to start. Batch log in privilege needs to be enabled for
(0x4131C)
the task principal.
(0x41325) The Task Scheduler service has asked the task to run.
(0x8004020D) Cannot modify or delete an object that was not added using the COM+ Admin SDK.
(0x80041309) A task's trigger is not found.
(0x8004130A) One or more of the properties required to run this task have not been set.
(0x8004130B) There is no running instance of the task.
(0x8004130C) The Task Scheduler service is not installed on this computer.
(0x8004130D) The task object could not be opened.
446
(0x8004130E) The object is either an invalid task object or is not a task object.
No account information could be found in the Task Scheduler security database for the
(0x8004130F)
task indicated.
(0x80041310) Unable to establish existence of the account specified.
Corruption was detected in the Task Scheduler security database. The database has
(0x80041311)
been reset.
(0x80041312) Task Scheduler security services are available only on Windows NT.
(0x80041313) The task object version is either unsupported or invalid.
The task has been configured with an unsupported combination of account settings and
(0x80041314)
run time options.
(0x80041315) The Task Scheduler Service is not running.
(0x80041316) The task XML contains an unexpected node.
(0x80041317) The task XML contains an element or attribute from an unexpected namespace.
(0x80041318) The task XML contains a value which is incorrectly formatted or out of range.
(0x80041319) The task XML is missing a required element or attribute.
(0x8004131A) The task XML is malformed.
(0x8004131D) The task XML contains too many nodes of the same type.
(0x8004131E) The task cannot be started after the trigger end boundary.
(0x8004131F) An instance of this task is already running.
(0x80041320) The task will not run because the user is not logged in.
(0x80041321) The task image is corrupt or has been tampered with.
(0x80041322) The Task Scheduler service is not available.
(0x80041323) The Task Scheduler service is too busy to handle your request. Please try again later.
The Task Scheduler service attempted to run the task, but the task did not run due to
(0x80041324)
one of the constraints in the task definition.
(0x80041327) The task has properties that are not compatible with earlier versions of Windows.
(0x80041328) The task settings do not allow the task to start on demand.
(0x80070002) The system cannot find the file specified.
(0x800700C1) Not valid Win32 application.
447
(0x800704C7) The operation was canceled by the user.
The operation being requested was not performed because the user has not logged on
(0x800704DD)
to the network. The specified service does not exist.
(0xC000013A) The application terminated.
(0xC06D007E) Unknown software exception.
For a complete list of error codes, see Task Scheduler Error and Success Constants.
448
WTSM status
The following table lists the conditions that must be met in order for a status of Available, Not Available, or
Undefined, to be triggered:
Available Not Available Undefined
Task Success Trigger Not Found Default
Task Ready Task Not Ready
Task Running Task Not Running
Task Disabled Service Not Installed
Task Has Not Run Cannot Open Task
Task No More Runs Invalid Task
Task Not Scheduled Account Information Not Set
Task Terminated Account Name Not Found
Task No Valid Triggers Account Database Corrupt
Event Trigger No Security Services
Some Triggers Failed Unknown Object Version
Batch Log on Problem Unsupported Account Option
Task Queued Service Not Running
Unexpected Node
Name space
Invalid Value
Missing Node
Malformed XML
Too Many Nodes
Past End Boundary
Already Running
User Not Logged On
Invalid Task Hash
Service Not Available
449
Service Too Busy
Task Attempted
Task Not V1 Compatible
Start On Demand
Service Does not Exist
No File Specified
Cannot Delete Object
Not Valid Application
Incorrect Function
File Not Found
Environment Is Incorrect
Application Terminated
Unknown Software Exception
Operation Canceled
450
The Real Time Event Log Viewer
View Windows event logs in real time using the WMI protocol with the Real Time Event Viewer (RTEV). Event
logs can be filtered by log type, event source, and the level of severity. You can also select which event logs
you want to monitor from within this resource.
451
Access the Real Time Event Viewer from the Node Details page

2. In the All Nodes group, click a node, and then locate the Real Time Event Viewer in the Management
resource.
3. Click Real-Time Event Viewer.
Pop-ups must be enabled for the RTEV to be viewed.
452
Filter events in the Real-Time Events Viewer
Different events are displayed in the RTEV depending on the log type and filters you choose. After you
select a Log Type from the drop-down list, SAM immediately begins collecting these logs and display them
in the message window to the right, as shown:
Select a log type
Select a Log Type from the drop-down menu.
Filter collected events
After the events of the selected Log Type are collected and displayed in the window on the right, you can
filter the results with various criteria.
1. Select Custom Sources from the Event Sources drop-down menu.
2. Select only the sources you want to keep when the filter is applied, as highlighted below:
453
3. Select the type of messages you want the filter to keep by selecting the Event Level.
4. Click Apply Filter to have the events filtered and displayed.
454
Reading events in the Real-Time Events Viewer
After filtering is complete, hide and unhide the filtering pane on the left by clicking either of the two
arrows, highlighted in red:
The display window shows a list of the most recent events. Should any new events occur while this window
is open, a green bar at the top of the window indicates that new events have arrived. Click the green bar to
add these new events to the display window.
The Level column icons correspond to the Event Level icons in the legend of the events pane.
Clicking any message in the display window brings up a message box providing the entire message along
with additional details.
455
Monitor events in the Real-Time Events Viewer
Begin monitoring events from within the RTEV by clicking Start Monitoring in the Message Details view.
This takes you to the Add Component Monitor wizard and lets you to create an application based on your
selection.
Component Monitor Wizard
After you begin the Component Monitor Wizard, you encounter the option to Disable Keyword Matching.
the Include Events drop-down menu will help you filter results.
456
Manage audit events
SAM offers the ability to audit itself. For example, you may want to know who added a node to SAM and
when. The Last 10 Audit Events resource provides this ability.
This resource is only available for users with administrative rights. You may need to log in with an
administrator account to perform this action.
From this view, you can click on either the user or the node which is linked to more information about that
particular item. Clicking All Audit Events will allow you to select the audit events you want displayed, in
addition to other self-explanatory options. Refer to the following topics for additional information:
Add the Audit Events resource
1. On the Web Console, click My Dashboards > Home > Customize Page.
2. Click the [+] in any column and search for Audit.
3. Select the resources wanted, and then click Add Selected Resources, then click Done.
457
Filter audit events
SAM allows you to filter Audit Events based on device, time, and message.
1. From the Audit Events resource, click All Audit Events.
2. Select the filters you want to apply by checking the appropriate boxes and items from the drop down
menus, as highlighted below, and then click Apply.
Edit audit events
Click Edit to choose the audit events you want displayed in addition to selecting the time period for the
events, as well as the number of events to display.
1. From the Audit Events resource, click Edit.

2. Check the events you want to be displayed in the resource, and then click Submit.
458
Manage SolarWinds SAM polling engines
To ensure that your polling engines are optimized to run at peak performance, you need to occasionally
tune them. If you use more than one polling engine, you need to balance the load so that each engine can
perform optimally.
For more information, see View polling engine status
459
View polling engine status
The Polling Engines view provides information about the performance of all polling engines in your Orion
Platform product installation.
To access the Polling Engine view, click Settings, then Polling Engines in the Details group.
460
Configure polling engine settings
Settings for your SolarWinds SAM polling engine are configured on the SolarWinds Polling Settings view
within the SolarWinds Web Console.
1. On the Web Console, click Settings > All Settings > Polling Settings.
2. Adjust the settings as needed, and then click Submit.
461
SolarWinds polling settings
The following poller settings are configurable on the SolarWinds Polling Settings view.
n Polling intervals
n Polling statistics intervals
n Network
n Calculations & Thresholds
462
Polling intervals
The following settings configure default polling intervals. To apply poller settings, click ReApply Polling
Intervals.
Default Node Poll Interval
Devices are regularly polled to determine status and response time on this designated interval. By
default, this interval is 120 seconds.
Default Volume Poll Interval
Volumes are regularly polled to determine status and response time on this designated interval. By
default, this interval is 120 seconds.
Default Rediscovery Interval
Your entire network is polled on this interval to detect any re-indexed devices. Monitored network
devices are also checked for IOS upgrades permitting EnergyWise support. By default, this interval is
30 minutes.
Lock custom values
This option is enabled by default. Enabling this option automatically saves any polling
customizations made on the SolarWinds Polling Settings view.
463
Polling statistics intervals
The following settings configure default polling intervals for device statistics. To apply poller settings, click
ReApply Polling Statistic Intervals.
Default Node Statistics Poll Interval
Device performance statistics are regularly polled on this interval. By default, this interval is 10
minutes.
Default Volume Statistics Poll Interval
Volume performance statistics are regularly polled on this interval. By default, this interval is 15
minutes.
464
Network
The following settings configure ICMP and SNMP requests.
ICMP Timeout
All ICMP (ping) requests made by the SolarWinds poller time out if a response is not received within
the period designated. By default, this period is 2500ms.
ICMP Data
This string is included within all ICMP packets sent by SolarWinds.
SNMP Timeout
All SNMP requests made by the SolarWinds poller time out if a response is not received within the
period designated. By default, this period is 2500ms.
SNMP Retries
If a response to an SNMP poll request made by the SolarWinds poller is not received within the
configured SNMP Timeout, the SolarWinds poller will conduct as many retries as designated by this
value. By default, this value is 2.
465
Calculations & Thresholds
The following settings designate methods for calculating availability and transmission rate baselines,
select the SolarWinds SAM node warning level and counter type, and indicate security preferences for
community strings and other potentially sensitive information in the web console.
Availability Calculation (advanced)
This setting designates the type of calculation SolarWinds SAM performs to determine device
availability. For more information, see Calculate node availability.
Baseline Calculation (advanced)
Upon startup, SolarWinds can calculate a baseline for the transmission rates of the various elements
of your network. This baseline is used as a starting point for any comparison statistics. For more
information, see Calculate a baseline.
Allow Secure Data on Web (advanced)
In the interest of security, sensitive information about your network is not viewable in the SolarWinds
Web Console. However, if your network is properly secured, you may check this option to allow the
viewing of community strings and other potentially sensitive information within the web console.
This setting does not affect the display of custom reports that you export to the web. For more
information see Creating and Editing Web Based Reports.
Node Warning Level
Devices that do not respond to polling within this designated period of time display as Down in the
web console. By default, this value is 120 seconds.
Counter Rollover
This option sets the type of counter SolarWinds SAM is to use. For more information, see Manage
counter rollovers.
466
Calculate a baseline
Much of the raw data that SolarWinds SAM polls from nodes is provided initially as counter values. If you
do not need statistics immediately, or if you do not want SolarWinds SAM to calculate a baseline at startup,
disable baseline calculation at startup by setting the Baseline Calculation option on the SolarWinds Polling
Settings view to False.
Baseline calculation requires significant data gathering and processing. Until baseline calculation is
completed, both SolarWinds SAM server performance and the CPU performance of some of network
routers may be adversely affected.
467
Set the node warning level
A device may drop packets or fail to respond to a poll for many reasons. Should the device fail to respond,
the device status is changed from Up to Warning. On the SolarWinds Polling Settings view, you can specify
the Node Warning Level, which is the length of time a device is allowed to remain in the Warning status
before it is marked as Down. During the interval specified, the service performs "fast polling" (ICMP) to
continually check the node status.
You may see events or receive alerts for down nodes that are not actually down. This can be caused
by intermittent packet loss on the network. Set the Node Warning Interval to a higher value to avoid
these false notifications. For more information about packet loss reporting, see Manage packet loss
reporting. You may need to log in with an administrator account to perform this action.
1. On the Web Console, click Settings > All Settings > Polling Settings.
2. In the Calculations and Thresholds group, set the Node Warning Level to an appropriate interval, in
seconds.
Note: The default Node Warning Level interval is 120 seconds.
3. Click Submit.
468
Use the polling engine load balancer
The Polling Engine Load Balancer is a useful tool for reassigning nodes to a new polling engine, deleting an
unused polling engine, and performing load balancing between multiple polling engines. The tool is
available within the Monitor Polling Engines application, which is an advanced feature of SolarWinds SAM.
Reassigning nodes to new polling engines may be required in the following situations:
n Moving or renaming your SolarWinds SAM server

n Merging two or more SolarWinds servers
If these or any other conditions present the need for reassignment, complete the following procedure to
reassign nodes to a new polling engine.
Reassign nodes to a different polling engine
1. Click Start > All Programs > SolarWinds > Advanced Features > SolarWinds Service Manager.
2. Click Shutdown Everything.
Note: Confirm that you stop the SolarWinds Network Performance Monitor Service on all polling
engines.
3. Click Start > All Programs > SolarWinds > Advanced Features > Monitor Polling Engines.
4. Click Servers > Poller Load Balancing.
5. Select the nodes you want to reassign.
Note: Use Shift + click to highlight multiple consecutive rows, and use Ctrl + click to highlight
multiple non-consecutive rows.
6. Click Polling Engines > Move Selected Nodes to *, substituting the target polling engine for *. The
node is reassigned, and it reflects the name of the polling engine in the polling engine column.
7. Click Start > All Programs > SolarWinds > Advanced Features > SolarWinds Service Manager to
restart SolarWinds services.
469
Manage packet loss reporting
To manage the amount of network-wide packet loss reported by SolarWinds, configure the Response Time
Retry Count for your polling engine. This setting designates the number of times SolarWinds retries ICMP
pings on a monitored device before packet loss is reported.
This configuration change requires an insertion into your Orion database. If possible in your
environment, SolarWinds recommends installing and using the SQL Server Management Studio to
perform this insertion.
Configure the response time retry count for your polling engine
1. Create a full backup of your Orion database.

2. On your SolarWinds server, click Start > All Programs > SolarWinds > Advanced Features >
SolarWinds Service Manager.
3. Click Shutdown Everything.
4. On your Orion database server, click Start > All Programs > Microsoft SQL Server > SQL Server
Management Studio.
5. Select your Orion database Server name.
6. Select an appropriate Authentication type, provide any required credentials, and then click Connect.
7. Expand Databases > SolarWindsDatabaseName > Tables, and then click New Query.
8. Type the following query into the empty SQL query field:
Note: Specify your own custom values for Maximum, CurrentValue, and DefaultValue.INSERT INTO
[SolarWindsDatabaseName].[dbo].[Settings] (SettingID, Name, Description,
Units, Minimum, Maximum, CurrentValue, DefaultValue) VALUES (‘SWNetPerfMon-
Settings-Response Time Retry Count’, ‘Response Time Retry Count’, ‘Number of
times SolarWinds retries ICMP pings on a monitored device before reporting
packet loss’, ‘’, 1, Maximum, CurrentValue, DefaultValue)
9. Click Execute, and then close SQL Server Management Studio.
10. On your SolarWinds server, click Start > Run, type regedit, and then click OK.
11. Expand HKEY_LOCAL_MACHINE > SOFTWARE > SolarWinds.Net > SWNetPerfMon.
12. Right-click Settings, and then click New > String Value.
13. Enter Response Time Retry Count as the New Value.
14. Right-click Response Time Retry Count, and then click Modify.
15. In the Value data field, enter the CurrentValue provided in the query above, and then click OK.
16. Close the Registry Editor.
17. Click Start > All Programs > SolarWinds > Advanced Features > SolarWinds Service Manager.
18. Click Start Everything.
470
Calculate node availability
The Availability Calculation setting on the SolarWinds Polling Settings view provides a choice between the
following two methods for determining device availability.
Node Status
The default method is based upon the historical up or down status of the selected node. The selected
node is polled for status on the Default Node Poll Interval defined on the SolarWinds Polling Settings view.
If the selected node responds to a ping within the default interval, the node is considered up, and a value
of 100 is recorded in the Response Time table of the Orion database. If the node does not respond to a
ping within the default interval, the node is considered down and a value of 0 is recorded in the Response
Time table of the Orion database. To calculate node availability over a selected time period, the sum of all
Response Time table records for the selected node over the selected time period is divided by the selected
time period, providing an average availability over the selected time period.
Percent Packet Loss
The second method is a more complicated calculation that effectively bases the availability of a selected
node on its packet loss percentage. As in the Node Status method, the selected node is polled for status. If
it responds within the Default Node Poll Interval defined on the SolarWinds Polling Settings view, a value of
100 is averaged with the previous 10 availability records.
The result of the Percent Packet Loss calculation is a sliding-window average. To calculate node availability
over a selected time period, the sum of all results in the Response Time table for the selected node over
the selected time period is divided by the selected time period, providing an average availability over time.
Note: The Percent Packet Loss method introduces a historical dependency into each availability node
record. In general, it is best to leave calculations based on Node Status unless you specifically need node
availability based on packet loss.
Calculating a Baseline
Much of the raw data that SolarWinds SAM polls from nodes is provided initially as counter values. If you
do not need statistics immediately, or if you do not want SolarWinds SAM to calculate a baseline at startup,
disable baseline calculation at startup by setting the Baseline Calculation option on the SolarWinds Polling
Settings view to False.
Baseline calculation requires significant data gathering and processing. Until baseline calculation is
completed, both SolarWinds SAM server performance and the CPU performance of some of network
routers may be adversely affected.
For more information, see Change the amount of data used in baseline calculations.
471
AppInsight for Exchange was designed exclusively for the mailbox role which offers a detailed view of your
Exchange environment. This application provides detailed metrics on mailboxes, databases, and a host of
performance counters without the use of agents or templates. Use Applnsight for Exchange to monitor
virtually every aspect of your Exchange environment.
After it is applied to a node, AppInsight for Exchange is considered an application. AppInsight for Exchange
is comprised of multiple component monitors.
To optimize your Exchange server performance, see 5 Tips to Optimize Exchange Server for
Improved Performance.
472
Quick configuration - AppInsight for Exchange requirements and permissions
AppInsight for Exchange requirements and permissions
n Local administrator permissions are needed for automatic configuration, but they are not needed for
monitoring after configuration is complete.
n To provide organization-wide capability, the service account (Domain User) needs to be a member of
the View-Only Organization Management group. Membership to this group gives the user object
read-only access to the entire Exchange environment, without providing any domain or local access
on the Exchange server. It also prevents abuse by an unauthorized user, for example (modifying
Exchange environment configuration, creating or deleting users, and so on.)
n In order to gather information, the user object must be assigned the Mailbox Search management
role within Exchange. In order for the account to be configured correctly, the account must be a
member of the Local Administrators group.
For more information, see Troubleshoot permissions.
473
Add AppInsight for Exchange to a node
It is recommended that you add this application on WMI managed nodes. If you convert an SNMP
managed node to WMI, interface statistics become lost. To convert SNMP managed nodes to WMI, see
Promoting a Node to WMI Monitoring.
Before you begin:
n Multiple instances of Exchange on the same server is not supported.

n Nodes that are not added via WMI are not be displayed in the List Resources dialog.
n Monitoring an Exchange Database Access Group (DAG) by way of a Virtual IP address (VIP) is not
supported. AppInsight for Exchange should only be applied to the physical IP address of each
mailbox server in the DAG individually.
n You may need to log in with an administrator account to perform this action.
Add AppInsight for Exchange to a node via discovery
2. Complete the information on the Define Node step, and then click Next.
3. On the Choose Resources step in the Configuration Wizard, select the AppInsight for Exchange
applications you want. AppInsight applications have a unique blue and white icon.
4. Click Next and complete the wizard as instructed.
5. Navigate to the All Applications resource and click your AppInsight for Exchange application.
6. Enter your Exchange credentials when prompted, and then click Configure Server.
474
Navigate the AppInsight for Exchange pages
AppInsight for Exchange can be found in the All Applications resource on the Application Summary view.
View the AppInsight for Exchange Details page
1. On the web console, locate the All Applications resource by clicking My Dashboards > Applications
> SAM Summary.
2. Expand the AppInsight for Exchange tree and click [+].
3. Expand the node tree, click [+], and then click the application.
View the AppInsight for Exchange Performance Counter Details page
From the AppInsight for Exchange Details view, click any performance counter within a resource.
475
View the AppInsight for Exchange Database Details page
From the AppInsight for Exchange Details view, click any database within a Database resource.
View the AppInsight for Exchange Mailbox Details page
From the AppInsight for Exchange Details view, click any user name within a Mailbox resource.
476
Advanced Manual Configuration of AppInsight for Exchange
Manual configuration is only recommended for experienced Exchange administrators.
n Changes that will be made to enable AppInsight for Exchange

n Find Exchange credentials
n Non-Domain Account
n Find Exchange URL settings
n Set PowerShell permissions
n Edit the AppInsight for Exchange template
477
Changes that will be made to enable AppInsight for Exchange
The configuration tool first transfers to the Exchange Server by using the Windows administrative share.
Once on the Exchange Server, the tool uses a custom PowerShell script to make configuration changes.
SAM will add the Mailbox Search Role to the Exchange server with the credentials provided. The tool then
reports back to SAM with the results. If errors are reported, you will be asked to configure Exchange.
The target machine must have the following:
n WinRM 2.0
n PowerShell v2.0
n IIS
SAM will make the following configuration changes
n Enable WinRM
n Enable Windows Authentication for PowerShell's web site
n WinRM and Windows Authentication configurations are performed remotely from SAM
SAM uses a specially designed configuration tool to make the necessary changes for enabling
AppInsight for Exchange. Once this tool completes remote configuration, it will automatically
remove and unregister itself.
478
Find Exchange credentials
For an account to access Exchange
n The account must be a domain account.

n In order to modify IIS and PowerShell settings on the Exchange server, the account must be a Local
Administrator.
n The account is recommended to not be a member of the Domain Administrators group. (Typically,
this is handled by adding a custom domain security group which is used to define a specific type of
administrator with specific permissions to the Local Administrators group. In larger, more mature
environments, this is handled using GPOs, whereas smaller organizations may perform this task
manually).
The verify you have valid Exchange credentials, run the following cmdlet in the Exchange Management
Shell (EMS):
Get-ManagementRoleAssignment -RoleAssignee “USER_IDENTITY”
479
Manually configuring the Exchange server
To manually prepare an Exchange server for AppInsight for Exchange, the following items must be
installed and/or configured on the server. Instructions for each item are listed on this page below.
n Define Exchange Credentials

n Install PowerShell 2.0 on Server 2008 R2
n Install PowerShell 2.0 on Server 2012
n Setup PSLanguageMode for the PowerShell web site.
n Create a self-signed certificate
n WinRM 2.0
n Create a firewall rule
n Configure IIS
For a list of possible configuration errors with solutions, see Troubleshoot error codes in AppInsight for
Exchange.
Define Exchange Credentials
Non-Domain Account
Local accounts (Non-Domain) cannot access Exchange Management interfaces and therefore are not
supported by AppInsight for Exchange. Please select an Active Directory account or create a new one to
use with AppInsight for Exchange.
Add Local Administrative privileges to an Active Directory account
1. On the server where you wish to grant local administrative privileges, open a Computer Management
console.
Note: On Windows 2012, add this privilege using the Active Directory console.
2. Navigate to the Administrators group.
3. Add the type in the Active Directory user name of the account you want to grant administrative
privileges. (Ensure the location is set to either the domain where the account is located or Entire
Directory.)
4. Save your changes.
Alternatively, you can add an Active Directory group to the local administrators group and add the
Active Directory user accounts to that group.
To verify the account and local group membership has been configured properly, run the
following in a PowerShell session
480
$Recurse = $true
$GroupName = 'Administrators'
Add-Type -AssemblyName System.DirectoryServices.AccountManagement
$ct = [System.DirectoryServices.AccountManagement.ContextType]::Machine
$group =
[System.DirectoryServices.AccountManagement.GroupPrincipal]::FindByIdentity
($ct,$GroupName)
$LocalAdmin = $group.GetMembers($Recurse) | select @{N='Domain'; E=
{$_.Context.Name}}, samaccountName, @{N='ObjectType'; E=
{$_.StructuralObjectClass}} -Unique
$LocalAdmin = $LocalAdmin | Where-Object {$_.ObjectType -eq "user"}
Exchange Access
Granting Least Privilege access to the Exchange Organization can be accomplished using Active Directory
Users and Computers (ADUC).
1. Open Active Directory Users and Computers (ADUC) and find he Microsoft Exchange Security Groups
OU.
2. From the View-Only Organization Management group, add the user name of the account you want to
grant access to the Exchange organization.
See Microsoft.com for detailed instructions.
Mailbox Search Access
Mailbox Search access is required to determine attachment counts and sizes. This can be granted using
the Exchange Management Shell (EMS).
481
1. From the Start menu, open the EMS.
2. Type: New-ManagementRoleAssignment -Role "Mailbox Search" -User <Username of
account being granted access> and then press Enter.
3. To verify the management role has been properly assigned, enter the following command:
Get-ManagementRoleAssignment -RoleAssignee <Username of account>
Install PowerShell 2.0 on Server 2008 R2
PowerShell 2.0 is automatically installed on Server 2008 R2 and therefore no additional installation
is required.
1. Navigate to Windows Management Framework (http://go.microsoft.com/fwlink/?LinkId=177670).

2. Review the information on the web page, and then click the link for the download of the Windows
Management Framework Core for your platform in the Download Information section.
3. On the Update page, click Download. When the download is complete, click Finish.
Install PowerShell 2.0 on Server 2012
1. Determine whether or not PowerShell 2.0 is installed. Typically, this can be done from the Server
Manager.
2. Ensure that PowerShell 2.0 is fully installed.
See Microsoft.com for detailed installation instructions.
Set PSLanguageMode to FullLanguage for the PowerShell website
1. The can be done on the IIS Manager on the Exchange server for the application settings of the
default website and PowerShell virtual directory.
2. You need to recycle the MSExchangePowerShellAppPool application pool.
See Microsoft.com for detailed instructions.
Create a self-signed certificate
SolarWinds has created a PowerShell script to create a self-signed certificate suitable for AppInsight for
Exchange. This can be found at: Self-signed Certificate PowerShell script for AppInsight for Exchange. If
you choose not to download this script, you can create your own self-signed certificate with the following
instructions and code:
1. To create a self-signed certificate using PowerShell and CertEnroll, open PowerShell in the Run as
Administrator context.
2. Enter the following code:
Note: The CN (Subject) should be in the following format: "<IP Address of Server>_
Solarwinds_Exchange_Zero_Configuration."
For Example: “10.199.15.106_Solarwinds_Exchange_Zero_Configuration”
482
$name = new-object -com
"X509Enrollment.CX500DistinguishedName.1"
$name.Encode("CN=TestServer", 0)
$key = new-object -com "X509Enrollment.CX509PrivateKey.1"

$key.ProviderName = "Microsoft RSA SChannel Cryptographic
Provider"
$key.KeySpec = 1
$key.Length = 1024
$key.SecurityDescriptor = "D:PAI(A;;0xd01f01ff;;;SY)
(A;;0xd01f01ff;;;BA)(A;;0x80120089;;;NS)"
$key.MachineContext = 1
$key.Create()
$serverauthoid = new-object -com "X509Enrollment.CObjectId.1"

$serverauthoid.InitializeFromValue("1.3.6.1.5.5.7.3.1")
$ekuoids = new-object -com "X509Enrollment.CObjectIds.1"
$ekuoids.add($serverauthoid)
$ekuext = new-object -com
"X509Enrollment.CX509ExtensionEnhancedKeyUsage.1"
$ekuext.InitializeEncode($ekuoids)
$cert = new-object -com

"X509Enrollment.CX509CertificateRequestCertificate.1"
$cert.InitializeFromPrivateKey(2, $key, "")
$cert.Subject = $name
$cert.Issuer = $cert.Subject
$cert.NotBefore = get-date
$cert.NotAfter = $cert.NotBefore.AddDays(3650)
$cert.X509Extensions.Add($ekuext)
$cert.Encode()
$enrollment = new-object -com

"X509Enrollment.CX509Enrollment.1"
$enrollment.InitializeFromRequest($cert)
$certdata = $enrollment.CreateRequest(0)
$enrollment.InstallResponse(2, $certdata, 0, "")
For more information, see Generating a Certificate.
WinRM 2.0
1. To configure WinRM on an Exchange server, open a command prompt in the Run as Administrator
context.
483
2. Type: winrm create winrm/config/listener?Address=*+Transport=HTTPS @
{Port="5986";CertificateThumbprint="<Thumbprint value of
certificate>";Hostname="<IP Address of Server>_Solarwinds_Exchange_Zero_
Configuration"} and then press Enter.
3. Verify the configuration by typing the following: winrm get

winrm/config/listener?Address=*+Transport=HTTPS.
Create a firewall rule
1. Open PowerShell in the Run as Administrator context.

2. Create a function for adding firewall rules using the following code:
function Add-FirewallRule {
param(
$name,
$tcpPorts,
$appName = $null,
$serviceName = $null
)
$fw = New-Object -ComObject hnetcfg.fwpolicy2
$rule = New-Object -ComObject HNetCfg.FWRule
$rule.Name = $name
if ($appName -ne $null) { $rule.ApplicationName = $appName }
if ($serviceName -ne $null) { $rule.serviceName = $serviceName }
$rule.Protocol = 6 #NET_FW_IP_PROTOCOL_TCP
$rule.LocalPorts = $tcpPorts
$rule.Enabled = $true
$rule.Grouping = "@firewallapi.dll,-23255"
$rule.Profiles = 7 # all
$rule.Action = 1 # NET_FW_ACTION_ALLOW
$rule.EdgeTraversal = $false
$fw.Rules.Add($rule)
}
484
3. Run the function to create the firewall exception for WSMAN using the following command:
Add-FirewallRule "Windows Remote Management" "5986" $null $null
4. Verify the rule was created.
Configure IIS
1. Open a command prompt in the Run as Administrator context.

2. Change the directory to C:\Windows\System32\Inetsrv.
3. Type: appcmd.exe unlock config -
section:system.webServer/security/authentication/windowsAuthentication and
then press Enter.
4. Open PowerShell in the Run As Administrator context.
5. Type: Import-Module WebAdministration and then press Enter.
485
6. Type: (Get-WebConfiguration
system.webServer/security/authentication/windowsAuthentication
'IIS:\sites\Default Web Site\PowerShell').enabled and then press Enter to
determine if Windows Authentication has been configured.
a. If the value returned is True, you do not need to do anything.
b. If the value returned is False, then take the following steps:
i. Type: Set-WebConfiguration
'IIS:\sites\Default Web Site\PowerShell' -value True and then press
Enter.
ii. Type: (Get-WebConfiguration
'IIS:\sites\Default Web Site\PowerShell').enabled to verify the setting
has changed.
iii. Close PowerShell.

iv. In the open command prompt, type: appcmd.exe lock config -
section:system.webServer/security/authentication/windowsAuthentica
tion and then press Enter.
v. Close the command prompt.
486
Test the application
1. When you are finished with configuration, navigate to the Application Edit page and click Test.
2. If successful, your screen should look like the illustration below:
n To find Exchange URL settings, see Find Exchange URL settings.

n To install PowerShell on the Exchange server, see Non-Domain Account
n To set the appropriate permissions for PowerShell, see Set PowerShell permissions
n To create a self-signed certificate, see Non-Domain Account.
n To configure WinRM, see Non-Domain Account.
n To create a firewall rule for WinRM, see Non-Domain Account
n To configure IIS, see Non-Domain Account
n To correct a Exchange access configuration error, see Non-Domain Account.
487
Set PowerShell permissions
1. On the remote computer, open the PowerShell console.

2. Execute Set-PSSessionConfiguration Microsoft.Powershell -
ShowSecurityDescriptorUI -Force (The permissions dialog should appear.)
3. Enable Full Control under the Permissions for Everyone group, then check Allow.
4. Ensure that the group to which the polling user belongs has access to Microsoft PowerShell, and
then click OK.
If PowerShell 2.0 was installed on Windows Server 2012 with Exchange 2013 and subsequently
uninstalled, a Microsoft error removes the required registry key for remote PowerShell to work
properly. Security patches or updates may also cause this issue. You can create the required
registry key by following these instructions:
1. Open Notepad and copy and paste the following text .
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine]
"ApplicationBase"="C:\\Windows\\System32\\WindowsPowerShell\\v1.0"
"PSCompatibleVersion"="1.0, 2.0"
"RuntimeVersion"="v2.0.50727"
"ConsoleHostAssemblyName"="Microsoft.PowerShell.ConsoleHost,
Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35,
ProcessorArchitecture=msil"
"ConsoleHostModuleName"="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Mi
crosoft.PowerShell.ConsoleHost.dll"
"PowerShellVersion"="2.0"
2. Save the file as PowerShellv1.reg and then double-click it to add it to the registry. (A reboot
may be required.)
488
Find Exchange URL settings
By default, AppInsight for Exchange uses the following URLs for the Exchange and WinRM sessions, where
${IP} is the IP address of the server node being added.
Exchange: https://${IP}/powershell/
WinRM: https://${IP}:5986/wsman/
Verify the PowerShell instance used by Exchange on a server
1. Open IIS Manager and navigate to the default website, and then navigate to the PowerShell virtual
directory.
2. Verify the Virtual Path value (typically in the Advance Settings).
Verify a server's WinRM PowerShell instance

2. Type: winrm get winrm/config/listener?Address=*+Transport=HTTPS to get the current
configuration for the HTTPS protocol.
The two items of interest for the URL are Port and URLPrefix. If either of these have been modified and do
not match the default values, edit the AppInsight for Exchange application with the correct values.
489
Additionally, the value of Hostname must match the CN of the certificate listed in the Certificate
Thumbprint property.
490
n Non-Domain Account
n Set PowerShell permissions
491
Edit the AppInsight for Exchange template
The AppInsight for Exchange application behaves like any other application in SAM. And like other
applications, AppInsight for Exchange's template can be edited.
Some limitations may apply. You may need to log in with an administrator account to perform this
action.
Edit the AppInsight for Exchange Template
2. Check the AppInsight for Exchange template in the list and then click Edit.
3. From here, you can edit certain component monitors within the template.
4. When done editing, click Submit at the bottom of the page.
492
Attachment extensions acknowledged by AppInsight for Exchange
The following table lists the default attachment extensions that are acknowledged by AppInsight for
Exchange:
.accdb .doc .inf .mmp .ppt .swf .xml

.arj .dot .ini .mobi .ps1 .tar .xps
.avi .eml .iso .mov .pst .tmp .zip
.bak .epub .jar .mp3 .pub .txt
.bat .flv .jpg .mpeg .psd .vbs
.bin .gif .jpeg .msg .rar .wav
.bmp .gzip .lnk .pdf .reg .wks
.cab .hta .log .png .rtf .wma
.cmd .htm .mdb .pot .sql .wmv
.csv .img .mid .pps .svg .xls
493
AppInsight for IIS
AppInsight for IIS is considered a template until it is applied. Therefore, it is a member of the Application
Monitor Templates collection. Once applied to a node, AppInsight for IIS is considered an application. Like
any SAM application, AppInsight for IIS is comprised of multiple component monitors.
n Add AppInsight for IIS to a node

n Troubleshooting AppInsight for IIS
The following reports are installed for use with AppInsight for IIS:
n IIS SSL Certificate Expiration Report

n Site Connections Report
n Site Log Size by File
n Site Size by File
494
Quick configuration and navigation
Configuration of SAM's AppInsight for IIS is most easily achieved via Discovery, as shown below.
n To add AppInsight for IIS, see Add AppInsight for IIS to a node
n AppInsight for IIS requirements and permissions

n Edit the AppInsight for IIS template
n Navigate the AppInsight for IIS details view
495
Add AppInsight for IIS to a node
1. Navigate to the Node Details view by clicking any node.

2. From the Management resource, click List Resources.
3. Select Microsoft IIS to enable AppInsight for IIS data collection. When done, click Submit.
4. Navigate to the All Applications resource to verify the addition by clicking the Applications tab in the
web console.
5. Click on the newly added AppInsight for IIS application in this view and then enter your IIS
credentials when prompted.
6. Once your credentials are entered, click Configure Server.
496
Edit the AppInsight for IIS template
The AppInsight for IIS application behaves like any other application in SAM. And like other applications,
the AppInsight for IIS template can be edited.
Some limitations may apply. You may need to log in with an administrator account to perform this
action.
Edit the AppInsight for IIS Template
2. Check the AppInsight for IIS template in the list and then click Edit.
3. From here, you can edit certain component monitors within the template; including threshold values,
number of records to retrieve, component monitor description, and so on.
4. When done editing, click Submit at the bottom of the screen.
497
Navigate the AppInsight for IIS details view
AppInsight for IIS acts like any other application and can therefore be found in the All Applications
resource on the Application Summary view.
The default IIS Application name is Microsoft IIS. You may need to log in with an administrator
account to perform these actions.
Navigate to the AppInsight for IIS details view
1. On the Web Console, click My Dashboards > SAM Summary

2. Locate the All Applications resource and expand the AppInsight for IIS tree by clicking [+].
3. Click an IIS application to view it.
Navigate to the Website details view
From the AppInsight for IIS details view, click a website in the Sites resource.
Navigate to the Application Pools details view
From the AppInsight for IIS details view, click an application pool in the Application Pool resource.
Navigate to the Performance Counter details view
From the AppInsight for IIS details view, click a performance counter in any resource.
498
Manually configure AppInsight for IIS
In the event automatic configuration of AppInsight for IIS failed, visit the sections below in order and take
the steps outlined to manually configure the remote computer.
For automatic AppInsight for IIS configuration see, Quick configuration and navigation.
Important: Ensure that Windows Remote Management (WS-Management) is running and that this
service's Startup Type property is set to Automatic. Once this is verified, continue manual
configuration in the order listed below:
1. The following procedures outline the installation of PowerShell and the required snapins.
2. Set execution policy on the target computer
3. Create a self-signed certificate
4. Create a firewall rule
5. Update WsMan limits
6. Important: If you received the following error: An HTTPS listener currently exists on port 5986, use
the following steps to configure the listener on an available port by changing "5986" to an available
port number throughout these steps.
499
Install PowerShell 2.0 and the WebAdministration snapin
The following procedures outline the installation of PowerShell and the required snapins.
Download and Install PowerShell 2.0 on Windows Server 2008
The following steps are not necessary for Windows Server 2008 R2 and Windows Server 2012.
Download PowerShell 2.0
1. Navigate to Windows Management Framework (http://go.microsoft.com/fwlink/?LinkId=177670).

2. Review the information on the web page, and then click the link for the download of the Windows
Management Framework Core for your platform in the Download Information section.
3. On the Update page, click Download.
4. When the download is complete, click Finish.
Install PowerShell 2.0 on Windows Server 2008 and 2008 R2
Installation of PowerShell 2.0 can typically be done from the Server Manager as shown below. For
installation instructions, visit www.microsoft.com
Install the WebAdministration Snapins.
For Managed Nodes with IIS 7.0, download and install the PowerShell WebAdministration snapins found at
the following link: http://www.iis.net/learn/manage/powershell/installing-the-iis-powershell-snap-in.
The IIS PowerShell Snap-in requires the following prerequisites
n Windows Server 2008 or higher

n Microsoft PowerShell 2.0
500
n IIS 7.0
Install the IIS PowerShell snap-in
1. The IIS PowerShell Snap-in is available as x86 and x64 version. Download the 32-Bit
version or 64-Bit version.
2. Run the MSI file to install the IIS PowerShell Snap-in.
Use the PowerShell snap-in
PowerShell snap-ins like the IIS PowerShell Snap-in have to be registered with PowerShell.
There are two ways to do this:
1. Automatic Registration by using the IIS PowerShell Management Console
The IIS PowerShell snap-in setup creates a new program menu shortcut. By starting this
shortcut, the IIS PowerShell snap-in is registered automatically. Navigate to Start > All
Programs > IIS 7.0 Extensions > IIS PowerShell Management Console. The prompt of the
new PowerShell command window is set to "IIS:\" - the root of the IIS snap-in namespace.
2. Manual Registration
If you want to use the IIS PowerShell snap-in from an existing PowerShell command
window, you have to register the IIS snap-in manually. You can do this by simply
executing the IISConsole.PSC1 file located in the
$env:programfiles\IIS\PowerShellProvider directory:
PS C:\> & "$env:programfiles\IIS\PowerShellSnapin\iisConsole.psc1"
501
Set execution policy on the target computer
For AppInsight, the Execution Policy needs to be set to RemoteSigned.
1. Open a PowerShell session in the Administrator context (Right-click and select Run as Administrator).
2. Enter the following command: Set-ExecutionPolicy RemoteSigned
502
Create a self-signed certificate
SolarWinds has created a PowerShell script to create a self-signed certificate suitable for AppInsight for IIS.
This can be found at:
https://support.solarwinds.com/Success_Center/Server_%26_Application_Monitor_(SAM)/AppInsight_for_
IIS:_Create_certificates
Once downloaded, execute the script by right-clicking it and selecting, Run with PowerShell. The following
parameters apply:
n IP address: Mandatory
n Certificate lifetime in days: Optional
You can run this script with the default arguments from the PowerShell console or specify each one.
For example:
& '.\Create self-signed certificate script.ps1' 192.168.2.69 3650
where 192.168.2.69 is the IP address of the node to be monitored by AppInsight for IIS and 3650 is
3,650 days (10 years).
503
SolarWinds has created a PowerShell script to create a firewall rule. This can be found at:
https://support.solarwinds.com/?title=Success_Center/Server_%26_Application_Monitor_(SAM)
/AppInsight_for_IIS:_Create_a_firewall_rule
parameters apply:
n Without parameters: The rule is created with the default name, "Windows Remote Management
HTTP/SSL" for port 5986.
n With one parameter: Non-default custom port.
n With two parameters: Non-default custom port and rule name
For example:
& '.\Add firewall rule.ps1' 5988 "My custom firewall rule name"
The default port for this rule is 5986 and does not need to be specified. Custom ports, as in the
example above that uses port 5988, must be specified.
504
Update WsMan limits
WsMan provides methods and properties used to create a session. SolarWinds has created a PowerShell
script to update the WsMan limits suitable for AppInsight for IIS. This can be found at:
/AppInsight_for_IIS:_Update_WsMan_limits
parameters apply:
n maxConcurrentUsersDefaultValue - Default value is 5

n maxShellsPerUserDefaultValue - Default value is 5
n maxMemoryPerShellMBDefaultValue - Default value is 150
n serviceRestartRequired - Default value is $false
For example:
& '.\Update WsMan Limits.ps1'
505
Create a WinRM listener
Important: If you received the following error: An HTTPS listener currently exists on port 5986, use the
following steps to configure the listener on an available port by changing "5986" to an available port
number throughout these steps.
1. To configure WinRM on an IIS server, open a command prompt in the Run as Administrator context.
certificate>";Hostname="<IP Address of Server>_Solarwinds_Zero_

506
Find IIS URL settings
By default, AppInsight for IIS uses the following URL for the IIS and WinRM sessions, where ${IP} is the IP
address of the server node being added.
WinRM: https://${IP}:5986/wsman/
Verify a server's WinRM PowerShell instance

2. Type: winrm get winrm/config/listener?Address=*+Transport=HTTPS to get the current
configuration for the HTTPS protocol.
Additionally, the value of Hostname must match the CN of the certificate listed in the Certificate
Thumbprint property.
507
508
AppInsight for SQL
SAM offers a detailed view of your SQL databases' performance without the use of agents or templates by
using the AppInsight for SQL embedded application. AppInsight for SQL provides a level of detail and
expert knowledge far beyond what a SQL template can provide, allowing you to monitor virtually every
aspect of your SQL instances and databases.
Like any unassigned application in SAM, AppInsight for SQL is considered a template until it is applied.
Therefore, it is a member of the Application Monitor Templates collection.
Once applied to a node, AppInsight for SQL is considered an application. Like any SAM application,
AppInsight for SQL is comprised of multiple component monitors.
509
Add AppInsight for SQL to a node via discovery
2. Fill out the information on the Define Node step, and then click Next.
3. On the Choose Resources step, check the AppInsight for SQL applications you want. When done, click
Submit.
4. Click Next and complete the wizard as instructed.
510
Add a named instance
If you have additional pollers and want to use them to poll AppInsight for SQL, ensure you install
the additional poller software on the poller(s) that are used. Not doing this takes you to the List
Resources page and you will not see AppInsight for SQL.
AppInsight for SQL – Default instances
1. Open a command prompt and ping the server, as shown below:
Add a node
1. Next, add the node to your SolarWinds implementation. The proper permissions are needed. To do
this, take the following steps:
a. On the web console, navigate to Settings > All Settings > Manage Nodes.
b. Click Add Node, then e Enter the IP Address (VIP of the SQL instance gathered earlier.)
c. Select a polling method, then select the polling engine for that node.
Choose your Applications
Choose the AppInsight for SQL application.
Set properties
You can begin editing the properties of the node being added.
Change the name
1. At the top of the form, change the name to the instance you are going to be monitoring. Additional
information can be changed as desired. Not selecting a name results in the default instance being
monitored.
511
2. Click OK, Add Node.
3. To view your progress, click the Applications tab from the web console
This instance is grayed until the poller has polled this node. Once polled, the color changes.
512
Edit the AppInsight for SQL template
2. Check the AppInsight for SQL template in the list and then click Edit.
3. From here, you can edit certain component monitors within the template; including threshold values,
number of records to retrieve, component monitor description, and so on.
4. When done editing, click Submit at the bottom of the screen.
Edit resources
1. From the resource, click Edit in the upper right-hand corner of the resource.
2. Select resources as needed, then click Submit.
Pertinent data for each resource is grouped together by default.
513
Navigate the different AppInsight for SQL views
AppInsight for SQL acts like any other application and can therefore be found in the All Applications
resource on the Application Summary view. By default, sub-views are turned on once you navigate to the
AppInsight for SQL Details page.
Navigate to the AppInsight for SQL details view
1. On the Web Console, click My Dashboard > Applications > SAM Summary > All Applications resource.
2. Expand the AppInsight for SQL tree by clicking [+].
3. Select a SQL instance to view by clicking it.
Navigate to the database details view
From the AppInsight for SQL Details view, click a database in the All Databases resource.
Navigate to the performance counter details view
From the AppInsight for SQL Details view, click a performance counter in any resource.
514
Monitor clusters with AppInsight for SQL
1. Connect to the instance that you want monitor using SQL Management Studio.
2. Execute the following query to make sure you have the proper target node and instance name:
SELECT SERVERPROPERTY('ServerName')
3. Determine the IP address of the target node (e.g. “ping P111SQLV23”)
4. Make sure that the node with this address is being monitored by SAM. If it is not, add it.
Note: If the IP address represents a cluster, the node name of the active cluster member populates.
It is recommended that you change the node name to something more easily understood, for
example: “P111SQLV23 (cluster)” during the final step of the Add Node Wizard.
5. Enter the proper information and manually assign the Appinsight for SQL template to the node with
the appropriate IP address.
6. The application should begin polling.
515
Manage the Desktop Notification tool
The Desktop Notification Tool is an application that is installed on an administrator's desktop that can be
used to notify administrators when there is an alert in Orion without the need for a web browser to be
opened to the Orion web page. This tool is available for download through the web based alert manage.
This tool allows you to play a sound as your alert action.
Use the Desktop Notification tool
1. Click Start > SolarWinds Orion > Desktop Notification Tool > Desktop Notification Tool.
2. Enter the correct Orion server and credentials. When done, click Connect.
3. From the Preferences screen, select the options you want, and then click Save.
SolarWinds Free Mobile Monitor is a mobile application that allows you to view alerts, acknowledge
alerts, view the status of nodes, and applications from your mobile device. This is a free download
that can be found in your Customer Portal.
Free Mobile Monitor supports the following mobile device operating systems:
516
n Android
n Apple iOS
n Older Blackberry devices)
Mobile Admin is a product that includes all the functionality of Free Mobile Monitor, but
extends that functionality by allowing you to resolve issues from your mobile device. This
download can be found in your Customer Portal. The Administrator's Guide for Mobile Admin
can be found at: Mobile Admin Documentation.
517
Agents
SolarWinds Orion agents
An agent is software that provides a communication channel between the Orion
server and a Windows or Linux computer. Agents are used to provide information
about key devices and applications that you specify. This can be beneficial in the
following situations:
n Polling hosts and applications behind firewall NAT or proxies.

n Polling node and applications across multiple discrete networks that have
overlapping IP address space.
n Secure, encrypted polling over a single port.
n Support for low bandwidth, high latency connections.
n Polling nodes across domains where no domain trusts have been established.
n Full ,end-to-end encryption between the monitored host and the main poller.
You can monitor servers hosted by cloud-based services such as Amazon EC2,
Rackspace, Microsoft Azure, and other Infrastructure as a Service (IaaS).
After deployment, all communication between the SolarWinds Orion server and the
agent occur over a single fixed port. This communication is fully encrypted using
2048-bit TLS encryption. The agent protocol supports NAT traversal and passing
through proxy servers that require authentication.
Java Management Extensions (JMX) polling is not supported using an agent.
Agent requirements
Agent software is free. You remain bound by the limits of the license you own
regardless of how information is polled, either through an agent or another polling
method.
n Windows agents run as a service.
Before you deploy agents to a target computer, review the following system
requirements.
518
Agent requirements
TYPE REQUIREMENTS
The following operating systems are supported for both 32-bit and
64-bit computers:

Operating n Windows Server 2012

System n Windows Server 2012 R2
n Windows 7, Windows 7 SP1
n Windows 8, Windows 8.1
n Windows 10
Only Pro, Enterprise, and Ultimate workstation operating

systems editions are supported.
The following software packages are installed by the agent installer if

necessary:
n Microsoft Visual C++ 2013 Redistributable Package for 32-bit or

Other 64-bit
software n .NET Framework 4.0 (You must install this manually if you are
installing an agent on Windows Core.)
n .NET Framework 4.5 (Required for Windows Server 2008 R2 SP1
and later.)
The VeriSign Root Certificate Authority (CA) must be current. This is

required because the agent software is signed using a VeriSign
Security certificate. To install a certificate, see Certificates and the agent.
After the agent is installed, it runs as the Local System account and
does not require administrative permissions to function.
Account If you want to deploy agents from the SolarWinds Orion server, the
permissions following requirements must be met:
519
TYPE REQUIREMENTS
n The account used for remote deployment must have access to
the administrative share on the target computer:
\\<hostname_or_ip>\admin$\temp.
n User Account Control (UAC) must either be disabled on the
target computer, or the built-in Administrator account must be
used.
Other remote or mass deployment methods do not have the

same requirements.
Approximately 100 MB of hard drive space on the target computer,

HDD
for installation only
Agent resource consumption
RESOURCE CONSUMPTION
Less than 1% on average under normal operating conditions (0.24% on
CPU
average)
Memory 10 - 100 MB, depending on the number and types of jobs
Roughly 20% (on average) of the bandwidth consumed by the WMI

Bandwidth protocol for transmission of the same information
For example, Agent: 1.3 kB/s versus WMI at 5.3 kB/s
Storage 100 MB when installed
A single polling engine can support up to 1,000 agents.
Agent port requirements
For agent-initiated communications, port 17778 (inbound) must be open on

SolarWinds Orion servers running Windows Server 2012 or port 17791 on
SolarWinds Orion server running Windows Server 2008 R2 SP1 and communication
through the port must be allowed by the firewall. It is used continuously after the
agent is deployed. Communication is initiated outbound from the agent to the Orion
server.
520
Agent settings
For server-initiated communications, port 17790 must be opened (inbound) on the

remote computer.
n 135 (DCE/RPC Locator service) Microsoft EPMAP. This port must be open on the
client computer (inbound) for remote deployment.
n 445 Microsoft-DS SMB file sharing. This port must be open on the client
computer (inbound) for remote deployment.
Agent settings
The Agent Settings page provides access to all of the settings and tools needed to
install and manage agents. Additional agent settings can be found in the Windows
Control Panel.
Navigate to the Agent Settings page

2. Under Product Specific Settings, click Agent Settings.
n Manage Agents: Opens the Manage Agents page from which you can add
a new agent, edit, update, or reboot an existing agent.
n Download Agent Software: Opens the Agent Downloads page from
which you can mass deploy or manually install an agent.
n Define Global Agent Settings: Opens the Global Agent Settings page
from which you can allow automatic agent registration and allow
automatic agent updates.
Adjust the Global Agent Settings
Click Define Global Agent Settings.
n Allow automatic agent registration: Select this option to automatically register

the agent and verify communication with the Orion Server. If this option is
disabled, you can register any waiting agents by clicking Settings > All
Settings > Manage Agents > Add Agent > Connect to a previously installed
agent.
n Automatically create node: Agents are automatically registered as Orion nodes.
521
n Allow automatic agent updates: Select this option to automatically upgrade the
agent software when updates are available. This process pushes a new version
of the agent to client computers over the agent communication channel. No
extra ports or permissions are needed. Once the agent receives the new
version, it updates itself. This process does not require rebooting.
If automatic updates are disabled and a new version of the software is

installed on the server, outdated agents may not be able to
communicate with the server. Ensure all agent versions match the
version of the server.
n XX Hours: Control the length of time the agent displays as being new in the
Manage Agents list.
Server-initiated communication
All communication between your SolarWinds Orion server or additional polling
engine and the agent is initiated by the server, and the agent does not initiate
communication to your SolarWinds Orion server. You must have a direct route from
the server with the agent installed to your SolarWinds Orion server or additional
polling engine. To use this communication method, port 17790 must be open on the
firewall of the remote host to retrieve information from the agent.
This communication method is also known as a passive agent.
522
All communication between your Orion server or additional poller and the agent is
initiated by the agent, and your SolarWinds Orion server does not initiate
communication with the agent. You do not need to have a direct route from the
server with the agent installed to your SolarWinds Orion server or additional poller.
To use this communication method, port 17778 must be open on the
SolarWinds Orion server firewall to receive information from the agent.
This communication method is most useful when the agent is installed on a network
separated from your Orion server by one or more NAT devices, and you have no easy
way to connect the two.
This communication method is also known as an active agent.
523
Windows agent deployment
SolarWinds Orion products supports three methods of deploying an agent to a client
computer running Windows.
n Push the agent software from the Orion Server to one or more client
computers.
n Mass deploy the agent software to multiple computers using a mass
deployment technology, such as Group Policy.
n Manually install the agent on a client computer.
Agents do not work with AppInsight for SQL when the SQL Server being
monitored is in a cluster.
Deploy a Windows agent with the Add Node wizard
This is the easiest and most common method to deploy an agent to a Windows
computer. For this deployment method to succeed, the Orion server must be able to
communicate with the client computer.

3. Click Add Node.
4. In the Polling hostname or IP address field, enter the IP address or fully
qualified domain name (FQDN) of the Windows host you want to manage.
5. Select Windows Server: Agent as the Polling Method.
6. Choose a credential from the list, or enter new credentials, and then click Next.
n These credentials are used to connect to the Windows host and install
the agent software.
n These credentials are only used for initially deploying the agent. After
deployment, you can change the password without affecting the agent.
7. Click Start Install on the Install Agent Software window.
8. Choose the resources to monitor on the agent, and click Next.
9. Add application monitors on the agent, and click Next.
10. Change properties or keep the defaults, and click OK, Add Node.
When the connections is successful, the agent appears in the agent list on the
Manage Agents page.
524
Select this method of deployment to perform a network-wide deployment from the

SolarWinds Orion server. This method does not require downloading additional files.
In order for this deployment method to succeed, the SolarWinds Orion server must
be able to communicate with the client computers.

3. Click Add Agent.
4. Select how you would like to add the agent.
Deploy the agent on my network
Select this method to install the agent on multiple client computers.
1. On the Deploy Agent on Network page, enter the IP address or host name of the
Windows computer where you want the agent to be installed, or select nodes
from the list, and then click Next.
This field does not accept ranges. Only add computers that are not
nodes in the system.
2. On the Agent Settings page:

a. Select the computer you selected in the previous step, and click Assign
Credentials
b. Select a credential from the list, or enter new credentials, and click
Submit.
You can assign credentials to multiple locations or nodes by
selecting multiple entries.
3. Click Deploy Agent.
When the connection is successful, the agent displays in the agent list on the Manage
Agents page.
525
Select this method to connect to agents that were configured with server-initiated
communication, or if Allow Automatic Agent Registration is not enabled. When you
connect to an agent, you first need to select the communication mode that was
chosen when the agent was installed. If the communication mode is server-initiated
(passive), a shared secret was required during installation. This secret must be
entered again here.
1. On the Add Agent page, enter a name for the Agent.
2. Select the agent communication mode.
3. For Server-initiated communication:
a. Enter the IP address or hostname where the agent is located.
b. Enter the shared secret.
c. Optional: Expand Advanced and adjust the following settings as needed:
a. Change the agent port number. This is the port the agent uses for
listening.
b. Use a proxy. Selecting a proxy and enter the proxy URL.
c. Use proxy authentication, and enter credentials.
4. For Agent-initiated communication, select the agent from the Agent list.
5. Select Allow automatic agent updates to upgrade the agent automatically when
upgrading to new versions of Orion Platform modules that support the agent.
Disabling this option requires you to manually upgrade agents after

upgrading your Orion Platform products.
6. Click Submit.

When the connection is successful, the agent displays in the agent list on the
Manage Agents page.
Deploy the Windows agent manually
Selecting this method of deployment may be helpful in troubleshooting connectivity

issues with another form of agent deployment. This method is also helpful when the
Orion server cannot communicate directly with the endpoint where the agent will be
installed, such as in the case of Active Agent mode.
526

2. Under Product Specific Settings, click Agent Settings > Download Agent
Software.
4. Click Install Manually, and click Next.
5. Click Download .MSI.
6. Download and copy the MSI file to the client machine, and execute it.
7. In the installation wizard, select Agent Initiated Communication or Orion Server
Initiated Communication.
8. Enter the SolarWinds Orion server IP address or hostname, and the SolarWinds
Orion administrator account credentials.
When installation is successful, the agent displays in the agent list on the Manage
Agents page.
If you are already using a mass-deployment technology, this deployment method is

an easy way to get agents on a large number of computers.
Polling engine selection is important. When you click Download .MST, the MST file
created includes the polling engine IP address and other vital information. When you
deploy the agent using the MSI file, along with the MST file on the managed node, the
agent will be installed and pointed to the correct polling engine.
Generate and download the .MST file

Software.
527
5. Select the agent communication mode. This information is included in the
MST file.
n For agent-initiated communication, enter the polling engine you want
the agent to use. You may need to manually enter the polling engine
information if the IP address is different from what the
SolarWinds Orion server reports. This happens when the monitored
host is behind a NAT or proxy device. In these cases, enter the IP
address of the SolarWinds Orion server or the additional polling engine
as it is accessible from the host where the agent will be installed.
a. To use an existing polling engine, select Use Connection Details
from Polling Engine, and then select a polling engine from the list.
b. To manually enter the polling engine IP address, select Enter
Connection Details Manually, and then enter the host name and IP
address. The IP address is required. Use the host name and
IP address of the polling engine that you can access from the
client.
n For server-initiated communications, enter your agent communication
port number. The default port is 17790.
6. Click Download .MSI, and save the file.
7. Click Download .MST, and save the file.
1. Copy the MSI and MST files to a shared network location that is accessible to
the hosts where you want to deploy the agent software.
2. Configure the permissions on the shared location to ensure that all required
users and computers have Read access to the installation files.
3. Locate the container in Active Directory (a site, a domain, or an organizational
unit (OU)) where you want to advertise the application and access the container
properties.
4. Add the modification for the application package. For more information, search
for "Add or remove modifications for an application package" at
5. After you complete the setup, the agent is deployed and registered by Orion (if
auto-registration is enabled as defined in the Agent settings page).
When the installation is successful, the agent displays in the agent list on the
Manage Agents page.
528
What is an MST file?
A Microsoft Transform (MST) file is a collection of specified changes applied to a base

Windows Installer package file at the time of deployment. It is an overlay on top of an
existing MSI file that defines what specific components or features of an application
get installed. The MST file modifies the Microsoft Installer package.
After the software you want to install is packaged in the Windows Installer package
format, you can use MST files to customize the software for your organization, such
as installing only specific features. The modular design of Windows Installer
packages simplifies deployment. When you apply transforms to an MSI file, Windows
Installer can dynamically add or modify data in the installation database to customize
the installation of the application. Additional information on creating MST files can
be found on technet.microsoft.com.
1. Share a folder containing the MST and MSI files with proper permissions.
2. Create a Group Policy object. In Advanced Options, add the Software
installation policy selecting the network path for Agent MSI/MST.
The agent is deployed at login and is registered by Orion (if auto-registration is

enabled).
Use a Gold Master Image when you want to maintain a master image that is copied
when a new server is provisioned. This is useful for virtual machines, physical
servers, and cloud instances. Whenever a new server is brought online using this
image, the agent will already be installed.
Install an agent offline

Software.
4. Click Distribute via a Golden Master Image, and click Next.
529
5. Select the agent communication mode. This information is included in the MST
file.
n For agent-initiated communication, enter the polling engine you want
the agent to use. You may need to manually enter the polling engine
information if the IP address is different from what the
SolarWinds Orion server reports. This happens when the monitored
host is behind a NAT or proxy device. In these cases, enter the IP
address of the SolarWinds Orion server or the additional polling engine
as it is accessible from the host where the agent will be installed.
a. To use an existing polling engine, select Use Connection Details
from Polling Engine, and then select a polling engine from the list.
b. To manually enter the polling engine IP address, select Enter
Connection Details Manually, and then enter the host name and IP
address. The IP address is required. Use the host name and
IP address of the polling engine that you can access from the
client.
n For server-initiated communications, enter your agent communication
port number. The default port is 17790.
6. Click Download .ZIP, and save the file.
7. Extract the contents of the ZIP file, and double-click setup.bat.
8. Follow the instructions in the installation wizard.
Enable server-initiated communication on deployed agents
If you are deploying a server-initiated agent, take the following steps to enable agent
communication with your SolarWinds Orion server.

3. Click Add Agent > Connect to a previously installed agent > Next.
4. Enter a name for the agent, and click Server-initiated communication.
5. Enter the IP address of the node where the agent is deployed, and the port
number for the agent. The default port is 17790.
6. Click Submit.
You can only perform this deployment method if you have successfully configured
Patch Manager to push software in your environment.
530
Download the installation files

Software.
5. Select the communication method and enter the required information. For
more information, see Mass deploy a Windows agent.
6. Download and save the MSI and MST files to a location on your Patch Manager
server.
Record the Latest Version value under the MSI file download. This is
needed when creating a package in Patch Manager.
Optional: Rename the SolarWinds agent files to SolarWinds Agent

<version> for easier tracking.
531
Build the package
1. Launch SolarWinds Patch Manager.

2. In the navigation pane, expand Administration and Reporting > Software
Publishing, and then click SolarWinds, Inc. Packages.
3. From the SolarWinds, Inc. Packages action pane, click New Package. This
launches the Patch Manager Package Wizard.
532
4. In the package information screen, enter the following general information for
the package:
n Package Title: SolarWinds Orion Agent (version number) MSI
n Description: SolarWinds Orion Agent
n Classification: Tools
n Vendor: SolarWinds, Inc.
n Product: Orion Agent (This must be entered the first time)
n Severity: None
n Impact: Normal
n Reboot Behavior: Can request reboot
All other fields can be left empty.
5. Click Next.
533
Add deployment rules
1. On the Prerequisite Rules window, click Add Rule.

2. Select Windows Version as the Rule Type, and enter the following information:
3. Click OK to save this rule, and click Next.

4. On the Select Package window, select the Package Type as a Microsoft Installer
File (.msi), and then select I already have the content for the package locally on
my network.
5. Click the browse icon and locate the MSI file for the SolarWinds Orion agent.
The Download URL field will automatically populate.
6. The GUID product code is extracted from the MSI file and displayed for review.
Copy the GUID product code that you will use later.
The GUID is detected from the installer. Use the one displayed in your
environment.
7. Select Includes additional files with the package, and click the button to the
right to open the Package Content Editor.
534
8. In the Package Content Editor, click Add Files, and browse to the MST File for
the SolarWinds Orion agent.
9. Click OK to close the Package Content Editor. To confirm that you want to add
these files to the cache, click Yes.
10. Select None for the Binary Language.
11. In the Command Line field, enter: TRASNFORMS=(MST FILE NAME)
Example: TRANSFORMS=SolarWinds_Agent_1.5.0.951.mst
12. Click Next.

13. On the Applicability Rules window, click Add Rule > Create MSI Rule.
14. Select Rule Type: Product Installed, and select Not Rule.
15. Enter the product code without the braces, and leave all other fields empty.
16. On the Installed Rules window, click OK to save the rule, and then click Next.
17. Click Add Rule > Basic Rule.
535
18. For the Rule Type, select File Version with Registry Value. Enter the following
values:
a. Registry Key: HKEY_LOCAL_
MACHINE\SOFTWARE\Wow6432Node\SolarWinds\Agent
b. Registry Value: InstallDir
c. Comparison: Equal To.
d. Version: Version number of the agent
19. Click OK to save the rule, and click Next. Review the Summary Page, and enter
notes at the bottom.
20. Click Next to save, and click OK.
When the file packaging and uploading completes, a Package Saved dialog displays.
Publish the package
1. In the SolarWinds, Inc. Packages view in Patch Manager, select the SolarWinds
Orion Agent package that you created.
2. In the SolarWinds Orion Agent action pane, click Publish Packages.
3. Accept the default selections, or choose a specific Windows Server Update
Services (WSUS) server for publication, and then click Next.
4. You are notified when the package publishes.
5. Click Finish to close the Publishing Wizard.
The package for the SolarWinds Orion agent is packaged and published to your WSUS
server.
536
If you are installing the agent on a Windows Core Server, you must install the .NET
Framework 4.0. Also install the latest Windows service pack and critical updates.
Prerequisites to installing an agent on Windows Core
n Start WoW64.
n Start the .NET 2.0 layer.
n Start the .NET 2.0 layer for WoW64.
n Download and install the .NET framework from www.microsoft.com.
By default, no web browser is installed with Windows Core. Consider

transferring the necessary files with FTP or a flash drive.
Once the .NET Framework is installed, you may need to reboot the host server. The
agent can then be deployed to the host server and operate normally.
Agents can be deployed in the cloud for use with Amazon Web Services, Microsoft
Azure, and other third-party cloud infrastructure services.
Manually deploy a Windows agent on Amazon Web Services
You can manually deploy agents to a virtual machine using Remote Desktop
Connection.
Requirements for manual agent deployment
n Agent-initiated communication: The poller must have a public IP address which

is visible from the node with the agent installed. Port 17778 must be open on
the poller.
n Server-initiated communication: The node with the agent installed must have a
public IP address. Port 17790 must be open.
You can manually deploy the agent in one of two ways:
537
Install through the command prompt

Software.
6. Run a command prompt as administrator context.
7. Enter the following command:
msiexec /i "SolarWinds-Agent.msi" TRANSFORMS="SolarWinds-
Agent.mst"
Deploy the agent manually using the interactive wizard
Following the instructions in Deploy the Windows agent manually.
Automatically deploy a Windows agent on Amazon Web Services

Software.
6. Log in to your AWS S3 account.
7. Create a bucket and upload the MSI and MST files.
8. Create a PowerShell script to use on each virtual machine where you want to
install the agent. This script will run on each virtual machine when it is
launched for the first time, downloading and executing the agent.
9. Log in to your Amazon Web Services account.
You can perform the following steps through the API or AWS command
line interface.
10. Create an instance, and paste your PowerShell script under Advanced Details in
the User Data text box. Select the As Text option.
538
11. For instances that are already created, take the following steps:
a. Stop the instance where you want to deploy the agent
b. Right-click the instance and click Instance Settings > View/Change User
Data.
c. Paste you PowerShell script in the text box as Plain Text.
Automatically deploy a Windows agent on Microsoft Azure

Software.
6. Upload the MSI and MST files to your Azure Blob Storage.
7. Create a PowerShell script to use on each virtual machine where you want to
install the agent. This script will run on each virtual machine when it is
launched for the first time, downloading and executing the agent.
539
8. Add your PowerShell script to virtual machines manually on the last step of the
Create a Virtual Machine wizard in the Azure management portal.
This step can also be accomplished via the API or AWS command line
interface.
Manage agents, connections, and deployment status

Check agent connection and deployment status on the Manage Agents page.

n Add Agent: Takes you to the Add Agent page, where you can deploy the agent
on a network, or connect to a previously installed agent.
n Edit Settings: Takes you to the Edit Agent Settings page, where you can adjust
the agent name and automatic updating.
n Delete: Deleting an agent from within this toolbar or the Manage Nodes page
provides you the option to remotely uninstall the agent.
540
n Choose Resources: Displays a list of resources and statistics to monitor. This is

only available for agents that are deployed on nodes.
n For a Single Agent: Takes you to the List Resources page to choose items
on the node you wish to monitor.
n For Multiple Agents: From here, SolarWinds Orion discovers available
resources on the agents you have selected using Network Sonar
Discovery. You can choose items on the nodes you wish to monitor.
n Manage as Node: This will manage the agent as a new node by navigating to
the Add Node page with pre-configured agent details.
n More Actions:
n View installed agent plug-ins: Displays a dialog detailing the node the
agent is deployed on, the agent status, connection status, plug-in status,
and plug-in version.
n View installed plug-ins report: Generates a report detailing the following:
Node Status, Agent DNS Name, Automatic Update enabled, Connection
Status, Agent Status, Agent Version, Plugin, Plugin status, and Plugin
Version.
n Retry agent installation: Attempts to install the agent in the event of a file
transfer timeout due to network connectivity issues.
n Reboot Agent Machine: Reboots the server that hosts the selected agent.
This button is disabled by default. It is enabled when the

installation of an agent requires a system reboot.
n Update: Updates the agent software to the latest version available.
This button is disabled by default. It becomes enabled when:

n Automatic updates for the agent is disabled.
n The selected agent requires an update.
n Reconnect to passive agent: The server tries to re-establish the

connection to the passive agent when the connection is lost and
automatic reconnection fails. This can also be used for connecting to an
agent that was deleted but not uninstalled.
541
Manage Agents table columns

Agent/Node Name or IP address of the listed node.
Current status of the listed agent.
Agent Status can be as follows:
n Connected/OK: Everything is working.

n Unknown: The agent is connected but no communication
is received.
n Update Available: The agent version is older than the
version on server and should be updated.
n Update in Progress: The agent is currently being
updated.
Agent Status
n Reboot Required: The agent needs to be rebooted in
order to finish the installation of plugins.
n Reboot in Progress: The agent is currently being
rebooted. Once reboot is complete, the agent should
finish installation of plugins.
n Reboot Failed: The agent cannot be rebooted. It may be
temporarily offline or there may be some other issue.
n Plugin Update Pending: A plugin on the agent has an
older version than the one that is on the server and
should be updated.
Current connection status of the listed agent.
Connection status can be as follows:
n Connected/OK: The agent is connected.

Connection Status n Unknown: The agent management service is not running.
n Service not Responding: The agent management service
is running, but the agent is not connected.
n Deployment Pending: An agent deployment is going to
start, but has not started.
542
Edit agent settings

n Deployment in Progress: The agent is being deployed to
the target node.
n Deployment Failed: Agent deployment failed.
n Invalid Response: The status displayed if the agent
responds in an unexpected manner.
n Waiting for Connection: The agent was approved, but has
yet to connect to the SolarWinds Orion server.
Date when the agent was added to the agent management

Registered On
system.
Agent communication type:
n Agent-initiated: The agent initiates the connection to the

Mode agent management system.
n Server-initiated: The agent behaves as a web server and
the agent management system initiates the connection.
Version of the agent software. This is helpful in determining

Version
which agents should be updated.
Edit agent settings
Editing the configuration of an agent may be necessary if you experience problems

and want to collect diagnostics.

3. Select an agent, and click Edit Settings.
Agent settings and troubleshooting options
n Agent Name: change the display name displayed in Orion.

n Communication type: choose whether the agent uses server-initiated or agent-
initiated communication.
n Allow automatic agent updates: choose whether the Orion server can update
the agent software to the latest version available.
543
n Troubleshooting:
n Log level: the amount of detail saved to the log.
n Diagnostics: click Collect new diagnostics, and then Download to save to
your local disk. Send the zip file to our support team if requested.
Track your polling method
If nodes are using different polling methods, you may want to keep track of the
polling method of each node to troubleshoot issues more easily. There are several
methods you can use to identify the polling method of nodes:
n Node Details page: View individually

n Application Details page: View individually
n Manage Nodes page: View as a list
n Create a report to identify agent usage
Identify the polling method from the Node Details page
1. From the web console, click My Dashboards > Home.

2. In the All Nodes resource, expand a node tree and click a node to go to the
Node Details page.
3. In the Polling Details resource, locate the Polling Method.
Identify the polling method from the Application Details page
1. From the Orion Web Console, click My Dashboards > Applications.

2. In the All Applications resource, expand an application tree and click an
application to go to the Application page.
3. In the Application Details resource, click Management > Edit Application
Monitor.
4. Expand the Advanced heading to located the Preferred Polling Method.
Identify the polling method from the Manage Nodes page

544
3. If not already visible, add the Polling Method field by clicking >> in the upper-
right of the table.
Create a report to identify agent usage
1. From the web console, navigate to Reports > All Reports.

2. Type agent in the Search box.
3. Click Agent Inventory to view the report.

3. Select an agent, and click More Actions > View installed agent plug-ins.
STATUS MEANING
The plug-
The plug-in is installed, working correctly, and communicating with no
in is
problems.
installed
The plug-in is waiting to be deployed. It may be waiting for the

Installation
computer it is installed on to reboot, or because some other process
Pending
on the remote host has interrupted the installation process.
The status is unknown due to networking interruptions,

Unknown communication problems with the agent, or because the plug-in is no
longer installed.
Error The plug-in may have installed incorrectly or failed to load.
In Progress The plug-in is either being installed or uninstalled.
545
If you think a plug-in should be available and cannot find it in the list, you may need
to check your purchased products or manually update your agent. New plug-ins and
updates to existing plug-ins are installed when an agent is updated. It may take a few
minutes before the status changes.
Edit agent settings in the Windows Control Panel
If the agent loses connectivity to the SolarWinds Orion server, or is unable to connect

after being manually installed, you can configure its settings in the Windows Control
Panel. This enables the agent to reconnect to the SolarWinds Orion server.

2. Select the Agent Communication Mode.
3. Edit the Connection Settings.
The Agent Shared Secret is provided for security. When you install the
agent, you must set a shared secret. When the SolarWinds Orion server
connects to the agent, it verifies the secret to connect.
4. Click OK to save your changes.
You can connect to agents that you installed previously or modify the assigned
polling engine of the agent. The steps are different depending on the agent
communication mode. You should confirm the agent communication mode before
connecting.
Connect to an agent using agent-initiated communication

3. Click Add Agent.
5. Enter the name of the agent you want to connect to, and select Agent-initiated
communication.
6. Select the agent from the Agent list.
7. Expand Advanced to change the proxy.
546
Disabling this option requires you to upgrade agents manually after

upgrading your SolarWinds products and modules.
9. Click Submit.

Manage Agents page.
Connect to an agent using server-initiated communication

3. Click Add Agent.
5. Enter the name of the agent you want to connect to, and select Server-initiated
communication.
6. Enter the IP address or hostname where the agent is installed.
7. Expand Advanced to change the port number, assign the agent to a different
poller, or use a proxy to connect to the agent.
Disabling this option requires you to upgrade agents manually after

upgrading your SolarWinds products and modules.
9. Click Submit.

Manage Agents page.
When you want to change how the agent communicates back to the SolarWinds Orion
server, you must uninstall and redeploy the agent with the new communication
method. Ensure that you loose as little data as possible, and prevent alerts or node
down notifications, by changing the polling method before you remove the agent.
Change the polling method

547
4. Under Polling Method, click Windows Servers: WMI and ICMP.
5. Enter your WMI credentials, and click Submit.
Delete the agent

3. Select the agent to uninstall, and click Delete.
Install the agent in the new mode

3. Click Add Agent.
4. Click Deploy the agent on my network, and click Next.
5. Under Select from Existing Nodes, select the node, and then click Next.
6. Enter credentials, and select the communication mode.
n Active: (Agent-initiated communication) The agent initiates
communication with the server on port 17778. This port must be open
on the server firewall so the agent can connect. No change to the agent
firewall is required.
n Passive: (Server-initiated communication) The agent waits for requests
from the server on a specified port. This port must be open on the
firewall on the agent computer so the server can connect. No change to
the server firewall is required.
7. Click Deploy agent.
Restore the polling method

4. Under Polling Method, click Windows & Linux Servers: Agent.
5. Click Submit.
Change the agent port
1. On the computer with the deployed agent, edit the following configuration file
using a text editor:
548
C:\Program Files (x86)

\SolarWinds\Orion\AgentManagement\SolarWinds.AgentManagemen
t.ServiceCore.dll.config
2. Change the port number on the following line:
<agentManagementServiceConfiguration messagingPort="17778"
/>
3. Save the file.
4. Restart the SolarWinds Orion Module Engine service.
n If you installed the agent manually, you can change the port number
during installation through the wizard in the web console.
n If you deployed the agent from the server, the port number is set
automatically.
n If you used the MST file for mass deployment, you must download a new
MST file from the server after you change the port number.
Change the port on deployed agents
1. Logon to the computer with the deployed agent.

3. Enter a new port number, and click OK.

An agent is software that provides a communication channel between the Orion
server and a Windows or Linux computer. Agents are used to provide information
about key devices and applications that you specify. For more information about the
polling method, see Choose the polling method to use.
When the Agent Polling Method is selected, an agent is deployed to the node and
installed using the credential you selected. After the agent is installed, it operates
under a local account.
549
Check nodes polling with agents for changes
Agent discovery has an option to keep nodes updated that use agents. Select this
option so the Orion server can find new volumes, interfaces, and other objects on
nodes that are polled by an agent.
While normal discovery finds new nodes and adds them to the SolarWinds Orion
server, this is not true for nodes using the agent. Agent discovery is an extension to
the standard discovery process.
A discovery profile may contain:
n Nodes using both the agent and non-agent nodes

n Non-agent nodes
n Agent nodes
Agent performance counters

SolarWinds: Agent Service
NAME DESCRIPTION
The number of messages sent to the Agent Management
Messages Sent
Service.
Messages The number of messages received from the Agent

Received Management Service.
The number of times the Exchange Receive method was

Exchange Received
called.
Exchange Sent The number of times the Exchange Send method was called.
550
SolarWinds: Agent Management Service
NAME DESCRIPTION
Messages Sent to Agent
The number of messages sent to the agent.
Count
Messages Received From

The number of messages received from the agent.
Agent Count
Incoming Timed Out The number of incoming messages that timed out
Messages Count before being processed by the recipient.
Outgoing Timed Out The number of outgoing messages that timed out
Messages Count before they were sent to the target agent.
Incoming Failed The number of incoming messages that failed to

Messages Count process.
Outgoing Failed The number of outgoing messages that failed to

Messages Count process.
Total Agents Fully

The number of total agents fully connected.
Connected
Active Agents Fully

The number of active agents fully connected.
Connected
Passive Agents Fully

The number of passive agents fully connected.
Connected
Passive Agents
The number of passive agents disconnected.
Disconnected
Total Agents Connected

The number of agents connected to the messaging hub.
to Messaging Hub
Total Agents Connected

The number of agents connected to the files hub.
to Files Hub
Messages Processed per

The number of messages processed per second.
Second
551
NAME DESCRIPTION
Incoming Messages The number of incoming messages processed per
Processed per Second second.
Outgoing Messages The number of outgoing messages processed per

Processed per Second second.
Incoming Processing The number of messages waiting in the incoming

Queue Size processing queue.
Outgoing Processing The number of messages waiting in the outgoing

Queue Size processing queue.
Incoming Persistence The number of messages waiting in the incoming

Queue Size persistence queue.
Outgoing Persistence The number of messages waiting in the outgoing

Queue Size persistence queue.
Incoming SignalR
The number of messages received from SignalR.
Messages
Outgoing SignalR
The number of messages passed to SignalR to send.
Messages
Incoming Exchange The number of messages in the incoming queue with

Queue Size Exchange items.

The Verisign Root Certificate Authority (CA) must be current. This is required because
the agent software is signed using a Verisign certificate. If your certificate is not
current, you must download the Root CA certificate and install it to the Local
Computer\Trusted Root Certification Authority store on the server
hosting the agent.
For more information, search for "Add the Certificates Snap-in to an MMC" at
552
Custom properties
Custom properties
Custom properties
Every object you monitor includes a list of default properties used to describe the
devices, such as IP address, host name, or MAC address. You can also create custom
properties and use them to create special alerts, reports, views, and groups.
Custom properties are user-defined fields, such as country, building, asset tag, or
serial number, that you can associate with monitored network objects.
Custom properties must use the Latin1 character set.
Custom property uses include:
l Add information to nodes, such as contact, owner, or support contract.

l Add a custom property that is used as an account limitation on nodes.
l Add a custom property to nodes for grouping on the web or in a report.
l Add a custom property and display it as an annotation on a chart.
A collection of the most commonly used properties is available out-of-the-box, but

you can create custom properties to meet your precise requirements.
When a custom property is defined, you can import values for the property from a
text- or comma-delimited file.
To apply a property to only a few objects, go to the Edit view in the Orion Web
Console.
You may also create external records by exporting custom properties from selected
objects as a spreadsheet.
When you create, edit or remove a custom property, an event is logged. These
events are audited, and you can display them in Audit Events resources.
Create a custom property
Custom properties help you add custom labels to monitored objects, group objects
based on the property or alert on objects with a certain value for the property.
Depending on the selected object type, some options are not available.
553
2. In the Node & Group Management grouping, click Manage Custom Properties.
4. Select the object type for the property, and click Next.
The available object types depend on the Orion Platform products

installed. All installations allow you to create Node and Volume custom
properties.
5. Define the custom property, and click Next.
Frequently used custom properties are available as templates. Select a

template, and adjust the settings if necessary. Templates ensure that
naming conventions are met when necessary for certain workflows, such
as drawing lines signifying a certain value in resources.
a. Edit the Property Name and Description fields.
Property names are not case-sensitive, and must be unique for
each object type. For example, you can have separate Comment
properties for Nodes, Volumes, and other object types.
b. Select the Format for the property.

We recommend that you limit the string length for text properties.
The string length can affect SQL performance, especially when
custom properties are used in limitations. The shorter the string
length, the faster the queries.
To limit the string length, click Edit, and provide the maximum number of
characters.
c. Create a drop-down menu with specific values for the property by
selecting Restrict values, and adding the values.
Restricting values helps to maintain the consistency of values for

individual custom properties.
d. If you want to limit how the custom property for nodes should be used,
clear boxes in the Usage section.
554
Create a custom property
6. Select objects for which you want to define the custom property.
a. Click Select <Objects>, and locate, and select the objects in the Available
<Objects> pane.
b. Click Add, and then click Select <Objects>.
7. Enter or select a default value for the property.
To add a value for properties with restricted values, select Add New
Value from the drop-down menu, and enter the new value.
8. To apply the selected property to a different group of objects, click Add More,
select the objects, and click Submit.
You have created a custom property and provided its value for the selected objects.
Now, you can specify the property value in the object properties. For example, for
node properties, click Settings > Manage Nodes, select the object, and click Edit
Properties.
555
You can now use the custom property for sorting objects of the type in Group By lists.
Remove a custom property
If the custom property is used in reports or alerts, remove it from the

definition of all alerts and reports before you remove it from the Orion Web
Console. Reports defined using removed custom properties do not work, and
alerts stop triggering.

4. Select properties you want to remove, and click Delete.
5. Confirm your action when prompted.
Import custom property values
If you have a spreadsheet listing custom property values, such as asset tags of all
your network nodes, you can make this information available for reporting and
publication in the Orion Web Console.
556
Import custom property values
Your data must be formatted as a table, and at least one column title should
match an existing object property such as IP Address.

4. Click Import Values.
5. Browse to the custom property data file, and click Open.
6. Select the object type you want in the Import Values For drop-down, and click
Next.
7. For each detected Spreadsheet Column in your data, select the corresponding
Orion Database Column, and select the Relationship between the columns.
n Select Matches to indicate columns in the spreadsheet that correspond
to existing columns in the SolarWinds Orion database, such as IP
Address or MAC address.
n Select Imports To to import the data in the spreadsheet column to the

selected SolarWinds Orion database column.
This option overwrites any existing data in the corresponding
custom properties.
n Select Imports To, and select <No Match Found, Ignore> for any
spreadsheet column you do not want to import.
n Click Create This Custom Property Now to open the Add Custom
Property in a new browser tab if you need to create a custom property
for this spreadsheet column.
8. Click Import.
When you view the values of the object type, the values of the custom property you
selected are populated.
557
Export custom property data
If you want to keep records of custom properties for selected monitored nodes, you
can export them as a spreadsheet. For example, you can create a single spreadsheet
that lists the asset tags of all your network nodes.
You can only select custom properties for a single object type.

4. Select the custom properties you want to export, and click Export Values. You
can Filter objects to find the custom properties more easily.
5. To export custom property data for specific objects, click Select <Objects>, and
select the objects.
6. Select the database columns you want to export. You can also change which
custom properties you want to export.
7. Select the file type for the exported data. This can be .csv, .txt, .html or xls.
8. Click Export.
The exported file is downloaded to your browser's default download location.
Change custom properties values
You can change the value of a custom property from the Manage Custom Properties
page or bulk edit the values of a custom property assigned to objects.
You can only edit properties of one object type at a time.
Edit values for custom properties
When you are entering a large amount of data, it can be easier to import the values
from a spreadsheet.

4. Select the custom properties, and click View / Edit Values. You can filter objects
to find the custom properties more easily.
558
Filter objects when assigning custom properties
5. To add or change a value for a property, enter the value into the field.
6. To add the same custom property value for multiple objects, select the objects,
and click Edit Multiple Values. Select the property, enter the value, and click
Save Changes.
7. When you have added or edited the values, click Save Changes.
Filter objects when assigning custom properties
You can limit objects displayed in the Custom Property Editor to find the objects you
want to edit.

3. Select the custom properties for which you want to assign values, and click
View / Edit Values.
4. In the column captions, click the Filter icon, and enter filter text.
The table will only display objects matching the filter options. The condition is added
above the Group by section of the Custom Property Editor.
559
To remove the filter, click the trash icon next to the filter.
Alerting
Use alerts to monitor your environment
An alert is an automated notification that a network event has occurred, such as a
server becoming unresponsive. The network event that triggers an alert is
determined by conditions you set up when you configure your alert. You can
schedule alerts to monitor your network during a specific time period, and create
alerts that notify different people based on how long the alert has been triggered.
The types of events for which you can create alerts vary, depending on the Orion
Platform products you have installed. For example, you can create an alert to notify
you if a node in a specific location goes down or if the network response time is too
slow when you have NPM. If you have installed SAM, you can receive alerts about
application response times or when your Exchange mailbox database is almost full.
You can create alerts for any monitored object. You can alert against volumes and
nodes with most Orion Platform products.
Use the following topics to get started if you have never used Orion Platform
products:
n Alert preconfiguration tasks

n Best practices and tips for alerting
n Navigate to the Alert Manager
n Create new alerts to monitor your environment
n Alert me when a server goes down
560
Alert preconfiguration tasks
You can also view our Alert Lab on thwack for community-based alert information.
Alert preconfiguration tasks
Some alerts require extra configuration, separate software installations, or

information that you may need to request from other departments.
Alert actions that require set up before creating or configuring alerts include:
n Send an email or page

n Dial a paging or SMS service
n Play a sound when an alert is triggered
n Send an SNMP trap
n Use the speech synthesizer to read alerts
Monitored objects in the SolarWinds Orion database must exist before

creating or configuring alerts. Monitored objects can include items such as
nodes, databases, and applications.
Configure the default information in the email action
The information you provide in the default email action is used to populate the Send
an Email/Page action. You can still customize individual email actions if you configure
the default email action.
n Separate email addresses with a semicolon.

n All email actions require a designated SMTP server.

2. Click Configure Default Send Email Action.
3. Under the Default Recipients heading, provide the email addresses of all
default recipients for any email alert action, like the following:
email@company.com; email2@company.com;
distrolist@company.com
4. Provide the default sender and reply address.
5. Enter the default SMTP server information.
Selecting SSL encryption automatically changes the SMTP port number

to 465.
561
Best practices and tips for alerting
Use these best practices and tips to help you configure and test your alerts.
Use the out-of-the-box alerts as templates
SolarWinds recommends using the alerts that are included when you install
the product as templates for your new alerts.
Find an alert that is similar to one you want to create and then click Duplicate
& Edit in the menu bar. Fields are pre-populated so you can skip to specific
parts of the Alert Wizard where there is data you want to change.
Enable out-of-the-box alerts
If there are out-of-the-box alerts that match your monitoring needs, enable
them in your environment. You can customize the alert actions for those alerts.
If you want to modify the conditions, use the alert as a template.
Restrict who receives alerts
During your initial evaluation and testing, send alerts to a few people instead of
to a large distribution list. This can prevent overloading your email server while
you fine-tune your alerts.
Plan which devices to monitor
To reduce the number of alerts sent out, consider which devices are most
important. For example, you may want to receive alerts only for mission-critical
interfaces instead of every interface on a device.
Establish dependencies
Establish dependencies to prevent you from receiving duplicate alerts that

stem from a single network event. For example, you may want to be emailed if
servers in your server farm go down, but if the router goes down and the
servers can no longer be polled, you do not want to receive notifications for all
of your servers.
Navigate to the Alert Manager
Use the Alert Manager to create, edit, delete, enable, or disable alerts. You can access
the Alert Manager in one of four ways:
562
Create new alerts to monitor your environment
n Settings Page (Recommended)

n Click Settings > All Settings in the menu bar. Under Alerts & Reports, click
Manage Alerts.
n Active Alerts Details
n From the Active Alerts Details page, click Manage Alerts in the
Management resource.
n All Active Alerts Resource
n From the All Active Alerts resource, click Manage Alerts in the right side.
n Node Details
n On the Node Details page, navigate to the All Alerts this Object can
trigger resource, and then click Manage Alerts.
Navigate to the Alert Manager to create a completely new alert definition, or

duplicate an alert that is similar to the alert you want to create.
1. Enter the alert properties, which includes who can view the alert, severity, and
how frequently the alert conditions are evaluated.
2. Define the conditions must exist to trigger the alert.
3. Define what event occurs to reset the alert.
4. Schedule when you want the alert to monitor your environment.
5. Define what happens when an alert is triggered.
6. Define what happens when the alert is reset.
7. Review your alert, including the number of alerts that will be triggered based
on the conditions you defined.
You can skip to different steps if you clicked Duplicate & Edit or if you are
editing a saved alert.
Once you have created an alert, it is added to the list of available alerts in the Alert
Manager. When the alert is enabled, it immediately monitors your environment for
the conditions necessary to trigger it.
563
Set alert properties
After creating a new alert, use the Alert Properties to describe the alert, including
which users can view the alert.
Name of alert definition
This is a required field. The name is displayed in the Alert Manager and can be
used to sort your alerts. If you intend to create a large number of alerts,
consider a naming convention that allows you to quickly scan through them.
SolarWinds recommends a name that describes the condition and most visible
alert action. For example, you can use "Email NetAdmins when router goes
down" as the name of an alert.
Description of alert definition
Describe the alert. This is displayed on the Manage Alerts page, so important
information should be near the front.
Enabled (On/Off)
Choose to evaluate the alert immediately after it is created and saved. The alert
is enabled. If you are in the process of refining your alert, you may want to
disable this alert until it is ready for use.
Evaluation Frequency
Set how frequently you want to evaluate the conditions. If you choose to alert
on an event, such as a changed IP address, the condition is not evaluated by
frequency, but by when the change is reported based on the polling interval.
SolarWinds recommends using intervals longer than one minute to evaluate

alert conditions. Shorter frequencies can negatively impact your network
performance or computing resources.
Severity of Alert
Control how the alert in the Active Alerts resource looks, and use the severity to
group or filter alerts more easily.
564
Alert Custom Properties
Use custom properties to organize your alerts. For example, you can create a
"Responsible Team" custom property and use it to help audit who receives
specific alerts.
You must create a custom property for alerts before you can use it in an alert.
Alert Limitation Category
Restrict who can view the alerts. For example, managed service providers can
restrict alerts to their specific customers. Create a new alert limitation by
editing or creating a user account.
Define the conditions that must exist to trigger an alert
The trigger condition is the most complex step in creating an alert. Before you begin,
you may want to revisit the Best practices and tips for alerting. To see an example of
completed trigger conditions, see the Alert me when a server goes down topic.
Trigger conditions are built using child conditions that are evaluated in order. Child
conditions are represented as a line item under the Actual Trigger Condition. You
can have multiple trigger condition blocks with multiple child conditions.
Filter your environment to only display the objects you want to monitor in The
scope of alert. Use the Show List link to view all of the objects that the alert
monitors.
565
1. Choose what objects you want to monitor in the I want to alert on field.
2. Establish how much of your environment you want to monitor in The scope of
alert.
You can monitor all objects in your environment or filter your environment to a
specific set of objects.
3. Create your trigger condition.
a. Choose if the child conditions must be true or false to trigger the alert.
n All child conditions must be satisfied (AND) - Every child condition
must be met
n At least one child condition must be satisfied (OR) - At least one
child condition must be true
n All child conditions must NOT be satisfied - Every child condition
must be false
n At least one child condition must NOT be satisfied - At least one
child condition must be false
b. Click the + sign to add child conditions.
n Add Single Value Comparison (Recommended) - The child
condition evaluates a single field, like Status
n Add Double Value Comparison - The child condition evaluates two
conditions, such as Status and OS
n Add And/Or block - Adds a sub condition block
Use the X at the end of each child condition to delete it, or use the
drop-down menu at the top of the block to delete the entire
condition.
566
c. Select the object you want the child condition to evaluate, and then select
which field you want to evaluate. In the example screenshot, the object is
"Node" and the field is "Status".
You can evaluate objects based on variables or macros.
d. Select how you want to compare the polled value of the field to the
value entered here, and then enter the value. In the example screenshot,
the comparison is "is equal to" and the value is "Down".
e. To use more complex conditions, such as evaluating when an
application on a specific server is down and a different application on
another server is down, enable complex conditions under Advanced
options.
See Building Complex Conditions for more information, or visit thwack,
SolarWinds' community website, for support from other users.
f. Choose how long the condition must exist before an alert is triggered.
This prevents receiving alerts when the alert condition, such as high CPU
utilization, occurs briefly or only once during a certain time period.
n Send an alert immediately when the condition is met by clearing
any selection for Condition must exist for more than.
n Wait before sending an alert by selecting Condition must exist for
more than, and entering how long the condition must exist. This
option prevents multiple alerts firing if the condition is temporary.
If you have successfully created an alert condition, you can move to the next step in
the alert wizard. The Summary step evaluates the conditions against your
environment and returns how many objects will trigger the alert.
Define the conditions that must exist to reset an alert
Use the reset condition to define what must occur to remove an alert instance from
the active alerts list. For example, the "Email me when a Node goes down" alert
automatically resets when the node comes back up. You can use the built-in reset
conditions or create your own.
When reset conditions are met, the alert is removed from Active Alerts. You can also
add actions that occur when the reset conditions are met.
567
For example, you can create an alert that triggers when nodes in your lab go down. If
node 192.168.4.32 goes down, the alert fires for that specific instance of the
trigger condition and any escalation levels you create continue until you reset the
alert. After the alert is reset, all trigger actions stop and a new alert fires the next
time node 192.168.4.32 goes down. If you have created reset actions, the reset
actions fire.
When the alert is reset, escalation actions are halted.
Select one of the following reset conditions:
n Reset this alert when trigger condition is no longer true (Recommended)
SolarWinds recommends using this reset condition. If the trigger

condition is no longer true when the objects are next polled, this
selection automatically resets the alert.
You can use the Condition must exist for more than option in the trigger
conditions in conjunction with this reset condition. Trigger conditions that
involve volatile components, such as high CPU utilization, can trigger
excessively with this reset condition.
n Reset this alert automatically after
Select to reset an alert after a set amount of time has passed. If this interval is
less than the amount of time you wait for different escalation levels, the
escalation levels that occur after this interval do not fire. This reset condition is
especially useful to remove event-based alerts from Active Alerts.
For example, if the trigger conditions still exists after 48 hours, you can use this
to trigger your alert actions again. The alert is reset and triggers as soon as the
trigger condition is detected, which is as soon as the objects are polled for this
example.
n No reset condition - Trigger this alert each time the trigger condition is met
The alert fires each time the trigger conditions are met.
For example, when the alert for node 192.168.4.32 going down fires, a new
alert for 192.168.4.32 fires every time the node is down when it is polled.
n No reset action
The alert is active and is never reset. To re-trigger the alert, the alert must be
manually cleared from the Active Alerts view.
568
n Create a special reset condition for this alert

Select to build a specific reset condition. For example, you can choose to reset
the condition when the node has been up for more than 10 minutes.
The alert wizard evaluates the reset condition for errors. If there are no errors,
you can proceed to the next step, or go back to previous steps.
See Define the conditions that must exist to trigger an alert or Build complex
conditions for more information on creating conditions.
Schedule when an alert monitors your environment
You can configure when an alert monitors your environment. By default, alerts
monitor your network for changes all the time. Schedule when you want to monitor
your network for the trigger conditions you created for the alert.
You can create multiple schedules that control when an alert is enabled or disabled.
For example, you can schedule the alert to monitor your network during off hours,
and disable the alert during your maintenance windows.
Alerts must be enabled to allow schedules to run.
1. Select Specify time of day schedule for this alert.

2. Click Add Schedule.
569
3. Enter the following information:
n Schedule Name
This is not required, but may help you organize or troubleshoot your
schedules. If you do not enter a name, a name is automatically generated
from the time period.
n Enable or Disable alert during following time period
If you choose to disable the alert, it is enabled all other times unless
otherwise scheduled.
n Frequency
Choose when to monitor on a high level, such as daily, weekly, or monthly.
n Enable or Disable every
These options change based on the frequency.
n If you selected Daily:
You can choose to enable or disable the alert every few days, up to
every 31 days. You can also select business days. For example, you
may want to disable network or disk activity alerts if you run daily,
off-site backups of your critical data.
n If you selected Weekly:
Choose which days the alert is enabled or disabled. You may want
to disable alerts during a weekly maintenance window.
n If you selected Monthly:
Choose which months the alert is enabled or disabled. This option
is useful when you have quarterly or monthly maintenance
windows.
Choose either a specific date, such as June 22nd, or a day, such as
Thursday.
n Starting on
Choose when to begin the schedule.
n Right now - Start the schedule immediately.
n Specific Date - Select a time and day to begin the schedule.
n Ending on
Choose an end date for the schedule, if necessary.
4. Click Add Schedule to create the schedule.
When you add a schedule to an alert, the alert only monitors during the time period
you have scheduled, or does not monitor during that time. Alert actions can also have
schedules, so not all alert actions may occur during the scheduled period.
570
Define what happens when an alert is triggered
Choose actions that occur whenever the trigger conditions are met. You can also set
up escalations levels so that different actions occur if the alert has not been
acknowledged quickly enough.
Add actions to alerts
By default, what you enter into the Message displayed when this alert field is
displayed in the All Active Alerts resource.
You can create a new action or use an action that you have already created. When
you reuse an action, you are also reusing all of its configurations, including its
schedule and execution settings.
If you are alerting others through email, SolarWinds recommends that you
notify a small number of users while you fine tune your alerts.
1. Click Add Action.

2. Select an action from the list.
See Alert Actions for a complete list of available actions.
3. Click Configure Action.
571
4. Enter the necessary information for the action.
Each action requires different information. Select from the list of Alert Trigger
Actions for more information per action.
Some actions require extra configuration steps, specific information, or special
software. See Alert preconfiguration tasks.
Each action has the following sections:
n Name of action - This is not required, but makes it easier to organize
and find your actions in the Action Manager.
n Time of Day - You can choose different actions to occur at different
times of the day or month. For example, if you want to send a page, you
might send it to a different person on weekends or holidays rather than
during the week.
n Execution settings - You can select both options, neither option, or a
single option.
n Do not execute this action if the alert has been acknowledged
already (Recommended)
n Repeat this action every X minutes until the alert is acknowledged
5. Click Add Action to save it to the list of actions in the alert.
Add a preexisting action to the alert

You can add actions that have already been configured to an alert. For example, if
you configured an action to reboot a VM, you can add that action to a separate alert.
If you use a preexisting action, any configuration change you make to the
action, including schedules, is used in every alert the action is assigned.
1. Click Assign Action(s).

2. Select one or more actions from the list.
3. Click Assign.
Add what happens when an alert is not acknowledged
Escalation levels in Orion Platform products refer to user-defined time intervals

between when an alert is activated and when a user acknowledges that alert. You
can configure the alert to perform different actions per escalation level.
Escalation Level 1 contains all initial actions that you want to occur when the trigger
conditions are met and the alert activates.
572
Add a preexisting action to the alert
Escalation Levels 2 and above include all actions you want to occur if no one
acknowledged the alert during the previous escalation levels.
For example, if an alert for a critical server activates and all of the recipient or first-
level responders are out for training and do not acknowledge the alert, then the
actions fire in the second escalation level. These actions may include emailing
managers or other backup staff.
1. In an existing alert, click Trigger Actions.

2. Below the action, click Add Escalation Level.
3. Choose how long you want to wait after the previous escalation level before
performing the actions in the new escalation level.
4. Enter new actions in this escalation level.
You can copy all of the actions as Reset Actions. This lets you quickly craft
actions to indicate that the issue has been acknowledged or resolved. Click
Copy Actions to Reset Actions Tab.
When an alert is triggered, the actions will be performed in the order that they are
displayed on the list. You can test each action to ensure the action does what you
expect it to do.
Define what happens when the alert is reset
Use reset actions to perform specific tasks when an alert is no longer active, such as
writing to the log that the issue has been acknowledged. Reset actions are usually
used to notify others that the situation has been resolved or to write the resolution to
a log file.

2. Select an action from the list.
See Alert Actions for a complete list of available actions.
3. Click Configure Action.
573
4. Enter the necessary information for the action.
Each action requires different information. Select from the list of Alert Actions
for more information per action.
Some actions require extra configuration steps, specific information, or special
software. See Preconfiguration Tasks.
Each action has the following sections:
n Name of action - This is not required, but can make it easier to organize
and find your actions in the Action Manager.
n Time of Day - You can choose different actions to occur at different
times of the day or month. For example, if you want to send a page, you
might send it to a different person on weekends or holidays than during
the week.
5. Click Add Action to save it to the list of reset actions in the alert.
To perform the same actions as when the alert was triggered, click Copy Actions
From Trigger Actions Tab. Use the copied trigger actions as a base and modify them
to reflect that the alert is no longer active.
When an alert is reset, the actions will be performed in the order that they are listed.
You can test each action to ensure the action does what you expect it to do.
Review the alert's configuration
The Summary tab allows you to check your alert definition before you save any
changes.
Before you click Submit, review the information box above it. This box lists the
number of objects that will trigger the alert immediately based on your
current trigger condition.
Modify any section by clicking Edit next to that section.
You can integrate your alerts with other SolarWinds' products, such as AlertCentral or
Web Help Desk, by expanding Alert Integration.
574
Commonly Created Alerts
Once you have created an alert, it is added to the list of available alerts in the Alert
Manager. When the alert is enabled, it immediately monitors your environment for
the conditions necessary to trigger it.
The following is a list of frequently created alerts. The topics walk you through the
easiest method to create the alert and include tips on how to build more complex
alerts.
n Alert me when a server goes down

n Creating an Alert to Discover Network Device Failures
Alert me when a server goes down
Use the following procedure to create an alert that writes to a log and sends an email
when a Windows server goes down.
1. Search for "Email me when a Node goes down" in the Alert Manager.
2. Select the check box next to the alert, and then click Duplicate & Edit.
3. Enter a name for the alert, such as "Notify me when Windows 2008 servers go
down".
4. Enable the alert, and then click Trigger Condition or Next.
5. In The scope of alert, select Only following set of objects.
6. Select Node Machine Type is equal to Windows 2008 Server as the
child condition.
You can further refine your scope by entering another AND

condition. For example, you can enter Node IP Address starts
with 10.10.45 to restrict the scope of the alert to a specific
subnet.
575
7. The actual trigger condition should be Node Status is equal to Down.
Select and enter a value for Condition must exist for more than to
prevent being alerted when a node enters the down state frequently
within a set amount of time. This prevents you from receiving alerts until
the node has been in the down state for longer than the time you have
selected.
You can further suppress alerts by enabling complex conditions in the

Advanced options. This allows you to choose to wait until multiple nodes
are down before triggering a single alert.
8. Click Reset Condition. The default action should be to reset the alert when the
node is up.
9. Click Trigger Actions, and then click Add Action.
10. Select Log the Alert to a file, and then click Configure Action.
a. Enter the location of the log. For example, enter
C:\ExampleAlertLog.txt in the Alert Log Filename Field.
b. In the Message text box, type Node ${N=SwisEntity;M=Caption}
is currently down.
c. Click Add Action.
11. Click Add Escalation Level, and enter 5 minutes to wait for 5 minutes before
escalating to the next level.
12. Click Add Action in Escalation Level 2, and select Send an Email/Page. Click
Configure Action.
a. Enter your email as the recipient.
b. Add a message.
You can use variables to customize your message. You can also

use a variable that allows you to acknowledge an alert from email
(${N=Alerting;M=AcknowledgeUrl}).
c. Enter your SMTP server information if you have not already done so.
You can enter a default SMTP server that is used for all your email
in the Configure Default Send Email Action setting.
d. Go to Execution settings to click Add Action.

13. Click Copy Actions to Reset Actions Tab, and then click Next.
14. Click Edit next to your logging action, and modify your message to Node
${N=SwisEntity;M=Caption} is back up.
576
15. Click Edit next to your email action, and modify your message. You can also
delete the email if you do not want to know if the situation has been resolved.
16. Click Summary to see if any object will trigger the alert, and then click Submit.
Once you have created the alert, it is added to the list of available alerts in the Alert
Manager. You can test and view the results of each of your alert actions. See Testing
Alerts for more information.
Creating an Alert to Discover Network Device Failures
With alerting, Orion Platform products give you the ability to immediately discover
whenever any device on your network is experiencing a problem.
The procedures in the topics below create an alert that uses a custom location
property to alert you to a node failure on your monitored network:
n Creating a Custom Property

n Creating an Alert Using a Custom Property
Alerting When an IP Address Changes
Alerting on Metrics
Alert on custom properties
The following example creates multiple alerts using the NodeLocation custom
property. An alert triggers when a node goes down. Upon triggering, the alert will
write to a local log file, send a syslog message, and send an SNMP trap.
The ${variable} syntax is required for variables.
1. Click Alerts & Activity > Alerts in the menu bar, and then click Manage Alerts.
2. Select the check box next to Node is down, and then click the Duplicate & Edit
button.
3. Click Trigger Condition, and add a child condition. A child condition should
already exist for a node being down.
577
4. Select the node object, and choose NodeLocation in the field drop-down menu.
Enter a comparison and value.
5. Click the Trigger Actions, and then click Add Action.
6. Select Log the Alert to a file, and then click Configure Action.
a. Enter the log filename in the Alert Log Filename field.
b. In the Message text box, type the following:
Node ${N=SwisEntity;M=Caption} is currently down.
7. Click Add Action, and select Send a Syslog Message. Click Configure Action.
a. Type 127.0.0.1 as the Hostname or IP Address of the Syslog Server,
and then type the following in the Message field:
b. Click Add Action.
8. Click Add Action, and select Send SNMP Trap. Click Configure Action.
a. Type 127.0.0.1 as the SNMP Trap Destination, and then type the
following in the Alert Message field:
b. Click Next.
9. Click Summary to see if any objects will trigger the alert, and click Submit.
After you have created the alert, it is added to the list of available alerts in the Alert
Manager. You can test and view the results of each of your alert actions.
n You can view results of your Syslog message action in the Web Console or
through the Syslog Viewer on your SolarWinds Orion server.
n To view the results of your SNMP Trap action, click Start > All Programs >
SolarWinds Orion > Syslog and SNMP Traps > Trap Viewer.
View triggered alerts in the Orion Web Console
View active triggered alerts through Alerts & Activity > Alerts in the menu bar. Click
each alert to view the details, which includes a historic count of how frequently the
object triggers the alert and other objects that are experiencing the same set of
conditions that triggered the alert you are viewing.
You can also add the All Active Alerts resource to any view.
578
Remove alerts from the Active Alerts list
Remove alerts from the Active Alerts list
When an alert has triggered and becomes active, you can then acknowledge it. After
an alert is acknowledged, alert actions in higher escalation levels are halted and the
time it was acknowledged and the account that acknowledged it is recorded. You can
also add notes that other users can read.
Depending on your organization, acknowledging an alert can have different purposes

outside of halting further notifications. The most common purposes are to provide an
audit trail or to prevent multiple people from working on the same issue.
You must enable the Allow Account to Clear Events privilege to acknowledge
alerts. For more information about access privileges for Orion Web Console
users, see Define what users can access and do.
1. Click Alerts & Activity > Alerts in the menu bar.

2. Click Acknowledge next to the alerts you want to acknowledge.
Tip: Depending on how you configure the email, you can acknowledge an alert
directly from an email notification.
You can hide acknowledged alerts by clicking More, and then selecting Hide
Acknowledged Alerts.
Test alert triggers and actions
You do not have to actually experience a device failure to confirm that your alerts are
working. The trigger condition is automatically evaluated and trigger and reset
actions can be tested individually.
Test trigger conditions
Alert conditions are automatically evaluated on the Summary tab. Scroll to the
bottom of the page and view the information box above the Submit button.
Test alert actions while creating or editing an alert
When you simulate actions, the action will be performed regardless of whether the
trigger condition is true. If the action sends a message to a recipient, you should
reduce the recipient list to yourself and a small number of team members until you
are confident the alert is ready to be enabled in your production environment.
579
The Send Email/Page, Play a Sound, and Text to Speech Output actions do not
have to fire. You can view what the message will look like when the trigger or
reset action fires without performing the action.
1. Click Trigger Actions or Reset Actions.

2. Click Simulate next to the alert action you want to test.
3. Select an object to resolve any variables you have used in your alert action.
4. Click Execute. Test email, play a sound, and text to speech actions without
sending an email by clicking Simulate.
Test alert actions in the Action Manager
You can also test actions independent of the trigger or reset conditions by using the
Action Manager.
1. Select the action you want to test.

2. Click Test.
3. Select an object to resolve any variables you have used in your alert action.
4. Click Execute. Test email actions without sending an email by clicking Simulate.
After the alert test completes, you can view the results of your alert actions.
l To view the results of your email alert action, open EvaluationAlertLog in

your Orion folder, typically <Volume:>\ProgramData\Solarwinds
\Logs\Orion\ActionsExecution.log.
l To view results of your Syslog message action, click Start > All Programs >
SolarWinds Orion > Syslog and SNMP Traps > Syslog Viewer.
l To view the results of your Syslog message action, click Start > All Programs >
SolarWinds Orion > Syslog and SNMP Traps > Trap Viewer.
Modify multiple alerts or share alerts
Use the Alert Manager to bulk edit multiple alerts. You can enable or disable multiple
alerts or add pre-configured actions.
Alerts must be enabled to be executed. For example, if an alert is scheduled to

run for a short period of time each year, it must be enabled so the schedule
runs. A disabled alert will not be executed, even if it is scheduled to run.
580
Build complex conditions
Add actions to alerts without opening the Alert Wizard
Assign actions that you have already configured to alerts. You can assign multiple
actions to multiple alerts. Actions are categorized into trigger and reset actions based
on how the action was created in the Alert Wizard.
SolarWinds does not provide generic actions due to the differences in intent behind
trigger and reset actions. For example, a trigger action to send an email is usually a
notification that an event happened, while the associated reset action is usually a
notification that the event has been resolved.
Share alerts with others
SolarWinds customers share their customized alerts in the SolarWinds thwack

community. Visit thwack.solarwinds.com to download and import alerts
created by others.
Export an alert to save the alert definition as an XML file on your local computer.
Alerts are exported to XML and can only be imported from XML. You can send this file
to other coworkers or share it in the SolarWinds thwack community.
Before you share an alert, check the exported file for confidential information,
such as SMTP server credentials, and delete before making it public. Also
review your company policy on sharing this type of file.
Build complex conditions
Complex conditions are generally enabled by users who are comfortable with
building normal trigger conditions, or who have trialed alerts using the normal
trigger conditions and require more control over the trigger conditions to better
refine the environmental conditions that trigger an alert.
Do not use complex conditions until you have tested the trigger conditions
individually. Creating an alert with complex conditions without testing it may
prevent you from receiving important alerts.
1. Navigate to the Trigger Condition page.

2. Expand Advanced options.
3. Select Enable complex conditions.
You can use complex conditions to do the following:
581
n Wait for multiple objects to meet the trigger condition before alerting
n Evaluate multiple condition blocks
n Evaluate multiple object types
Wait for multiple objects to meet the trigger condition
With complex conditions enabled, you can choose to trigger alerts only when multiple
objects meet the trigger condition.
After you have enabled complex conditions, the following option is available in your
trigger condition:
This setting then combines all alerts that would be sent for each object into a single
alert.
Do not use this setting until you are confident that the trigger condition is
correct. This setting can prevent important alerts from triggering.
For example, if you were monitoring computers used in a high availability cluster, you
may only want to be alerted if more than half the cluster is down at the same time.
1. Enable complex conditions.

2. In the trigger condition, select Alert can be triggered if.
3. Enter how many objects must meet the trigger condition before sending an
alert.
Evaluate multiple condition blocks
You can use complex conditions to evaluate multiple condition blocks, or sections,
independently. For example, you may want to create an alert when an application is
down and when your fail-over server is active for more than an hour.

2. Click Add Section.
582
Manage alert actions
3. Select And then after from the drop-down menu between the two condition
sections.
4. Choose how long to wait before evaluating the next section.
5. Create the next condition block.
How condition blocks are evaluated
The condition blocks are evaluated at the same time. If they are all true based on the
conditions, the alert triggers. For example, condition A, B, and C must be true in order
for the alert to trigger.
(Condition A) & (Condition B) & (Condition C)
Condition blocks are evaluated using variations of AND, so the trigger condition in
each section must be met.
A condition block can be evaluated at a different time than other condition blocks.
For example, if you want to be alerted if the backup system is active for more than an
hour, you can choose to wait an hour after the primary condition block, where the
application going down is the trigger condition, before evaluating whether the
backup system is still active.
Evaluate multiple object types
To evaluate multiple object types, you should use complex conditions. Complex
conditions can be used to alert on different object types within the same alert. For
example, you can create an alert to notify you when IIS is down and the free space on
the volume is less than 30 GB.

2. Click Add Section.
3. Choose a different value in I want to alert on.
Manage alert actions
You can edit, test, enable, disable, and delete alert actions from the Action Manager.
583
Mostly for bulk actions and assigning previously created actions to alerts. View meta
data about the action to help troubleshoot alert actions from a single area instead of
trying to find the action in an alert.
Assign an action to an alert
You can use actions that you have already configured in multiple alerts. For example,
if you have configured an action to email emergency response teams, you can assign
this action to multiple alerts. When you assign an alert, it is added to the highest
escalation level.
Enable and Disable Alerts
Use the On/Off toggle or select an alert and click Enable/Disable to enable or disable
alerts.
Alerts must be enabled to be evaluated. For example, if an alert is scheduled to run

for a short period of time each year, it must be enabled so the schedule runs. A
disabled alert will not be evaluated, even if it is scheduled to run.
Available Alert Actions
Orion Platform products provide a variety of actions to signal an alert condition on

your network. For information on configuring each action, refer to the following list.
The following actions are available:
n Change a custom property

n Dial a paging or SMS service
n Email a web page to users
n Execute an external batch file
n Execute an external VB script
n Log the alert message to a file
n Log the alert to the NPM event log
n Change the resource allocation of a virtual machine
n Delete a snapshot of a virtual machine
n Move a virtual machine to a different host
n Move a virtual machine to a different storage
n Pause a virtual machine
584
n Power off a virtual machine

n Power on a virtual machine
n Restart a virtual machine
n Suspend a virtual machine
n Take a snapshot of a virtual machine
n Play a sound when an alert is triggered
n Restart IIS sites or application pools
n Send a Windows Net message
n Send an SNMP trap
n Using Get or Post URL Functions
n Send a syslog message
n Send an email or page
n Manually set a custom status
n Use the speech synthesizer to read alerts
n Log an alert to the Windows Event Log on a specific server
Change a custom property
Custom properties are additional fields, such as country, building, asset tag, or serial
number, that you can define and store in your SolarWinds Orion database. After
properties are added, you can view or filter using them.
1. When editing or adding an alert, click Add Action in the Trigger or Reset Action
section of the Alert Wizard.
2. Select the Change Custom Property option, and then click Configure Action.
3. Under Custom Property Settings, select the custom property and enter the
value you want to change it to.
4. Schedule the action by selecting Time of Day > Use special Time of Day
schedule for this action. This schedule only applies to the alert action you are
editing.
This is often used to prevent an action from occurring during specific

windows.
5. Select how frequently this action occurs for each triggered alert in Execution
Settings.
585
The action is added to the trigger or reset action list, and you can test the action
using the Simulate button. When the trigger or reset conditions of the alert are met,
the value of the custom property you selected changes.
Create a ServiceNow incident
This alert management action is only available if the integration with ServiceNow® is
enabled.
For information about configuring ServiceNow integration, see Configure an Orion

Platform product with ServiceNow.
2. Select Create ServiceNow Incident, and click Configure Action.
3. Under Select ServiceNow Instance, specify the ServiceNow instance where you
want to create the incident.
4. Under Incident Detail, define the properties of an incident template that will be
used for new incidents. For example, here you can define the urgency, impact,
and other properties of incidents. Text areas can hold macro variables to add
information about alerts and alert objects.
If the property you want is not displayed in the Incident Detail section,
click Select Properties at the bottom of the section, and select the
property from the list.
5. Under State Management, define the status of the incident when the incident
is reset, reopened, acknowledged, and closed. You can also specify notes to be
added to the incident.
editing.

windows.
Settings.
an incident will be created or updated in the specified ServiceNow instance.
586
When you use this alert action, we recommend that you only use it on the
trigger tab. It is also recommended that you only use one ServiceNow action
per alert.
To deactivate the integrated behavior, remove the alert action from the alert
definition.
You can specify one alert action for one ServiceNow instance. To create an
incident in another ServiceNow instance, specify another alert action and use
a different ServiceNow instance.
Dial a paging or SMS service
This action forwards alerts to a paging or SMS service. You must download and install
NotePager Pro from Notepage.net to your SolarWinds Orion server to use this action.
For instructions on configuring this action, see the NotePage Technical Support page
at http://www.notepage.net/solar-winds/technicalsupport.htm and SolarWinds
Network Performance Monitor Integration at www.notepage.net.
Email a web page to users
Send a web page, including content of resources available in the Orion Web Console,
to others.
2. Select the Email a Web Page option, then click Configure Action.
3. Enter the Recipients.
Multiple addresses must be separated with commas.
4. Enter the Subject and Message of your alert trigger email/page.
n For the Optional Web Server Authentication section, select User
currently logged in, Another user, or No user defined.
Use variables to make the message dynamic.
n You can create a dynamic URL to send information about the object that
triggered the alert.
587
5. Enter your SMTP server information.
editing.

windows.
Settings.
an email is sent to the recipients.
Create a dynamic URL
Use variables to create a URL that changes based on the object that triggers the alert.
Click Insert Variable and search for URL to find the all of the variables you can use to
create the dynamic URL.
For example, enter ${N=SwisEntity;M=DetailsUrl} in the URL field to email a link to the
Details view of the object that triggered the alert. When the email is sent, the variable
resolves to a valid URL such as
http://myserver/Orion/View.aspx?NetObject=N:3 and the email contains
the content of the Details view in the body.
Execute an external batch file
There are several circumstances where you may want to execute a program when a
specific network event occurs. For example, you may want to run a custom script to
reboot your SQL servers.
External programs selected for this action must be executable using a batch file
called from the command line. Programs executed this way run in the background.
However, you can set the SolarWinds Alerting Engine Service to Interact with Desktop.
SolarWinds recommends that scripts and batch files be placed on the root of
c:\ to simplify the path for the batch file.
588
2. Select the Execute an External Program option, then click Configure Action.
3. Under Execute an External Program settings:
a. Enter the Network path to external program in the field provided.
For example: Use c:\test.bat, where c:\ is the disk on your main
poller and test.bat is your external program to be executed.
b. Select either Define User or No User Defined for Optional Windows
Authentication
editing.

windows.
Settings.
the external program runs.
Execute an external VB script
In some situations, you may want to execute a Visual Basic (VB) script when a network
event occurs to perform a specific action.
SolarWinds recommends that scripts and batch files be placed on the root of
c:\ to simplify the path for the batch file.
2. Select the Execute an External VB Script option, then click Configure Action.
589
3. Under Execute an External VB Script settings:
a. Select a VB Script Interpreter from the drop down list.
b. Enter the Network path to the external VB Script in the field provided.
For example: Use c:\test.vbs, where c:\ is the disk on your main
Orion poller and test.vbs is your external VB Script to be executed.
c. Select either Define User or No User Defined for Optional Windows
Authentication
editing.

windows.
Settings.
the VB script runs.
Log the alert message to a file
SolarWinds can be configured to log alerts to a designated file which can be viewed
at a later time.
2. Select the Log the Alert to a File option, then click Configure Action.
3. Under Log to File Settings:
a. Enter the log filename in the Alert Log Filename field.
b. Enter a maximum log file size in MB (0 = unlimited).
c. Enter the Message of your alert trigger in the field provided.
editing.

windows.
590
Settings.
the alert is logged to the file with the message you created.
Log the alert to the NPM event log
Record when an alert is triggered to the NetPerfMon (NPM) event log on your
SolarWinds Orion server or on a remote server for later investigation.
2. Select Log the Alert to the NetPerfMon Event Log from the options, and then
click Configure Action
3. Under Log the Alert to the NetPerfMon Event Log settings, enter the text you
want written to the file.
Use variables to make the message dynamic.
editing.
This is often used to prevent an action from occurring during specific windows.
5. Expand Execution Settings to select when the action occurs.
the alert is logged to the NPM event log with the message you created.
Change the resource allocation of a virtual machine
If a virtual machine is experiencing performance issues, you can have an alert trigger
a specified allocation of resources. This alert management action is available if the
integration with Virtualization Manager is enabled.
591
2. Select Manage VM - Change CPU/Memory Resources, and click Configure
Action.
3. Enter a name for the action.
4. Under Select Virtual Machine, specify the virtual machine on which you want to
adjust the number of CPUs, the memory capacity, or both.
a. To change the resource allocation of the virtual machine that triggered
the alert, click Execute this action.
This option is only available if the alert is built to trigger for virtual
machines.
b. To change the resource allocation of a different virtual machine, click

Select specific VM, and search for a virtual machine.
5. To power off the virtual machine before changing the resource allocation, and
then power it on again after the resource allocation has been changed, select
the relevant option.
If the option is not selected, the action will be performed live on the
virtual machine.
6. Under Specify New Resources, specify whether you want to add more resources
to the virtual machine, or replace the existing resources with new resources,
and then specify the parameters of the new resource or resources.
a. Select Number of processors, and specify the number of processors to
allocate.
b. Select Memory, and specify the memory capacity to allocate.
editing.

windows.
Settings.
the specified CPU and memory resources will be allocated to the virtual machine.
592
Delete a snapshot of a virtual machine
If a virtual machine is experiencing resource issues, you can have an alert trigger a
virtual machine snapshot to be deleted. This alert management action is only
available if the integration with Virtualization Manager is enabled.
2. Select Manage VM - Delete Snapshot, and click Configure Action.
3. Under Select Virtual Machine, specify the virtual machine from which you want
to delete a snapshot.
a. To delete a snapshot of the virtual machine that triggered the alert, click
Execute this action.
machines.
b. To delete a snapshot of a different virtual machine, click Select specific

VM, and search for a virtual machine.
editing.

windows.
Settings.
the snapshot of the specified virtual machine will be deleted.
Move a virtual machine to a different host
If a virtual machine is experiencing issues, you can have an alert trigger the virtual
machine to be moved to a different host. This alert management action is only
available if the integration with Virtualization Manager is enabled.
2. Select Manage VM - Move to a Different Host, and click Configure Action.
593
3. Under Select Virtual Machine, specify the virtual machine that you want to
move.
a. To move the virtual machine that triggered the alert, click Execute this
action.
machines.
n To apply the action only to virtual machines of a specific vendor,

select the relevant option, and specify whether you want to
perform to action on Hyper-V or VMware virtual machines.
b. To move a different virtual machine, click Select specific VM, and search
for a virtual machine.
4. To power off the virtual machine before moving it to a different host, and then
power it on again after the action has been completed, select the relevant
option.
virtual machine.
5. Under Select Target Host, search for the host where you want to move the
selected virtual machine.
editing.
This is often used to prevent an action from occurring during specific windows.
Settings.
the specified virtual machine will be moved to a different host.
594
Move a virtual machine to a different storage
If a virtual machine is experiencing storage issues, you can have an alert trigger the
moving of the virtual machine to a different storage location. This alert management
action is only available if the integration with Virtualization Manager is enabled.
2. Select Manage VM - Move to a Different Storage, and click Configure Action.
move.
a. To move the virtual machine that triggered the alert, click Execute this
action.
machines.
n To apply the action only to virtual machines of a specific vendor,

select the relevant option, and specify whether you want to
perform to action on Hyper-V or VMware virtual machines.
b. To move a different virtual machine, click Select specific VM, and search
4. To power off the virtual machine before moving it to a different storage, and
then power it on again after the action has been completed, select the relevant
option.
virtual machine.
5. Under Select Target Datastore, search for the datastore where you want to
move the selected virtual machine.
a. In a VMware environment, select one of the available datastores.
b. In a Hyper-V environment, select one of the available datastores, and
click either Use the default location to move the virtual machine to the
default location of the datastore, or click Specify custom path, and enter
a custom location.
editing.

windows.
595
Settings.
the specified virtual machine will be moved to a different datastore.
Pause a virtual machine
If a virtual machine is experiencing issues, you can have an alert trigger a pause for
the virtual machine. This alert management action is only available if the integration
with Virtualization Manager is enabled.
This action can only be configured for Hyper-V virtual machines.

2. Select Manage VM - Pause, and click Configure Action.
pause.
a. To pause the virtual machine that triggered the alert, click Execute this
action.
machines.
b. To pause a different virtual machine, click Select specific VM, and search
editing.

windows.
Settings.
the specified virtual machine will be paused.
596
Power off a virtual machine
machine to be powered off. This alert management action is only available if the
2. Select Manage VM - Power Off, and click Configure Action.
power off.
a. To power off the virtual machine that triggered the alert, click Execute
this action.
machines.
b. To power off a different virtual machine, click Select specific VM, and
search for a virtual machine.
editing.

windows.
Settings.
the specified virtual machine will be powered off.
Power on a virtual machine
If a virtual machine is powered off, you can have an alert trigger the virtual machine
to be powered on. This alert management action is only available if the integration
with Virtualization Manager is enabled.
2. Select Manage VM - Power On, and click Configure Action.
597
power on.
a. To power on the virtual machine that triggered the alert, click Execute
this action.
machines.
b. To power on a different virtual machine, click Select specific VM, and
editing.

windows.
Settings.
the specified virtual machine will be powered on.
Restart a virtual machine
machine to be restarted. This alert management action is only available if the
2. Select Manage VM - Reboot, and click Configure Action.
reboot.
a. To reboot the virtual machine that triggered the alert, click Execute this
action.
machines.
b. To reboot a different virtual machine, click Select specific VM, and
598
editing.

windows.
Settings.
the specified virtual machine restarts.
Suspend a virtual machine
If a virtual machine is experiencing performance issues, you can have an alert trigger
the virtual machine to be suspended. This alert management action is only available
if the integration with Virtualization Manager is enabled.
2. Select Manage VM - Suspend, and click Configure Action.
suspend.
a. To suspend the virtual machine that triggered the alert, click Execute
this action.
machines.
b. To suspend a different virtual machine, click Select specific VM, and
editing.

windows.
Settings.
599
the specified virtual machine is suspended.
Take a snapshot of a virtual machine
If a virtual machine is experiencing issues, you can have an alert trigger a snapshot
of the virtual machine to be taken. This alert management action is only available if
the integration with Virtualization Manager is enabled.
2. Select Manage VM - Take Snapshot, and click Configure Action.
3. Under Select Virtual Machine, specify the virtual machine of which you want to
take a snapshot.
a. To take a snapshot of the virtual machine that triggered the alert, click
Execute this action.
machines.
b. To take a snapshot a different virtual machine, click Select specific VM,
and search for a virtual machine.
editing.

windows.
Settings.
using the Simulate button. When the trigger or reset conditions of the alert are met, a
snapshot is taken of the specified virtual machine.
Play a sound when an alert is triggered
The Play a Sound action uses the SolarWinds desktop notification client to play the
sound on your computer when an alert arrives.
600
You must download and install the client on every computer that you want to play a
sound when an alert arrives. After installing the desktop notification client, configure
which sound you want to play when an alert is received.
Computers that do not have the desktop notification client installed on them do not
play a sound when an alert arrives. If you want an alert notification sound to play on
your desktop or laptop, you must install and configure the desktop notification client
on that computer.
Download the desktop notification client from <Your SolarWinds Orion

server>/DesktopNotificationTool/SolarWinds.DesktopNotificationTool.msi. Run the
installer and follow the on-screen instructions to install the client.
The desktop notification client requires the following information to connect to your
SolarWinds Orion server and receive alerts:
n Orion Server Name or IP Address

n Orion User Name
n Password
You can use the server name and credentials that you use to logon to your
SolarWinds product.
SolarWinds can be configured to play a sound upon alert trigger or reset. This alert
action is frequently used in NOC environments. The SolarWinds Desktop Notification
client must be installed on each computer that you want to play a sound. The
following procedure configures a sound to play for an alert.
2. Select the Play a Sound option, and then click Configure Action.
3. Under Play a sound settings:
n If not installed, click Download our desktop notification client to
download and install the notification client. From the notification client,
select an alert sound.
editing.

windows.
601
Settings.
using the Simulate button. When the trigger or reset conditions of the alert are met, a
sound plays through the client.
Send a Windows Net message
If a computer is experiencing issues, you can have an alert trigger a Windows Net
Message to be sent to a specific computer or to all computers.
Alerts can be configured to display a pop-up Windows Net Message either on a

specific computer or on all computers in a selected domain or workgroup. The
following steps configure Windows Net messaging for triggered or reset alerts.
The only operating systems supporting Windows Net Messaging on which

SolarWinds supports SolarWinds installations are Windows Server 2003 and
Windows XP. SolarWinds only supports evaluation installations of SolarWinds
on Windows XP.
2. Select the Send Net Message option, then click Configure Action.
3. Under Send a Net Message settings:
a. Enter Computer Name or IP address in the field provided.
You can enter multiple computers or IP addresses by separating

them with commas.
b. Enter the Message of your alert trigger in the field provided.
editing.

windows.
Settings.
602
the message is sent to the selected computers.
Restart IIS sites or application pools
If IIS or application pools are experiencing performance or resource issues, you can
use an alert to restart them.
You must know the IIS Server name and the Site or Application Pool to restart a
remote instance of IIS.
2. Select Restart IIS Site/Application Pool from the options, and then click
Configure Action.
3. Expand Restart IIS Site/Application Pool Settings.
a. Select the IIS Action to Perform from the drop down list.
b. Choose the Site or Application Pool.
editing.

windows.
Settings.
the selected site or pool restarts.
Send an SNMP trap
SNMP traps signal the occurrence of significant events by sending SNMP messages to
a monitoring device. You can have an alert trigger this action to inform you of these
events.
603
This action requires the following information:
n UDP port number
n SNMP version number
n SNMP credentials
2. Select the Send SNMP Trap option, then click Configure Action.
3. Under Send SNMP Trap Message:
a. Enter SNMP Trap Destinations in the field provided.
Multiple IP Addresses should be separated by commas or

semicolons.
b. Select a Trap Template from the drop down lists.

4. Enter the Message of your alert trigger in the field provided.
a. Optionally click Insert Variable to add variables using the following
procedure:
5. Expand SNMP Properties.
a. Enter a UDP Port number in the field provided.
b. Select an SNMP Version from the drop down list.
c. Enter the SNMP Community String in the field provided.
editing.

windows.
Settings.
the SNMP trap message is sent.
604
Using Get or Post URL Functions
SolarWinds can be configured to communicate alerts using HTTP GET or POST

functions. As an example, a URL may be used as an interface into a trouble ticket
system, and, by correctly formatting the GET function, new trouble tickets may be
created automatically. The following procedure configures SolarWinds to use GET or
POST HTTP functions to communicate alert information.
To configure SolarWinds to use GET or POST URL functions with alerts:
1. When editing or adding an alert, click Add Action in an Action section of the
Alert Wizard.
2. Select the Send a GET or POST Request to a Web Server option, then click
Configure Action.
3. Enter a name for the action in the Name of Action field.
4. Under HTTP request settings:
a. Enter a URL in the field provided.
b. Select either Use HTTP GET or Use HTTP POST.
5. Expand Time of Day. Use this setting if you want to schedule this action. This
schedule does not the overall alert schedule.
a. Select either Schedule is controlled on the alert level, no additional
schedule for this action needed or Use special Time of Day schedule
for this action. If you choose the latter, Click Add Schedule and then
enter the time period over which you want to activate your alert action,
and then select the days on which you want to activate your alert action.
6. Expand Execution Settings.

a. Check either Do not execute this action if the alert has been
acknowledged already (Recommended) or Repeat this action
every X minutes until the alert is acknowledged. If you choose the
latter, specify the frequency to have this action repeated.
7. When done, click Add Action.
605
Send a syslog message
SolarWinds can log received alerts to the syslog of a designated machine for later
investigation. The following procedure configures an alert to send a message to a
designated syslog server.
2. Select the Send a SysLog Message option, then click Configure Action.
3. Under Send a SysLog message settings:
a. Enter the Hostname or IP Address of the syslog server in the field
provided.
Multiple syslog servers should be separated by commas.
b. Select a Severity and a Facility from the drop down lists.
4. Enter the Message of your alert trigger in the field provided.
editing.

windows.
Settings.
the syslog message is sent.
Send an email or page
This action sends an email from the product to selected recipients for investigation
into the cause of the alert.
Before configuring this alert you must first configure the default SMTP server
the product uses to send email. You can change the default SMTP server later
or use different SMTP servers for specific alerts.
You need the following information:
606
n The SMTP host name or IP address

n The SMTP port number
n Whether the SMTP server uses SSL
n The SMTP credentials, if necessary
n Default sender email address
Configure the SMTP server in the alert action or from the Settings page.
2. Select the Send an Email/Page option, then click Configure Action.
3. Enter recipients and the message.
n You must provide at least one email address in the To field, and
multiple addresses must be separated with commas. Some pager
systems require a valid reply address to complete the page.
n Messaging is disabled if both the Subject and Message fields are
empty.
4. Enter the SNMP information.
editing.

windows.
Settings.
the email or page is sent.
Manually set a custom status
Setting a custom status can be useful if you want to change the status of a familiar
node, but does not affect actual, polled values. For example, if the custom status is
set to Up, but the server is down or unresponsive, packet loss continues to be 100%.
Alerts based on the status do not trigger in this instance, but alerts based on a polled
value, such as packet loss, do trigger.
607
When the status is set with an alert, the status does not update to the actual,
polled status. The status must be switched manually to a different status or
configured to use the polled status. Change the status to use the polled status
from the node details page or create a reset action to set the status to use the
polled status.
2. Select the Set Custom Status option, then click Configure Action.
3. Under Change Object Status Manually:
a. Select Change to a specific status if you are creating a trigger action, and
choose a status.
b. Select Use polled status if you are creating a reset action.
editing.

windows.
Settings.
the status for the object changes.
Use the speech synthesizer to read alerts
The Text to Speech Output action uses the SolarWinds desktop notification client and
your computer's speech synthesizer to convert text messages-to-speech messages.
The action notifies users of new alerts by reading the alert out loud. This capability is
especially helpful for users who are visually impaired or who are not always at their
desks to read alerts onscreen.
Download and install the client on each computer that you want to play a sound.
Then configure which synthesizer you want to play.
608
SolarWinds uses Microsoft® Speech Synthesis Engine version 5.0. If you are under
active SolarWinds maintenance, you may also install and use other text-to-speech
engines by visiting the SolarWinds website. The following procedure configures text-
to-speech output for an alert trigger or reset.
Due to restrictions on Windows service applications, the Text to Speech action

is not available to SolarWinds installations on Windows 7 or Windows Server
2008 and higher.
2. Select the Text to Speech Output option, then click Configure Action.
3. Under Text to Speech Output settings click Download our desktop notification
client to download, install, and configure the notification client.
editing.

windows.
Settings.
the message is read.
Log an alert to the Windows Event Log on a specific server
You may specify that an alert be logged to the Windows Event Log either on the
SolarWinds server or on a remote server for later investigation. r.
2. Select the Windows Event Log option, then click Configure Action.
3. Under Event Log Settings:
a. Select either Use Event Log Message on Network Performance Monitor
Server or Use Event Log Message on a Remote Server.
609
b. Enter the Message of your alert trigger.
editing.

windows.
Settings.
the alert message is added to the Windows Event log.
Changes in the alerting engine
As of Orion Platform version 2015.1, alerts are no longer created with the desktop-
based, Advanced Alerts Manager or Basic Alerts Manager. Alerts are instead created
and managed in the SolarWinds Orion Web Console.
Alerts that you created in the desktop-based Alert Manager are migrated to the web-
based alerting engine when upgrading to Core version 2015.1 or later. Some alerts
may not be successfully migrated and include information about why they were not
migrated in the migration log. You can view the alert migration logs in the
informational banners displayed after you update your installation.
Changed or removed functionality
The suppression section has not been carried over to web-based alerting. Use
options, such as Condition must exist for more than, in the trigger conditions to
accomplish similar tasks.
Database changes
The following are a list of tables that have been changed that you may be using in
custom SQL queries:
n Engines has been renamed to AllEngines.

n Nodes has been split into NodesCustomProperties, NodesData, and
NodesStatistics.
610
Changes in the alerting engine
n History has been split into table-specific history tables, such as the AlertHistory
table.
The new alerting engine also includes the following new alerting tables:
n Actions
n ActionsAssignments
n ActionsProperties
n AlertActive
n AlertActiveObjects
n AlertConditionState
n AlertConfigurations
n AlertHistory
n AlertHistoryView (introduced in 2015.1.3)
n AlertMigrationLog
n AlertObjects
n AlertSchedules
For a list of database changes from Orion Platform version 2014.2 to version 2016.1,
including new tables, column changes, or data constraint or data type changes, see
the online Database Changes spreadsheet.
Macro or variable changes
The following variables are no longer valid:
n ${Property} - The property the alert is monitoring. You can select a new
variable with the specific property you want to view.
n ${TriggeredValue} - The value that triggered the alert. You can select a
new variable with the specific property you want to view.
n ${AlertStartTime} - When the alert active. You can use the Time of Day
scheduler to control when the alert is active.
n ${AlertEndTime} - When the alert is no longer active. You can use the Time
of Day scheduler to control when the alert is not active.
n ${ObjectSubType} - Determines if the node supports SNMP or is ICMP only.
You can use Node.ObjectSubType as the macro name.
611
Alert migration to the web
The Advanced Alert Manager and the Basic Alert Manager are deprecated in
SolarWinds Orion Core 2015.1 and later. A web-based alerting engine replaces the
previous alerting engine and includes new alerting variables.
To facilitate using the web-based alerting engine, part of the upgrade process
migrates alerts created with the desktop-based alerting engine to the web-based
alerting engine. All alerts are migrated, including alerts that are disabled.
Migration issues
Some alerts may not be successfully migrated. The migration log records all alerts
that are migrated and includes error messages for alerts that either cannot be
migrated or that are not migrated successfully.
Common reasons that migration may not be successful include:
n Invalid alert variables or macros - Some variables are no longer supported.

n Invalid conditions - Some conditions are no longer supported.
n Large alert scope - The number of objects that are relevant to an alert may be
too large to migrate.
Limitations to migrated alerts
After an alert has been migrated, you can only view the alert definition through the
web-based Alert Manager. You can no longer click the alert in the views.
SolarWinds SAM Alerts
Your installation of SolarWinds Server & Application Monitor supplements the

alerting abilities of SolarWinds common components with a number of SolarWinds
Server & Application Monitor-specific configurable alerts.
The following list provides the SolarWinds Server & Application Monitor properties on
which you can trigger alerts:
Component Monitor Alerting Properties
Provides the following alert possibilities:
Component Name
This allows you to base your alert criteria on component names.
612
Component Type
This allows you to base your alert criteria on component types. Specify the
component monitor type by value using the following table.
Component Monitor Type Value
None 0
Directory Size Monitor 38
DNS Monitor - TCP 4
DNS Monitor - UDP 5
DNS User Experience Monitor 15
Download Speed Monitor 25
File Age Monitor 36
File Change Monitor 23
File Count Monitor 39
File Existence Monitor 28
File Size Monitor 22
FTP Monitor 7
FTP User Experience Monitor 24
HTTP Form Login Monitor 27
HTTP Monitor 6
HTTPS Monitor 14
IMAP4 Monitor 13
613
IMAP4 User Experience Monitor 30
JMX Monitor 49
Linux/Unix Script Monitor 21
MAPI User Experience Monitor 31
Nagios Script Monitor 50
NNTP Monitor 11
ODBC User Experience Monitor 16
Oracle User Experience Monitor 18
Performance Counter Monitor 37
POP3 Monitor 12
Process Monitor – SNMP 8
Process Monitor - WMI 1
RADIUS User Experience Monitor 40
SMTP Monitor 10
SNMP Monitor 32
SQL User Experience Monitor 17
TACACS+ User Experience Monitor 41
TCP Port Monitor 2
Tomcat Server Monitor 33
614
Web Link Monitor 26
Windows Event Monitor 42
Windows PowerShell Monitor 45
Windows Script Monitor 20
Windows Service Monitor 9
WMI Monitor 19
Component Status
This allows you to alert on Critical, Down, Unknown, Up, and Warning status.
Response Time
This allows you to alert on response time.
Statistic Data
This allows you to alert on statistic data.
Process (Service) Name
This allows you to alert on the process or service name. For example: dns.exe,
or AlertingEngine.
Process Instance Count
This allows you to alert on the instance count of a process.
Percent CPU
This allows you to alert on the percentage of CPU in use of a monitored process
or service.
Percent Physical Memory
This allows you to alert on the percentage of physical memory in use of a

monitored process or service.
615
Percent Memory Used
This allows you to alert on the percentage of total memory in use of a

Percent Virtual Memory
This allows you to alert on the percentage of virtual memory in use of a

Virtual Memory Used
This allows you to alert on the amount of virtual memory in use, in bytes, of a
Application Monitor Alerting properties
Below are alert possibilities:
Application Name
This allows you to select the names of currently configured application

templates as values.
Application Status
This allows you to select whether the application is in a Critical, Down,

Unknown, Up, or Warning status.
Application Monitor Variables for Alerts
SolarWinds SAM adds the following variables to the core SolarWinds Orion variables
when selecting APM-Application as the property type.
Application Variable Macro Defini

tion
616
${APM:ApplicationDetails ${N=SwisEntity;M=DetailsUrl} Hyperl

URL} ink to
the
Applic
ation
Details
page
that
trigger
ed the
alert,
or the
Details
page
of the
applic
ation
that
trigger
ed the
compo
nent.
${Availability} ${N=SwisEntity;M=ApplicationAlert.Applicatio Provid

nAvailability} es the
status
of the
applic
ation.
617
${ComponentsWithProble ${N=SwisEntity;M=ApplicationAlert.Compone Provid
ms} ntsWithProblems} es a
comm
a-
delimi
ted list
of
compo
nents
in a
Down,
Unkno
wn,
Warni
ng, or
Critical
state.
618
${ComponentsWithProble ${N=SwisEntity;M=ApplicationAlert.Compone List of

msFormatted} ntsWithProblemsFormatted} compo
nents
that
are
not Up
along
with
the
compo
nent
status,
format
ted
with
HTML
tags.
HTML
format
ting is
used
for the
Send
e-mail
action
to
provid
e an
impro
ved
appea
rance
of the
listed
compo
nents.
619
${ComponentsWithProble ${N=SwisEntity;M=ApplicationAlert.Compone List of
msFormattedHtml} ntsWithProblemsFormattedHtml} compo
nents
that
are
not Up
along
with
the
compo
nent
status.
Forma
tted
with
HTML
tags
for
events
that
appea
r on
the
web
consol
e.
620
${ComponentsWithStatu ${N=SwisEntity;M=ApplicationAlert.Compone Provid

s} ntsWithStatus} es a
comm
a-
delimi
ted list
of all
compo
nents
and
their
curren
t
status.
621
${ComponentsWithStatus ${N=SwisEntity;M=ApplicationAlert.Compone List of
Formatted} ntsWithStatusFormatted} compo
nents
with
compo
nent
status
includ
ed
format
ted
with
html
tags.
Html
format
ting is
used
for
send
e-mail
action
to
provid
e
impro
ved
appea
rance
of
listed
compo
nents.
622
${ComponentsWithStatus ${N=SwisEntity;M=ApplicationAlert.Compone List of

FormattedHtml} ntsWithStatusFormattedHtml} compo
nents
with
the
compo
nent
status.
Forma
tted
with
HTML
tags
for
events
that
appea
r in
the
web
consol
e.
${ID} ${N=SwisEntity;M=Application.ApplicationID} Provid

es the
numer
ic
applic
ation
ID of
the
specifi
c
applic
ation.
623
${LastTimeUp} ${N=SwisEntity;M=CurrentStatus.LastTimeUp} Provid
es the
date
and
time
the
applic
ation
was
last
seen
in an
Up
state.
${Name} ${N=SwisEntity;M=Application.ApplicationAle Provid

rt.ApplicationName} es the
name
of the
applic
ation
that is
trigger
ing the
alert.
624
${NodeID} ${N=SwisEntity;M=Application.Node.NodeID} Provid

es the
numer
ic
node
ID of
the
server
on
which
the
applic
ation
is
monit
ored.
625
${SystemSummaryFormat ${N=SwisEntity;M=Application.ApplicationAle Syste
ted} rt.SystemSummaryFormatted} m
summ
ary.
HTML
format
ting is
used
for the
Send
e-mail
action
to
provid
e an
impro
ved
appea
rance
of the
listed
compo
nents.
626
Component Monitor Variables for Alerts
${SystemSummaryFormat ${N=SwisEntity;M=ApplicationAlert.SystemSu Syste

tedHtml} mmaryFormattedHtml} m
summ
ary.
Forma
tted
with
HTML
tags
for
events
that
appea
r in
the
web
consol
e.
${TimeStamp} ${N=SwisEntity;M=Application.CurrentStatus. Provid

ObservationTimestamp} es the
last
polling
date
and
time of
an
applic
ation.
SolarWinds SAM adds the following variables to the core SolarWinds Orion variables
when selecting APM-Component as the property type.
627
Component Macro Definiti
Monitor Variable on
${APM:Component ${N=SwisEntity;M=DetailsUrl} Hyperli

DetailsURL} nk to
the
Compon
ent
Details
page
that
triggere
d the
alert.
${ApplicationId} ${N=SwisEntity;M=Application.ApplicationID} Provide

s the
unique
numeric
identifie
r of the
applicat
ion.
This
value is
analogo
us to
the
node ID.
628
${ApplicationNam ${N=SwisEntity;M=Application.ApplicationAlert.Ap Provide

e} plicationName} s the
name of
the
monitor
ed
applicat
ion.
${ApplicationStatu ${N=SwisEntity;M=Application.Status} Provide

s} s the
status
of the
applicat
ion.
${ComponentId} ${N=SwisEntity;M=ComponentAlert.ComponentID} Provide

s the
numeric
compon
ent ID
of the
specific
applicat
ion.
${ComponentMess ${N=SwisEntity;M=ComponentAlert.ComponentMe Messag

age} ssage} e sent
when
alerting
on
compon
ent
status.
629
${ComponentNam ${N=SwisEntity;M=ComponentAlert.ComponentNa Provides
e} me} the
name of
the
compon
ent, for
exampl
e, SW
Module
Engine.
${ComponentStatu ${N=SwisEntity;M=Status} Provide

s} s the
status
of the
specific
compon
ent.
${ComponentType} ${N=SwisEntity;M=ComponentAlert.ComponentTy Provides

pe} the
numeric
compon
ent type.
${DisplayType} ${N=SwisEntity;M=ComponentAlert.DisplayType} Provide

s the
display
type for
the
specific
monito
r. For
exampl
e,
Window
s
Service.
630
${LastTimeUp} ${N=SwisEntity;M=ComponentAlert.LastTimeUp} Provide

s the
date
and
time the
compon
ent was
last
seen in
the Up
state.
${MemoryUsed} ${N=SwisEntity;M=ComponentAlert.MemoryUsed} Provide

s the
memory
used by
a
compon
ent, in
bytes.
${MultiValueMessa ${N=SwisEntity;M=ComponentAlert.MultiValueMes Messag

ges} sages} e sent
when
alerting
on the
Multiple
Value
Chart.
631
${MultiValueStatisti ${N=SwisEntity;M=ComponentAlert.MultiValueStat Statistic
cs} istics} s sent
when
alerting
on the
Multiple
Value
Chart.
${NodeID} ${N=SwisEntity;M=ComponentAlert.NodeId} Provide

s the
numeric
node ID
of the
server
on
which
the
applicat
ion is
monitor
ed.
${PercentApplicatio ${N=SwisEntity;M=ComponentAlert.PercentApplica Provide

nAvailability} tionAvailability} s the
availabil
ity of an
applicat
ion as a
percent
age.
632
${PercentCompone ${N=SwisEntity;M=ComponentAlert.PercentCompo Provide

ntAvailability} nentAvailability} s the
availabil
ity of a
compon
ent as a
percent
age.
${PercentCPU} ${N=SwisEntity;M=ComponentAlert.PercentCPU} Provide

s the
amount
of CPU
used by
a
compon
ent as a
percent
age.
${PercentMemory} ${N=SwisEntity;M=ComponentAlert.PercentMemor Provide

y} s the
memory
used by
a
compon
ent as a
percent
age.
633
${PercentVirtualMe ${N=SwisEntity;M=ComponentAlert.PercentVirtual Provide
mory} Memory} s the
virtual
memory
used by
a
compon
ent as a
percent
age.
${ProcessInstanceC ${N=SwisEntity;M=ComponentAlert.ProcessInstanc Provide

ount} eCount} s the
instanc
e count
of a
process.
${ProcessName} ${N=SwisEntity;M=ComponentAlert.ProcessName} Provide

s the
process
name.
${ResponseTime} ${N=SwisEntity;M=ComponentAlert.ResponseTim Provide

e} s the
respons
e time
of a
compon
ent.
634
${StatisticData} ${N=SwisEntity;M=ComponentAlert.StatisticData} Provide

s the
statistic
s data
value of
a
compon
ent.
${StatusOrErrorDes ${N=SwisEntity;M=ComponentAlert.StatusOrError Provide

cription] Description} s the
status
of the
compon
ent,
includin
g the
full text
of any
error
messag
es.
${Threshold-CPU- ${N=SwisEntity;M=ComponentAlertThresholds.Thr Provide

Critical} esholdCPUCritical} s the
critical
threshol
d for
CPU.
635
${Threshold-CPU- ${N=SwisEntity;M=ComponentAlertThresholds.Thr Provide
Warning} esholdCPUWarning} s the
Warnin
g
threshol
d for
the
CPU.
${Threshold- ${N=SwisEntity;M=ComponentAlertThresholds.Thr Provide

PhysicalMemory- esholdPhysicalMemoryCritical} s the
Critical} Critical
threshol
d for
physical
memor
y.

PhysicalMemory- esholdPhysicalMemoryWarning} s the
Warning} Warnin
g
threshol
d for
physical
memor
y.

ResponseTime- esholdResponseTimeCritical} s the
Critical} Critical
threshol
d for
respons
e time.
636

ResponseTime- esholdResponseTimeWarning} s the
Warning} Warnin
g
threshol
d for
respons
e time.

Statistic-Critical} esholdStatisticCritical} s the
Critical
threshol
d for
statistic
s.

Statistic-Warning} esholdStatisticWarning} s the
Warnin
g
threshol
d for
statistic
s.

VirtualMemory- esholdVirtualMemoryCritical} s the
Critical} Critical
threshol
d for
virtual
memor
y.
637
VirtualMemory- esholdVirtualMemoryWarning} s the
Warning} Warnin
g
threshol
d for
virtual
memor
y.
${TimeStamp} ${N=SwisEntity;M=CurrentStatus.ObservationTime Provide

stamp} s the
last
polling
date
and
time of
a
compon
ent.
638
${UserDescription} ${N=SwisEntity;M=ComponentAlert.UserDescriptio Provide

n} sa
descript
ion of
the
compon
ent.
Note: A
default
descript
ion is
given by
SolarWi
nds.
Any
changes
you
make
will
override
the
default
descript
ion and
be
automat
ically
saved.
639
${UserNotes} ${N=SwisEntity;M=ComponentAlert.UserNotes} Provide
s notes
from
the user
about a
compon
ent.
Change
s you
make
will
automat
ically be
saved.
${WindowsEventM ${N=SwisEntity;M=ComponentAlert.WindowsEvent Full

essages} Messages} details
of the
corresp
onding
event.
${VirtualMemoryUs ${N=SwisEntity;M=ComponentAlert.VirtualMemory Provide

ed} Used} s the
virtual
memory
used by
a
compon
ent, in
bytes.
Share alerts with other SolarWinds products
Alerts may be shared with selected other SolarWinds products that are not part of
the SolarWinds Orion Platform, such as AlertCentral and Web Help Desk.
640
1. On the Alert Summary page, expand Alert Integration.

2. Select the Integrate alert with other SolarWinds check box.
3. Provide an appropriate Alert Subject. You can choose to use this name as the
subject field for the alert.
4. Choose the alert Severity.
This information may be used to determine how a shared alert is

handled by the other product.
5. Include additional alert properties in the alert by clicking Insert Variable and
choosing the ones you want to include. This ensures that the variables you
used in the alert message are translated correctly to the other product.
Integrate your Orion Platform product with ServiceNow® to automatically open new
ServiceNow tickets based on critical events defined in your Orion Platform product.
The integration with ServiceNow allows for two-way communication between your
Orion Platform product and ServiceNow. By integrating the two systems, you can:
n Automatically create incidents in ServiceNow and assign them to the correct

tech or group
n Synchronize the acknowledgment of alerts and tickets in SolarWinds Orion and
ServiceNow
n Update, close, and reopen tickets
n Suppress ticket storms
You can integrate one Orion Platform product with multiple ServiceNow
instances.
The integration requires NPM 12.0, SAM 6.3, or any other Orion Platform product
running Core version 2016.1 or later.
Before you begin
Before you can configure the integration details in your SolarWinds Orion product,
check the prerequisites and configure your ServiceNow instance.
n The communication between the SolarWinds server and the ServiceNow

instance uses HTTPS port 443. Open this port for outbound communication.
641
n For minimum hardware and software requirements, see the administrator
guide of your product.
n Download the ServiceNow integration application from the ServiceNow app
store.
n Install the integration app and configure your ServiceNow instance for the
integration.
Install and configure the SolarWinds Alert Integration application in ServiceNow
The SolarWinds Alert Integration application enables the communication between

your SolarWinds server and the ServiceNow instance.
After downloading the SolarWinds Alert Integration application from the ServiceNow
store, deploy the application in ServiceNow.
1. Navigate to your downloaded system applications.

2. Locate the SolarWinds Alert Integration application, and click Install.
When the installation is complete, the caption of the Install button will change to
Installed.
After the installation is complete, SolarWinds recommends that you create a

ServiceNow integration user with Web service access only.
Create a ServiceNow integration user with Web service access only
1. Navigate to the user administration section in ServiceNow, and create a new
user.
2. Provide a user ID, a password, and other required information.
3. Specify that the new user should have Web service access only.
4. Edit the newly created user, and add the x_sow_intapp.integration_
user role to the role list.
After installing the integration application and creating an integration user, you can
now configure the integration with ServiceNow in your SolarWinds Orion server.
Configure an Orion Platform product with ServiceNow
After completing the configuration of the integration in ServiceNow, you can

configure the integration to be able to automatically create, update, and resolve
alerts that were raised in your Orion Platform product in your ServiceNow® instance.
642
1. In the Orion Web Console, click Settings > All Settings.
2. In the Alerts & Reports group, click ServiceNow Instances.
3. Click Add Instance.
4. Enter a name and the URL for the ServiceNow instance.
5. Enter the ServiceNow credentials:
n Username
The user name of the account that is configured for the SolarWinds
integration role.
n Password
6. Test the connection to your ServiceNow instance. If the connection is not
working, you receive descriptive messages to help you solve the issue.
7. If you are accessing your ServiceNow instance through a HTTP proxy, select Use
a HTTP proxy server, and click the Configure your HTTP proxy settings link to
edit the details. For more information, see Configure web proxy settings.
8. Click Save.
643
Reports
Creating and Viewing Reports
SolarWinds provides you with a wide array of predefined reports for each Orion module, and a web-based
interface that enables you to customize these predefined reports and create your own reports, which can
be printed or exported in a variety of formats.
In addition to using the Orion Web Console to view and create reports, you can also use the Orion Report
Writer to maintain legacy reports created prior to the introduction of the Web Console Report Interface.
The following sections provide detailed information related to creating, viewing, and managing SolarWinds
reports:
n Predefined Orion Reports

n Viewing, Creating, Exporting, Importing, Editing and Scheduling Reports in the Orion Web Console
n Viewing, Creating and Editing Reports in the Orion Report Writer
n Reports and account limitations
n Exporting and Importing Reports
Predefined Orion Reports
Your SolarWinds installation comes with many predefined reports that can be used as soon as there is
data to be reported on.
To view the list of available reports in the Web Console:
2. On the Home tab, click Reports.
To view the list of predefined reports in the Report Writer:
1. Click Start > All Programs > SolarWinds Orion > Alerting, Reporting, and Mapping > Report Writer.
These predefined reports are sufficient for most needs, but for specialized requirements, these can be
easily customized. You can also create entirely new report layouts. For more information, see Viewing,
Creating, Exporting, Importing, Editing and Scheduling Reports in the Orion Web Console.
Note: Legacy reports created prior to the introduction of the Web Console report interface can only be
edited using the Report Writer. For more information, see Using Report Writer.
Viewing, Creating, Exporting, Importing, Editing and Scheduling Reports in the Orion Web Console
The Reports tab in the Orion Web Console enables you to view, edit, create, export, print and schedule
reports for your SolarWinds Orion installation.
644
Note: The Orion Web Console does not allow you to edit legacy reports created with the Orion Report
Writer. Use the Report Writer to edit these. For more information, see Using Report Writer.
Modify an existing web-based report
Modifying an existing web-based report is often the simplest way to generate a new report. You can add
pre-existing resources or create a custom table or chart. You can also edit information about each
resource.
1. Click Reports > All Reports in the menu bar, and click Manage Reports.
2. Select Report Origin in the Group by drop-down menu in the left pane, and select Web-based from
the list.
3. Select the report to use as the basis for your new report, and click Duplicate & Edit.
4. Click Add Content.
5. Select the resource to add to the report, and click Select and Continue.
Some resources require you to choose a specific object to report on. For example, if you want
to track how many people use a specific application, you must choose the application when
adding the resource.
6. Click the Edit button on the resources to make changes such as filtering the objects, group columns,
or setting a sample interval. Available options depend on the type of resource you add.
7. Click Next to display the Preview view, and click Next.
8. Add report properties, such as categories or custom properties. Use the report limitation category to
restrict the report to specific user accounts. Click Next.
9. Schedule the report by clicking Schedule this report to run regularly, and creating a new schedule or
adding the report to an existing schedule. Click Next.
10. Review the Summary and click Submit to save the report.
Create a new web-based report
Web-based reports are created in the Orion Web Console, and can be restricted to specific users through
report limitations. Users may be assigned specific report limitation categories and can only view reports
that are in the same report limitation category.
SolarWinds recommends that you duplicate and edit an existing web-based report instead of
creating a new one.
1. Click Reports > All Reports > Manage Reports > Create New Report.
2. On the Layout Builder panel, click Add Content. You may be prompted to add content as soon as you
click Create New Report.
645
3. Select the first resource to add to the report and click Select and Continue.
Some resources require you to choose a specific object to report on. For example, if you want to track
how many people use a specific application, you must choose the application when adding the
resource.
The Layout Builder view is displayed with the selected resource added.
4. In the Content area, add resources and sections to the report. You can also modify the layout.
a. Click Add content to add resources to your report. For more information, see Add content to
a web-based report.
646
b. Click Add section to add more rows of content to this report.
5. To filter a resource to include a specific set of data, click Edit Resource. Not all resources can be
filtered.
647
6. Filter the resource and click Submit.
Each resource has different filter options.
7. After adding and filtering the resource, enter a report name, and click Next.
8. On the Preview panel, click Next.
9. Add report properties, such as categories, custom properties, or limitations, and click Next.
10. To schedule the report, click Schedule this report to run regularly, create a new schedule or assign a
schedule, and click Next.
You can schedule a report to be generated, emailed, saved, or printed.
11. Review the Summary and click Submit to save the report.
Customize a web-based report layout
You can customize how the report looks, such as the width, header, or number of columns. By default a
report is 960 pixels wide with a header and footer, and a single column for content.
1. Select a report to edit from the Report Manager.

2. In the Layout Builder page, change the width of your new report by doing one of the following:
n Click Fit to window width so the content of the report expands to the width of the browser
window.
n Enter a new value, in pixels (px), in the Report width field.
3. Click Browse for logo to change the default logo. The Logo check box must be selected in the Header
area. Changing the logo does not affect other reports.
The maximum image size is 600 pixels wide and 240 pixels high.
648
4. In the Content area, change the number of columns or rows. You can select a predefined page layout
or manually add columns and rows.
n Enter a number in the Layout columns field to change the number of columns.
n Click Add section to add more rows
5. Select the Footer check box to include a footer in your report. Select each option you want included.
Add content to a web-based report
You can include any Orion Web Console resource, including charts and graphs, in a report.
The following procedure assumes you are already creating or editing a report in the Orion Web Console.
Resources can be dragged between columns and sections.
1. On the Layout Builder page, click Add Content in the column to which you want to add a new
resource.
2. Use the Group by field to filter the available resources or search for a specific resource.
The Classic category grouping provides the most comprehensive list of available resources.
3. Select the resource from the list in the main pane.
If you are an advanced user and want to add a Custom Chart or Table, see Add a custom chart
or table to a web-based report.
4. Click Select and Continue.
5. If the resource requires you to select specific objects:
a. Select the required objects from the left pane.
b. Click Add to Layout.
6. You can edit the resource if you want to change the title or subtitle.
7. If you want to add another row to your report, click Add section. You can now add content to this row
as described above.
Add a custom chart or table to a web-based report
You can create custom charts or tables for inclusion in web-based reports. Custom charts or tables are
usually added when you are familiar with your SolarWinds Orion database or are comfortable creating
SQL or SWQL queries. Because the Orion Platform generates so much data, you need to ensure that you
know exactly what data you are using, from which instances it originates from, and what you do with them
to ensure that your custom charts and tables show meaningful results.
You can reuse customized charts or tables by clicking Use previously specified objects when adding
the chart or table and then selecting the object.
1. Click Add Content in the column to which you want to add a custom chart.
2. Group by Reports to find the Custom Chart or Custom Table resources.
3. Select Custom Chart or Custom Table, and click Select and Continue.
649
4. Use one of the following methods to configure the objects displayed in the chart or table:
n Specific Objects (static selection) - use when you know which objects you want to include in
your chart or table.
a. Filter or search for the objects you want to include.
b. Select the objects' check boxes.
This is the most straightforward selection method, and recommended for new users. It
is also the preferred method for relatively permanent network objects.
n Dynamic Query Builder - use to select objects based on object properties.

a. Select Basic Selector to create simply and/or queries or select Advanced Selector to
create complex queries.
b. Choose the object type you want to include.
c. Enter your conditions.
This is the preferred selection method for groups of objects of a specified type that may
change over time. "All Cisco nodes in Austin" is an example of a group best defined
using the Dynamic Query Builder.
n Advanced DataBase Query (SQL, SWQL) - only use if you are comfortable querying your
SolarWinds database directly using SQL or SWQL.
a. Select SQL or SWQL, and enter your query.
b. Click Preview Results to test your query.
5. Enter a name for this selection in the Selection Name field, and click Add to Layout.
You must now edit the chart or table to choose the data series or columns you want to use and modify
display and filtering settings.
Add a data series and customize a chart
Once you have specified the objects for your custom chart, you need to select the data series. You can also
change the sample interval and filter the results.
1. If you have just added a custom chart, the Edit Resource page opens. You can open this page by
clicking Edit Chart on the resource in the Layout Builder page.
2. Click Add Data Series in Left Y-axis.
3. Filter or search for the data series, and select the one you want to use.
The groups available and the data series within these groups will depend on the object
selected.
4. Click Add Data Series. The data series is added to the Left Y-axis.
5. For additional settings for each data series, click More. Here you can:
n Edit the Display name for this data series.
n Select a custom Color for this data series.
n Show the 95th percentile line for this data series.
n Show Trend for this data series.
6. Enter a Custom label for the Left axis.
650
7. Select the Units displayed, Chart type, and select the Show the sum of all data series, if required.
8. Select the Sample Interval. This can be as frequent as once a minute to once a week. Data within
each sample interval are summarized so that a single point or bar is plotted for each of these
periods.
It is possible to select a sample interval that is longer than the reporting period.
9. Choose how you want to filter your report.

a. Select how you want to sort this selection of records from the Sort records by drop-down.
The choices depend on the data series selected.
b. Select either Ascending or Descending from the Sort order drop-down.
c. Select the Data aggregation method required to summarize your data by time period.
d. Click Advanced if you want to sort records using a secondary field.
10. You can set up additional data series using the right axis. This allows you to superimpose two charts
using different labels, units, and chart type.
You cannot use a separate time period or filter results settings for the right axis series.
11. Click Submit to return to the Add Report page.
Add a data series and customize a table
Once you have specified the objects to be reported on for a custom table, you need to select the data
series. You can also sort and filter the results.
1. If you have just added a custom table, the Edit Resource page opens. You can open this page by
clicking Edit Table on the resource in the Layout Builder page.
2. Click Add Column.
3. Filter or search for the column, and select the column you want to use.
The columns and options available depend on the object selected.
4. Click Add Column.

5. For additional settings for a column, click Advanced. Here you can:
n Edit the Display name for this column.
n Select Hide this column in the resulting table, if you want to use this column when querying
the database but do not want to show it. For example, you may want to use this column's
data in the time-based settings but not show the data in the table.
n Select Allow HTML tags, if you want to use any HTML tags retrieved from the database for this
column.
n Select the Display settings to be used for this column. This applies the selected formatting to
the data in this column.
n Select the Data aggregation method to use for this column, to summarize your data by time
period.
n Select the Alignment for this data. This can be left, right or center.
6. Click on the plus sign in the table layout section to add more columns.
7. Filter the number of records shown in the table by either a specific number or a percentage.
651
8. Restrict data in your table to a specific time period by selecting Yes from the Time-based settings
drop-down.
You can only do this if your table contains a column with historical data.
a. Select the column to use to specify the time period from the Date/Time column in this table
is drop-down.
b. Select the Sample Interval. This is used to summarize your data by time period.
9. Use the Group results by option to organize the table by the values in the columns you select.
10. Click Submit to return to the Add Report page.
Build conditions
Use the Dynamic Query Builder selection when objects may change over time. For example, as your
network ages, you will replace or upgrade various pieces of equipment. You can select each piece of
equipment individually, or you can create a dynamic query that adds objects to the custom chart or table
based on the properties you select.
Though the Advanced Selector provides access to all network object characteristics, the Basic
Selector provides access to a smaller subset of the most frequently used network object
characteristics.
1. Select the type of selector query you want to use (Basic or Advanced).
2. Select the type of objects to report on from the I want to report on drop-down.
3. Use the following steps if you choose Basic Selector:
a. Click Add Condition.
b. Select All child conditions must be satisfied (AND) or At least one child condition must be
satisfied (OR).
c. Select a property of the monitored object, a conditional relation, and provide a value.
d. Click Add Simple Condition if you want to add another condition.
4. Use the following steps if you choose Advanced Selector:
a. Select All child conditions must be satisfied (AND) or At least one child condition must be
satisfied (OR).
b. Select which field you want to evaluate, a conditional relation, and provide a value.
c. Click the + sign to add child conditions.
n Add Single Value Comparison (Recommended) - The child condition evaluates a single
field, like Status
n Add Double Value Comparison - The child condition evaluates two conditions, such as
Status and OS
n Add And/Or block - Adds a sub condition block
Restrict who can access reports
Use report limitation categories to limit access to any SolarWinds report created on SolarWinds Orion
Platform versions 2013.1 and later. Users with a report limitation category set can only see reports that are
in the same report limitation category.
652
The No Reports limitation is a special report limitation category that removes all access to reports
when applied to a user account. You do not need to add No Reports as a limitation in the report
properties.
n If you are running SolarWinds Orion Platform versions 2012.2.X or earlier, reports are stored
in a folder on the primary SolarWinds server (default location C:\Program
Files\SolarWinds\Orion\Reports). Place reports into subfolders and restrict user
access to the file system to limit user access.
n If you are running SolarWinds Orion Platform version 2013.1.X or later, reports are stored in
the SolarWinds database, and both users and reports may be assigned a report limitation
category to restrict who can access the report.
Create or add a report limitation category
When you create or edit a report, expand Report Limitation on the Properties page to add a report
limitation. Choose an existing limitation or enter a new one.
Each report can have only one limitation.
After the report limitation is created and the report saved, the limitation is available in the user settings.
Restrict user access to the report
After the report limitation is saved, it is available in the user account's Define Settings page.
In the Report Limitation Category, select the limitation, and save your changes.
Scheduling Reports
Schedules enable you to set up report actions to occur at specific times. These actions let you generate
reports and print them, save them to disk or email them to selected recipients. You can create schedules
for single or multiple reports or assign reports to existing schedules. In addition, you can add URLs to the
schedules, so that screen captures of specific websites at the time the reports were generated are
included.
n Reports can be assigned to schedules either when they are being edited or created, or in the
Schedule Manager.
n Schedules can be created from the Report Manager, the Schedule Manager or from within the
creation or editing of a report.
Creating a Report Schedule While Creating or Editing a Report
You can directly assign a report to a schedule while editing the report.
To create a new schedule while creating or editing a report:
1. Click on the Schedule Report tab to display the Schedule Report view.
2. Click Schedule this report to run regularly.
653
3. Click Create new schedule in the dropdown.
4. Enter an appropriate Schedule Name and Description.
5. Click Add Frequency and then complete the following steps:
a. Enter a name for this frequency.
b. Select:
n Specific Date(s) to select specific dates and times
n Daily to schedule the report actions to run every day
n Weekly to schedule the report actions to run once or more a week
n Monthly to select the month and the day of the month to run the report actions.
c. If you selected Specific Date(s), select the date(s) and time(s) when you want the scheduled
report actions to occur and then click Add Frequency.
Note: Click Add Time to select additional dates and times.
d. If you selected Daily, complete the following steps:
i. Select the number of days between scheduled report actions.
Note: to run the report on work days, select Business Day (Mon - Fri).
ii. Select the time(s) to run your report actions.
Note: Click Add Time to add additional dates and times.
iii. If you do not want the schedule to start immediately upon completion, select
Specific Date(s) in the Starting On field, and then select the date and time when you
want the schedule to start.
iv. If you want the schedule to end at some point, check Ending On, and then select the
date and time when you want the schedule to end.
v. Click Add Frequency.
e. If you selected Weekly, complete the following steps:
i. Check the days of the week to run the report actions.
ii. Select the time(s). You can click Add Time to add additional dates and times.
iii. If you do not want the schedule to start immediately upon completion, select
Specific Date(s) in the Starting On field, and then select the date and time to start.
iv. If you want the schedule to end at some point, check Ending On, and then select the
date and time for it to end.
v. Click Add Frequency. You can add multiple frequencies, if required.
f. If you selected Monthly, complete the following steps:
i. Select the months, days and times when you want to run your report actions.
Note: Click Add Time to add additional dates and times.
ii. If you do not want the schedule to start immediately upon completion, select
Specific Date(s) in the Starting On field, and then select the date and time when you
want the report schedule to start.
iii. If you want the schedule to end at some point, check Ending On, and then select the
date and time when you want the report schedule to end.
iv. Click Add Frequency.
654
6. Click Add Action, and select the action (Email, Print, or Save to Disk) to be executed on the configured
schedule, and then click Configure Action.
7. Enter a Name for the action.
8. If you selected Email:
a. In the To field, enter the email addresses of all recipients, separated by semicolons.
b. If you need to add CC or BCC addresses, click CC and/or BCC, and enter the email addresses
of these recipients.
c. To change the default name and address of the sender, click "-" and enter the
appropriate Name of Sender and Reply Address.
d. Click Message, and enter the Subject and Message for the email. You can compose the
message as HTML or Plain Text.
e. If you also want a printable version of your emailed reports, check Retrieve a Printable
Version of Reports.
f. Check the format(s) in which you want to provide the emailed report: PDF, CSV, Excel, or
HTML.
g. To include the URL of the emailed report so recipients can access it remotely, check
Include Report's URL
h. Click SMTP Server.
i. If you have already configured an SMTP server, select the Name of SMTP Server, and then
click Save.
j. If you have not already configured an SMTP server, select Add New Server, and then
complete the following steps:
i. Provide the Hostname or IP Address of your SMTP Server and the designated SMTP Port
Number.
Note: The SMTP server hostname or IP address field is required. You cannot send an
email without identifying the SMTP server.
ii. If you want to use SSL encryption for your emailed report, check Use SSL. This
changes the SMTP port number to 465.
iii. If your SMTP server requires authentication, check This SMTP Server requires
Authentication, and then provide requested credentials.
k. Click Add Action.
9. If you selected Print:
a. Provide a Windows User name, using domain\username format, and Password for a user
with access to the printer on which you want to print your report.
b. Click Printer Settings.
c. Click Select, and then select the printer to which you want to send the report.
d. Click Select.
e. Enter the number of Copies, the Layout, whether you want Color or Black and white printing,
and the Margins to be applied.
f. Click Add Action.
655
10. If you selected Save to Disk:
a. Enter the Network Share Location where you want to save the report.
b. If you also want a printable version of your saved report, check Retrieve a Printable Version of
Reports.
c. Enter the Windows User name, using domain\username format, and Password for a user
with access to the Network Share Location.
d. Select the format(s) in which you want to provide the saved report (PDF, CSV, or Excel).
e. Click Add Action. You can add multiple actions.
Create, assign, and editing report schedules in Report Manager
Create a report schedule

1. Select the report for which you want to set up a schedule.
2. Click on Schedule Report > Create New Schedule to display the Properties view.
3. Enter an appropriate Schedule Name and Description of Report Schedule.
4. To add addition reports to this schedule, click Assign another Report, select the report(s) to be
included in this schedule, and click Assign Report(s).
5. To assign webpages to this schedule, so that a snapshot of the selected website is included with the
reports, click Assign Webpage, and enter the URL in the field displayed. You can assign multiple
webpages. Remember to start each with http:// or https:// as appropriate.
6. To specify a user account so that its limitations are applied to this schedule, expand Advanced
Settings, click Another User, and enter the User name or Account ID and Password.
7. Click Next to display the Frequency view.
8. Click Add Frequency and complete the following steps:
a. Enter a name for this frequency.
b. Select:
n Specific Date(s) to select specific dates and times
n Daily to schedule the report actions every day
n Weekly to schedule the report actions once or more a week
n Monthly if you want to select the month and the day of the month to schedule the
report actions.
c. If you selected Specific Date(s), select the date(s) and time(s) when you want the scheduled
report actions to occur and click Add Frequency.
Click Add Time to select additional dates and times.
d. If you selected Daily, complete the following steps:

i. Select the number of days between scheduled report actions.
To run the report on work days, select Business Day (Mon - Fri).
ii. Select the time(s) to run your report actions.

Click Add Time to add additional dates and times.
656
iii. If you do not want the schedule to start immediately upon completion, select Specific
Date(s) in the Starting On field, and select the date and time when you want the
schedule to start.
iv. If you want the schedule to end at some point, check Ending On, and select the date
and time when you want the schedule to end.
v. Click Add Frequency.
e. If you selected Weekly, complete the following steps:
i. Check the days of the week to run the report actions.
ii. Select the time(s). You can click Add Time to add additional dates and times.
iii. If you do not want the schedule to start immediately upon completion, select Specific
Date(s) in the Starting On field, and then select the date and time to start.
iv. If you want the schedule to end at some point, check Ending On, and select the date
and time for it to end.
v. Click Add Frequency. You can add multiple frequencies, if required.
f. If you selected Monthly, complete the following steps:
i. Select the months, days of the month and times at which you want to run this schedule.
Click Add Time to add additional dates and times.
ii. If you do not want the schedule to start immediately, select Specific Date(s) in the
Starting On field, and then select the date and time when you want the report schedule
to start.
iii. To set an end date and time for the schedule, check Ending On, and then select the date
and time when you want the report schedule to end.
iv. Click Add Frequency
9. Click Next to display the Actions view.
10. Click Add Action, and select the action (Email, Print, or Save to Disk) to be executed on the configured
schedule, and then click Configure Action.
11. Enter a Name for the action.
12. If you selected Email:
a. In the To field, enter the email addresses of all recipients, separated by semicolons.
b. To add CC or BCC addresses, click CC and/or BCC, and enter the email addresses of these
recipients.
c. To change the default name and address of the sender, click "-" and enter the appropriate
Name of Sender and Reply Address.
d. Click Message, and enter the Subject and Message for the email. You can compose the
message as HTML or Plain Text.
e. If you also want a printable version of your emailed reports, check Retrieve a Printable
Version of Reports.
f. Check the format(s) in which you want to provide the emailed report: PDF, CSV, Excel, or
HTML.
g. To include the URL of the emailed report so the recipients can access it remotely, check
Include Report's URL.
h. Click SMTP Server.
657
i. If you have already configured an SMTP server, select the Name of SMTP Server, and click
Save.
j. If you have not already configured an SMTP server, select Add New Server, and complete the
following steps:
i. Provide the Hostname or IP Address of your SMTP Server and the designated SMTP Port
Number.
The SMTP server hostname or IP address field is required. You cannot send an
email without identifying the SMTP server.
ii. To use SSL encryption for your emailed report, check Use SSL. This changes the SMTP
port number to 465.
iii. If your SMTP server requires authentication, check This SMTP Server requires
Authentication, and provide requested credentials.
k. Click Add Action.
13. If you selected Print:
a. Provide a Windows User name, using domain\username format, and Password for a user
with access to the printer on which you want to print your report.
b. Click Printer Settings.
c. Click Select, and then select the printer to which you want to send the report.
d. Click Select.
e. Enter the number of Copies, the Layout, whether you want Color or Black and white printing,
and the Margins to be applied.
f. Click Add Action.
14. If you selected Save to Disk:
a. Enter the Network Share Location where you want to save the report.
b. If you also want a printable version of your saved report, check Retrieve a Printable Version of
Reports.
c. Enter the Windows User name, using domain\username format, and Password for a user
with access to the Network Share Location.
d. Select the format(s) in which you want to provide the saved report (PDF, CSV, or Excel).
e. Click Add Action. You can add multiple actions.
15. Click Next to display the Summary view.
16. If the schedule summary is correct, click Create Schedule.
17. The schedule is display in the Schedule Manager.
Edit a schedule
1. Click the Schedule Manager tab.
2. Select the schedule you want to edit and click Edit Schedule.
3. The Properties view for the schedule is displayed.
658
Assign a report to a schedule or multiple schedules
1. Select the report you want to assign.
2. Click Schedule Report > Assign Existing Schedule.
3. Confirm that you want to assign the report by selecting the schedule or schedules in the Assign
existing schedule list and clicking Assign Schedule(s).
Unassign a report from a schedule or multiple schedules

1. Select the report you want to unassign.
2. Click Schedule Report > Unassign Schedule.
3. Confirm that you want to remove the report by selecting the schedule or schedules in the Unassign
schedule from report list and clicking Unassign Schedule(s).
The Report Scheduler
The Report Scheduler provides a list of all report schedules that have been set up for your Orion web-
based reports. You can create, edit, run and delete schedules from this page, and assign reports to
schedules.
1. Log in to theOrion Web Console.

2. Click Home > Reports.
3. Click Manage Reports in the upper right.
4. Click the Schedule Manager tab.
5. To create a schedule, click Create New Schedule. The Add Report Schedule page is displayed. For
more information, see Create a report schedule.
6. To edit a schedule, select the schedule and click Edit Schedule. The Edit Report Schedule page is
displayed. For more information, see Create a report schedule.
7. To run a schedule immediately, select the schedule and click Run Now . The selected schedule is
run.
8. To delete a schedule, select the schedule and click Delete. You are asked to confirm that you want
to delete the schedule.
9. To assign a report or reports to a schedule, select the schedule and click Assign to a Report.
Select the report(s) to be assigned to this schedule and click Assign Report(s).
Exporting Reports
The most appropriate format for exporting a report depends on how you want to use the exported file. The
different formats, in which Orion reports can be exported, are shown below.
Orion Web Console Orion Report Writer
XML a
659
Orion Web Console Orion Report Writer
Excel a a
PDF a a
HTML and MHTML a
Image (BMP, GIF, JPG, PNG, etc.) a
Using Report Writer
Before using Report Writer, you must have collected at least a few minutes' worth of data in a database
populated with devices you want to monitor. A variety of reports are included with Report Writer, and icons
that precede report names distinguish available report types. The following procedure starts Report
Writer.
To start Report Writer:
1. Click Start > All Programs > SolarWinds Orion > Alerting, Reporting, and Mapping > Report Writer.
3. In the General tab of the Report Writer Settings window, select either of the following as a default
viewing mode:
Note: You can toggle between Preview and Report Designer modes at any time by clicking Preview
or Design, respectively, on the toolbar.
l Preview displays the report as it will appear in printed form. For more information, see
Preview Mode.
l Report Designer is the report creation and editing interface. For more information, see
Design Mode.
4. If you want to separate the data for individual network objects with horizontal lines, click
Report Style, and then check Display horizontal lines between each row.
5. Click OK to exit Report Writer Settings.
For more information about creating reports in Report Writer, see Creating and Modifying Reports in
Report Writer.
Preview Mode
Preview mode shows a report as it will print. When you open a report in Preview mode, or switch to
Preview mode from Design mode, Orion runs the query to generate the report, and then Report Writer
displays the results.
The Preview window toolbar provides the following actions and information:
l Current page number and total number of pages in the report.

l Page navigation buttons: First Page, Page Up, Page Down, and Last Page
l Zoom views
660
Note: Double-click a preview to zoom in and double-right-click to zoom out.
l Print report
Design Mode
Use Design mode to create new reports and modify or rename existing reports. The options available for
creating and modifying reports are the same. Design mode options are also dynamic, based upon the type
of report, included report data, and report presentation. The options available depend on the type of
report being designed, but all reports require that you select the data to include and decide how that data
will be sorted, ordered, filtered, and presented.
Customize report headers and footers with Report Writer
To add your company logo as the report header and footer, save your logo as Header.jpg in the
SolarWinds\Common\WebResources folder, typically located in C:\Program Files\, and then click
Refresh.
The image must be in JPEG format with a height of no more than 150 pixels.
Creating and Modifying Reports in Report Writer
Use the following procedure to modify or create reports in Report Writer.
To open a report with Report Writer:
1. To modify an existing report, click an existing report from the inventory in the left pane of the
main Report Writer window.
2. To create a new report, click File > New Report.
3. Select the type of report that you would like to create, and then click OK.
Each report offers different configuration options, so, depending on the report, some formatting tabs
described in the following sections may not be available.
Notes:
l The SQL query used to generate a report may be viewed in an additional tab. Click Report > Show
SQL to add a read-only SQL tab to the Design window.
l A preview of your report is also available at any time. Click Preview to enter Preview Mode, and then
click Design to return to Design Mode.
See the following documents for more information about configuring reports in Report Writer:
l General Options Tab

l Select Fields Options Tab
l Filter Results Options Tab
l Top XX Records Options Tab
l Time Frame Options Tab
l Summarization Options Tab
661
General Options Tab
The General tab is displayed by default, showing titling and display options.
To configure General options:
1. Specify the Report Group, Report Title, Subtitle, and Description.
Note: If you use an existing report group name, the new report is added to that existing group in the
left pane of the main window.
2. Select the display Orientation of your report.
3. If you are configuring an historical report and you do not want to group data by days, clear
Group historical data by days.
Note: By default, data in some availability and historical reports is grouped by days when displayed
in the Orion Web Console. Data grouping by days is not viewable in Report Viewer.
4. If you do not want to make this report available on your Orion Web Console, clear Make this
Report available from the Orion website.
Note: By default, most reports are made available for display in the Orion Web Console. Customize
views.
Select Fields Options Tab
The Select Fields tab allows you to select the data fields in a report.
To select and configure fields:
1. Click Select Fields.

2. If you are creating a new report or adding fields to an existing report, click the ellipsis, select
Add a new field, and then dynamically define each new report field as follows:
a. Click the asterisk after Field:, and then select the type of information to include in the current
report field.
b. If you want to sort the data in the current field, click the sort asterisk and select a sort
order.
c. If you want to perform an operation on the data in the current field, click the function
asterisk and select an operation.
3. If you are modifying an existing report, click the Field, sort, or function that you want to change
and select a new value as follows.
a. Click the asterisk after Field.
b. Select the type of information to include in the current report field.
c. If you want to sort the data in the current field, click the sort asterisk and select a sort
order.
d. If you want to perform an operation on the data in the current field, click the function
asterisk and select an operation.
4. If you want to test your selections as you assemble your report, click Execute SQL Query to
view the current query results.
5. If you want to delete a field or rearrange the order of the fields that are listed in your
report, select a field, click Browse (… ), and then select the appropriate action.
662
Note: Unchecked fields are not displayed in your report, but their sort and function configurations
are retained.
6. If you want to preview your report, click Preview.
Filter Results Options Tab
The Filter Results tab allows you to generate filter conditions for field data by selecting appropriate
descriptors from the linked context menus. Filters are configured as follows.
To configure filters:
1. Click Browse (… ), and then select from the following options:
l Select Add a new elementary condition to generate a condition based on a direct comparison
of network object data fields.
l Select Add a new advanced elementary condition to generate a condition based on a
comparison of device data fields and values.
l Select Add a new complex condition to define a condition that filters other defined
conditions.
l Select Delete current condition to remove a selected condition.
n Select Move current condition forward or Move current condition backward to change the
order of your conditions accordingly.
Note: The lists of available linked descriptors are dynamically generated in consideration of all other
variables within the same condition.
2. Check or clear individual filter conditions to enable or disable their application, respectively, to your
report.
Top XX Records Options Tab
You can limit the number of records shown in your report to either a top number or a top percentage of all
results. Top XX options are configured as shown below.
To configure Top XX records:
1. If you want to show all records in your report, select Show All Records.
2. If you want to specify a truncated list of eligible items for your report, complete the following
steps:
a. Select either Show only the Top number Records or Show the Top percentage % of Records
b. Provide appropriate number or percentage values.
Time Frame Options Tab
You can limit the scope of your report to a specific period of time. To configure Time Frame options, select
a Named, Relative, or Specific Time Frame, and then select or provide required values.
Notes:
l If you receive a SQL Timeout error message, you may edit the timeout setting in the
SWNetPerfMon.db file. By default, this file is located in the C:\Program Files\SolarWinds\Orion
directory
663
l Since the Relative Time Frame is continuously variable, reports run with it may show different
results, even if they are run close together in time.
Summarization Options Tab
You can generate summaries of your results over specific periods of time using the Summarization tab.
To configure results summarization:
1. If you do not want to summarize your results, confirm that Do not Summarize the Results is
selected.
2. If you want to summarize your results, complete the following steps:
a. Select Summarize the Results by Hour, Date, Month, etc., and then select the summarization
period.
b. Specify the location of the summary field for your report.
c. Select a location for the Summary Date/Time field.
Report Grouping Options Tab
The Report Grouping tab allows you to group results by field descriptor within your report. Add, edit and
delete report groups to organize the data in your report. Establish and edit report groups as follows.
To add and edit report groups:
1. If you want to add a new report group, select a field from the list to define your group, and then
click Add Report Group to add your selected field to the Report Groups list.
Note: Use up and down arrows to change the grouping order accordingly.
2. If you want to edit an existing report group, select the field from the Report Groups list, and then
click Edit Report Group.
3. The following options may be changed as needed:
l The Group Header is the text that designates groups on your report.
l The Web URL is the dynamic location of your published report with respect to your Orion
Web Console.
l Font size, face, color, and background may all be modified by clicking associated ellipses.
l Alignment may be left, center, or right.
l Check Transparent Background for better results when publishing your report to the Web.
4. If you want to change the grouping order, use the up and down arrows to change the grouping
order accordingly.
Field Formatting Options Tab
The Field Formatting tab allows you to customize the format of the various results fields in your report. To
format results fields, select the field you want to format, and then edit labels and select options as
appropriate.
664
Notes:
l The formatting options available for each field may be different according to the nature of the data
contained in that field.
l Check Hidden Field to hide any field in your report.
l To view your changes at any time, click Preview.
Reports and account limitations
SolarWinds reports respect Orion Web Console account limitations. For security, by default, reports are not
available to users with limited accounts unless an Orion administrator specifically provides access. The
following procedure creates a reports folder for an account-limited user and configures the
account-limited user to access Orion reports from it.
Note: For more information about creating user accounts, Create users. For more information about
applying account limitations to user accounts, Restrict user access to network areas by applying
limitations.
To allow account-limited users access to reports:
1. Open the Orion Reports folder.

Note: All reports created or predefined in Orion Report Writer are, by default, stored, in C:\Program
Files\SolarWinds\Orion\Reports.
2. Create a new folder using the name of the account-limited user.
3. Copy the reports you want the account-limited user to see from the Orion Reports folder into the
new, account-limited user folder.
7. Click Manage Accounts in the Accounts grouping of the Orion Website Administration page.
8. Select the account-limited user, and then click Edit.
9. In the Default Menu Bar and Views section, select the Report Folder you created in the Orion Reports
folder for the account-limited user.
10. Click Submit.
Exporting Reports from the Orion Report Writer
The Orion Report Writer provides an export menu that enables you to save you report in all formats listed
above except XML. To export to XML, you need to use the SolarWinds Orion Web Console.
To export a report from the Orion Report Writer:
1. Click Start > All Programs > SolarWinds Orion > Alerting, Reporting and Mapping > Orion Report
Writer.
2. Click on the report you want to export.
3. Click File > Export.
665
4. Click on the required file format.
5. Type a name for the exported file.
6. Click Save.
OrionGlobalSearch
Search syslogs, traps and objects monitored in the Orion Web Console globally
SolarWinds NPM 11.5 introduces the technical preview of Orion Global Search. This feature provides a
global search interface in the Orion Web Console and allows you to search for information contained in
traps, syslogs, alerts, events and in the database of objects monitored in SolarWinds Orion.
This feature is Technical Preview. Any functionality in this feature may be subject to change upon
official release. This feature is not fully supported at this time and should be used carefully.
Install Orion Global Search
1. Go to your installation folder, run the Orion Global Search executable, and complete the installation.
By default, you can find the executable using the following path:
<ProgramData Folder>\Solarwinds\Installers\OGSinstaller.msi
2. Run the Configuration Wizard.
If you want to also search through historical syslogs and traps, select the option to index existing
entries.
If historical syslogs and traps are not relevant for you, you do not have to index syslogs and traps.
Indexing runs in the background, and can be time-consuming, depending on the amount of data
being indexed.
To uninstall Orion Global Search:
n Go to Program Features (for example, navigate through Start > Control Panel > Program Features),
right-click SolarWinds Orion Global Search, and select Uninstall.
Search with Orion Global Search
When you are notified about an event or issue, search for textual keywords from the notification,
such as a user name, application impacted, IP address, remote site name, performance counters or
error message.
Example Use Case
When a user reports poor connectivity, you can search for his computer name or IP address.
To execute a global search:
666
2. Enter a keyword into the Search Orion box in the top right corner of the Orion Web Console, and click
the Search icon.
This will open the results of the basic search in the Global Search view.
n Orion Global Search performs a full text search of the string you enter into the search
field. If you want to search for a certain sequence of words, enclose the phrase by
quotation marks (" ").
n You can also use auto-complete of search queries and properties.
3. Refine the search to narrow down items you are interested in.
Adjust the time period
n To prolong or shorten the time period which is relevant for your search, select the
appropriate item in the Time Period list below the search line.
n To specify a precise time period, click the links next to From and To items to define start and
end date of the period you are interested in.
Refine filters
Refine the search with filters available by default.
Add filters
Add more filters.
Remove filters
Remove an already applied filter.
Locate the property which you want to remove from the search below the search line and click
x to remove it.
4. Display information about individual search result items:
n To display information about an object in the results list, position the cursor over it. A tooltip
displays with relevant information about the object. For nodes, relevant details might include
the status, polling IP address, machine type, average response time, packet loss, and CPU
load.
n To view events and alerts concerning the object, click the + before the item in the results list.
Orion Global Search query syntax
Orion Global Search allows you to specify the information you are looking for by entering a query into the
search box.
Supported queries consist of database field names (also called properties) and database field values.
These can be further connected by logical operators.
The Orion Global Search field requires the following syntax:
[database field name]:[field value] [LOGICAL OPERATOR] [database field name]:[field value]
Example:
Orion.Nodes.StatusDescription:"Node status is Up." AND Orion.Nodes.Vendor:Windows
This query returns all Cisco nodes that are down.
667
For more information about automatic suggestions provided for any input into the global search field, see
Auto-completing queries and properties in Orion Global Search.
Auto-completing queries and properties in Orion Global Search
Orion Global Search has a powerful auto-complete feature which helps you specify what information you
are looking for in logs and NPM. The auto-complete feature suggests available properties and modifiers
which you can use to tailor a query to suit your needs.
Auto-suggestions include
n Field names from the Orion database. These are object properties that can be used to design a
search query for Orion Global Search.
n Logical operators that allow you to combine multiple properties, such as AND, OR, or NOT.
Note: Auto-suggestions only include available properties, not values available for them. To be able to
use auto-suggestions, you need to add an appropriate value to limit the search results by.
To specify a search using auto-complete:
1. Log on to the Orion Web Console and execute an Orion Global Search.
2. Now in the Global Search view, start typing a value or property you want to search for. A list of
suggestions will display below the search field.
3. Use the arrow keys to move in the list and press <Enter> to add the selected suggestion into the
search field.
4. Fill in the required field value to be searched for.
5. If you want to further specify your query, use a logical operator, such as AND. Then you can add
another field name and value that you are interested in finding.
Refining Global Search with available filters
The Refine Further section in the Orion Global Search view provides default filtering options based on the
keyword you entered. You can find their properties and their values available in the results of the current
search.
In most cases, default filters include the object type (for example Nodes, Interfaces, Components,
SqlServerApplication, and so on), and their status (for example Disabled, Down, Up, Unknown).
To refine search results:
1. Log into the Orion Web Console and execute a global search.
2. In the Refine Search section, select the items which you want to have in the results.
3. Click Update results.
The results will now only show items corresponding with the selected properties. Applied properties
display below the search field.
Removing a property filter
If you have refined your filter too much, or need to apply a different approach to filtering, you can remove
properties used for filtering.
668
To remove a filter, locate the filter below the search field, and click x for property filters that you do not
want to apply on the search results any more.
Adding more properties for filtering search results
You can further limit Orion Global Search results to display information related only to objects with
specified properties. This can be done by adding a filter property and specifying values which should be
included in the results.
For example, you might want to see log and NPM information only for loopback interfaces.
To add a filter property:
1. Log on to the Orion Web Console and execute an Orion Global search.
2. Now in the Global Search view, click Add Filter Property.
3. Select the appropriate Orion Object in the Available Columns list, and then select the required
property in the Database Column name table.
Example: To search for loopback interfaces information, select Interface in the Orion Object
list, and then select Interface Type Description.
4. Click Add Filter Property.
The selected property with available values will display in the Refine Further area.
Example: If you selected Interface Type Description, it will display in the Refine Further area,
with all available values, such as loopback, Ethernet, ppp, and so on.
5. Select one or more property values by which you want to limit the search results, and then click
Update Results.
Example: If you are interested only in results concerning loopback interfaces, select loopback
below Interface Type Description, and update the results.
The selected filters display below the search field. If you want to exclude the selected property from
filtering the results again, click x next to the appropriate property.
The Refine Further area displays only the properties and values that are available in your SolarWinds
Orion database and in your logs.
669
SolarWinds
Server & Application Monitor
Version 6.2.4
Administrator Guide
Last Updated: Friday, June 10, 2016

NetworkAtlasAdminGuide
671
Table of Contents
Before you install 37
Introduction 38
Applications Defined 39
How Does SolarWinds Server & Application Monitor Work? 40
Requirements and Installation 44
Prepare a SolarWinds Orion Platform installation 44
SAM hardware requirements 44
SAM software requirements 45
Server port requirements 47
SolarWinds SAM database server (SQL server) requirements 47
SAM requirements for virtual machines and servers 49
Additional monitoring requirements 50
Configure the SolarWinds Orion server to use the correct syslog port 54
Server sizing 54
Recommendations 55
672
Orion Common Components Administrator Guide
SQL server configuration best practices 55
Maximizing SQL server performance 55
Hardware settings for SQL servers 56
Recommendations for multi-CPU systems and the optimal settings of the I/O subsystem 57
Database file setting recommendations 58
Memory setting recommendations 58
CPU setting recommendations 58
Security enhancements and exceptions for SolarWinds Orion Platform products 58
Enable secure channels with SSL 58
Enable FIPS 60
Antivirus directory exclusions 61
SolarWinds Orion Platform products licensing 61
Activate your SolarWinds license 62
License Manager requirements 63
Additional SAM technology requirements 67
SAM technology requirements 67
Additional SolarWinds SAM requirements 68
Asset inventory and hardware health monitoring requirements 68
AppInsight for SQL requirements and permissions 69
AppInsight for Exchange requirements and permissions 71
AppInsight for IIS requirements and permissions 72
Requirements for the Windows Scheduled Task Monitor 73
Scale SAM for larger environments 74
673
(Undefined variable: Core.TOC)
SAM licensing model detailed 75
See the available component monitors remaining in your license 77
Install and configure Server & Application Monitor 77
Configure Server & Application Monitor 78
Run SolarWinds SAM 78
Perform common tasks 78
Install, upgrade, and move SolarWinds Server & Application Monitor 79
Uninstall SAM from your server 79
Administer and implement SAM technologies 81
Manage Orion Web Console 81
Log in to the Orion Web Console 81
Customize the Orion Web Console 82
Customize resources 87
Customize views 95
Orion Web Console and chart settings 107
Administrative functions 110
Manage Users 113
Manage Orion Web Console user accounts 113
Create users 113
Change account passwords 116
Enable users to authenticate through LDAP 117
Define what users can access and do 117
Set default menu bars and views for users 120
Limit users to specific network areas 121
Configure automatic login 123
674
Enable LogonFallback 125
Discover and add network devices 128
Discover your network with the Discovery Wizard 129
Add nodes using Active Directory 133
Credentials for Active Directory discovery 134
Automatically add discovered nodes 135
Add discovered devices to SolarWinds NPM 137
Choose the polling method to use 140
External Node (No Status) 140
Status Only: ICMP 140
Most Devices: SNMP & ICMP 140
Windows Servers: WMI and ICMP 140
Windows Servers: Agent 141
Import nodes from a list of IP addresses 142
Manage scheduled discovery results 143
Minimize SNMP processing load during discoveries using the Discovery Ignore List 144
Add ignored devices back to discovery 144
Manage devices in the Orion Web Console 145
Stop monitoring devices 146
View node data in tooltips 147
View the resources and statistics monitored on a node 152
Suspend collecting data for monitored nodes 153
Poll and rediscover devices immediately 154
675
Manage groups and dependencies 156
Groups 157
Mirror network object dependencies in the Orion Web Console 163
Discover applications in your environment 169
Access Application Discovery 169
Select nodes to scan 169
Select applications 169
Add application monitors to nodes 171
Customize the application details view 172
Custom application details view 172
Select a view for a template 172
Select a view for an application 173
Viewing node and application data in tooltips 174
Enable SolarWinds SAM data in the Node Details view 176
Customize SAM Application Summary views 177
Add a summary view menu item to the menu bar in the Applications tab: 177
Monitor network events in the web console 178
178
Manage nodes, applications, and settings from the web console 181
Manage nodes from the web console 181
676
Unmanage nodes 181
View node resources 181
Delete nodes from monitoring 181
Manage nodes and applications (Advanced) 182
Delete applications or volumes from monitoring 182
Promoting the node 182
Unscheduled node polling and rediscovery 183
Performing an unscheduled poll or rediscovery 183
Unmanage a node using the Unmanage Scheduling Utility 183
Viewing the details of a selected item's schedule 183
Manage SAM settings and general thresholds 185
Adjust SAM account settings 185
Set SolarWinds general thresholds 185
Certificate Credentials Library 186
189
Add a certificate to the library 190
Assign certificate credentials 191
Create and assign credentials using Quick Credentials when editing a template or
application monitor. 193
Configure and manage the web console 194
677
Administrative Functions of the Orion Web Console 195
Customize views 208
Schedule tasks to be stopped using the Unmanage Scheduling utility 236
Schedule tasks to be stopped 236
View the details of a selected item's schedule 236
Monitor your network 237
View events, alerts, traps, and syslogs in the Orion Web Console Message Center 237
Add server hardware monitoring 237
Hardware monitoring and VMware 238
Access hardware monitoring agent software 239
Hardware Details 239
Hardware Health Chart 242
Monitor virtual infrastructure in the Orion Web Console 245
Prerequisites to monitoring virtual infrastructure 245
Create ESX server credentials for SolarWinds Orion products 247
Enabling SNMP on VMware ESXi and ESX Servers 247
Edit VMware Credentials in the Orion Web Console 251
Add virtual servers for monitoring 252
Assess the status of the virtual environment 252
View ESX host details 253
Assign credentials to virtual servers 253
Monitoring Quality of Experience 255
Benefits of QoE 256
678
Packet Analysis Sensor Licensing 259
How SolarWinds Packet Analysis Sensors Work 263
Limitations to Packet Analysis Sensors 264
Deploying Packet Analysis Sensors 265
Aggregation with access to network (NPAS) 268
Aggregation with access to application servers (SPAS) 269
Aggregation per site with access to network (NPAS) 270
Aggregation per site with access to application servers (SPAS) 271
Aggregation per computer with access to network (NPAS) 272
Aggregation per computer with access to application servers (SPAS) 273
Monitor QoE Applications and Nodes 278
Advanced Sensor Configuration 288
Agent settings 294
Add the MST file to a Group Policy 302
Enable server-initiated communication on deployed agents 303
Requirements for manual agent deployment 310
Install through the command prompt 310
Deploy the agent manually using the interactive wizard 310
679
View network events in the Web Console 326
Filter the displayed logged events in the Web Console 327
Remove events from the Web Console 328
Syslogs and traps 328
Monitor Syslog messages 328
Monitor SNMP traps 337
Before you begin 342
Install and configure the SolarWinds Alert Integration application in ServiceNow 343
Configure an Orion Platform product with ServiceNow 344
Manage SAM technologies 345
Work with application monitor templates 346
Creating component monitors and templates 347
Add tags 357
Remove tags 358
Assign component monitors to a node 360
Copy assigned component monitors to an assigned application monitor 361
Copy assigned component monitors to an application monitor template 361
Edit assigned application monitors 361
Delete assigned application monitors 361
Edit an individual application 369
Add a JMX component monitor 373
Load WSDL Files 374
Manually Enter XML 375
680
Adapt an existing Perl script to a Linux/Unix Script component monitor in a new template 378
Linux/Unix scripts 380
Example Scripts 380
Creating a Windows Script Monitor 384
Adapt an existing Visual Basic script to a Windows Script Monitor in a new template 384
Macros for Script Arguments 384
Example Scripts 386
Return Codes 388
What needs to be monitored 391
Troubleshooting the Lsass.exe PowerShell Monitor 392
Threshold Adjustments at the Template Level 395
Threshold Adjustments at the Component Monitor Level 395
Change the amount of data used in baseline calculations 401
Apply baseline thresholds at the template level 401
Apply baseline thresholds at the application level 402
Use latest baseline details 403
Edit capacity planning thresholds 404
View the Latest Baseline Details Page 405
Scan nodes for applications 408
681
Select Nodes 408
Select Applications 408
Enter Credentials 409
Review & Start Scan 409
Add UX Monitors 409
Common Tasks with SolarWinds SAM 410
Manage Asset Inventory 421
Enable and disable the Asset Inventory dashboard 422
Asset Inventory data collection 423
Manage AppStack 424
Navigate to AppStack 425
Use AppStack 426
Manage processes, services, tasks, and events in real time 428
445
Manage audit events 457
Add the Audit Events resource 457
Filter audit events 458
Manage SolarWinds SAM polling engines 459
View polling engine status 460
Node Status 471
Percent Packet Loss 471
682
Quick configuration - AppInsight for Exchange requirements and permissions 473
Advanced Manual Configuration of AppInsight for Exchange 477
Non-Domain Account 480
Quick configuration and navigation 495
Manually configure AppInsight for IIS 499
Add AppInsight for SQL to a node via discovery 510
Add a named instance 511
Edit the AppInsight for SQL template 513
Navigate the different AppInsight for SQL views 514
Monitor clusters with AppInsight for SQL 515
Manage the Desktop Notification tool 516
Agents 518
Agent resource consumption 520
Agent port requirements 520
Agent settings 521
Navigate to the Agent Settings page 521
Adjust the Global Agent Settings 521
683
Deploy a Windows agent with the Add Node wizard 524
Deploy Windows agent software via server push 525
Deploy the Windows agent manually 526
Mass deploy a Windows agent 527
Deploy with a Gold Master Image 529
Deploy a Windows agent with Patch Manager 530
Deploy on Windows Core Servers 537
Deploy Windows agents in the cloud 537
Manage Agents toolbar options 540
Manage Agents table columns 542
Edit agent settings 543
Track your polling method 544
View the status of agent plug-ins 545
Edit agent settings in the Windows Control Panel 546
Connect to a previously installed agent 546
Change agent communication modes 547
Change the agent port 548
Check nodes polling with agents for changes 550
684
Create a custom property 553
Remove a custom property 556
Import custom property values 556
Export custom property data 558
Change custom properties values 558
Filter objects when assigning custom properties 559
Alerting 560
Use alerts to monitor your environment 560
Alert preconfiguration tasks 561
Configure the default information in the email action 561
Best practices and tips for alerting 562
Navigate to the Alert Manager 562
Create new alerts to monitor your environment 563
Add a preexisting action to the alert 572
Commonly Created Alerts 575
View triggered alerts in the Orion Web Console 578
Remove alerts from the Active Alerts list 579
Test alert triggers and actions 579
Modify multiple alerts or share alerts 580
Build complex conditions 581
Manage alert actions 583
Available Alert Actions 584
Changes in the alerting engine 610
Alert migration to the web 612
685
SolarWinds SAM Alerts 612
Component Monitor Alerting Properties 612
Application Monitor Alerting properties 616
Application Monitor Variables for Alerts 616
Component Monitor Variables for Alerts 627
Share alerts with other SolarWinds products 640
Reports 644
Creating and Viewing Reports 644
Predefined Orion Reports 644
Viewing, Creating, Exporting, Importing, Editing and Scheduling Reports in the Orion Web
Console 644
Create a report schedule 656
Edit a schedule 658
Assign a report to a schedule or multiple schedules 659
Unassign a report from a schedule or multiple schedules 659
Using Report Writer 660
OrionGlobalSearch 666
Search syslogs, traps and objects monitored in the Orion Web Console globally 666
Install Orion Global Search 666
Search with Orion Global Search 666
Orion Global Search query syntax 667
Auto-completing queries and properties in Orion Global Search 668
Refining Global Search with available filters 668
Adding more properties for filtering search results 669
NetworkAtlasAdminGuide 671
686
Network Atlas tooltip variables 703
Application variables for Network Atlas tooltips 703
Application component monitor variables for Network Atlas tooltips 703
Date and Time Variables for Network Atlas tooltips 704
Group variables for Network Atlas tooltips 706
Interface variables for Network Atlas tooltips 707
IP SLA variables for Network Atlas tooltips 711
Node variables for Network Atlas tooltips 712
Wireless variables for Network Atlas tooltips 717
Network Atlas 717
What can you see on maps? 717
What customization options are there? 718
Install Network Atlas 718
Start Network Atlas 719
Create network maps 720
Create wireless heat maps 728
Display Network Atlas maps in the Orion Web Console 735
Advanced mapping techniques 738
Delete a custom icon 743
Add custom icons from graphics files 744
Assign a custom icon to an object 744
Environment requirements 747
User requirements 747
687
Configure environment for the map import 747
Advanced map layouts 749
Access remote nodes 753
Using Integrated Remote Desktop 753
References 755
AppInsight Applications 756
Zooming 763
Zooming 826
Change thresholds for the Top Indexes for Database performance counter 843
Changing the number of tables displayed in this resource requires values be changed in two
locations 843
Change the thresholds for the Top Indexes for Database performance counter 847
Change thresholds for the Top Tables for Database performance counter 849
Zooming 863
Zooming 899
The AppInsight Performance Counter Details view 1005
Zooming 1006
Zooming 1009
688
The AppStack environment 1010
Introduction to the AppStack Environment view 1011
AppStack categories and data 1015
Understand status and colors 1021
Understand mixed icons 1021
Understand Quick Links 1022
Understand Categories 1024
Understand the Overview bar 1025
Understand filtering options 1026
Understand filter properties 1027
Understand layouts 1029
Understand the AppStack resource 1031
Customize the AppStack Environment view 1032
The Template and Application relationship 1033
Understand component monitors 1034
1034
1034
View the component monitor library 1035
Choose component monitors and templates based on protocol 1036
Monitor external nodes 1037
Application availability and status 1038
Charts in the SolarWinds web console 1039
Chart Information 1039
Custom Chart Resource Title Bar Options 1039
Edit Chart Title View 1039
689
Enable hardware health monitoring 1045
Change hardware health temperature units 1046
Edit hardware health thresholds 1047
Agents 1048
Viewing and customizing application and component performance and status 1051
Volume details 1052
Navigate to the volume details page 1052
Add Disk Volumes to the current view 1052
Understand interface details 1053
Navigate to the Interface Details page 1053
1054
Understand component monitors and application monitor templates 1055
Web service monitoring 1059
JSON 1060
690
SOAP Monitor 1061
Definitions 1061
About the SOAP Monitor 1061
View the Asset Inventory dashboard 1065
Custom Asset Information 1066
Drivers 1067
Firmware 1068
Graphics and Audio 1069
Hard Drives 1070
Hosted Virtual Machines 1071
Logical Volumes 1072
Memory 1073
Network Interfaces 1074
Operating System Updates Applied 1075
Out of Band Management 1076
Peripherals 1077
Ports and USB Controllers 1078
Processors 1079
Removable Media 1080
Software Inventory 1081
Storage Controllers 1082
System Information 1083
General 1085
Hardware 1085
Operating System 1086
691
Windows Update Information 1087
SolarWinds SAM Charts and Resources 1088
Application Availability Chart 1089
Custom Chart 1091
Custom Area Chart 1093
Custom Bar Chart 1094
Component Availability Chart 1095
Custom Chart View 1097
Printing Options 1097
Chart Titles 1097
Time Period 1097
Sample Interval 1097
Chart Size 1097
Font Size 1097
Data Export Options 1098
Custom Line Chart 1099
Custom Query resource 1100
Custom Table 1101
Custom Node Charts 1102
Availability 1102
CPU Load 1102
Memory Usage 1102
Packet Loss and Response Time 1102
Custom Volume Charts 1103
Event Log Message Details 1104
692
Min/Max Average Chart 1105
Zooming 1105
Multiple Object Chart 1107
Multiple Statistic Chart 1109
Zooming 1109
Multi Chart 1111
Reading the Application Summary view 1113
Active application alerts 1114
Application Health Overview 1115
Applications with Problems 1116
Last 25 Application Events 1117
Thwack Latest Application Templates 1118
Top 10 Components Monitored by Response Time 1119
Top 10 Monitored Processes by CPU Load 1120
Top 10 Monitored Processes by Physical Memory 1121
Top 10 Monitored Processes by Virtual Memory 1122
Top 10 Monitored Processes by I/O Reads/Sec 1123
Top 10 Monitored Processes by I/O Writes/Sec 1124
Top 10 Monitored Processes by I/O Total Operations/Sec 1125
Server Warranty Summary 1126
Application Monitor Thresholds 1128
Multi-Value scripts and thresholds 1129
Understand latest baseline details 1130
Understand sustained thresholds 1134
SolarWinds Variables and Examples 1135
693
Filter syntax reference 1135
Filter syntax reference and navigation 1135
SolarWinds SAM SWQL resource matrix 1136
SolarWinds EOC SWQL resource matrix 1138
SWQL filter syntax examples 1151
SQL Filter Syntax Examples 1153
Variable Modifiers 1154
Date Time 1155
Group Variables 1156
SQL Query 1157
Status Variables 1158
Node variables 1159
View monitored objects on maps 1165
The Worldwide Map 1166
Set up the Worldwide map 1166
Map objects 1167
Network Atlas Maps 1168
Set up a user account on a SQL server 1169
1171
Add credentials to the Credentials Library 1171
Edit credentials in the Credentials Library 1171
694
Delete credentials from the Credentials Library 1171
Component Monitor Types 1173
Directory Size monitor 1177
DNS Monitor - TCP 1179
DNS User Experience monitor 1180
DNS Monitor - UDP 1182
Download Speed monitor 1183
Exchange Web Services User Experience monitor 1185
File Age Monitor 1187
File Count monitor 1189
File Existence monitor 1191
File Change monitor 1192
File Size monitor 1194
695
FTP User Experience monitor 1196
FTP monitor 1199
HTTP Form Login monitor 1200
HTTP monitor 1203
HTTPS monitor 1206
IMAP4 monitor 1210
IMAP4 User Experience monitor 1211
JMX monitor 1213
Linux/Unix Script monitor 1217
MAPI User Experience monitor 1219
Nagios Script monitor 1222
696
NNTP monitor 1224
ODBC User Experience monitor 1225
Oracle User Experience monitor 1228
Performance Counter monitor 1232
POP3 monitor 1234
Process monitor - SNMP 1238
Process monitor - WMI 1239
RADIUS User Experience monitor 1241
Service Status – SNMP 1243
SMTP monitor 1244
SNMP monitor 1245
SOAP component monitor 1247
697
SQL Server User Experience monitor 1250
SSL Certificate Expiration Date monitor 1252
TACACS+ User Experience monitor 1254
TCP Port monitor 1256
Tomcat Server monitor 1257
VMware Performance Counter monitor 1260
Field Description 1260
Web Link monitor 1263
Windows Event Log monitor 1265
Windows PowerShell monitor 1268
Windows Script monitor 1271
Windows Service monitor 1273
WMI monitor 1275
Worldwide Map of Orion Nodes Resource 1277
698
Regular Expression Pattern Matching 1281
Characters 1281
Character Classes or Character Sets [abc] 1282
Anchors 1283
Quantifiers 1284
Dot 1286
Word Boundaries 1287
Alternation 1287
95th Percentile Calculations 1288
Required SolarWinds account permissions 1290
Notifications in the Orion Web Console 1292
SAM Glossary of Terms 1293
Solutions 1295
Move the SQL server temporary directory 1296
SAM WMI monitors show a status of Unknown 1296
Redefine Windows system temporary directories 1297
Troubleshooting 1297
Back up your data 1297
Verify program operation 1297
Stop and restart 1298
Run the Configuration Wizard 1298
Slow Performance on Windows Server 2008 1298
Troubleshoot slow performance on Windows Server 2008 1299
699
Error When Creating New Group 1300
Why can't I connect to thwack? 1300
WMI troubleshooting flowchart for SolarWinds SAM 1301
Test local WMI services 1302
Test WMI on the target server 1302
Manually reset the WMI counters 1303
Test remote WMI connectivity 1303
Remotely test WMI on the target server 1304
Verify administrator credentials 1305
Enable Remote Procedure Call (RPC) 1305
Configure Distributed Component Object Model (DCOM) and User Account Control (UAC) 1305
Enable DCOM permissions for your SAM credentials 1306
Enable Account Privileges in WMI 1306
Disable Remote User Account Control for workgroups 1307
Add a Windows firewall exception for remote WMI connections 1307
Determine if an additional polling engine is needed 1308
Verify SAM component configuration 1308
Service reporting, "Invalid Class" 1308
WMI is still not working. Now what? 1309
Working with Temporary Directories 1309
Moving the SQL Server Temporary Directory 1309
Redefining Windows System Temporary Directories 1309
Troubleshooting agents 1310
Troubleshooting agent installation 1310
Troubleshooting agent deployment 1311
700
Troubleshooting agent configuration 1311
Troubleshooting agent connections 1312
Hardware troubleshooting flowchart 1314
Troubleshoot an SNMP node 1315
Troubleshoot a WMI node 1317
Use Wbemtest.exe to troubleshoot WMI 1317
Troubleshoot a VMWare node 1319
Hardware prerequisite checklist 1320
Troubleshoot AppInsight for Exchange 1321
Troubleshoot permissions 1321
Troubleshoot Exchange performance counters 1324
Troubleshoot error codes in AppInsight for Exchange 1327
Troubleshooting AppInsight for IIS 1332
Access is denied when configuring AppInsight for IIS 1333
Change between 32-bit and 64-bit polling 1333
Credentials test failed 1334
Polling fails due to a missing certificate. 1334
IIS polling failed 1334
Node unreachable 1335
IIS version failed 1335
WinRM testing failed 1335
701
Error Code 16049 1339
Other errors 1339
Event IDs 1341
WinRM 2.0 1347
An HTTPS listener currently exists on port 5986 1347
Create a firewall rule 1348
Troubleshoot ESX hardware monitoring 1349
Troubleshoot baseline thresholds 1349
702
Network Atlas tooltip variables
Network Atlas tooltip variables

Many variables used in SolarWinds NPM alerts can also be used in Network Atlas
tooltips. These variables are dynamic, and they parse when the tooltip is opened.
For example, the variable ${CPULoad} will parse with the current processor
utilization of the node you are viewing.
n See Customize map tooltips.

n In some cases, the table name may be required for alert variables, as in
${Nodes.Description}. The following tables provide the table name
in listed variables when it is required.
n In earlier versions of Network Atlas, variables were referred to as
macros.
Application variables for Network Atlas tooltips
VARIABLE DESCRIPTION
${ApplicationID} Internal unique identifier of the application.
${ApplicationTemplateID} Internal unique identifier of the parent template.
${Name} Application name.
${NodeID} Internal unique identifier of assigned node.
Numerical application status code. For more

${Status}
information see Status Icons and Identifiers.
${StatusDescription} User friendly application status.
${UnManaged} States if application is currently unmanaged.
Application component monitor variables for Network Atlas tooltips
${ApplicationId} Internal unique identifier of the associated application.
${ComponentId} Internal unique identifier of the component.
703
Numerical component monitor type code. For more

${ComponentType} information, see "SolarWinds SAM Alerts" in the SolarWinds
Server & Application Monitor Administrator Guide.
${Name} Component monitor name.
Numerical application status code. For more information see

${Status}
Status Icons and Identifiers.
${StatusDescription} User friendly application status.
${TemplateID} Internal unique identifier of the parent template.
Date and Time Variables for Network Atlas tooltips
DATE/TIME VARIABLE DESCRIPTION
${AMPM} AM/PM indicator.
${AbreviatedDOW} Current day of the week. Three character abbreviation.
${D} Current day of the month.
${DD} Current day of the month (two digit number, zero padded).
${Date} Current date. (Short Date format).
Current date and time. (Windows control panel defined “Long

${DateTime}
Date” and “Long Time” format).
${DayOfWeek} Current day of the week.
${DayOfYear} Numeric day of the year.
${H} Current hour.
${HH} Current hour. Two digit format, zero padded.
${Last2Hours} Last two hours.
${Last24Hours} Last 24 hours.
${Last7Days} Last seven days (Short Date format).
704
General variables for Network Atlas tooltips
${LastHour} Last hour.
${LocalDOW} Current day of the week. Localized language format.
${LocalMonthName} Current month name in the local language.
${LongDate} Current date. (Long Date format).
${M} Current numeric month.
${MM} Current month. Two digit number, zero padded.
${MMM} Current month. Three character abbreviation.
${MMMM} Full name of the current month.
${MediumDate} Current date. (Medium Date format).
${Minute} Current minute. Two digit format, zero padded.
${S} Current second.
${Second} Current second. Two digit format, zero padded.
${Time} Current Time. (Short Time format).
${Today} Today (Short Date format).
${Year} Four digit year.
${Year2} Two digit year.
${Yesterday} Yesterday (Short Date format).
GENERAL VARIABLE DESCRIPTION
${Acknowledged} Acknowledged status.
${AcknowledgedBy} Who the alert was acknowledged by.
${AcknowledgedTime} Time the alert was acknowledged.
705
${AlertTriggerCount} Count of triggers.
Date and time of the last event for this Alert. (Windows
${AlertTriggerTime}
control panel defined “Short Date” and “Short Time”).
${Application} SolarWinds application information.
${CR} Line Feed – Carriage Return.
${Copyright} Copyright information.
${ObjectName} Description/Name of the object in the alert.
${Release} Release information.
${Version} Version of the SolarWinds software package.
Group variables for Network Atlas tooltips
${ContainerID} Designated identifier for a mapped group.
${DetailsURL} URL of the Group Details view for a mapped group.
Interval on which group membership is evaluated and group

${Frequency}
snapshots are taken.
When a group is marked for deletion, it is not deleted

${IsDeleted} immediately. If a group is marked for deletion but not yet
deleted, ${IsDeleted} returns 1.
The date and time of the last change made to the definition of
${LastChanged} a group. This does not include changes made to group
members resulting from dynamic queries.
${Name} The name assigned to the mapped group.
${Owner} Orion product appropriate to the mapped group type.
706
Interface variables for Network Atlas tooltips
Name of roll-up logic calculator that evaluates status of the

mapped group based on member statuses. 0 = Mixed, 1 =
Worst, 2 = Best. The "Worst" method reports group status as
${RollupType} the worst status of any of its members. The “Mixed” method
reports group status as ”Warning” when members are of
multiple different statuses. The “Best” method reports group
status as the best status of any of its members.
Status of the mapped group. For more information, see

${Status} “Managing the Display of Group Status” in the SolarWinds
Orion Common Components Administrator Guide.
Name of roll-up logic calculator that evaluates status of the

mapped group based on member statuses. 0 = Mixed, 1 =
Worst, 2 = Best. The Worst method reports group status as the
${StatusCalculator} worst status of any of its members. The Mixed method reports
group status as ”Warning” when members are of multiple
different statuses. The “Best” method reports group status as
the best status of any of its members.
Uri used by SolarWinds Information Service (SWIS) to refer to

${Uri}
the selected group member within the web console.
${WebUri} URL of the Group Details view for a mapped group.
Numeric administrative status of interface. For

${AdminStatus} more information see Status Icons and
Identifiers.
Filename of current interface administrative

${AdminStatusLED}
status icon.
User friendly description of interface combining

${Caption}
name with other identifying information.
707
States if interface supports IF-MIB high capacity

${Counter64}
counters.
Indicates if transmit and receive bandwidth

${CustomBandwidth} fields are user-controlled (1) or controlled by
automated detection via ifSpeed MIB (0).
Day, date, and time that this interface was last

${CustomPollerLastStatisticsPoll}
polled by the current poller.
${InBandwidth} Incoming bandwidth of interface.
${Inbps} Current incoming traffic, in bps, to interface.
Number of incoming packets discarded by

${InDiscardsThisHour}
interface in last hour.
Number of incoming packets discarded by

${InDiscardsToday}
interface in current day.
${InErrorsThisHour} Number of interface receive errors in last hour.
Number of interface receive errors in current

${InErrorsToday}
day.
Current incoming multicast traffic, in packets per

${InMcastPps}
second, to interface.
${InPercentUtil} Current percent utilization of interface receive.
${InPktSize} Average size of incoming packets to interface.
Current incoming traffic, in packets per second,

${InPps}
to interface.
File name of the icon represent the interface

${InterfaceIcon}
type.
${InterfaceID} Internal unique identifier of selected interface.
${InterfaceIndex} Index of selected interface on parent node.
708
sysUpTime value when the interface entered

${InterfaceLastChange}
current operational state.
Interface Maximum Transfer Unit: the largest

${InterfaceMTU}
packet the interface can handle.
${InterfaceName} User-friendly name.
${InterfaceSpeed} Interface bandwidth.
${InterfaceType} IANA type of selected interface.
${InterfaceTypeDescription} User-friendly description of interface type.
${InterfaceTypeName} User-friendly name of interface IANA type.
Current incoming unicast traffic, in packets per

${InUcastPps}
second, to interface.
Time and date of last interface database and

${LastSync}
memory synchronization.
${MaxInBpsTime} Time when ${MaxInBpsToday} was measured.
Maximum measured traffic, in bps, into

${MaxInBpsToday}
interface.
${MaxOutBpsTime} Time when ${MaxOutBpsToday} was measured.
Maximum measured traffic, in bps, out from

${MaxOutBpsToday}
interface.
Day, date and time of next scheduled interface

${NextPoll}
polling.
${NextRediscovery} Next interface rediscovery time.
Internal unique identifier of node that is parent

${NodeID}
to the selected interface.
709
States if parent node supports SNMP or is ICMP

${ObjectSubType}
only.
Numeric operational status of interface. For

${OperStatus} more information see Status Icons and
Identifiers.
File name of current interface operational status

${OperStatusLED}
icon.
${OutBandwidth} Outgoing bandwidth of interface.
${Outbps} Current outgoing traffic, in bps, from interface.
Number of outgoing packets discarded by

${OutDiscardsThisHour}
interface in last hour.
Number of outgoing packets discarded by

${OutDiscardsToday}
interface in current day.
${OutErrorsThisHour} Number of interface transmit errors in last hour.
Number of interface transmit errors in current

${OutErrorsToday}
day.
Current outgoing multicast traffic, in packets per

${OutMcastPps}
second, from interface.
${OutPercentUtil} Current percent utilization of interface transmit.
${OutPktSize} Average size of outgoing packets from interface.
${OutPps} Current outgoing traffic, from interface, in pps.
Current outgoing unicast traffic, in packets per

${OutUcastPps}
second, from interface.
${PhysicalAddress} Physical address of interface.
Interval, in seconds, between polling attempts

${PollInterval}
for interface.
710
IP SLA variables for Network Atlas tooltips
Interval, in minutes, between rediscovery

${RediscoveryInterval}
attempts for interface.
A network health score providing 1 point for an

interface in a warning state, 1000 points for a
${Severity}
down interface, and 1 million points for a down
node.
Interface statistics collection frequency, in

${StatCollection}
minutes.
Numeric interface status. For more information

${Status}
see Status Icons and Identifiers.
${StatusLED} Filename of current interface status icon.
${UnManaged} States if interface is currently unmanaged.
${UnPluggable} States if interface is designated as unpluggable.
IP SLA variables for Network Atlas tooltips
${DateChangedUtc} The last time operation information was updated.
${Description} A user defined explanation of the operation.
${Frequency} How often the operation is performed.
${IpSlaOperationNumber} The time between operation executions.
This value is True if it was created by VoIP & Network

${IsAutoConfigured}
Quality Manager, False if it was created by the user.
${OperationInstanceID} The internal ID of the operation.
${OperationName} The name of the operation as it appears in Orion.
711
Numerical operation status code. 1=DHCP, 2=DNS,

${OperationTypeID} 3=FTP, 4=HTTP, 5=ICMP Echo, 8=TCP Connect, 9=UDP
Echo, 10=UDP Jitter, 11=VoIP UDP Jitter.
${SourceNodeID} The Orion node ID of the source node.
Numerical operation status code. For more information

${Status}
see Status Icons and Identifiers.
${StatusMessage} A message that describing the ${Status} value.
The Orion node ID of the node the operation is

${TargetNodeID}
targeting.
Node variables for Network Atlas tooltips
${AgentPort} Node SNMP port number.
Node allows 64-bit counters (1), or not

${Allow64BitCounters}
(0).
Average node response time , in msec, to

${AvgResponseTime}
ICMP requests.
Day, date, and time until which node

${BlockUntil}
polling is blocked.
${Caption} User-friendly node name.
${Community} Node community string.
${CPULoad} Node CPU utilization rate at last poll.
Day, date, and time of last poll attempt

${CustomPollerLastStatisticsPoll}
on node.
Day, date, and time that node was last

${CustomPollerLastStatisticsPollSuccess}
successfully polled.
712
Current date and time. (Windows control

${DateTime} panel defined “Long Date” and “Long
Time” format).
${Description} Node hardware and software.
${DNS} Fully qualified node name.
If node supports dynamic IP address

${DynamicIP} assignment via BOOTP or DHCP (1); static
IP address return (0).
Internal unique identifier of the polling

${EngineID}
engine to which node is assigned.
States if node is currently designated as

${External}
external.
File name of status icon for node and its

${GroupStatus}
interfaces.
${IOSImage} Family name of Cisco IOS on node.
${IOSVersion} Cisco IOS version on node.
${IP_Address} Node IP address.
${LastBoot} Day, date and time of last node boot.
Time and date of last node database and

${LastSync}
memory synchronization.
Node manufacturer or distributor and

${MachineType}
family or version information.
Maximum node response time , in msec,

${MaxResponseTime}
to ICMP requests.
Total node memory used over polling

${MemoryUsed}
interval.
713
Minimum node response time , in msec,

${MinResponseTime}
to ICMP requests.
Day, date and time of next scheduled

${NextPoll}
node polling.
${NextRediscovery} Time of next node rediscovery.
${NodeID} Internal unique identifier of node.
Node host name. Defaults to node IP

${NodeName} address ${IP_Address} if host name
does not resolve.
States if node supports SNMP or is

${ObjectSubType}
ICMP-only.
ICMP packet loss percentage when node

${PercentLoss}
last polled.
Percentage of total node memory used

${PercentMemoryUsed}
over polling interval.
${PollInterval} Node polling interval, in seconds.
${RediscoveryInterval} Node rediscovery interval, in minutes.
Node response time, in milliseconds, to

${ResponseTime}
last ICMP request.
Node read/write community string; acts

${RWCommunity} as security code for read/write SNMP
access.
A network health score providing 1 point

for an interface in a warning state, 1000
${Severity}
points for a down interface, and 1 million
points for a down node.
714
States the version of SNMP used by the

${SNMPVersion}
node
Statistics collection frequency, in

${StatCollection}
minutes.
Numerical node status. For more

${Status} information see Status Icons and
Identifiers.
${StatusDescription} User-friendly node status
${StatusLED} File name of node status icon.
String reply to SNMP SYS_NAME OID

${SysName}
request.
Vendor ID of the network management

${SysObjectID} subsystem in OID form. Clearly
determines the type of node.
Time, in hundredths of a second, since

${SystemUpTime}
monitoring started.
${TotalMemory} Total node memory available.
${UnManaged} States if node is currently unmanaged.
Day, date, and time when node is set to

${UnManageFrom}
“Unmanaged”.
Day, date, and time when node is

${UnManageUntil}
scheduled to be managed.
${Vendor} Node manufacturer or distributor.
${VendorIcon} File name of node vendor logo icon.
715
Volume variables for Network Atlas tooltips
${Caption} User-friendly volume name.
User-friendly volume name including

${FullName}
captions of parent node and interface.
Time and date volume last synchronized in

${LastSync}
database and memory models.
${NodeID} Internal unique identifier of parent node.
Numerical volume status: (0=”Unknown”,

${Status}
1=”Up”, 2=”Shutdown”, 3=”Testing”).
${StatusLED} Filename of volume status icon.
Number of volume allocation errors for this

${VolumeAllocationFailuresThisHour}
volume in last hour.
Number of volume allocation errors for this

${VolumeAllocationFailuresToday}
volume in current day.
${VolumeDescription} User-friendly volume description.
${VolumeID} Internal unique identifier of volume.
Unique index of volume within the parent

${VolumeIndex}
node.
${VolumePercentUsed} Percentage of volume currently in use.
(Y) = volume is currently responding to

${VolumeResponding}
SNMP queries.
${VolumeSize} Size of volume, in bytes.
${VolumeSpaceAvailable} Total space available on volume, in bytes.
${VolumeSpaceUsed} Total space used on volume, in bytes.
716
Wireless variables for Network Atlas tooltips
Volume type, as reported by hrStorageType

${VolumeType} OID (Removable Disk/Fixed Disk/Compact
Disc/Virtual Memory/RAM/etc).
${VolumeTypeIcon} Filename of icon for volume type.
Wireless variables for Network Atlas tooltips
States if node is being polled by the wireless poller (1)

${WirelessAP}
or not (0).
Date and time when the node was last polled by the
${WirelessLastStatPoll}
wireless poller.
Interval, in minutes, between wireless polling attempts

${WirelessPollInterval}
on node.
Date and time node may be polled again by wireless

${WirelessStatBlockUntil}
poller.
Network Atlas
Network Atlas is an application for creating custom maps and network diagrams. It is
preinstalled with your Orion Platform product.
Maps provide a graphical depiction of the network. You can export or print maps, and
use them to document your network. You can also view Network Atlas maps in the
Orion Web Console.
What can you see on maps?
n Monitored SolarWinds NPM nodes, interfaces, and volumes, SAM applications

and components, nested maps, and network links
n The coverage provided by your wireless access points and wireless clients
connected to the access points
717
What customization options are there?
n Customize the map background with default colors, textures, or images. Add
custom background graphics, such as floor plans.
n Link dynamic real-time weather or natural disaster maps to your network maps
as the background.
n Customize the shape, size, color, and style of map links to illustrate the status
of the relative bandwidth of associated objects.
n Select a graphical style for objects to reflect the network status on maps.
n Nest maps, so that you can drill down to reveal increasing levels of detail, and
the status of nested map child objects may be bubbled up to the parent map.
You can for example nest floor maps into a map of a building, and be notified if
devices on the floor map are down.
Install Network Atlas
Network Atlas is pre-installed on Orion EOC and SolarWinds NPM, and it can be run
as a local application on those Orion servers.
Users can also run Network Atlas as a standalone application on a remote computer.
Network Atlas Requirements
Network Atlas users must have the Map Management rights in SolarWinds NPM or in
Orion EOC.
The user logged in to Network Atlas must be able to access the Network Atlas
synchronization folder to ensure synchronization with the SolarWinds Orion
database.
SERVER
REQUIREMENTS
COMPONENT
Operating Microsoft Windows XP, Windows Vista, Windows 7, Windows Server

System 2003, or Windows Server 2008 R2.
Memory 1 GB
Hard Drive
150 MB
Space
718
Start Network Atlas
SERVER
REQUIREMENTS
COMPONENT
Remote instances of Network Atlas require TCP on port 17777 to

Ports
either the SolarWinds NPM or the Orion EOC server.
Install Network Atlas on a remote computer
1. Log in to your SolarWinds NPM or Orion EOC server.

2. Start the Orion Web Console in the SolarWinds Orion program folder.
3. In the Map resource, click Download Network Atlas.
If you do not see the download link in the Map resource, click Edit, select
Show Network Atlas Download Link, and click Submit.
4. Save the installer (NetworkAtlas.exe) on the remote computer.
5. Run the installer on the remote computer, and click Next on the Welcome
window.
If you have previously installed Network Atlas, you may be prompted to

change, repair or remove your installation. Click Repair, click Repair
again on the Ready to repair window, and complete the Setup Wizard.
6. Accept the terms in the license agreement, and click Next.
7. Provide an appropriate installation destination folder, and click Next.
8. Click Install on the Ready to Install window.
9. Click Finish when the Setup Wizard completes.
See Create network maps.
Start Network Atlas
Users must have the Map Management right in SolarWinds NPM or in Orion
EOC.
1. Log in to the computer hosting your Network Atlas installation.

2. Start Network Atlas in the SolarWinds program folder.
3. Connect to your primary Orion server:
a. Provide your Orion Web Console user name and password.
b. Provide the IP address or hostname of your primary Orion server in the
Address field.
719
c. If you are connecting to an SolarWinds NPM server, select Orion as the
Connect To target.
d. If you are connecting to an Orion EOC server, select EOC as the Connect
To target.
e. Click Connect.
4. Now on the Network Atlas Welcome screen, select what map you want to open:
n To open a recent map, select it in the Open Recent section.
n To open a map available in a certain location, click Browse and navigate
to the map.
n To create a new network map, click Network Map in the Create New
section. See Create network maps.
n To create a wireless heat map, click Wireless Heat Map in the Create
New section. See Create wireless heat maps.
Create network maps
Before you start creating maps, prepare a map management strategy. Consider the
following recommendations:
n Map only static objects. If objects move, you need to adjust their location on
maps, and it is difficult to keep maps up-to-date.
n Build maps to match the column width of your Orion Web Console views.
Rescaling maps in views results in distorting of icons and texts.
To create a network map:
1. Start the Network Atlas in the SolarWinds program folder.

2. Provide your Orion Web Console credentials.
3. If you are launching Network Atlas on the local computer, type localhost into
Address. If you are starting Network Atlas on a remote computer, provide the IP
address of the main polling engine.
4. Click Connect.
5. Click Network Map in the Create New section.
A new empty network map will open in the Network Atlas.
720
Create network maps
Add objects on a map
Any objects monitored by SolarWinds NPM or SAM may be added to a Network Atlas

map, such as:
n SolarWinds NPM nodes, interfaces, volumes, and Universal Device Pollers

(UnDPs)
n SAM applications and components
n VoIP & Network Quality Manager operations
n Network Atlas maps
n Network links
To add objects on a map:
1. If you are creating a new map, click the Network Atlas button ( ), and click
New Map.
2. If you are adding objects to an existing map:
a. Click the Network Atlas button ( ).
b. Click Open Map.
c. Navigate to your existing map, and click Open.
3. Expand and navigate the node tree in the left pane to locate the network nodes
and monitored objects you want to add to your map.
4. Drag selected objects onto the drawing area.
n To add all the objects of a type on a node to your map, click + next to
the node name to reveal all its associated monitored network objects,
and drag all objects in the object group onto the drawing area.
n A check mark ( ) next to a node or network resource indicates you

have already added it to your map.
n To view details about a map object, hover over it with the mouse
pointer.
n To locate a specific map object in your map, click its network resource in
the left pane. This selects the map object.
Connect objects on maps automatically with ConnectNow
Using the ConnectNow tool, Network Atlas can automatically draw lines between
directly connected nodes on your network.
721
ConnectNow displays connections based on data polled for nodes with enabled L2
and L3 topology pollers, and for unidentified nodes.
An unidentified node is a node that was found on the network but which is not
managed by Orion. These devices might be switches, hubs, routers, or other devices
without names or addresses.
Unidentified nodes can be virtual, generated to signify an indirect connection in your
map. For example, when a topology calculation cannot find any direct connections
between two nodes, an unidentified node is generated between the two known
nodes.
l The ConnectNow tool cannot draw indirect connections between nodes.

For example, if nodes A and C are connected indirectly through node B,
you must manually add node B to the map to create the connections.
l Orion Enterprise Operations Console (EOC) does not support
ConnectNow.
Connect objects on maps automatically using ConnectNow
1. Add the nodes to an open network map.

See Add objects on a map.
2. Click ConnectNow ( ) in the Home ribbon.
Update the Topology
ConnectNow displays data stored in the TopologyConnections database table. By

default, the data are re-calculated every 30 minutes. You can update the data
manually.

3. In the Node & Group Management grouping, click Manage Nodes.
4. In the More Actions drop-down list, select Update Topology.
The values in the TopologyConnections table will be re-calculated and your

topologies will be updated.
722
Create network maps
Connect objects on maps manually
You can represent network links in your map by drawing lines between map objects.
If a connected object is down, any connected links change color to red.
1. Make sure the Home ribbon is selected.

2. Click Straight ( ) or Curved Line ( ) in the Lines group, as appropriate.
3. Click an object with the line drawing tool to begin drawing the link
4. Click and drag as needed to set optional anchor points along the link path.
5. Click a second object to finish drawing the link.
6. If you want the links connecting your mapped objects to communicate the
status of connected interfaces:
a. Right-click a link, and select Properties.
b. Select Status in the left pane of the Link Properties page.
c. Drag the appropriate interface objects from the left pane of the Network
Atlas window to the link status assignment areas.
Reshape map links
You can use anchor points to change the shape of object links on your map. Use
multiple anchor points to create more complex shapes and curves.
1. Select in the Tools group, or click the middle mouse button.
2. Click and drag the link you want to reshape.
Configure display of connections on maps
Links created on Network Atlas maps are not merely connectors between network
objects. They can display status of the connection, the link speed, or utilization.
1. Right-click a link, and select Properties.

2. Click Status and review the objects from which the link gets its status. To
change the objects, drag objects from the Network Atlas navigation tree to the
appropriate endpoint box.
3. Click Appearance and set the default width and style for the link. Select the
color for links that are UP. Down links are always red.
4. Click Hyperlink to specify what should open when you click the link in the Orion
Web Console.
723
5. To add a label, right-click a link, and select Add Label. A default label appears.
Edit the label text or move the link label.
6. To specify what should be displayed for connections:
a. Expand Connection Display Options.
b. To display the link speed, select Show Link Speed.
c. To show the link utilization in percent, select Link Utilization.
To hide all labels for the connections, clear the Include Link Labels, and
click Don't Show Additional Info.
You can set interfaces through which linked objects are connected. Links can then
display the status, speed or link utilization of the connection. Interface states and
performance data are determined from SolarWinds NPM polling data.
Interface performance information in maps can be communicated using the interface

status or performance:
n Determine interface status in connections

n Specify interfaces which determine the status of connections on maps
n Display interface performance in map links
Determine interface status in connections
Connections are shown as either solid or dotted lines. A solid line indicates that the
connection is UP. A dotted line indicates that the connection is DOWN.
The connection status depends on the status of interfaces at both ends of the
connection.
The connection status is only shown as either UP or DOWN. To emphasize

potential problems, DOWN status is granted a higher priority.
724
Create network maps
The following table shows how interface states are reflected in the status of a
connection between NodeA, with InterfaceA, and NodeB, with InterfaceB.
InterfaceB Status

UP DOWN UNKNOWN
UP UP DOWN UP
InterfaceA Status DOWN DOWN DOWN DOWN
UNKNOWN UP DOWN DOWN
Specify interfaces which determine the status of connections on maps
1. Right-click a link in a map, and select Properties.

2. Select Status in the left pane of the Link Properties page.
3. Drag the interface objects from the left pane of the Network Atlas window to
the link status assignment areas.
Display interface performance in map links
Map links can show either interface utilization or interface connection speed. A
legend is available to interpret colors representing interface performance data.
1. Expand Connection Display Options in the bottom left pane.

2. Select display options:
n Show Link Speed provides interface connection speed information in
colored links.
n Show Link Utilization provides interface utilization information in
colored links. This option is default on new maps.
Utilization data is not shown for manually created links.
n Don't Show Additional Info provides only interface UP/DOWN status

information on device links. This is the default option for previously
created maps.
n Include Link Labels enables or disables displaying connection labels.
725
Add a background
You can select colors, textures, and locally-hosted or Internet-hosted images to serve
as your map backgrounds.
n Select a background color

n Select a background texture
n Select a background image
To clear the current map background, click Home, and click Background > Clear
Background ( ).
Select a background color
Network Atlas supports 24-bit color backgrounds.
1. Click Home.

2. Click Background > Background Color ( ).
3. Select a color from the palette, or click More Colors to select a custom color.
Select a background texture
1. Click Home.

2. Click Background > Background Texture ( ).
3. Enter the Width and Height of your map in the Map Size in Pixels area.
The default values are the smallest area bounding the existing map
objects and labels.
4. Select a texture, and click OK.
Select a background image
Add images accessible on the hard drive or on the Internet as the background for
your maps.
Requirements and recommendations
n Files used for linked backgrounds must be continuously accessible by URL

reference.
n Files used for static backgrounds must be available within the local file system.
726
Create network maps
n To ensure optimal quality of images, plan graphics to display at full size in the
Orion Web Console.
n When determining map size and resolution, consider web page layouts and
display screen resolutions.
Example backgrounds are in the NetworkAtlas Backgrounds folder

located in your default shared documents folder.
Supported formats
n Graphics Interchange Format (.gif, non-animated)

n Tagged Image File Format (.tiff)
n Joint Photographic Experts Group (.jpg)
n Microsoft Windows Bitmap (.bmp)
n Portable Network Graphics (.png)
Linked backgrounds are updated when you access the map, or refresh the browser
page.
Add an image as the background
1. Open the map in the Network Atlas, and click Home.
2. To use a background image the disk, click Background > Background Image, and
navigate to the image.
3. To use a background image from the Internet:
a. Click Background > Linked Background.
b. Type the URL of the image.
c. Click Validate.
d. Click OK.
n In the web console, map background images linked from the

Internet are refreshed with the Orion Web Console refresh.
n If the SolarWinds Orion server is behind a web proxy which
requires authentication, you cannot link directly to the
background image.
A workaround is to write a script that periodically downloads the
image and saves it to a folder on the web server. You can specify
the saved image as the linked background image.
727
Add a dynamic background for a map
Weather conditions can affect availability of a certain location. You can add weather
maps displaying the current weather as a background for maps.
1. Navigate to the page which you want to link as the background, and copy the
static link.
2. Open the map in the Network Atlas.
3. Click Linked Background, and paste the URL.
4. Validate the URL, and click OK.
The dynamic map will now display as the map background.
When you add the map to the Orion Web Console, the map will refresh every time the
Orion Web Console refreshes.
Save maps
Network Atlas saves your maps directly to the server to which you are connected.
1. Click the Network Atlas button ( ), and click Save.

2. If you are saving the map for the first time, name the map, and click OK.
3. If you want to save your map to your hard drive:
a. Click > Export > Export Map.
b. Navigate to a location on your hard drive.
c. Provide a File name, and click Save.
Open maps
Maps are loaded from the Orion server to which you are connected. They appear in
the left pane of the Network Atlas window.
1. Click + to expand the Maps group in the left pane of the Network Atlas window.
2. Double-click the map you want to open.
Create wireless heat maps
Wireless heat maps help you visualize wireless signal coverage on a building floor
plan.
728
Wireless heat maps are only supported for Cisco wireless controllers. The
wireless controllers you want to see on wireless heat maps must be managed
in SolarWinds NPM.
Before you begin
n Obtain an image of the wireless coverage area, such as a floor plan.

n Find at least one measurement of the distance between two points on the
image, such as the length of a conference room.
n Choose the physical location of access points to accurately place them on the
map.
To create wireless heat maps:
1. Start Network Atlas in your SolarWinds program folder.

2. On the Welcome to Orion Network Atlas page, click Wireless Heat Map in the
Create New section.
3. Enter a name for the new map.
4. Set a floor plan as the background.
5. Set the wireless heat map scale.
6. Add wireless access points.
7. Optional: Improve the accuracy of wireless heat maps by taking samples of the
signal strength on real devices.
8. Click Generate to display wireless signal coverage.
See also Display wireless heat maps in the Orion Web Console.
Disable the wireless heat map poller
The wireless heat map poller collects information about the signal strength on
monitored access points. By default, this poller is disabled on your devices because
of performance issues.
Network Atlas enables the wireless heat map poller on wireless controllers used in
wireless maps because the information collected by the poller is required for
including access points into wireless heat maps.
729
When do I need to disable the wireless heat map poller?
If you experience performance issues when working with wireless heat maps, disable
the wireless heat map poller on the devices.
Disabling the poller resolves performance issues, but your wireless heat maps
will no longer be updated. The Orion Web Console resources and the Network
Atlas will both display the last status generated before you disabled the
wireless heat map poller.

3. In the Node & Group Management grouping, click Manage Pollers.
4. Locate the wireless heat map poller in the pollers table, and click the item in
the Assignments column, such as 1 Node. Clicking the assignments link opens
the Assign Wireless Heat Map to Nodes view.
5. Select all nodes for which you want to disable the poller, and then click Off:
Disable Poller in the table title.
Clicking the grey Off icon for the nodes in the Poller Status column
disables the poller for the nodes. The icon will turn to green On, and the
poller will be disabled.
Set a floor plan as the background
The floor plan should reflect the real dispositions of the office or buildings on the
map, so that you can correctly position the wireless access points and reflect the
wireless signal coverage on your map.
730
Requirements:
The floor plan must be a graphic file in one of the following graphics formats:
n Graphics Interchange Format (.gif, non-animated)
n Tagged Image File Format (.tiff)
n Joint Photographic Experts Group (.jpg)
n Microsoft Windows Bitmap (.bmp)
n Portable Network Graphics (.png)
To ensure the readability of wireless heat maps, use black and white
images.
To set a background for wireless heat maps:
1. Create the wireless heat map in the Network Atlas.

2. Click Background Image on the Home ribbon.
3. Navigate to the floor plan image, select the image, and click Open.
The floor plan will appear as the background for your heat map.
Set the wireless heat map scale
The correct scale is necessary for an accurate display of the wireless coverage
provided by your wireless access point.
You can use online maps, such as the full version of Google Maps, to measure
your office building. Locate the building on Google Maps, right-click one wall,
and measure the distance to the other wall of the building.
Requirements
n You have already inserted a background image for your wireless heat map (a
floor plan).
n You know the distance of two objects displayed on the background image.
To minimize error, set the scale for the longest distance possible, such
as the building or floor length.
731
To set the map scale:

2. Click Set Scale in the Home ribbon. A blue line segment with squares as end
points will appear in the plan.
3. Drag endpoints of the segment to the objects on the map whose distance you
know.
4. Fill in the distance between the endpoints into the appropriate field, and select
the units (feet or meters).
Example: In floor plans, you usually know the dimensions of individual rooms.
Drag and drop the line segment endpoints so that the endpoints are located on
the opposite walls, and fill in the width of the room.
5. Click Set Scale to apply the scale to the wireless heat map.
Add wireless access points
To generate a wireless heat map, add wireless access points used by client devices
into the map.
Requirements
n The wireless LAN controllers must already be managed in your Orion Platform
product.
n Only Cisco controllers are supported.
n The wireless heat map poller must be enabled on the wireless LAN controllers
that you use in the map.
To add wireless access points:
1. Create a wireless heat map in the Network Atlas.

2. Go to the navigation tree on the left of the Network Atlas main screen.
3. Locate the wireless access points that you want to add to the map.
To find access points on a node, navigate to Orion Objects > vendor

name, such as Cisco > appropriate node > Wireless Access Points.
4. Drag the access points to their location on the map.

The selected access points will appear on the map. You can now generate the
map.
To make the map more accurate, take signal samples.
732
Improve the accuracy of wireless heat maps by taking samples of the signal strength
on real devices
Wireless heat maps display the ideal wireless signal coverage, they do not count with
physical obstacles, such as office walls. To make wireless heat maps more real,
measure the signal strength on real devices, such as cell phones, laptops, or tablets
connected to your wireless network. The measured values are stored as signal
samples and used for calculating the signal coverage on wireless heat maps.
Signal samples represent the signal strength measured in a specified location.
Take signal samples in places where you expect the signal to be blocked by
walls or other obstacles, or in places where the signal strength does not
correspond with your heat map.
Take signal samples with cell phones, because polling the signal is usually
faster for them.
Simple signal samples
Take a wireless device, walk it to a certain location, and take a signal sample
there. Then, walk the device to another location, and take another signal
sample. This procedure is called "walking edition" because it requires you to
walk through the office.
Multiple signal samples
If you have multiple devices connected to your wireless access points, take
multiple signal samples at once (called "sitting edition" because you can do it
sitting at your desk).
Signal samples stay in the map and influence the calculation of wireless heat
maps even after the client moves from its position.
When you move access points in a map, the signal samples might not be
accurate any more. Delete obsolete signal samples, and add new ones.
Requirements
n You need to have a wireless heat map created and open in the Network Atlas.
n You need to have wireless access points added into the map.
733
n You need to have clients, such as cellular phones, tablets, laptops, connected to
the access points positioned in your wireless heat maps.
Take simple signal samples

1. Click Take Signal Sample in the Home ribbon. The Signal Sample wizard will
display on the right side of the Network Atlas screen as a tab.
2. Walk your device to the location where you want to measure the wireless signal
strength and click Next.
3. Select the wireless client (cellular phone, laptop, or tablet) in the drop-down
list, and click Next.
4. Drag the client into its current location on the map, and click Next. Network
Atlas will start measuring the wireless signal strength in the spot. It can take a
few minutes, depending on the device.
5. To add another signal sample, click Repeat, walk the device to a new location,
and repeat steps 3 - 4.
6. To apply the measured signal strength to the heat map, click Generate Map.
7. Network Atlas will regenerate the map. Click Close to hide the Signal Sample
wizard tab.
734
Display Network Atlas maps in the Orion Web Console
Take multiple signal samples at the same time

1. Click Take Signal Sample in the Home ribbon. The Signal Sample wizard will
display on the right side of the Network Atlas screen as a tab.
2. Click Use Multiple Devices to Take Signal Samples.
3. Drag the clients to their positions on the wireless heat map, and click Next.
n If there are too many devices, use the search box to find the
devices you want to use for creating signal samples.
n Measuring the wireless signal strength can take a few minutes.
n If the signal measuring fails, you can either repeat the
measurement for the device, or restart the wizard.
4. Network Atlas will automatically regenerate the map according to the defined
signal samples. Click Close to hide the Signal Sample wizard tab.
Troubleshoot wireless heat maps
If your wireless signal coverage on your wireless heat maps is not as expected, you
can take the following troubleshooting measures.
n Make sure that the map scale you have entered is precise.
n Make sure that your access points are located correctly.
n Verify that signal samples are up-to-date.
n The signal samples stay in the map even after the device you measured the
signal strength on moves away. If you change the position of your access
points, or the dispositions of your office, the signal samples might not be
accurate and could affect the calculated wireless heat map.
n Delete obsolete signal samples.
To delete a signal sample, open the wireless heat map in the Network Atlas,
select the signal sample, and press the Delete key.
n Add new signal samples. See Improve the accuracy of wireless heat maps by
taking samples of the signal strength on real devices.
To see a graphical overview of devices on your network, create a Network Atlas map,
add the Map resource on the view, and specify the map you want to see in the
resource.
735
2. Click Edit in the Map resource.
3. Select your map from the Select Map list.
4. Click Submit.
The selected map will now appear in the Map resource.
Display maps in the Orion EOC Web Console
Network Atlas maps must be converted to display in an Orion EOC Web

Console. See Import maps into Orion EOC.
1. Log on to the Orion EOC web console with an administrator account.
2. Click Settings.
3. Click Manage Views.
4. Select Home, and click Edit View.
5. Click Resource.
6. Click Network Map in the Added list.
7. Select the map from the Select Network Map list, and click Save.
8. Click OK, Save Changes.
9. If prompted to confirm your changes, click OK.
10. Click the Home view to see the map.
Display wireless heat maps in the Orion Web Console

3. To open a wireless heat map, use one of the following options:
n Go to the All Wireless Heat Maps resource, and click the thumbnail for
the map. The map will open in the Wireless Heat Map view that includes
all resources specific for wireless heat maps.
By default, the All Wireless Heat Maps resource is available on the
NPM Summary view.
n Add the Map resource on the view, click Edit, select the map in the list,
and click Submit. See Add resources and columns to views, and define
subviews for more details about adding the resource.
736
Change the time and frequency for regenerating the map
By default, the wireless heat map is regenerated once a day, and the information
about clients connected to wireless access points is collected every 5 minutes.
1. Click Settings > All Settings.

3. Scroll down to the Wireless Heat Map.
4. Adjust the time when wireless heat maps should be regenerated in Map
Generation Start Time.
5. Specify how often the information about clients connected to wireless access
points should be collected in Default Client Signal Strength Poll Interval.
6. Click Submit.
View the location of clients connected to access points in the Orion Web Console maps
To be able to view clients in a wireless heat map, you must add at least three
access points and one signal sample, or four access points into the map.
Viewing the location of connected clients is supported only for Cisco access
points with CleanAir technology.
1. Create a wireless heat map in the Network Atlas. See Create wireless heat
maps.
2. Log in to the Orion Web Console, and open the wireless heat map in the
Wireless Heat Map resource. See Display wireless heat maps in the Orion Web
Console.
3. Make sure the Show Connected Wireless Clients option is selected.
You should now be able to see clients connected to access points available on
the map.
If you cannot see a client on the map, its position might be calculated
outside of the selected map. To verify this, consult the Displaying item in
the legend. If the map shows less clients than are actually connected,
such as one out of three, it means that the remaining clients are either
outside of the map, or filtered out.
737
Limit the number of clients displayed on the map
Too many clients on the map might make the map crowded, and could also cause
performance issues. A wireless heat map can show a maximum of 100 clients.
1. Go to the Map resource.

2. Click Select Which Clients to Show
3. Click + next to Select Wireless Clients To Be Specified.
4. Define how the displayed clients should be selected:
Random selection of all clients
a. Select Show Every Client Connected to Any AP on the Map.
b. To limit the number of clients, select the Limit the Number of Clients To
box, and enter the number of clients to be shown on the map (1 - 100).
Clients connected to an AP
a. Select Only Show Clients Connected to a Specific AP.
b. Select a Wireless AP.
c. To limit the number of clients, select the Limit the Number of Clients To
box, and enter the number of clients to be shown on the map (1 - 100).
Select which clients to show
a. Select Let Me Pick Specific Clients to Show.
b. Use the Group and Search by filters, and select the clients to be
displayed on the map.
5. Click Submit to apply your settings.
Advanced mapping techniques
n Zoom in and out of a map

n Create nested maps
n Display the status of child objects on maps, and change metric thresholds
n Add independent map objects and floating labels
n Change the appearance of map objects
n Customize the width, color, and line styles of network links in maps
n Customize labels
n Customize the page that opens when you click on a map object
n Link or embed maps in web pages using the map URL
738
Zoom in and out of a map
Zoom into a map to enlarge details or to zoom out to reduce its size. Zoom level is a
visual aid, and it is not saved with the map.
Use any of the following methods:

n Press and hold CTRL while rotating the mouse wheel button.
n Click the Zoom slider on the status bar, and then slide the zoom control to the
zoom level you want.
n Click View, and select the type of zoom you want to use from the Zoom group.
Create nested maps
Nested maps allow you to navigate through a map to see multiple levels of detail.
For example, a map of the United States can include an icon for a child map of
Oklahoma. You can then click the Oklahoma object to open the child map.
The map of Oklahoma can become a parent map to a network diagram.
Each child map can include a view of the objects, either devices or other maps,
deployed on it.
Click any nested object to view the next level of map detail, until you reach the final
network device and see all available network information.
739
The total number of objects on a map, including objects on child maps, affects
how fast the map loads in the Orion Web Console. If your maps load slowly,
decrease the number of map objects.
1. Create all maps to be nested in the Network Atlas.

2. Open the parent map, and drag a map from the Maps group onto the parent
map.
3. Position the new map object on the parent map, and save the map.
4. If you want the status of a child map to also indicate the status of its child
objects, complete the following steps:
a. Right-click the child map icon on the map, and select Properties.
b. Select Include Child Status on the Status properties page, and click OK.
The object status icon now includes the secondary status indicator.
Display the status of child objects on maps, and change metric thresholds
The status of a map object icon reflects its current state, such as up or down. You can
add a secondary status indicator to a map object to reflect metrics such as response
time, CPU load, or the state of any child objects. This secondary status indicator
appears at the bottom right corner of the status icon.
To add the secondary status indicator:

1. Right-click the map object, and select Properties.
2. Select Include Child Status on the Status properties page, and click OK.
To change the thresholds of the metrics:

1. Right-click the map object, and select Properties.
2. Click Metrics to view the Metrics properties page.
3. To change the warning or critical threshold for a metric, click the threshold
value, and type a new value.
4. To ignore a metric, clear the metric.
5. Click OK.
n The secondary status indicator respects the Orion Web Console Status
Rollup Mode setting for displaying status.
740
n All child objects and selected metric thresholds are taken into account to
determine secondary status.
Add independent map objects and floating labels
Independent objects and floating labels do not have associations to network nodes or
resources.
To add an independent object:
1. Click Home.

2. Click Add Object in the Objects group to add a gray map object to the map.
To add an independent label:
1. Click Home.

2. Click Add Label in the Labels group. A label is added to the map.
Change the appearance of map objects
Changing the graphics that represent map objects allows you to increase the
information density of your map without increasing the map complexity.
Set the default representations of map objects
1. Click the Orion Network Atlas button , and click Network Atlas Settings.
2. Click Graphic Styles in the left column.
3. Select an appropriate default style for each available map object.
For example, you can set an object icon to visually designate the type of the
monitored device. You can then select a status style, such as 3D Pad Underneath, to
illustrate the object status.
Change the representation of single map objects
1. Right-click a map object, and select Properties.

2. Click Appearance in the left column of the Properties page.
741
3. If you want the map object to appear as a fixed-size, LED-type graphic,
complete these steps:
a. Select Orion LED Status Icon.
b. Select a style from the Orion LED Status Icon Style list, and click OK.
4. If you want the map object to appear as a scalable shape, complete these
steps:
a. Select Shape.
b. Select a style from the Shape Style list, and click OK.
c. Drag a corner handle on the map object to resize the shape.
5. If you want the map object to appear as a scalable graphic, complete these
steps.
a. Select Graphic.
b. Click Select Graphic, select an appropriate graphic, and click OK.
c. Select a status style from the Graphic Style list, and click OK.
d. Drag a corner handle on the map object to resize the graphic.
Paste custom icons from the Windows clipboard
You can paste graphics from the Windows clipboard into Network Atlas maps, and
display an overlay behind them to depict their status.
Icons that you paste into Network Atlas are saved to the SolarWinds Orion database,
and made available for reuse in other maps under the "Imported" icon grouping.
Pasted icons saved to the SolarWinds Orion database can be used by remote
instances of Network Atlas.
1. Open the icon image in a graphics program, such as Visio or Photoshop.
2. Copy the image to the Windows clipboard with the Copy command.
3. Open the appropriate map in Network Atlas.
4. Paste the image as a new object following these steps:
a. Right-click on the map and then click Paste.
b. Select Paste the Image From the Clipboard as a New Object.
c. Enter a name for the image.
d. Click OK.
The added icons are also saved on the SolarWinds Orion server in the
path
742
Delete a custom icon
%APPDATA%\SolarWinds\NetworkAtlas\Maps\Orion\<orion
server address>\NetObjects\Imported.
%APPDATA% is typically located in C:\Users\<logged on
user>\AppData\Roaming
Delete a custom icon

1. Determine which file on the SolarWinds Orion server contains the icon (for
example, mypicture.wmf).
2. Add .del to the file name (for example, mypicture.wmf.del).
3. Start Network Atlas on the SolarWinds Orion server to delete the icons from the
database.
Add custom icons from graphics files
The custom graphic files must meet the following requirements:
n Supported image formats: Windows Media File (.wmf) or Graphics Interchange

Format (.gif).
n Name the graphic files according to their roles.
n The file name must not contain any other dash (-) characters other than
depicted in this table.
ROLE FILE NAME

Critical status iconName-critical.gif
Down status iconName-down.gif
External status iconName-external.gif
Icon with no status iconName.gif
Unknown status iconName-unknown.gif
Unmanaged status iconName-unmanaged.gif
Unplugged status iconName-unplugged.gif
Unreachable status iconName-unreachable.gif
Up status iconName-up.gif
Warning status iconName-warning.gif
743
Add custom icons from graphics files
1. Prepare the icons and save them as .gif or .wmi files.
2. On your SolarWinds NPM server, paste the icons into the following folder:
%APPDATA%\SolarWinds\NetworkAtlas\Maps\Orion\<orion server
address>\NetObjects\User Graphics.
%APPDATA% is typically located in C:\Users\<logged on
user>\AppData\Roaming
3. Start Network Atlas on the SolarWinds NPM server.
You can now assign the custom icons to objects on Network Atlas maps.
Assign a custom icon to an object

1. Right-click the object on the map, and then click Select Graphic.
2. Select User Graphics in the left pane.
3. Select the graphic image, and click OK.
The custom icon will display on the map.
Customize the width, color, and line styles of network links in maps
1. Right-click a link, and select Properties.

2. Select Appearance in the left column of the Properties page.
3. Select a line width in pixels from the Width list.
4. Select a line color from the Color list.
5. Select a line style from the Style> list.
6. Click OK.
The color setting only changes the color of links that have the Up status.
Customize labels
To move a label, drag it to the new location.
744
Assign a custom icon to an object
Edit a label text
1. Double-click the label.

2. Press <SHIFT>+<ENTER> to separate multiple lines within the same label.
Customize text attributes, borders, and background colors
1. Right-click the label, and select Properties.

2. Select Appearance in the left column of the Properties page.
3. To change the font attributes, click the … button, select the font attributes, and
click OK.
4. To change the text alignment, select an alignment from the Text Alignment list.
5. To change the text color, click the Text Color box, and select a color.
6. To add a label border, select the border width in pixels from the Border Width
list.
7. To change the label border color, click the Border Color box, and select a color.
8. To remove label borders, select 0 from the Border Width list.
9. To add a label background, clear Transparent Background.
10. To change the label background color, click the Background Color box, and
select a color.
11. to remove a label background, select Transparent Background.
12. Click OK.
Customize the page that opens when you click on a map object
By default, map objects are linked to the most relevant details page for the object.
Customize the URL hyperlink to link to external web sites and pages.
1. Right-click the map object, and select Edit Hyperlink.

2. To link to the relevant Orion page for the map object, select Logical Page in
Orion.
3. To link to a custom URL, select Manually Set Address, and type the URL.
4. Click OK.
Link or embed maps in web pages using the map URL
The map URL is in the form:
http://orionServer/Orion/NetPerfMon/MapView.aspx?Map=ma
pName
745
orionServer
This is the IP address or host name of your SolarWinds NPM server.
mapName
This is the display name of the map. If the name contains space characters,
substitute %20 for the spaces when specifying the name.
Customize map tooltips
When you hover over map objects in the Orion Web Console, a tooltip with the
current identification and status of the object appears.
Customize tooltips for all map object types in the Orion Web Console to display
additional information using alert variables, custom properties, and other text.
n Tooltip customizations are global, and affect all maps.

n Orion EOC does not support custom web console tooltips.
n To enter a carriage return, use ${CR}.
Add additional information to map object tooltips

2. Locate the Map resource, and click Edit.
3. Click Customize Map Tooltips.
4. Type the variables and any text in the text field for the map object type.
5. Click Submit.
746
Environment requirements
Import Network Atlas maps into Orion EOC
Maps created for use in SolarWinds NPM must be converted before they may be
used in Orion EOC.
Map import requirements and configuration
The Orion to EOC Map Converter utility imports maps into Orion EOC v1.5 from other
SolarWinds Orion products.
Environment requirements
n Orion EOC must currently be managing at least one SolarWinds Orion server.
n If Orion EOC is configured to use Active Directory accounts to access Orion
servers, confirm that you have entered the password for the AD account in the
Orion Logins section of EOC. Additionally, only AD accounts that were
individually added to the Orion Server may be used to import a map. Active
Directory group accounts are not compatible with Map Converter.
User requirements
To run the Orion to EOC Map Converter utility, the user must also meet the following
specifications:
n The user must run the Map Converter using a Windows Administrator account
that also has Orion EOC Administrator role permissions.
n The user must log into the Map Converter using an Orion EOC account that was
individually added to Orion EOC. Active Directory group accounts are not
compatible with Map Converter.
n The user must have Orion EOC access to at least one Orion server.
n The user must have Node Management rights on the remote Orion server
Configure environment for the map import

1. Copy SolarWinds-OrionToEOCMapConverter-1.5.exe to your Orion EOC
server.
Download SolarWinds-OrionToEOCMapConverter-1.5.exe from

http://downloads.solarwinds.com/.
747
2. Execute SolarWinds-OrionToEOCMapConverter-1.5.exe, and complete
the installer.
3. Provide members of the Users group Full Control of files in the folder
<volume>:\Windows\Microsoft.NET\Framework\v2.0.50727\Tempor
ary ASP.NET Files. See Microsoft TechNet Library for more information.
4. Allow the Everyone group Full Control to the folder
<volume>:\Windows\Temp\SolarWinds\NetworkAtlas\EOC\SolarWin
ds\NetworkAtlas\MapsWeb\EOC\localhost and all of its child objects.
See Microsoft TechNet Library for more information.
Import maps into Orion EOC
1. Log in to the Orion EOC server with a Windows Administrator account that has
Orion EOC Administrator role permissions.
2. Start the converter utility by running Convert Orion Maps to EOC in your
SolarWinds program folder.
3. Select the Orion server hosting your maps from the Orion list.
4. Select the maps you want to import into Orion EOC.
To edit the name of an Orion EOC map you are importing, click the map
name in the New Name column, and edit the name.
5. Click Import.
Troubleshoot importing maps into Orion EOC
Map name conflict
Maps you import from different Orion servers may share the same name.
Resolution: Rename the maps so that each has a unique name in Orion EOC.
Any pre-existing child/parent relationships for any renamed map will

break. You must manually reconfigure parent/child relationships after
importing.
Windows 2008 issues
Windows 2008 customers may encounter problems either after manually

clicking the Refresh button or after selecting a different Orion server. If the
utility crashes, restart it and resume importing.
748
Advanced map layouts
User Access Control (UAC)
If using an operating system that has UAC, you must run the program
using Run as Administrator.
Set when a map is displayed as Up on parent maps using the Up status threshold
The UP status threshold is the percentage of map objects that must be in an up state
on a given map for the map to be represented as up on the parent map.
1. Right-click any empty portion of the map, and select Map Properties.
2. Slide the Map Status Will Be UP slider to configure the up state threshold on
the Map Properties page.
Display restricted nodes for users with account limitations
If Orion Web Console users have account limitations that prevent them from seeing
network nodes, set whether the users should see the restricted nodes on maps.
Users with restricted access to the nodes will only see the restricted nodes, but
cannot retrieve any additional information about the nodes.
Hide nodes from users who have account limitations
2. Select Remove Nodes That Users Do Not Have Permission to View.
Reveal nodes to all users
2. Select Allow All Users to View All Nodes On This Map.
Users with account limitations, but with the permission to run and use the
Network Atlas can change this setting in the map. To prevent this, do not give
node management permissions to users who have account limitations.
n Position map objects

n Display grid
n Align map objects
749
n Distribute map objects
n Arrange map objects according to a layout style
Position map objects
Drag objects from the tree on the left to the appropriate position on the map.
To nudge a map object, select the object, and press <Ctrl> + <arrow>.
To reposition a map object:
1. Click the map object.

2. Click the Edit ribbon.
3. In the Size & Position area, enter the X and Y coordinates.
Map center is designated as (X,Y) = (0,0).
Display grid
A grid guide helps you maintain structural and spatial relationships as you arrange
your map objects.
Grids are neither saved with a map, nor displayed in the Orion Web Console.
1. Click the View ribbon.
2. Click Show Grid in the Grid group.
Customize grid
1. Click View.

2. To display grid lines, click Grid Option > Grid Lines.
3. To display grid points, click Grid Options >Grid Points.
4. To change the grid size, click Grid Options > Grid Size, and select a grid size.
Align map objects
1. Click the Edit ribbon.

2. Select the map objects you want to align.
3. Click the button in the Align group to arrange the object.
750
BUTTON FUNCTION DESCRIPTION

Aligns all selected objects on the left edge of the
Align Left
group
Aligns all selected objects on the right edge of
Align Right
the group
Aligns all selected objects on the bottom edge of
Align Bottom
the group
Aligns all selected objects on the top edge of the
Align Top
group
Center
Centers all selected objects vertically
Vertically
Center
Centers all selected objects horizontally
Horizontally
Distribute map objects
1. Click Edit.

2. Select the map objects you want to distribute.
3. Click the appropriate button in the Distribute group to arrange the selected
objects.

Distributes all objects so that they are equidistant
Distribute
from the left edge of the leftmost object to the right
Horizontally
edge of the rightmost object
Distributes all objects so that they are equidistant
Distribute
from the top edge of the topmost object to the
Vertically
bottom edge of the bottommost object
Arrange map objects according to a layout style
1. Click Edit.

2. Click a layout style from the AutoArrange group.

Emphasizes the clusters inherent in the topology of
a map. It emphasizes prominent links between
Circular
main objects and its peripherals. Object groups
have radial placements.
751
Use circular layouts for maps containing ring and
star network topologies.
Emphasizes the symmetrical patterns inherent in
the map topology. It emphasizes an even
distribution of objects, and minimizes edge
Symmetrical crossings. Object groups have star spiral
placements.
Use symmetrical layouts for maps that have fairly
homogenous or uniform clusters.
Emphasizes mapped dependency relationships by
placing objects at different levels.
Hierarchical
Use hierarchical layouts to depict data
dependencies.
Emphasizes compact drawings, and uses only
horizontal and vertical edges. Objects are enlarged
if necessary to provide enough space for edge
Orthogonal connections.
Use orthogonal layouts for maps that need to depict
multiple clusters in a space-efficient manner.
Emphasizes parent and child relationships. Child

objects are arranged farther from the root object
Tree than their parent objects.
Use tree layouts for maps that have a central
control object.
Moves all mapped objects back to the center of the

Reorganize
map view.
Arrange Restores the default relative position of all object

Labels labels.
752
Access remote nodes
Using Integrated Remote Desktop
Sometimes it is necessary to console into a remote server to troubleshoot an issue. This can be
accomplished within the Orion Web Console.
Press Ctrl+Alt+Break to enter/exit full screen mode.
The easiest way to open the Node Details view is to click the remote server you want to view in
any All Nodes resource.
2. Click , located at the of the Node Details view.
Depending on the security settings of your browser, you may be asked to install an ActiveX
control for remote desktop viewing. Follow all prompts to install this required control.
3. Verify the Server IP address or hostname, select an appropriate Screen Size, and then click Connect.
753

The Orion Web Console supports the use of HTTP, SSH, and Telnet protocols for
remote device access if associated applications like PuTTy and FiSSH on your
SolarWinds Orion server are properly registered.
For more information, search the MSDN online help for "Registering an Application to
a URI Scheme".
To use the remote access applications, web browser integration for the user
account must be enabled. Navigate to the user account, and ensure Allow
Browser Integration is set to Yes.
Launch remote access applications from any Details view.
754
References
For information on specific SAM technologies, refer to the following sections:
n Understanding Agents
n AppInsight Applications
n The AppStack environment
n The Template and Application relationship
n Understand component monitors
n Monitor hardware health
n Understanding Quality of Experience
n Monitor external nodes
n Create new alerts to monitor your environment
n Application availability and status
n Charts in the SolarWinds web console
n Predefined Web Console Based Reports
755
AppInsight Applications
AppInsight applications provide a level of detail and expert knowledge far beyond what a simple template
can provide, allowing you to monitor virtually every aspect of the assigned application.
Like any unassigned application in SAM, AppInsight applications are considered templates until applied.
Once applied to a node, AppInsight applications are considered applications. Like any SAM application,
AppInsight applications are comprised of multiple component monitors, also known as performance
counters.
Currently, SAM offers three different AppInsight applications:
n AppInsight for SQL

n AppInsight for IIS
n AppInsight for Exchange
756
AppInsight for SQL
SAM offers a detailed view of your SQL databases' performance without the use of agents or templates by
using the AppInsight for SQL embedded application.
Like any unassigned application in SAM, AppInsight for SQL is considered a template until it is applied.
n Details View : Unlike a traditional Application Details view, the AppInsight for SQL Details view is
comprised of two tabs, or sub-views, that host a variety of resources and information:
n Summary Tab: This view displays an informative summary about the current SQL instance.
n Queries Tab: This view displays details about the most expensive queries running across all
databases on the current SQL instance.
l Database Details View : This view displays details about the selected database.
l Performance Counter Details View : This view displays details about the selected performance
counter.
From here, you can select from the drop down menu and choose to display different amounts of data
based on a time range, as shown below:
Editing Resources
Both the titles and subtitles of each resource can be changed by clicking Edit in the upper right-hand
corner of any resource, and then clicking Submit.
757
Additionally, certain resources allow you to add and remove component monitors from the resource. You
can do this by clicking the Edit button, and then checking the component monitors you want to keep.
For more information, see AppInsight for SQL
758
Understand the AppInsight for SQL details view
The AppInsight for SQL Details view is the equivalent of the Application Details view of a traditional SAM
application; however, there are some notable differences:
n Details view: Unlike a traditional Application Details view, the AppInsight for SQL Details view is
comprised of two tabs, or sub-views, that host a variety of resources and information:
n Summary tab: This view displays an informative summary about the current SQL instance.
n Queries tab: This view displays details about the most expensive queries running across all
databases on the current SQL instance.
n Database Details view : This view displays details about the selected database.
n Performance Counter Details view: This view displays details about the selected
performance counter.
From here, you can select from the drop down menu and choose to display different amounts of data
based on a time range, as shown below:
Editing Resources
The time and date displayed at the top of each resource (where applicable) shows the range of data
currently loaded into the resource. This, along with the Sample Interval Range, can be changed by clicking
Edit from within the resource.
Additionally, certain resources will allow you to add and remove component monitors from the resource.
You can do this by clicking Edit and then checking the component monitors you want to keep.
759
AppInsight for SQL Details View (Summary Tab)
The Summary tab provides a great deal of information about the current SQL instance. The available
resources unique to this view include:
n All Databases
n Application Availability
n Application Details
n Buffer Manager
n Cache
n Connections
n Disk
n Latches and Locks
n Memory
n Pages
n Sessions
n SQL Agent Job Status
n SQL Errors
n SQL Event Log Message Details
n SQL Server
n Top 10 Databases by Active User Connections
n Top 10 Most Expensive Queries by CPU Time
Chart resources require several values for lines on charts to be visible.
760
All Databases
This resource shows the status of all monitored databases on the current SQL instance.
n Name: Displays the name of the listed database, in addition to the current performance status as
indicated by the icon. Clicking the name of the database will take you to the Database Details page.
n Status: Displays the Online or Offline status of the listed database.
n Database Size: Displays the current size of the listed database.
n Transaction Log Size: Displays the size of the transaction log associated with the listed database.
761
Active Alerts
This resource lists details about all unacknowledged active alerts.
The following defines the three columns of this resource:
n Time of Alert: Displays the time and date the listed alert was triggered.
n Object Name: Displays the object that triggered the alert. Clicking the object takes you to the details
page for that object.
n Message: Displays the message of the listed alert.
762
Application Availability
This resource graphically shows the various states of an application in a percentage format and is made
up of three sections: the legend, the main chart, and the lower chart. The colors of the main chart
correspond to the labels in the legend.
This resource is not available when using Internet Explorer 7. Consider upgrading Internet Explorer
8 or higher or using FireFox or Chrome as your web browser.
Zooming
You can have the chart show a predetermined time period of data by clicking on any one of the three Zoom
buttons. Alternatively, you can have the chart show a specific time range by dragging the mouse over a
small area of the chart.
Once you have a time period selected, the lower chart zooms to the starting and ending values of the
selected time period. With the lower chart you can zoom in further by fine tuning the view with the sliders.
The main view of the chart displays the selected time period between the two sliders of the lower chart.
763
Moving the mouse over the main chart reveals a tooltip with more detailed information about the specific
time period the mouse is hovering over. By default, all statistics are shown in the main chart.
764
Application Details
This resource provides tools and details concerning the current application.
n Management: This provides tools allowing you to more easily manage and troubleshoot the current
application.
n Instance Name: Displays the name of the current SQL instance.
n Status: Displays the status of the current SQL instance.
n SQL Server Version: Displays the version of the current SQL server.
n SQL Server Product Level: Displays the maturity level of the current SQL version.
n SQL Server Edition: Displays the edition of the current SQL Server.
n Clustered with: If the listed SQL Server is in a cluster, this field shows a listing of the servers that
make up the cluster. If the cluster is managed by SAM, a status icon becomes visible. If the cluster is
not managed in SAM, no status icon is visible.
765
Buffer Manager
This resource contains performance counters specific to the current status of buffers. The icons of the
listed performance counters in the Statistic Name column change color to reflect the listed counter's
current state. Clicking any performance counter in the Statistic Name column takes you to the Performance
Counter Details page for that counter.
If the value of a listed performance counter crosses the Warning threshold, the chart for the listed counter
displays a yellow background. If the value of a listed monitor crosses the Critical threshold, the chart for
the listed counter displays a red background. Hovering over any time period within the chart displays
detailed information about that time period in the tooltip. Hovering over a counter gives you detailed
information about that performance counter.
Counter Expert Knowledge
Total Definition:
pages This performance counter returns the number of pages in the buffer pool
Information:
The returned value includes database, free, and stolen pages.
Note: This counter is not available in SQL 2012.
Buffer Definition:
Cache Hit Indicates the percentage of pages found in the buffer cache without having to read from
Ratio disk. The ratio is the total number of cache hits divided by the total number of cache
lookups over the last few thousand page accesses.
766
Information:
After a long period of time, the ratio moves very little. Because reading from the cache is
much less expensive than reading from disk, you want this ratio to be high. Generally, you
can increase the buffer cache hit ratio by increasing the amount of memory available to
SQL Server. The higher this ratio, the less often SQL Server has to go to the hard disk to
fetch data, and performance is boosted overall. This counter averages the Buffer Cache Hit
Ratio from the time the last instance of SQL Server was restarted. This counter is not a
real-time measurement, but an average of all the days since SQL Server was last restarted.
In OLAP applications, the ratio could be much lower because of the nature of how OLAP
works.
Possible problems:
If the returned value is low, this could indicate that your SQL server may not have enough
memory to function at peak performance.
Remediation:
Check your SQL server and verify its memory is being used efficiently. Applications other
than SQL may be using a great deal of memory. Try and recover memory by closing
unnecessary applications. Installing additional memory may also help.
Lazy Definition:
Writes/sec The lazy writer is a system process that flushes out buffers that contain changes that must
be written back to disk before the buffer can be reused for a different page and makes
them available to user processes.
Information:
This counter tracks how many times per second that the Lazy Writer process is moving
dirty pages from the buffer to disk in order to free up buffer space. The Lazy Writer
eliminates the need to perform frequent checkpoints in order to create available buffers.
Generally speaking, this should not be a high value, say more than 20 per second. Ideally, it
should be close to zero. If it is zero, this indicates that your SQL Server's buffer cache is
large and your SQL Server does not need to free up dirty pages.
Possible problems:
If the returned value is high, this can indicate that your SQL Server's buffer cache is small
and that your SQL Server needs to free up dirty pages.
Remediation:
767
Free List Definition:
Stalls/sec Indicates the number of requests per second that had to wait for a free page.
Information:
This displays the frequency with which requests for available database pages are
suspended because no buffers are available.
Possible problems:
If the returned value is high, this indicates that not enough memory is available for the SQL
Server.
Remediation:
Zooming
buttons in the head of the Zoom column. Alternatively, you can have the chart show a specific date range
by dragging the mouse over an area of the chart. The time and date displayed at the top of the resource
shows the amount of data currently loaded into the chart. This can be changed by clicking Edit from within
the resource.
The Value from Last Poll column shows the most recent data available for the listed statistic.
768
Cache
This resource contains monitors specific to the current status of the cache. The icons of the listed
performance counters in the Statistic Name column change colors to reflect the listed counter's current
state. Clicking any performance counter in the Statistic Name column takes you to the Performance
Counter Details page for that performance counter.
Cache Definition:
Used/min This displays the number of times the cache object has been looked up.
769
Information:
This is not incremented when parameterized queries find a plan in the cache. However,
this can be incremented multiple times when using Showplan. Good plan reuse is one sign
of a healthy system. Compiling a query plan can be a CPU-intensive operation, especially
with complex queries, so reuse is encouraged.
Possible problems:
If the returned value is low, this can indicate ineffective reusing of plan cache which could
cause a CPU spike. Conversely, if the returned value is high for a large number of plans, this
could indicate that your cache space is being taken up with plans that were compiled and
used once to execute an ad hoc query, then never used again.
Remediation:
A database setting that can be helpful to plan reuse is forced parameterizaton. (You can set
this using the following command: ALTER DATABASE <databaseName> SET
PARAMETERIZATION FORCED). Normally, the query optimizer is very conservative when
deciding what queries can be parameterized, but this setting makes the optimizer be more
liberal in choosing parameters.
Cache Definition:
Object This performance counter returns the number of cache objects in the cache.
Counts
Information:
The Plan Cache object provides counters to monitor how SQL Server uses memory to store
objects such as stored procedures, ad hoc and prepared Transact-SQL statements, and
triggers. Multiple instances of the Plan Cache object can be monitored at the same time,
with each instance representing a different type of plan to monitor.
Possible problems:
High numbers of total cached objects use portions of the physical memory available to a
SQL instance on a per database basis. This can result in one database cache impacting the
performance of other local databases due to memory contention.
Remediation:
Increase the memory available to SQL services, reduce the number of databases on this
instance of SQL, or examine the volume of ad hoc queries running against the server.
Cache Definition:
Objects This performance counter returns number of cache objects in use.
in Use
Information:
The Plan Cache object provides counters to monitor how SQL Server uses memory to store
objects such as stored procedures, ad hoc and prepared Transact-SQL statements, and
triggers. Multiple instances of the Plan Cache object can be monitored at the same time,
with each instance representing a different type of plan to monitor.
770
Possible problems:
High numbers of cached objects in use consume the memory available to a SQL server at a
higher rate than non-active objects on a per database basis. This can result in one
database cache impacting the performance of other local databases due to memory
contention.
Remediation:
Increase the memory available to SQL server, reduce the number of active objects,
consolidate stored procedures, consolidate and convert ad hoc queries to stored
procedures where possible, or reduce the number of databases on the server.
Zooming
the resource.
771
Connections
This resource contains monitors specific to the current status of the active connections. The icons of the
listed performance counters in the Statistic Name column change colors to reflect the listed counter's
User Definition:
Connections The User Connections performance counter identifies the number of different users that
are connected to your SQL Server at the time the sample was taken.
772
Information:
You need to watch this counter over time to understand your baseline user connection
numbers. Since each user connection consumes some memory space, a high number of
user connections can impact throughput and cause a performance slow-down. Once you
have an idea of your high and low thresholds during normal usage of your system, you
can then look for times when this counter exceeds these high and low marks.
Possible problems:
If the returned value of this counter goes down and the load on the system remains
stable, you might have a bottleneck that is not allowing your server to handle the normal
load. Keep in mind that this counter value might go down just because less people are
using your SQL Server instance. If you see this number jump by 500% from your baseline,
you may be seeing a slowdown of your server activity.
Remediation:
You may want to boost the SQL Server configuration setting, Maximum Worker Threads to
a figure higher than the default setting of 255. The setting for Maximum Worker Threads
should be higher than the maximum number of user connections your server ever
reaches.
Logins/sec Definition:
This performance counter returns the total number of logins started, per second, and
does not include pooled connections.
Information:
Opening and closing connections is an expensive process. A pooled connection is one
which is kept open by an application for other requests to re-use.
Possible problems:
If the returned value is high, this can indicate that the application is not correctly using
connection pooling.
Remediation:
Review the Connection Polling configuration.
Logout/sec Definition:
This performance counter returns the total number of logout operations started, per
second.
773
Information:
Opening and closing connections is an expensive process. When applications do not use
a connection pool, each request needs to establish its own connection before the query
can be executed. It then has to close it. A pooled connection is one which is kept open by
an application for other requests to re-use.
Possible problems:
connection pooling.
Remediation:
Zooming
the resource.
774
Disk
This resource contains monitors specific to the current status of the disk. The icons of the listed
Average Disk Definition:

sec/Read This performance counter shows the average time, in seconds, of a read of data from
the disk.
Information:
The returned value indicates the average time of read data from the disk. 4-8ms is
ideal. The returned value is considered acceptable up to 20ms. Any higher value needs
further investigation.
Possible problems:
If a value greater than 15-20ms is reported, this may indicate disk bottlenecks.
Remediation:
Increase the number of hard disks.
775
Average Disk Definition:
sec/Write This performance counter shows the average time, in seconds, of a write of data to the
disk.
Information:
The returned value indicates the average time of write data from the disk. 4-8ms is
ideal. The returned value is considered acceptable up to 20ms. Any higher value needs
further investigation.
Possible problems:
Values greater than 15-20ms nay indicate disk bottlenecks.
Remediation:
Increase the number of hard disks.
Forwarded Definition:
Records/Batch This performance counter identifies the use of a pointer which has been created when
Requests variable length columns have caused a row to move to a new page in a heap.
Possible problems:
Rows with Varchar columns can experience expansion when Varchar values are
updated with a longer string. In the case where the row cannot fit in the existing page,
the row migrates and access to the row traverses a pointer. This only happens on
heaps (tables without clustered indexes).
Remediation:
Evaluate clustered indexes for heap tables. In cases where clustered indexes cannot
be used, drop non-clustered indexes, build a clustered index to Reorg pages and rows,
drop the clustered index, then recreate non-clustered indexes.
Records/sec This performance counter returns the number of records fetched through forwarded
record pointers.
Information:
Tables without a clustered index. If you start with a short row, and update the row
creating a wider row, the row might not fit on the data page. A pointer is put in its
location and the row is forwarded to another page.
Possible problems:
Look at the code to determine where the short row is inserted followed by an update.
Remediation:
Can be avoided by:
776
1. Using default values so that an update does not result in a longer row that is the
root cause of forwarded records.
2. Use Char instead of Varchar. This fixes the length so that an update does not
result in a longer row.
Physical Disk Definition:

Time This performance counter returns the ratio of elapsed time when the disk drive was
busy with read or write requests.
Information:
This performance counter is deceptive because it makes no accommodation for
multiple spindles. Thus, the more spindles (i.e. physical hard disks) you have, the
higher the percentile values can go. Conversely, if these spindles are shared across
LUNs or other services, you may have high numbers on this counter without any
correlation to SQL Server activity. The value for this counter should be below 50%.
Possible problems:
If this performance counter sustains an average above 70%, you may have contention
with your drive or RAM.
Remediation:
You should increase number of hard drives used by SQL server.
Zooming
the resource.
777
Latches and Locks
This resource measures the time it takes for latches and locks to perform various operations.
Latches perform the task of thread synchronization. For example, if a thread is reading a page from disk
and creating a memory structure to contain it, it creates one or more Latches to prevent corruption of
these structures. Once the operation is complete, the Latches are released and other threads are able to
access that page and memory structure again. For the most part, latches are transient, taking a few
milliseconds to complete.
A Lock prevents different users from overwriting each others changes. Generally speaking, a lock lasts for
the duration of the transaction.
The icons of the listed performance counters in the Statistic Name column change color to reflect the
listed counter's current state. Clicking any performance counter in the Statistic Name column takes you to
the Performance Counter Details page for that counter.
If the value of a listed performance counter approaches or crosses the Warning threshold, a yellow band
will appear for the listed counter allowing plotted values that cross the threshold to easily be visualized
against the yellow band. If the value of a listed performance counter approaches or crosses the Critical
threshold, a red band will appear for the listed counter allowing plotted values that cross the threshold to
easily be visualized against the red band. Hovering over any time period within the chart will display
detailed information about that time period in the tooltip. Hovering over a counter will give you detailed
778
Latch Definition:
Waits/sec This performance counter displays the number of latch requests that could not be
granted immediately.
Total Latch Definition:

Wait This performance counter returns the ratio of Total Latch Wait Time, in milliseconds, for
Time/Latch latch requests in the last second to amount of latches, in a one second period that had
Waits to wait. Latches are lightweight means of holding a very transient server resource, such
as an address in memory.

779
Information:
This ratio should be less than 10. Monitoring the latches to determine user activity and
resource usage can help you to identify performance bottlenecks.
Possible problems:
If the returned value is high, it is likely there is an I/O or memory bottleneck.
Remediation:
Check your SQL server and verify its memory is being used efficiently. Applications
other than SQL may be using a great deal of memory. Try and recover memory by
closing unnecessary applications. Installing additional memory may also help.
Lock Definition:
Requests/sec This performance counter returns the number of requests for a type of lock, per second.

Possible problems:
If the returned value is high, this can indicate that the queries are accessing large
numbers of rows. If you notice a high Average Wait time, then this could be an
indication of blocking.
Information:
Blocking is an unavoidable characteristic of any relational database management
system (RDBMS) with lock-based concurrency. On SQL Server, blocking occurs when one
Server Process ID (SPID) holds a lock on a specific resource and a second SPID attempts
to acquire a conflicting lock type on the same resource. Typically, the time frame for
which the first SPID locks the resource is very small. When it releases the lock, the
second connection is free to acquire its own lock on the resource and continue
processing. This is normal behavior and may happen many times throughout the course
of a day with no noticeable effect on system performance.
Remediation:
High Read queries should be reviewed. The simple way to fix locking is just kill the
connection that is causing the lock. Fixing locking, blocking, and deadlocking issues is
often a matter of redesign. You should examine either the schema of your database
and/or the way the application is designed. One of the most efficient ways to deal with
locking is to ensure that the design of your system does not have to deal with excessive
locks. The best way to do this is to normalize your tables, using more atomic structures
that allow the query to get in and get out faster. Another method is to code with the
locks in mind. If the design requires less normalization, you have to evaluate the
programs to ensure that they have the right isolation levels.
780
Lock Definition:
Waits/sec This performance counter reports the number of times users waited to acquire a lock
over the past second.

Information:
Note that this counter only gets incremented only when you “wake up” after waiting on
the lock.
Possible problems:
Non-zero values indicate that there is at least some level of blocking occurring. If you
combine this with the Lock Wait Time counter, you can get some idea of how long the
blocking lasted. A zero value for this counter can definitively rule out blocking as a
potential cause.
Remediation:
High Read queries should be reviewed.
Lock Definition:
Timeouts/sec This performance counter returns the number of lock requests per second that have
timed out, including internal requests for NoWait locks.

Information (timeout_period):
This is the number of milliseconds that passes before Microsoft SQL Server returns a
locking error. A value of -1 (default) indicates no time-out period (that is, wait forever).
When a wait for a lock exceeds the time-out value, an error is returned. A value of 0
means to not wait at all and return a message as soon as a lock is encountered.
Possible problems:
If you see a value above 0 for this counter, your users experience problems as their
queries are not completing.
Remediation:
You should review your queries to determine which queries are causing this situation.
Lock Wait Definition:

Time This performance counter displays the total time spent waiting across all transactions,
in milliseconds, to acquire a lock in the last second.
781
Information:
Though this counts how many milliseconds SQL Server is waiting on locks during the
last second, this counter actually starts recording at the end of locking event. Peaks
most likely represent one large locking event.
Possible problems:
If the returned value is greater than 60 seconds (60,000ms) then there may be extended
blocking which could be an issue.
Remediation:
Thoroughly analyze the blocking script output. Some applications are written for timing
out after 60 seconds. Because SQL Server records a lock at the end of a locking event,
remember that an application with large transactions may have inflated lock wait times
while still performing as expected. For example, an application that issues multi-million
record updates might have very long lock wait times while performing exactly as it was
designed.
Average Definition:
Latch This performance counter reports the average latch wait time, in milliseconds, for latch
Wait Time requests that had to wait.
Information:
SQL Server two lightweight mutual exclusion solutions-Latches and Spinlocks-which are
less robust than locks but are less resource intensive. The value of this counter should
generally correlate to Latch Waits/sec and move up or down with it accordingly.
Possible problems:
If you see this number jump above 300, you may have contention for your server's
resources. High values for this counter could potentially block other users.
Remediation:
You should examine tasks currently waiting using the following command: sys.dm_os_
waiting_tasks DMV.
Average Lock Definition:

Wait Time This performance counter reports the average amount of Wait time, in milliseconds, for
each lock request that resulted in a wait.
Information:
Generally speaking, the lower the value, the better. This value should correlate to
the Lock Waits/sec counter and move up or down with it accordingly.
782
Possible problems:
An average wait time longer than 500ms may indicate excessive blocking.
Remediation:
You should determine which queries are generating locks to identify where the blocking
is originating.
Total Latch Definition:

Wait Time Total latch wait time (in milliseconds) for latch requests in the last second.
Information:
Short term light weight synchronization object. Latches are not held for the duration of
a transaction. Typical latching operations during row transfers to memory, controlling
modifications to row offset table, and so on.
Possible problems:
If high, check Perfmon Disk and Memory objects for:
n I/O bottlenecks
n Memory pressure
Remediation:
This can be mitigated by adding more memory or I/O capacity.
Zooming
the resource.
783
Memory
This resource displays the current status of SQL Server memory. The icons of the listed performance
counters in the Statistic Name column change colors to reflect the listed counter's current state. Clicking
any performance counter in the Statistic Name column takes you to the Performance Counter Details page
for that performance counter.
784
785
Total Server Definition:
Memory This performance counter measures the current amount of memory that SQL Server is
using.
Information:
If the value of this counter continues to grow larger, the server has not yet reached its
steady state and is still trying to populate the cache and get pages loaded into memory.
Performance may be somewhat slower if this value continually grows larger since more
disk I/O is required. This behavior is normal. Eventually Total Server Memory should
approximate Target Server Memory.
Possible problems:
If the Total Server Memory counter is greater than or equal to the Target Server Memory
counter, this can indicate that your SQL Server may be under memory pressure.
Remediation:
Installing additional memory into your SQL server should resolve the problem.
Target Definition:
Server This monitor measures the total amount of dynamic memory the server can consume.
Memory
Information:
This performance counter tells you how much memory SQL Server would like to use to
operate efficiently. Compare with Total Server Memory.
Possible problems:
If the Total Server Memory counter is greater than or equal to the Target Server Memory
counter, this could indicate that your SQL Server may be under memory pressure.
Remediation:
Installing additional memory into your SQL server should resolve the problem.
Target - Definition:
Total Server This performance counter shows the difference between the total amount of dynamic
Memory memory the server can consume and the current amount of memory that SQL Server is
using.

Possible problems:
If this performance counter is greater than or equal to the Target Server Memory
performance counter, this indicates that SQL Server may be under memory pressure.
Remediation:
Installing additional memory into SQL server should resolve the problem.
786
SQL Cache Definition:
Memory This performance counter measures the total amount of dynamic memory the server is
(KB) using for the Dynamic SQL cache.
Information:
Most memory used by SQL Server is allocated to the Buffer Pool, which is used to store
data pages. SQL Server steals a proportion of this memory for use in caching query
plans. The overall amount of memory available to SQL Server depends upon the amount
of memory installed on the server, the architecture of the server, the version and edition
of SQL Server and the amount of memory pressure being experienced by SQL Server.
This pressure can be internal (SQL Server resources need memory) or external (operating
system needs memory). SQL Server is designed to respond to memory pressure when
necessary.
Possible problems:
Memory contention with the buffer pool.
Remediation:
Increase memory available to SQL server.
Lock Definition:
Memory This performance counter returns the total amount of dynamic memory the server is
using for locks.
Information:
Lock pages in memory is used to prevent older versions of Windows and SQL from
allowing Windows operating system page out of the buffer pool.
Possible problems:
Lock pages in memory determines which accounts can use a process to keep data in
physical memory, which prevents the system from paging the data to virtual memory on
disk. Exercising this privilege could significantly affect system performance by
decreasing the amount of available random access memory (RAM).

Remediation:
Upgrade to Windows 2008 R2 or greater and SQL 2008 or greater.
787
Granted Definition:
Workspace This performance counter returns the total amount of memory currently granted to
Memory executing processes, such as Hash, Sort, Bulk Copy, and Index creation operations.
Information:
This performance counter tells you how much memory has currently been granted to
running queries. If there is memory pressure because of workspace memory, this value
should be at least 25% of the virtual memory available to SQL Server.
Possible problems:
If the memory pressure is severe, the server might return errors such as 701 or 8645.
Remediation:
If this is the case, this might be a good reason to consider using SQL Server 64-bit.
Optimizer Definition:
Memory This performance counter returns the total amount of dynamic memory the server is
using for query optimization.
Information:
There are no thresholds associated with this performance counter.
Connection Definition:
Memory This monitor returns the total amount of dynamic memory the server is using for
maintaining connections.
Information:
SQL Server sets aside three packet buffers for every connection made from a client. Each
buffer is sized according to the default network packet size specified by the sp_configure
stored procedure. If the default network packet size is less than 8KB, the memory for
these packets comes from SQL Server's buffer pool. If it is 8KB or larger, the memory is
allocated from SQL Server's MemToLeave region. It is worth noting that the default
network packet size for the .NET Framework Data Provider for SQL Server is 8KB, so the
buffers associated with managed code client connections typically come from SQL
Server's MemToLeave region. This contrasts with classic ADO applications, where the
default packet size is 4KB, and the buffers are allocated form the SQL Server buffer pool.
Memory Definition:
Grants This monitor returns the total number of processes waiting for a workspace memory
Pending grant.
788
Information:
Memory resources are required for each user request. If sufficient memory is not
available, the user waits until there is adequate memory for the query to run.
Possible problems:
Returned values greater than zero for a sustained period of time is a very strong
indicator of memory pressure.
Remediation:
You should first examine the database design, queries, and indexes to ensure the system
is properly tuned before installing additional RAM. There may be query inefficiencies in
the instance that is causing excessive memory grant requirements. For example, large
Sorts or Hashes that can be resolved by tuning the indexing or queries being executed.
Compare with Memory Grants Outstanding. If the number of pending grants increases,
try the following:
l Add more memory to SQL Server

l Add more physical memory to the server.
l Check for memory pressure. See and correct indexing if you experience “Out of
memory” conditions.
Memory Definition:
Grants This performance counter returns the total number of processes that have successfully
Outstanding acquired a workspace memory grant.
Information:
Look at Memory Grants Outstanding and Memory Grants Pending. If you see a long
queue of pending grants as compared to outstanding grants, there is likely memory
pressure because of query workspace memory. You can confirm this by checking the
Granted Workspace Memory (KB) performance counter that tells you how much memory
has currently been granted to running queries.
Possible problems:
A returned value that is high can indicate peak user activity. If there is memory pressure
because of workspace memory, this value should be at least 25% of the virtual memory
available to SQL Server. If the memory pressure is severe, the server might even return
errors such as 701 or 8645.
Remediation:
If severe, and using 32-bit, consider using SQL Server 64-bit. See Memory Grants
Pending.
789
Pages/sec Definition:
This performance counter displays the rate at which pages are read from or written to
disk to resolve hard page faults.
Information:
This is a primary indicator of the kinds of faults that cause system-wide delays. This
should be close to zero on a dedicated SQL Server. You will see spikes during backups
and restores, but this is normal.
Possible problems:
High values causes hard page faults, which can cause SQL Server to use the page, as
opposed to RAM.
Remediation:
You may want to add additional RAM to stop the paging.
Cache Hit Definition:

Ratio This metric is the ratio between Cache Hits and Lookups. Cache Hit Ratio measures how
much the plan cache is being used.
Information:
A high percentage here means that your SQL Server is not building a new plan for every
query it is executing and is working effectively and efficiently. A low percentage here
means that, for some reason, the SQL Server is doing more work than it needs to. This
metric needs to be considered alongside the plan cache reuse metric which looks at the
spread of plan reuse through your cache.
Plan cache is memory used to store objects such as stored procedures, ad hoc and
prepared Transact-SQL statements, and triggers. The plan cache is the component of
SQL memory that stores query plans for re-use. When a query is issued against SQL, the
optimizer attempts to re-use a cached plan if the traits of the query permit - but can only
do so if that plan resides in cache, otherwise it needs to compile a new plan. This is not
to say that every plan that is cached is re-used. Changes in schema, a query running
parallel that may have run serially before, or changes in parameters may require a new
plan to be compiled even if a similar plan exists in cache. Plan compilations are
expensive though. Ideally this counter should be near 100%.
Possible problems:
The value of this counter should never fall below 90%. Low cache hit ratio (<20%) along
with a sustained query execution rate (Batch Requests/sec) indicates that compiled plans
are not being re-used. It should be noted that the hit ratio counter may be skewed by
internal lookups performed.
790
Remediation:
The amount of caching should be reduced by examining the workload to see if queries
have been parameterized, or can be rewritten with stored procedures.
Available Definition:
MBytes This is the amount of available physical memory on the server.
Information:
An acceptable output for this may vary widely based on how much physical memory is in
the machine. If you have 2GB of RAM installed on the machine, it is common to see SQL
Server use 1.7GB of RAM. If no other processes are running on your SQL Server, ensure
you have at least 80MB available for Windows at any given time.
Possible problems:
Low values show that SQL server has lack of memory.
Remediation:
Install additional memory.
Page Usage Definition:

This shows the percentage of the page file that is being utilized.
Information:
A Page File is simply a file on the hard drive that handles situations where the system
wants to move or “page out” sections of memory. There are several situations that cause
this, but the one you should be most concerned about is when the system is out of
physical memory.
Possible problems:
Values greater than 70 percent indicate paging and lack of memory. If the system runs
out of memory it can “borrow” some storage from the hard drive to release some memory
until it needs that data again. The reason that this is bad is because hard drives are
amazingly slow in comparison with solid-state memory access. Using the page file slows
SQL Server a great deal.
Remediation:
Install additional memory.
Workfiles Definition:
Created/sec This is the number of work files created per second.
791
Information:
For example, work files could be used to store temporary results for hash joins and hash
aggregates. The returned value should be less than 20. Tempdb work files are used in
processing hash operations when the amount of data being processed is too large to fit
into the available memory.
Possible problems:
High values can indicate thrash in the tempdb file as well as poorly coded queries.
Remediation:
It is possible to reduce the value this monitor returns by making queries more efficient
by adding/changing indexes. Adding additional memory also helps.
Worktables Definition:
Created/sec This performance counter displays the number of work tables created per second.
Information:
For example, work tables could be used to store temporary results for query spool, lob
variables, XML variables, and cursors. The returned value should be less than 20.
Worktables are used for queries that use various spools (table spool, index spool, and so
on).
Possible problems:
High values could cause general slowdown.
Remediation:
Remediation requires rewriting your procedures.
Zooming
the resource.
792
Pages
This resource shows page status of the SQL server.
In SQL Server, the page size is 8 KB. Therefore, SQL Server databases have 128 pages per MB. Each page
starts with a 96 byte header that stores information about the page. This information includes the page
number, page type, the amount of free space on the page, and the allocation unit ID of the object that
owns the page.
The icons of the listed performance counters in the Statistic Name column change color to reflect the
793
Page Definition:
Lookups/sec: This performance counter returns the number of requests to find a page in the buffer
pool.

Information:
(Page lookups/sec) / (Batch Requests/sec) > 100.
Possible problems:
When the ratio of page lookups to batch requests is much greater than 100, this is an
indication that while query plans are looking up data in the buffer pool, these plans are
inefficient.
Remediation:
Identify queries with the highest amount of logical I/O's and tune them.
Page Definition:
Reads/sec This performance counter returns the number of physical database page reads issued.
Information:
80 - 90 physical database page reads per second is normal.
Possible problems:
Returned values that are high could indicate indexing or memory constraint.
Remediation:
Attempt to tune the application so that fewer I/O operations are required. For example,
perhaps I/O operations would be reduced if there were the appropriate indexes, or if
the database design were de-normalized. If the applications cannot be tuned, you need
to acquire disk devices with more capacity. Because physical I/O operations are
expensive, you may be able to minimize the cost either by using a larger data cache,
intelligent indexes, more efficient queries, or by changing the database design.
Page Definition:
Lookups/ This performance counter displays the number of page splits per second that occur as
Batch the result of overflowing index pages.
Request
794
Information:
(Page lookups/sec) / (Batch Requests/sec) > 100.
Possible problems:
When the ratio of page lookups to batch requests is much greater than 100, this is an
indication that while query plans are looking up data in the buffer pool, these plans are
inefficient.
Remediation:
Identify queries with the highest amount of logical I/O's and tune them.
Page Definition:
Writes/sec This performance counter returns the number of physical database page writes issued.
Information:
80 - 90 physical database page writes per second is normal.
Possible problems:
If the returned values are high, you should check the Lazy Writer/sec monitor.
Page Definition:
Faults/sec This performance counter returns the average number of pages faulted per second.
Information:
This performance counter gives an idea of how many times information being
requested is not where the application expects it to be. The information must either be
retrieved from another location in memory or from the pagefile. While a sustained value
may indicate trouble, you should be more concerned with hard page faults that
represent actual reads or writes to the disk. Disk access is much slower than RAM.
Possible problems:
Any measurement higher than zero delays response time and probably indicates that
more RAM is needed.
Remediation:
Add additional memory to your SQL server.
Page Definition:
Splits/Batch This performance counter displays the number of page splits per second that occur as
Request the result of overflowing index pages.
795
Information:
The returned value needs to be low as possible.
Possible problems:
High values could mean poor table or index design.
Remediation:
If the number of page splits is high, consider increasing the Fill Factor of your indexes.
An increased Fill Factor helps to reduce page splits because there is more room in data
pages before it fills up and a page split has to occur. Note that this counter also
includes the new page allocations as well and does not necessarily pose a problem. The
other place we can confirm the page splits that involve data or index rows moves are
the fragmented indexes on page splits.
Page Definition:
Splits/sec This performance counter returns the number of page splits per second.
Information:
The returned value for this monitor should be as low as possible.
Possible problems:
Returned values that are high can indicate the overflowing of index pages. A high value
for this counter is not bad in situations where many new pages are being created, since
it includes new page allocations.
Remediation:
To avoid Page Splits, review the table and index design so as to reduce non-sequential
inserts. You can also implement Fillfactor and Pad_Index to leave more empty space per
page.
Page Life Definition:

Expectancy This performance counter returns the number of seconds a page stays in the buffer
pool without references.

796
Information:
This performance monitor reports, on average, how long data pages are staying in the
buffer.
Possible problems:
If this value gets below 300 seconds, this is a potential indication that your SQL Server
could use more memory in order to boost performance. Consistently having pages that
stay in memory for less than that amount of time may indicate the need for more
memory.
Remediation:
Add additional memory to your SQL server.
Database Definition: This metric tells you the number of database pages that are currently being
Pages occupied in the data cache.
Information:
The higher the buffer manager Database Pages is, the less room there is for SQL Server
to cache more data pages. This means that SQL Server may have to free up data cache
pages order to make room for pages being moved in from disk to the data cache, which
can increase disk IO and hurt performance. There are no specific thresholds for this
counter as each server is different. Instead, watch baseline values and look for sudden
changes in the baseline value.
Possible problems:
If the value for this performance counter increases above its typical baseline value, this
may indicate memory pressure for the SQL Server instance.
Remediation:
Investigate buffer management and disk I/O.
Free Definition:
Memory The amount of memory available for SQL Server to use.
Note: This
performance
counter is
only available
in SQL Server
2012.
797
Information:
When SQL Server is using memory dynamically, it queries the system periodically to
determine the amount of free memory. Maintaining this free memory prevents the
operating system (OS) from paging. If less memory is free, SQL Server releases memory
to the OS. If more memory is free, SQL Server may allocate more memory. SQL Server
adds memory only when its workload requires more memory; a server at rest does not
increase the size of its virtual address space. The returned value should be as high as
possible.
Possible problems:
If Resource Semaphore does not find enough free memory, then it puts the current
query into the waiting queue.
Remediation:
l Increase RAM
l Increase SQL Server’s Max Server Memory
l Consider OS requirements and other instances
Free Pages Definition:

This performance counter displays the total number of pages on all free lists.
Information:
This is not main indicator of memory problems and could only used as signal of possible
memory pressure.
Possible problems:
If this performance counter is critical and other memory counters are good, it is possible
that there are no problems with memory.
Remediation:
Check other memory counters. If they have critical values, you may try to install
additional memory into SQL server.
Zooming
the resource.
798
Processes and Services
This resource provides detailed information about the active processes and services associated with the
database selected. Hovering over a component gives you detailed information about that component.
n Component Name: Name of the listed component.

n Process Name: Name of the listed process and its ID value.
n CPU Load: Percentage of the CPU that the listed process/service is currently using.
n Memory Used: Memory currently being used by the listed process/service.
n Physical: RAM currently being used by the listed process/service.
n Virtual: Virtual memory currently being used by the listed process/service.
n IOPS: Current amount of Input/Output data being processed per second.
799
Sessions
This resource displays the current number of sessions.
Sessions include both connections and internal background processes like ghost cleanup , checkpoint, and
so on. There is a close correlation between connections and sessions, but they are not necessarily the
same.
The icons of the listed performance counters in the Statistic Name column changes color to reflect the
Active Definition:
Sessions A current connection that is actively processing.
800
Information:
To find information about an active session, Use Sp_Who2 Active or Sys.Dm_Exec_Sessions
(Available in SQL 2005 or greater).
Possible problems:
Blocking session.
Remediation:
Wait until blocking clears or kill the session. If killed, the process would roll back changes. If
there are many changes, it could take a while to roll-back.
Inactive Definition:
Sessions A current connection that is not currently processing.
Information:
To find information about an inactive sessions, use Sp_Who2.
Possible problems:
Blocking session.
Remediation:
Kill the session if blocking a process needs to finish. If killed, the process would roll back
changes. If there are many changes, it could take a while to roll-back.
System Definition:
Sessions A System initiated connection.
Information:
Normally these numbers are less than 50.
Possible problems:
Blocking session.
Remediation:
Do not kill system sessions.
User Definition:
Sessions A user initiated connection.
801
Information:
Normally these numbers are greater than 50.
Possible problems:
Blocking session.
Remediation:
Kill the session if blocking a process needs to finish. If killed, the process rolls back changes.
If there are many changes, it could take a while to roll-back.
Zooming
the resource.
802
SQL Agent Job Status
The SQL Agent is a Microsoft Windows service that executes scheduled administrative tasks known as
"jobs" in SQL Server. This resource shows the status and details of these jobs.
The data can be sorted by clicking the headers of each column.
n Job Name: Displays the name of the listed job.

n Last Run: Displays the date and time the listed job was last run.
n Duration: Displays the amount of time the listed job took to complete.
n Outcome: Displays the result from having run the listed job.
SQL Agent Job information is used to provide metrics for this resource and cannot be edited.
803
SQL Errors
This resource displays SQL events that have occurred on the current SQL instance. The data can be sorted
by clicking the headers of each column.
n Date/Time: Displays the date and time that the error occurred.
n Error Message: Displays the error message that occurred at the listed date and time.
804
SQL Event Log Message Details
This resource displays the SQL event log messages while providing a search window and a filter. The filter
allows you to choose which types of log messages you want to display. The data can be sorted by clicking
the headers of each column. This resource shows only Error and Warning events specific to the monitored
SQL instance.
The filter, Information, will not list any events. This is by design and is an accidental by-product of
an earlier resource that was implemented.
Clicking any event message in the list will open a new window, displaying the entire message.
805
SQL Server
This resource shows the status of SQL server counters that warrant a view independent of grouped
resources.
The icons of the listed performance counters in the Statistic Name column changes color to reflect the
806
Batch Requests/sec Definition:

This performance counter returns the number of Batch Requests that SQL Server

receives per second.
807
Information:
The values this monitor returns generally follows in step as to how busy your
server's CPUs are. From a network bottleneck approach, a typical 100Mbs network
card is only able to handle about 3,000 batch requests per second.
Possible problems:
Generally speaking, over 1,000 batch requests per second indicates a very busy
SQL Server. If this is the case, you may soon experience a CPU bottleneck, if you
are not already. Of course, this is a relative number, and the more powerful your
hardware, the more batch requests per second your SQL Server can handle.
Sometimes low Batch Requests/Sec can be misleading. If there were a SQL

Statements/sec counter, this would be a more accurate measure of the amount of
SQL Server activity. For example, an application may call only a few stored
procedures, yet each stored procedure does a great deal of work. In this case, we
see a low number for Batch Requests/sec, but each stored procedure (one batch)
executes many SQL statements that drive up CPU and other resources. As a
result, many counter thresholds based on the number of Batch Requests/sec
seems to identify issues because the batch requests on such a server are
unusually low for the level of activity on the server.
Remediation:
Check your SQL server and verify system resources are being used efficiently.
Applications other than SQL may be using unnecessary system resources. Try and
recover memory by closing unnecessary applications. Installing additional
memory and upgrading your hardware should solve this problem.
SQL Definition:
Compilations/sec This performance counter returns the number of times per second that SQL
Server compilations have occurred.

Information:
This value should be as low as possible.
Possible problems:
If you see a high value, say above 100, then this can be an indication that there
are a great deal of ad hoc queries that are running which may cause increased
CPU usage.
Remediation:
Re-write the running ad hoc queries as stored procedures or use the following
command: sp_executeSQL.
808
SQL Definition:
Recompilations/sec This performance counter returns the number of SQL statement recompiles that
are triggered per second.

Information:
When an execution plan is invalidated due to some significant event, SQL Server
re-compiles it. Re-compiles like compiles, are expensive operations so you want to
minimize the number of re-compiles. Ideally you want to keep this counter less
than 10% of the number of Compilations/Sec. In other words, keep this value as
low a possible.
In SQL Server 2000, when SQL Server recompiles a stored procedure, the entire
stored procedure is recompiled, not just the statement that triggered the
recompilation. In SQL Server 2008 and SQL Server 2005 SP3, the behavior is
changed to statement-level recompilation of stored procedures. When SQL Server
2008 or SQL Server 2005 SP3 recompiles stored procedures, only the statement
that caused the recompilation is compiled, not the entire procedure. This uses
less CPU bandwidth and results in less contention on lock resources such
as Compile locks.
Possible problems:
Returned values that are high can indicate deadlocks and compile locks that are
not compatible with any locking type.
Remediation:
Recompilation can happen for various reasons, such as: Schema changed;
Statistics changed; Deferred compile; Set option changed; Temporary table
changed; Stored procedure created with the Recompile query hint or using
the Option (Recompile).
n If the recompile occurred because a Set option changed, use SQL Server

Profiler to determine which Set option changed. Avoid changing Set options
within stored procedures. It is better to set them at the connection level.
Ensure that Set options are not changed during the lifetime of the
connection.
n Recompilation thresholds for temporary tables are lower than for normal
tables. If the recompiles on a temporary table are due to statistics changes,
you can change the temporary tables to table variables. A change in
the cardinality of a table variable does not cause a recompilation. The
drawback of this approach is that the query optimizer does not keep track
of a table variable’s cardinality because statistics are not created or
maintained on table variables. This can result in non-optimal query plans.
Test the different options and choose the best one.
809
n Another option is to use the Keep Plan query hint. This sets the threshold of
temporary tables to be the same as that of permanent tables.
The EventSubclass column indicates that “Statistics Changed” for an
operation on a temporary table.
n To avoid recompilations that are due to changes in statistics (for example,
when the plan becomes suboptimal due to change in the data statistics),
specify the KeepFixed Plan query hint. With this option in effect,
recompilations can only happen because of correctness-related reasons (for
example, when the underlying table structure has changed and the plan no
longer applies) and not due to statistics. An example might be when a
recompilation occurs if the schema of a table that is referenced by a
statement changes, or if a table is marked with the sp_recompile stored
procedure.
n Turning off the automatic updates of statistics for indexes and statistics
that are defined on a table or indexed view prevents recompiles that are
due to statistics changes on that object. Note, however, that turning off
the Auto-Stats feature by using this method is usually not a good idea. This
is because the query optimizer is no longer sensitive to data changes in
those objects and suboptimal query plans might result. Use this method
only as a last resort after exhausting all other alternatives.
n Batches should have qualified object names (for example, dbo.Table1) to
avoid recompilation and to avoid ambiguity between objects.
n To avoid recompiles that are due to deferred compiles, do not
interleave DML and DDL or create the DDL from conditional constructs such
as If statements.
n Run Database Engine Tuning Advisor (DTA) to see if any indexing changes
improve the compile time and the execution time of the query.
n Check to see if the stored procedure was created with the With
Recompile option or if the Recompile query hint was used. If a procedure
was created with the With Recompile option, in SQL Server 2005 SP3, you
may be able to take advantage of the statement level Recompile hint if a
particular statement within that procedure needs to be recompiled. This
would avoid the necessity of recompiling the whole procedure each time it
executes, while at the same time allowing the individual statement to be
compiled.
Auto-Param Definition:
Attempts/sec: This monitor returns the number of auto- parameterization attempts per second.
810
Information:
The total for this monitor should be the sum of the failed, safe, and unsafe auto-
parameterizations. Auto-parameterization occurs when an instance of SQL Server
tries to parameterize a Transact-SQL request by replacing some literals with
parameters so that reuse of the resulting cached execution plan across multiple
similar-looking requests is possible. Note that auto-parameterizations are also
known as simple parameterizations in newer versions of SQL Server. This counter
does not include forced parameterizations.
Possible problems:
Bad T-SQL coding practices can increase recompilation frequency and adversely
affect SQL Server's performance. Such situations can be debugged and corrected
in many cases.
Longest Definition:
Transaction The performance counter displays the length of time, in seconds, the transaction
Running Time that has been running the longest, has been active.
Information:
Transactions that run longer than others use more resources. They can be used
to track down procedures and calls that are taking longer than expected by
identifying the specific transaction(s).
Possible problems:
Long running transactions can prevent truncation of transaction logs. This can
cause the transaction log files to grow until they consume all available physical
disk space shutting down access to the database.
Remediation:
Check the functionality of the query and/or redesign the long running
transaction.
Failed Auto- Definition:

Params/sec This monitor returns the number of failed auto- parameterization attempts per
second.

Information:
The value returned by this monitor should be low. Note that auto-
parameterizations are also known as simple parameterizations in later versions of
SQL Server. Preferred values should be near zero.
Possible problems:
Bad T-SQL coding practices can increase recompilation frequency and adversely
affect SQL Server's performance. Such situations can be debugged and corrected
in many cases.
811
Full Scans/sec Definition:
This performance counter returns the number of Full Scans on base tables or

indexes.
Information:
This is the number of unrestricted full scans per second. These can be either
base-table or full-index scans.
Possible problems:
Values greater than 1 or 2 indicate table/Index page scans are occurring. If the
CPU is running high, you should investigate the cause as related to this counter
measurement. You can rule this out as a problem if the full scans are on small
tables.
Remediation:
Following are a few of the main causes of high Full Scans/sec:
n Missing indexes
n Too many rows requested; Queries with missing indexes or too many rows
requested have a large number of logical reads and an increased CPU time.
n Scans are IO-intensive and should run within your databases minimally.
Identify the tables that have a large number of scans against them. Review
the fill factor you have set up on your indexes and minimize it where
appropriate.
Range Scans/sec Definition:

This performance counter returns the number of Qualified Range Scans through

indexes per second.
Information:
This monitor returns the number of qualified range scans through indexes per
second.
Plan Re-Use Definition:

A query plan is used to execute a query.

Information:
Plan re-use is desirable for OLTP workloads because re-creating the same plan
(for similar or identical transactions) is a waste of CPU resources.
812
Possible problems:
Zero cost plans are not be cached (not re-used) in SQL 2005 SP2. Applications that
use zero cost plans have a lower plan re-use but this is not a performance issue.
Remediation:
Review your plan re-use design. Tune your plan re-use design as it is described in
the following article: http://sqlmag.com/sql-server/fine-tuning-plan-reuse.
Probe Scans/sec Definition:

This performance counter returns the number of Probe Scans, per second, that

are used to find at most, one single qualified row in an index or base table
directly.
Information:
Recompilations/ Definition:
Compilations This performance counter shows the ratio of SQL Recompilations to SQL
Compilations.
Information:
SQL Recompilations should be less than 10% of SQL Compilations.
Possible problems:
Returned values that are high can indicate more temporary tables in use.
Remediation:
Change stored procedures to not change schemas, Use table variables instead of
temporary tables
Compilations/ Definition:
Recompilations/sec Monitoring the number of query compilations and recompilations and the
number of batches received by an instance of SQL Server gives you an indication

of how quickly SQL Server is processing user queries and how effectively the
query optimizer is processing the queries.
Information:
Compilation is a significant part of a query's turnaround time. In order to save the
compilation cost, the Database Engine saves the compiled query plan in a query
cache. The objective of the cache is to reduce compilation by storing compiled
queries for later reuse, therefore ending the requirement to recompile queries
when later executed. However, each unique query must be compiled at least one
time.
Compilations/sec divided by 10 minus recompilations/sec.
813
Possible problems:
Query recompilations can be caused by the following factors:
n Schema changes, including base schema changes such as adding columns

or indexes to a table, or statistics schema changes such as inserting or
deleting a significant number of rows from a table.
n Environment (Set statement) changes. Changes in session settings such as
Ansi_Padding or Ansi_Nulls can cause a query to be recompiled.
Zooming
the resource.
814
Top 10 Databases by Active User Connections
This resource graphically shows the number of users per database for the top 10 most active databases.
The colors of the chart correspond to the labels in the legend, which indicate the most active databases.
The performance counter, Top Active Sessions with Statistics, is used to provide metrics for this
resource and cannot be edited.
Expanding the tree by clicking [+] will provide details about the users, host, length of connection
and idle time, as well as the number of bytes transferred during that time.
815
Top 10 Most Expensive Queries by CPU Time
This resource displays the top 10 most expensive queries sorted by the length of time the CPU spent
processing the listed query.
When viewing this resource from the Summary tab on the Application Details page, queries are listed for
the entire SQL Server instance. Conversely, when this same resource appears on the Database Details
view, queries are only listed for that specific database.
The data can be sorted by clicking the headers of each column. Additionally, this resource can optionally
show Top Queries by I/O by clicking Edit in this resource and making the necessary adjustments.
The resource is filtered based on the settings found on the Queries tab in Details view in the Most
Expensive Queries resource.
n Query Text: The text shown is a preview of the full query. To view an entire query in the list, click [+]
next to the query listed to expand and view the query.
Note: Clicking any listed query takes you to the Most Expensive Queries resource on the Queries tab,
providing greater detail about the query.
n CPU Time: Display the time, in milliseconds, the listed query took to complete.
n Database: Displays the database with which the listed query is associated. The icon in this column
shows the current state of the listed database.
816
The performance counter, Top Expensive Queries, is used to provide metrics for this resource and
cannot be edited.
817
AppInsight for SQL Details View
The Queries tab provides detailed insight into the most expensive queries running on your SQL instance.
cannot be edited.
818
Most Expensive Queries
This resource provides detailed insight into the most expensive queries running on your SQL database.
Queries for this view can be filtered by Time, Host, Database, and Login using the filter drop down menus
at the top of the window.
The filters used here are also be applied to the Top 10 Most Expensive Queries by CPU Time
resource found on the Summary tab in the Details view.
To view an entire query in the list, hover the mouse over a query, or click [+] next to the query listed to
expand and view the query.
This resource remains empty when polling of queries is disabled.
n SPID: Server Process ID of the listed query.
n Plan Count: Displays the number of cached query plans for the listed query. A large number might
indicate a need for explicit query parameterization.
n Executions: Displays the number of times the listed query was executed.
n CPU Time: Displays the amount of time, in milliseconds, that the listed query took to complete.
n Phys. Read: This field returns the number of physical reads. Physical reads are reads that require
reading directly from disk. Physical reads are substantially slower than reading from the cache or
from RAM.
n Logical Reads: Displays the number of times data was read from the cache.
n Logical Writes: Displays the number of times data was written to the cache.
819
n Average Duration: This displays the length of time it took, in milliseconds, to execute the listed
query averaged by the number of executions.
n Bytes Transferred: Number of bytes transferred during the query.
n Login: Displays the current login information for the listed database.
n Host: Displays the host for the listed database.
n Database: Displays the current name for the listed database. Clicking any database in the list will
take you to the Database Details page.
820
Database Details View
The Database Details view provides a great deal of information about the current database and can be
accessed by clicking any listed database.
Important: A high number of databases monitored on a single SQL instance using AppInsight for
SQL can cause job timeout issues. To alleviate this problem, try increasing the timeout value. If this
does not resolve the issue, reduce the number of visible databases by granting view permissions to
the user account used for polling only for the databases you want to see.
Navigate to the Database Details view
1. On the Web Console, click to the AppInsight for SQL Details view.
2. From the All Databases resource, click any database in the list.
The available resources unique to this view include:
n Active User Connections

n Connections
n Database Availability
n Database Details
n Database Disk I/O
n Database Size by File
n Log Flushes
n Processes and Services
n Storage
n Top 10 Clustered Indexes by Fragmentation
n Top 10 Most Expensive Queries by CPU Time
n Top 10 Nonclustered Indexes by Fragmentation
n Top 10 Tables by Size
n Transaction Log Disk I/O
n Transaction Log Size by File
821
Active User Connections
This resource provides detailed information about the active user connections associated with the
database selected. Data can be sorted by clicking the headers of each column.
n Login: This displays the login information for the listed user connection.
n Host: This displays the type of host associated with the listed user connection.
n Connection Duration: This displays the length of time the listed user connection has been
connected.
n Idle Time: This displays the length of time the listed user connection has been idle.
n Bytes Transferred: This displays the number of bytes transferred for the listed user connection.
The performance counter, Top Active Sessions with Statistics, is used to provide metrics for this resource
and cannot be edited.
822
Connections
This resource shows the status of your current database connections. The icons of the listed performance
counters in the Statistic Name column change colors to reflect the listed counter's current state. Clicking
any performance counter in the Statistic Name column takes you to the Performance Counter Details page
for that performance counter.
User Definition:
Connections The User Connections performance counter identifies the number of different users
that are connected to your SQL Server at the time the sample was taken.
Information:
823
You need to watch this performance counter over time to understand your baseline user
connection numbers. Since each user connection consumes some memory space, a high
number of user connections can impact throughput and cause a performance slow-
down. Once you have an idea of your high and low thresholds during normal usage of
your system, you can then look for times when this counter exceeds these high and low
marks.
Possible problems:
If the returned value of this performance counter goes down and the load on the system
remains stable, you might have a bottleneck that is not allowing your server to handle
the normal load. Keep in mind that this counter value might go down just because less
people are using your SQL Server instance. If you see this number jump by 500% from
your baseline, you may be seeing a slowdown of your server activity.
Remediation:
You may want to boost the SQL Server configuration setting, Maximum Worker Threads
to a figure higher than the default setting of 255. The setting for Maximum Worker
Threads should be higher than the maximum number of user connections your server
ever reaches.
Logins/sec Definition:
This performance counter returns the total number of logins started, per second, and
does not include pooled connections.
Information:
Opening and closing connections is an expensive process. A pooled connection is one
which is kept open by an application for other requests to re-use.
Possible problems:
connection pooling.
Remediation:
Logout/sec Definition:
This performance counter returns the total number of logout operations started, per
second.
824
Information:
Opening and closing connections is an expensive process. When applications do not use
a connection pool, each request needs to establish its own connection before the query
can be executed. It then has to close it. A pooled connection is one which is kept open
by an application for other requests to re-use.
Possible problems:
connection pooling.
Remediation:
Zooming
the resource.
825
Database Availability
This resource graphically shows the various states of availability for the current database in a percentage
format. This chart is made up of three sections: the legend, the main chart, and the lower chart. The colors
of the main chart correspond to the labels in the legend.
Clicking Edit lets you change the default zoom range, the amount of historical data loaded, and set the
sample interval time period, as well as reveal the Advanced section. Expanding the Advanced section lets
you to change the defaults of the titles from macros to anything you want.
Zooming
You can have the chart show a predetermined, hourly time period of data by clicking on any one of the
three Zoom buttons; 1h, 12h, or 24h. Alternatively, you can have the chart show a specific time range by
dragging the mouse over a small area of the chart.
826
time period the mouse is hovering over.
827
Database Details
This resource provides tools and details concerning the current database.
n Management: This provides tools allowing you to more easily manage and troubleshoot the current
application.
n Database Name: Displays the name of the current database.
n Performance Status: Displays the status of the current database.
n Operational State: Displays whether or not the database is currently online.
n Recovery Model: Displays the type of recovery model employed on the listed database. This can be
either, Simple, Full, or Bulk-Logged. For more information, refer to the following MSDN article:
http://msdn.microsoft.com/en-us/library/ms175987(v=sql.105).aspx
n Collation: Displays the method of sorting used by the database. (In the above image, Latin1 means
the server treats strings using Charset Latin 1, i.e. ASCII. CI means Case Insensitive. AS means Accent
Sensitive ('ü' does not equal 'u')).
828
n Compatibility Level: Displays the compatibility level of the current database. The value displayed in
this field correlates to the bulleted table below:
n 60 = SQL Server 6.0
n 80 = SQL Server 2000
n Last Backup: Displays the date and time of the last successful backup for the current database.
n High Availability Group: Displays the database mirroring status and details of the mirrored
database, if available.
829
Database Disk I/O
This resource displays the status, as well as I/O metrics, for your current database file. The icons of the
listed performance counters in the Statistic Name column change to reflect the listed counter's current
state. Clicking any volume in the Volume column takes you to the Volume Details page for that counter.
n File Path: Displays the full path of the listed database.

n Volume: Displays the name of the volume of the current database. Clicking a listed volume takes you
to the Volume Details page.
n Disk Queue Length: This is the number of both read and write requests that were queued for the
selected disk during the sample interval.
n Total IOPS: Displays the current total read and write I/O operations occurring for the database
logical volume. High I/O may be normal for some databases, but excessively high I/O leads to higher
queue lengths, meaning there are more requests for disk reads or writes than the storage
subsystem can handle simultaneously.
n Latency: Displays a measurement of disk latency occurring on the disk where the database resides.
High latency values indicate sluggish database performance
The performance counter, Database Files, is used to provide metrics for this resource. It is used in
combination with volume polling. This counter is not listed in the resource; however, the thresholds can be
changed.
Change thresholds for the Database Files performance

counter
1. From the Database Details view, locate the Database Files resource and click Edit in the Management
field.
2. Locate the Database Files performance counter and click [+] to expand the counter and reveal the
counter details.
3. Click Override Template and adjust the thresholds to suit your needs.
830
Database Size by File
This resource lists the current databases sorted by file size. Moving the mouse over the Database Usage
percent value reveals a tooltip with more detailed information about that database. Clicking the value
takes you to the Custom Chart resource page. If the Warning or Critical thresholds is breached, the color of
the bar chart changes from green to yellow or red, respectively.
n File Path: Displays the full path of the listed database.

n Auto-Growth: Displays the Auto-growth status of the listed database.
n File Size: Displays the size of the listed database in megabytes.
n Database Usage: Depending on how your database is configured, this value is showing you how
close you are to running out of space. If your database is configured as a fixed size, auto-grow, or a
restricted auto-grow, the percentages relate to what is going to cause your database to run out of
space.
n Volume Usage: The value returned is the database file usage in relation to the space remaining on
the volume.
Database Files is used to provide metrics for this resource. This counter is not listed in the resource;
however, the thresholds can be changed.

counter
field.
counter details.
831
Log Flushes
This resource contains monitors specific to the current status of log flushes for the current database. The
icons of the listed performance counters in the Statistic Name column change colors to reflect the listed
counter's current state. Clicking any performance counter in the Statistic Name column takes you to the
Performance Counter Details page for that performance counter.
Log Bytes Definition:

Flushed/sec This performance counter shows the average log bytes flushed per second for the current
database since the last data point.
Information:
The value returned helps identify trends of the transaction log. A log flush happens when
data is written from the log cache to the transaction log on disk, each time a transaction
happens.
Note: This is not available in SQL 2012.
832
Possible problems:
The rate at which log records are written to the disk. This is the log generation rate of the
application. It plays a very important role in determining database mirroring
performance. This counter is in the Databases performance object.
Log Bytes Flushed/sec can indicate many small transactions leading to high mechanical
disk activity.
Remediation:
Look at the statements associated with the log flush and determine if the number of log
flushes can be reduced. When a single transaction is used, the log records for the
transaction can be bundled and a single, larger write can be used to flush the gathered
log records. The mechanical intervention is significantly reduced. It is not recommended
that you increase your transaction scope. Long-running transactions can lead to excessive
and unwanted blocking as well as increased overhead.
Log Definition:
Flushes/sec This performance counter returns the number of log flushes per second, averaged since
the last collection time.
Information:
A log flush happens when a transaction is committed and data is written from the log
cache to the transaction log file. The log cache is a location in memory where SQL Server
stores data to be written to the log file. This is used to roll back a transaction before it is
committed. Once complete, the log cache is flushed to the physical log file on the disk.
Generally speaking, log flushes per second should parallel the number of transactions
per second.
Possible problems:
If the returned value is higher than expected, check your use of explicit transactions in
your queries.
Remediation:
Explicitly define the start and end of your transactions. This should reduce the number of
log flushes, and reduce the impact on I/O. Also check the Log Bytes Flushed/Sec monitor.
Log Flush Definition:

Waits/sec This performance counter returns the number of commits, per second, waiting for the log
flush.
Information:
Possible problems:
A high number of Log Flush Waits can indicate that it is taking longer than normal to flush
the transaction log cache. This slows the performance of your SQL Server.
833
Remediation:
Check the value of the Disk avg. Write time monitor. If the returned value is greater than
5ms, then this can indicate that there is an I/O bottleneck. Move your transaction log file
to a disk drive separate from your data files. This should increase performance since
there is no access competition on the same disk. Consider upgrading to RAID 10 for
transaction log storage. Also, adding spindles to your RAID array should increase
performance.
Log Flush Definition:

Wait Time This performance counter returns the total wait time (in milliseconds) to flush the log to
the transaction log file.
Information:
On an AlwaysOn secondary database, this value indicates the wait time for log records to
be hardened to disk.
Percent Log Definition:

Used This performance counter returns the percentage of space in the log that is in use.
Information:
This is the size of the transaction log that actively contains data in relation to the total
physical size on disk of the log file.
Possible problems:
If the log file is 100% used, it attempts to increase its size. If there is not sufficient disk
space to accommodate the growth, the database stops functioning.
Remediation:
Perform a transaction log backup to truncate the log.
Zooming
the resource.
834
Storage
This resource contains monitors specific to the current storage status of the current database. The icons of
the listed performance counters in the Statistic Name column change colors to reflect the listed counter's
835
Backup/ Definition:
Restore This performance counter shows the Read/Write throughput for backup and restore
Throughput/sec operations of a database per second.
Information:
836
You can measure how the performance of the database backup operation changes
when more backup devices are used in parallel, or when faster devices are used.
Throughput of a database backup or restore operation allows you to determine the
progress and performance of your backup and restore operations. There are no
thresholds associated with this performance counter.
Log Cache Definition:

Reads/sec This performance counter returns the amount of Reads performed per second
through the Log Manager cache.
Total Size Definition:

This performance counter returns the total size of the database including white
space.
Possible problems:
Running out of storage space.
Remediation:
Shrink the database if free space is running low.
Log File(s) Size Definition:

This performance counter shows the cumulative size (in kilobytes) of all the
transaction log files in the database.
Information:
Every transaction in the database is logged to the Transaction log. This is useful
during recovery in the event of data loss. Information about the log file is shown
under the Files section of the Database Overview page in SQL Server Management
Studio.
The size of this file is based on the logging level set for the database. By default, a
new database uses Full Recovery Mode or the recovery mode that the model
database is set up as. Transactions in the log file are only removed when a complete
backup or transaction log backup is initiated. This enables pinpoint recovery for
critical applications. Be aware that if the transaction log is not backed up on a
regular basis, the log grows until your disk is completely full. The transaction log
should be adjusted to a reasonable size. This depends on the number of
transactions you expect, and how often you perform backups.
Set the correct Autogrowth properties: The default of 10% Autogrowth for data and
log files should be enough for low use databases. Conversely, a 500 MB Autogrowth
rate may be better suited for a busy database, preventing a large I/O impact caused
by normal Autogrowth operations.
837
Possible problems:
If the returned value occasionally drops to zero, this can indicate a problem with the
following file: sys.master_files. This file is what the SQL Monitor uses to collect data.
Note: With Simple Recovery Model, fast writing to the transaction log triggers
Autogrowth.
Remediation:
If you are performing a insert operation, you should consider switching the recovery
model to Bulk Logged for the insert.
n If you do not need pinpoint recovery, it is recommended you switch to Simple

Recovery model.
n If your database is configured with the Full or Bulk Logged recovery model,
back up the log on a regular basis so it can be truncated to free up log space.
Note: This action removes inactive virtual log files, but does not reduce the file size.
Data File(s) Size Definition:

This performance counter shows the cumulative size (in kilobytes) of all the data
files in the database including any automatic growth.
Information:
Monitoring this counter is useful for determining the correct size of tempdb. The
value returned from this monitor reports the size of your database (not including
the Transaction log). Information about distinct primary data files and secondary
data files is shown under the Files section of the Database Overview page in SQL
Server Management Studio.
Having a file size increase on demand is expensive and degrades performance

significantly. Autogrowth should only be used to let a database increase in size if
you are running out of disk space. Autogrowth should not be used to manage your
MDF size increases. Data files should be sized properly when they are initially
created to meet the expected growth. This also helps avoid fragmentation, which
leads to better database performance.
Possible problems:
Be wary of large and unusual increases to the size of your data files. Generally
speaking, your database should be sized to minimize Autogrowth. An increase in
size is expensive concerning I/O. Additionally, this fragments your data and log files.
If the returned value occasionally drops to zero, this can indicate a problem with the
following file: sys.master_files. This file is what the SQL Monitor uses to collect data.
Remediation:
n Ensure that Full Recovery Mode is used for your databases and that you
regularly backup everything, including the transaction log.
838
n Manually add space as data increases in size. It is recommended that you
have approximately one year of space available for data growth. If this is not
possible, move the database to a higher capacity drive or simply upgrade the
drive.
Note: Compressing files causes fragmentation and is therefore not
recommended.
Shrink Space Definition:

This is essentially the white space in the database that can be reclaimed by
compacting/shrinking the database.
Information:
Shrinking data files recovers space by moving pages of data from the end of the file
to unoccupied space closer to the front of the file. When enough free space is
created at the end of the file, data pages at end of the file can de-allocated and
returned to the file system.
Possible problems:
Data that is moved to shrink a file can be scattered to any available location in the
file. This causes index fragmentation and can slow the performance of queries that
search a range of the index.
Remediation:
To eliminate the fragmentation, consider rebuilding the indexes on the file after
shrinking.
Average Definition:
Bytes/Read Perfmon captures the total number of bytes sent to the disk (write) and retrieved
from the disk (read) over a period of one second.

Information:
The Disk Read Bytes/sec and the Disk Write Bytes/sec performance counters break
down the results displaying only read bytes or only write bytes, respectively.
Average Definition:
Bytes/Write Perfmon captures the total number of bytes sent to the disk (write) and retrieved
from the disk (read) over a period of one second.
Information:
The Disk Read Bytes/sec and the Disk Write Bytes/sec performance counters break
down the results displaying only read bytes or only write bytes, respectively.
Average Read Definition:

Latency This performance counter indicates the response time of the disk – how long it takes
for a read request to get acknowledged by the disk.
839
Information:
The average read latency should be less than 20ms for database files.
Average Write Definition:

Latency Avg. Disk sec/Write is the average time, in seconds, to write data to the disk.
Information:
This analysis determines if any of the physical disks are responding slowly.
Possible problems:
If the response times are greater than .015 (15 milliseconds), then the disk
subsystem is keeping up with demand, but does not have much overhead left.
If the response times are greater than .025 (25 milliseconds), then noticeable slow-
downs and performance issues affecting users may be occurring.
Records/sec This performance counter returns the number of records per second fetched
through forwarded record pointers.

Information:
Heaps have one interesting feature - forwarded records. If a record needs to be
updated and the updated record size is greater than the current record size, and
there is no space on the page to fit the new record in, then we have two options:
1. Move the record to a new page and change all the non-clustered index
records that point to it to point to the new location of the record.
2. Move the record to a new page and leave a forwarding record in the original
location to point to the new location.
Possible problems:
This is one drawback of using heaps - all the extra space that is wasted with the
Forwarding/Forwarded Records. Another drawback is that when scanning through
the heap, forwarding records have to be followed immediately (as opposed to
ignoring them and just reading the forwarded records when they are encountered).
This is to vastly reduce the possibility of read anomalies such as non-repeatable
reads or missed rows if a row moves before the scan point during a scan.
Remediation:
Once a data table (heap) includes forward pointers, there is only one way to get rid
of them : Table Reorg. There are a few options to do this:
n The simplest one would be to create a clustered index on the data table and
drop it again.
840
n To avoid forward pointers entirely, create a clustered index from the
beginning. A clustered index keeps the data rows in its leaf node level.
Therefore the data is always sorted according to the index keys and forward
pointers are not used. This is like a continuous online Reorg in this regard.
Log Cache Definition:

Reads/sec This performance counter displays the number of Reads performed per second
through the Log Manager cache.

Information:
Log Cache Hit Definition:

Ratio This performance counter returns the percentage of Log cache reads satisfied from
the Log cache.

Information:
The log cache is used to hold information that is written to the transaction log. There
are no thresholds associated with this performance counter.
Number of Definition:
Reads/sec This performance counter returns the number of physical database page reads
issued per second.
Information:
This statistic displays the total number of physical page reads across all databases.
80 to 90 per second is normal. Anything that is above 90 indicates indexing or
memory constraint.
Possible problems:
Because physical I/O is expensive, you may be able to minimize the cost, either by
using a larger data cache, intelligent indexes, and more efficient queries, or by
changing the database design.
Remediation:
Attempt to tune the application so that fewer I/O operations are required. For
example, perhaps I/O would be reduced if there were appropriate indexes or if the
database design were de-normalized. If the applications cannot be tuned, you need
to acquire disk devices with more capacity. Compare to the Memory: Pages/sec
performance counter to see if there is paging while the SQL Server:Buffer
Manager\Page reads/sec is high. Note: Before adjusting the fill factor, at a database
level, compare the SQL Server:Buffer Manager\Page reads/sec performance counter
to the SQL Server:Buffer Manager\Page writes/sec counter, and use the fill factor
option only if writes are a substantial fraction of reads (greater than 30 percent).
841
Number of Definition:
Writes/sec This performance counter returns the number of data pages written per second.
Information:
Page writes per second are the total number of physical writes, including checkpoint
writes, lazy writer writes, and large block writes done during index creation or bulk
copy operations.
Possible problems:
If Page Writes/sec is high, this might indicate a SQL Server performance issue.
Remediation:
If these values are high, you can try to reduce the values by tuning your application
or database to reduce I/O operations such as index coverage, better indexes,
normalization, increasing the I/O capacity of the hardware, or by adding memory.
Total Size: Definition:

Percent This value is the same as the value returned by the performance counter, Total Size
Change 24 Hrs but calculated as a percentage of change over the last 24 hours.
Information:
This metric allows users to be alerted when the database experiences sudden
growth.
Possible problems:
A database that suddenly changes in size by a high percentage could be indicative
of a problem that should be investigated.
Zooming
the resource.
842
Top 10 Clustered Indexes by Fragmentation
A clustered index determines the physical order of data in a table. This resource displays the clustered
indexes with the highest level of fragmentation. If the Warning or Critical threshold is breached, the color
of the bar chart changes from green to yellow or red, respectively.
n Table Name: Displays the name of the listed table.

n Index Name: Displays the name listed index.
n Fragmentation: Numerically and graphically displays the percentage of fragmentation of the listed
index.
The performance counter, Top Indexes for Database, is used to provide metrics for this resource. This
counter is not listed in the resource; however, the thresholds can be changed.
Change thresholds for the Top Indexes for Database

performance counter
1. From the Database Details view, locate the Database Details resource and click Edit in the
Management field.
2. Locate the Top Indexes for Database performance counter and click [+] to expand the counter and
reveal the counter details.
Changing the number of tables displayed in this

resource requires values be changed in two locations
1. In the resource, click Edit.
2. Change the value for the field: Maximum Number of Records to Display, and then click Submit.
3. Edit the application or the template that the application is based on. To edit the template which
affects applications based on it:
a. On the web console, navigate to Settings > All Settings > SAM Settings > Manage Templates.
b. Check the AppInsight for SQL application and click Edit in the toolbar.
c. Expand the Top Indexes for Database component monitor by clicking [+].
843
d. Change the value for the field, Number of Records to Retrieve and then click Submit.
4. Editing the individual application:
a. On the Web Console, click the Applications tab.

b. From the All Applications resource, click an AppInsight for SQL application to select it.
c. From the Application Details resource, click Edit Application Monitor.
d. Expand the Top Indexes for Database component monitor by clicking [+].
e. Click Override Template corresponding to the row, Number of Records to Retrieve.
f. Change the value for the field, Number of Records to Retrieve and then click Submit.
844
Top 10 Most Expensive Queries by CPU Time
This resource displays the top 10 most expensive queries sorted by the length of time the CPU spent
processing the listed query.
When viewing this resource from the Summary tab on the Application Details page, queries are listed for
the entire SQL Server instance. Conversely, when this same resource appears on the Database Details
view, queries are only listed for that specific database.
The data can be sorted by clicking the headers of each column. Additionally, this resource can optionally
show Top Queries by I/O by clicking Edit in this resource and making the necessary adjustments.
The resource is filtered based on the settings found on the Queries tab in Details view in the Most
Expensive Queries resource.
Note: Clicking any listed query takes you to the Most Expensive Queries resource on the Queries tab,
providing greater detail about the query.
n CPU Time: Display the time, in milliseconds, the listed query took to complete.
n Database: Displays the database with which the listed query is associated. The icon in this column
shows the current state of the listed database.
845
cannot be edited.
846
Top 10 Nonclustered Indexes by Fragmentation
A non-clustered index is one in which the data rows are not sorted and stored in order based on their non-
clustered keys. This resource displays the non-clustered indexes with the highest level of fragmentation. If
the Warning or Critical thresholds is breached, the color of the bar chart changes from green to yellow or
red, respectively.
n Table Name: Displays the name of the listed table.

n Index Name: Displays the name listed index.
n Fragmentation: Numerically and graphically displays the percentage of fragmentation of the listed
index.
The performance counter, Top Indexes for Database, is used to provide metrics for this resource. This
Change the thresholds for the Top Indexes for

Database performance counter
Management field.
2. Locate the Top Indexes for Database performance counter and click [+] to expand the counter and
847
Change the number of tables displayed in this resource, values must be changed in two locations
1. In the resource, click Edit, then change the value for the field: Maximum Number of Records to
Display, and then click Submit.
2. Edit the application or the template that the application is based on. To edit the template which
affect applications based on it:
a. On the Web Console, click Settings > All Settings > SAM Settings > Manage Templates.
b. Check the AppInsight for SQL application and click Edit in the toolbar.
c. Expand the Top Indexes for Database component monitor by clicking [+].
d. Change the value for the field, Number of Records to Retrieve and then click Submit.
3. To edit the individual application:
a. On the Web Console, click My dashboards > Applications.

b. From the All Applications resource, click an AppInsight for SQL application to select it.
c. From the Application Details resource, click Edit Application Monitor.
d. Expand the Top Indexes for Database component monitor by clicking [+].
e. Click Override Template corresponding to the row, Number of Records to Retrieve.
f. Change the value for the field, Number of Records to Retrieve and then click Submit.
848
Top 10 Tables by Size
This resource displays the current database tables in order based on size. If the Warning or Critical
thresholds is breached, the color of the bar chart changes from green to yellow or red, respectively.
n Name: Displays the name of the listed table of the current database.
n Size: Displays the size of the listed table of the current database.
n % Used by Index: Displays the percentage of the table space used by the index.
n Total Row Count: Displays the total number of rows in the listed table of the current database.
The performance counter, Top Tables for Database, is used to provide metrics for this resource. This
Change thresholds for the Top Tables for Database

performance counter
Management field.
2. Locate the Top Tables for Database performance counter and click [+] to expand the counter and
849
Transaction Log Disk I/O
This resource lists the current status of the transaction log file. The icons of the Volume column changes to
reflect the listed volume's current state. Clicking the volume takes you to the Volume Details page.
n File Path: Displays the full path where the transaction log file resides.
n Volume: Displays the volume where the transaction log file resides. Clicking on the volume name
takes you to the Volume Details View.
n Disk Queue Length: Displays the current disk queue length for the listed volume as seen on the
Volume Details view. Queue lengths that are high for a sustained period of time are indicative of disk
I/O performance issues that can negatively impact the database.
n Total IOPS: Displays the current total read and write IO operations occurring on the drive where the
database or transaction log file resides. High I/O may be normal for some databases, but excessively
high I/O leads to higher queue lengths, meaning there are more requests for disk reads or writes
than the storage subsystem can handle.
n Latency: Displays a measurement of disk latency occurring on the disk where the database or
transaction log file resides. High volume latency values indicate sluggish database performance.
The performance counter, Database Files, is used to provide metrics for this resource. It is used in
combination with volume polling. This counter is not listed in the resource; however, the thresholds can be
changed.

counter
field.
counter details.
850
Transaction Log Size by File
This resource lists the current status of transaction log files as sorted by size. Hovering the mouse over a
listed percentage reveals a tooltip with detailed information about the item listed. Clicking the percentage
takes you to the Database Details page. If the Warning or Critical thresholds is breached, the color of the
bar chart changes from green to yellow or red, respectively.
n File Path: Displays the complete file path of the listed transaction log.
n Auto-Growth: Displays the current Auto-growth setting.
n File Size: Displays the current size of the listed transaction log.
n Database Usage: This resource displays the amount of space consumed as a percentage of
whatever restrictions are in place for the file. For example:
n If the transaction log is allowed to grow unrestricted, then it is limited only by the amount of
free space on the volume.
n If the transaction log is allowed to grow to a maximum size, the percentage is calculated based
on this restricted size limit.
n If the transaction log has a fixed size, the percentage used is calculated based on the total size
of the transaction log file and the amount of remaining white space.
n Volume Usage: Displays the amount of space the listed file is consuming on the volume where it is
located.
The performance counter, Database Files, is used to provide metrics for this resource. This counter is not
listed in the resource; however, the thresholds can be changed.

counter
field.
counter details.
851
Transactions
A transaction is a unit of work that is performed against a database. In other words, if you are creating a
record, for example, then you are performing transaction on the table. It is important to control
transactions to ensure data integrity and to handle database errors.
This resource contains monitors specific to the current status of transactions. The icons of the listed
performance counters in the Statistic Name column changes color to reflect the listed counter's current
Counter Details page for that counter.
Longest Definition:
Transaction This performance counter displays the length of time, in seconds, the transaction that
Running has been running the longest, has been active.
Time
852
Information:
Transactions that run longer than others use more resources. They can be used to track
down procedures and calls that are taking longer than expected by identifying the
specific transaction(s).
Possible problems:
Long running transactions can prevent truncation of transaction logs. This can cause
the transaction log files to grow until they consume all available physical disk space
shutting down access to the database.
Remediation:
Check the functionality of the query and/or redesign the long running transaction.
Transactions/ Definition:
sec This performance counter returns the number of transactions started for the database,
per second.
Information:
Transaction rate is affected by general system performance and resource constraints,
such as I/O, number of users, cache size, and the complexity of requests.
Possible problems:
A high rate of transactions can indicate that some transactions are not completing.
Remediation:
Using stored procedures in transactions speeds transaction processing because SQL
code in stored procedures runs locally on the server. The transactions can finish much
faster without the network traffic required by the transactions.
Active Definition:
Transactions This performance counter returns the number of active transactions for the database.
Information:
During an active transaction, no other transaction can modify the data held by the
active transaction. While you are modifying data, an exclusive lock is held on that data.
Conversely, you cannot read data held by another transaction because another
transaction holds an exclusive lock on the data that prevents it from being read. The
returned value for this monitor should be less than 200.
Possible problems:
A high number of active transactions can indicate that certain transactions are never
completing.
Remediation:
Keeping a low level of active transactions assists in keeping requested data accessible.
853
Repl. Trans. Definition:
Rate This performance counter returns the number of transactions read out of the
transaction log and sent to the distribution database
(Replication
Information:
Transactions
SQL Server Overall Replication Performance Analysis provides a graph of several SQL
Rate)
Server overall replication performance counters for the specified server during the
specified time period. Performance counter data is averaged by the hour. The graph
displays the following replication performance counters:
n SQLServer:Databases / Replication Pending Xacts (SQL Server; Scale=1\100)

n SQLServer:Databases / Replication Transaction Rate (SQL Server; Scale=1\100)
n SQLServer Replication Published DB / Replicated Transactions Per Second
Bulk Copy Definition:

Rows/sec This monitor returns the number of rows bulk copied per second.
Information:
Measure the number of rows coming into the database. Optimization yields a higher
number. See The Data Loading Performance Guide http://technet.microsoft.com/en-
us/library/dd425070(v=SQL.100).aspx
Possible problems:
BCP to bulk load data over the network, having the correct throughput configured is
crucial.
Bulk Copy Definition:

Throughput/ This monitor returns the amount of data bulk copied (in kilobytes) per second.
Sec
Possible problems:
Overall throughput is mostly be limited by your I/O subsystem.
Zooming
the resource.
854
AppInsight for SQL alerts
AppInsight for SQL comes with two predefined alerts:
n Alert me when my database file disk I/O latency is high

n Alert me when my database file is running low on space
View Alerts
1. On the Web Console, click Settings > All Settings > Manage Alerts.
2. Select the alerts you want to view from the list, or type a keyword in the text box and click Search.
855
AppInsight for IIS
AppInsight for IIS is considered a template until it is applied. Therefore, it is a member of the Application
Monitor Templates collection. Once applied to a node, AppInsight for IIS is considered an application. Like
any SAM application, AppInsight for IIS is comprised of multiple component monitors.

n Troubleshooting AppInsight for IIS
The following reports are installed for use with AppInsight for IIS:

n Site Size by File
856
Understand the AppInsight for IIS Details View
The AppInsight for IIS Details view is the equivalent of the Application Details view of a traditional SAM
application; however, there are some notable differences:
n Site Details View: This view displays an overview of a particular site being monitored.
n Application Pool Details View: This view displays details about the selected application pool.
From the AppInsight for IIS Details view, you can select from the drop down menu and choose to display
different amounts of data based on a time range.
Editing Resources
Additionally, certain resources will allow you to add and remove component monitors from the resource.
You can do this by clicking the Edit button, and then checking the component monitors you want to keep.
857
Alerts and reports for AppInsight for IIS
The following three alerts and their macros/variables are included with AppInsight for IIS:
1. Alert Name Restart Failed IIS Application Pool
State Alert disabled by default.
Alert Description This alert restarts any failed IIS application pool that is configured to be
"AlwaysRunning." As configured, this alert will not trigger for application pools that
are configured to start "OnDemand," as these application pools stop normally when
not in use, or when the site that is configured to use the Application Pool has no
activity and is dormant.
Alert Trigger IIS application pool = Stopped and application pool startup mode is configured for
"AlwaysRunning" and Application Pool is not equal to Unmanaged.
Trigger Action Start application pool (Note: Application Pool trigger actions should include Stop,
Start, and Restart, no differently than the actions available through the Orion web
interface for AppInsight for IIS application pools.)
Trigger Action 2 Email Notification:

Subject: Application Pool ${N=SwisEntity;M=Name} on
${N=SwisEntity;M=Application.Node.Caption} is
${N=SwisEntity;M=DisplayState}.
Message Body: The IIS Application Pool ${N=SwisEntity;M=Name} on

${N=SwisEntity;M=Application.Node.Caption} is currently
${N=SwisEntity;M=DisplayState}. Attempting to restart Application Pool
${N=SwisEntity;M=Name} now. For more information click the URL below.
<br/>
<br/>
${N=SwisEntity;M=DetailsUrl}
Trigger Reset Email Notification:

Action
Subject: Application Pool ${N=SwisEntity;M=Name} on
${N=SwisEntity;M=DisplayState}
Message Body: The IIS Application Pool ${N=SwisEntity;M=Name} on

${N=SwisEntity;M=Application.Node.Caption} is now
${N=SwisEntity;M=DisplayState}. For more information click the URL below.
858
<br/>
<br/>
2. Alert Name Restart Failed IIS Site
State Alert disabled by default.
Alert Description This alert attempts to restart any site that is monitored by AppInsight for IIS that is
found to be in a Stopped state.
Alert Trigger IIS site = Stopped and not equal to Unmanaged.
Trigger Action Start IIS site (Note: IIS site trigger actions should include Stop, Start, and Restart, no
differently than the actions available through the Orion web interface for AppInsight
for IIS sites.
Trigger Action 2 Email Notification:

Subject: IIS Site ${N=SwisEntity;M=Name} on
Message Body: The IIS Site ${N=SwisEntity;M=Name} on

${N=SwisEntity;M=Application.Node.Caption} is currently
${N=SwisEntity;M=DisplayState}. Attempting to restart Site
${N=SwisEntity;M=Name} now. For more information click the URL below.
<br/>
<br/>
Trigger Reset Email Notification:

Action Subject: IIS Site ${N=SwisEntity;M=Name} on
Message Body: The IIS Site ${N=SwisEntity;M=Name} on

${N=SwisEntity;M=Application.Node.Caption} is now
${N=SwisEntity;M=DisplayState}. For more information click the URL below.
859
<br/>
<br/>
${N=SwisEntity;M=DetailsUrl}.
3. Alert Name Alert me when the Average Server Execution Time for any URL exceeds an
acceptable limit.
State Alert disabled by default
Alert This alert notifies you when the execution time of any URL monitored by AppInsight
Description for IIS exceeds a predefined acceptable limit.
Alert Trigger Average URL Server Execution Time is greater than 5 minutes.
Trigger Action Email Notification:

Subject: IIS Site Server Execution Time exceeded on
${N=SwisEntity;M=Site.Name}.
Message Body: The Server Average Execution time for

${N=SwisEntity;M=Site.Name} on
${N=SwisEntity;M=Site.Application.Node.Caption} has been exceeded.
Details for the URL being accessed are listed below.
Recent Request Date:${N=SwisEntity;M=RecentRequestDate}
URL: ${N=SwisEntity;M=URLStem}
Average Server Execution Time:${N=SwisEntity;M=AverageElapsedTime}

ms
Reports installed for use with AppInsight for IIS:

n Site Size by File
860
AppInsight for IIS Application Details View
The IIS Details view provides a great deal of information about the current IIS Application. The available
resources offered in this view include:
n This resource lists details about all unacknowledged active alerts.

n Zooming
n Application Pools
n Cache
n Connections
n IIS Average CPU and Memory Usage
n IIS Average Network Traffic
n Event Log Message Details
n Management
n Processes and Services
n Sites
n Top Page Requests by Average Server Execution Time
Top Page Requests by Average Server Execution Time
This resource is only shown when AppInsight for IIS is being polled via an Agent. It does not appear if the
node is being polled via SNMP or WMI. For more information, see Agents.
Chart resources may not display data until multiple successful polls have completed.
861
Active Alerts
The following defines the four columns of this resource:
n Alert Name: Displays the name of the listed alert.

n Triggering Object: Displays the object that triggered the alert. Clicking the object takes you to the
details page for that object.
n Active Time: Displays the time the alert was active.
862
This resource graphically shows the various states of an application's availability in a percentage format
and is made up of three sections: the legend, the main chart, and the lower chart. The colors of the main
chart correspond to the labels in the legend.
Zooming
863
Application Details
This resource provides details concerning the current application. You can click on both the application
and the node to be taken to their respective details page.
n Application Name: Displays the name of the listed application, in addition to the node on which it
resides.
n Status: Displays the current status of the listed application. Possible statuses include: Up, Down,
Warning, Critical, Unknown, Unreachable, and Unmanaged.
n IIS Version: Displays the current version information of IIS currently being monitored.
Note: The following three fields are tied together as components with polling issues and are
displayed in the Application Details resource.
n Component Name: Displays the component name along with its current status as indicated
by the icon.
n Component Type: Displays the information about the current component.
n Component Status: Displays the current status of the listed component.
864
Application Pools
This resource shows the status of all monitored application pools for the current IIS application. The data
can be sorted by clicking the headers of each column.
n Name: Displays the name of the listed application pool, in addition to the current performance
status as indicated by the icon. Clicking the name of the application pool takes you to the Application
Pool Details page.
n State: Displays the current state of the listed application pool. Possible states include: Stopped,
Started, Stopping, and Starting.
n Worker Processes: Displays the current number of worker processes the listed application pool is
using.
n CPU: Displays the percentage of CPU currently being used for the listed application pool.
n Physical Memory: Displays the amount of physical RAM the listed application pool is currently
using.
n Virtual Memory: Displays the amount of virtual RAM the listed application pool is currently using.
You can search for an application pool by entering text in the Search field and clicking Search.
865
Cache
This resource contains monitors specific to the current status of the IIS application cache. The icons of the
Counter Expert Knowledge Warning Critical
Current File Cache Definition:

Memory Usage This performance counter returns the current number of
bytes used for the user-mode file cache.
Output Cache Current Definition:

Memory Usage This performance counter returns the current memory usage
by output cache.
866
File Cache Hits % Definition:
This performance counter returns the ratio of user-mode file
cache hits to the total number of cache requests since the
service started.
Information:
This counter reflects how well the settings for the IIS file cache
are working. A site with mostly static files should have a very
high cache hit percentage (70%-85%). If the Kernel: Cache
Hits % counter is low, this value should be high. Note that this
counter does not include dynamic content, only static files. If
your static files are not being cached, you might want to
lengthen the activity period for this cache.
Possible problems:
The value returned from Kernel: Cache Hits % is low.
Remediation:
If the value returned from Kernel: Cache Hits % is low,
examine your file set and determine why your files are not
being cached.
Kernel URI Cache Definition: < 90 < 70

Hits % This performance counter returns the ratio of kernel URI
cache hits to the total number of cache requests since the
service started.
Metadata Cache Hits Definition:

% This performance counter returns the ratio of user-mode
metadata cache hits to total number of cache request since
the service started.
Output Cache Definition:

Current Hits % This performance counter returns the output cache current
hit ratio. The ratio is calculated as (H)/(H+M), where H and M
represent Hits and Misses in previous sample intervals,
respectively.
URI Cache Hits % Definition:

This performance counter returns the ratio of user-mode URI
Cache Hits to the total number of cache requests since the
service started.
867
Information:
If content cannot be cached in the HTTP.sys response cache,
the value of this counter should be as high as possible. If your
content can be stored in the HTTP.sys response cache, the
value of this counter should be low.
Zooming
the resource.
868
Connections
This resource contains monitors specific to the current status of the active connections for the current
IIS application. The icons of the listed performance counters in the Statistic Name column change colors to
reflect the listed counter's current state. Clicking any performance counter in the Statistic Name column
takes you to the Performance Counter Details page for that performance counter.
Total Description:
Connection This displays the total number of connections to the Web or FTP service that have been
Attempts attempted since service startup. The count is the total for all web sites or FTP sites
combined, regardless of the instance selected.
Information:
This number does not include connection attempts that failed at the TCP (transport) or IP
(network) layer.
Total Logon Definition:

Attempts This displays the total number of successful logons to the Web or FTP service since the
service started.
869
Information:
This number does not include failed logon attempts.
Current Description:
Connections This displays the current number of connections established with the Web service.
Information:
This is the sum of both non-anonymous (authenticated) and anonymous
(unauthenticated) users.
Possible problems:
If this number is at or near the maximum connections allowed, the Web service is near
or at full capacity.
Remediation:
If the value is too high for a particular IIS server, then load balancing or clustering
technologies can be applied to lower the burden of the server in question. Also check the
Web Site property page for maximum connection limit.
Anonymous This displays the number of Current Anonymous Users who currently have an
Users anonymous connection using the Web service.
Information:
If anonymous connections are not permitted on the server, the value of all anonymous
user counters is always zero.
Non- This displays the number of Current Non-Anonymous Users who currently have a non-
Anonymous anonymous connection using the Web service.
Users
Information:
If authentication is not enabled on the server, and none of the applications that run on
the server request or require authentication, then the value of all non-anonymous user
counters is always zero.
Zooming
the resource.
870
IIS Average CPU and Memory Usage
This resource graphically and numerically details the consumption of IIS as it relates to the overall
resource utilization of the server itself. This allows you to determine if performance issues are caused by
IIS, or if IIS performance is impacted by other applications, processes, or services running on the server.
This resource has three tabs, allowing you to see the charts for CPU usage, Physical Memory Usage, and
Virtual Memory Usage. Hovering over any time period within the chart displays detailed information about
that time period in the tooltip. The colors of the main chart correspond to the labels in the legend. You can
choose which data to display by using the check boxes in the legend, as well as cycling through the three
different tabs.
The three columns to the right in the lower portion of the chart report the most recent percentage of CPU
Load, Physical Memory Usage, and Virtual Memory Usage, respectively, for each available worker process.
CPU and Memory need to be enabled via List Resources in order for this to function properly. If
CPU and Memory are not enabled, N/A is reported for other values when they are unselected.
The columns for this resource are defined as follows:
871
n Application Pool (Worker Process): Lists the processes being monitored and displayed in the
chart. Non-IIS Processes and Services are those resources consumed by other applications running
on the server that are not associated with IIS.
n Latest CPU Load: Displays the percentage of CPU usage for the listed process.
n Latest Physical Memory Usage: Displays the percentage of physical memory in use for the listed
process.
n Latest Virtual Memory Usage: Displays the percentage of virtual memory in use for the listed
process.
Zooming
buttons. Alternatively, you can have the chart show a specific date range by dragging the mouse over an
area of the chart or manipulating the sliders of the lower chart.
872
IIS Average Network Traffic
This resource graphically details the history of IIS network traffic. Hovering over any time period within the
chart displays detailed information about that time period in the tooltip. The colors of the main chart
correspond to the labels in the legend. You can choose which data to display by using the check boxes in
the legend.
The columns for this resource are defined as follows:
n Traffic Source: Lists the sources of network traffic that is displayed in the chart. Non-IIS Processes
and Services are those resources consumed by other applications running on the server that are not
associated with IIS.
n Latest Network Traffic: Displays the network traffic rate for the listed source in kilobytes per
second.
Zooming
by dragging the mouse over an area of the chart or manipulating the sliders of the lower chart.
873
Event Log Message Details
This resource displays the IIS event log messages while providing a search window and a filter. The filter
allows you to choose which types of log messages you want to display. The data can be sorted by clicking
the headers of each column. This resource shows Error, Warning, Information events specific to the
monitored IIS server. For a complete list of Event IDs, see Event IDs
Clicking any event message in the list opens a new window, displaying the entire message. Click Edit to
alter the title, subtitle, and number or rows displayed.
For more information, see Event IDs
874
Management
This resource contains controls that are actionable for both the application and the node. The controls in
the following illustration are SAM-specific.
Application:
n Edit Application Monitor: This allows you to edit the current application by changing the settings
specifically related to this application. This includes, but is not limited to: changing the polling
frequency, changing the Windows and PowerShell URLs, changing the IIS Server credentials, and
adjusting threshold settings for component monitors that have thresholds.
Note: Changing some settings may require you to override the template that this application is
based upon. To do this, click Override Template.
n Unmanage: Allows you to stop the polling and collecting of statistics of the current application for a
user-defined period of time.
n Poll Now: Allows the application to retrieve the most current statistics when clicked.
Note: By default, statistics are not polled when Poll Now is clicked.
Node:
n Real-Time Process Explorer: Opens the Real-Time Process Explorer in a new window. For more
information, see The Real Time Process Explorer.
n Service Control Manager: Opens the Service Control Manager in a new window. For more
information, see The Service Control Manager.
875
n Real-Time Event Viewer: Opens the Real-Time Event Viewer in a new window. For more
information, see The Real Time Event Log Viewer.
876
Processes and Services
This resource provides detailed information about the active processes and services associated with the
database selected. Hovering over a component gives you detailed information about that application.
n Component Name: Name of the listed component.

n Process Name: Name of the listed process and its ID value.
n CPU Load: Percentage of the CPU that the listed process/service is currently using.
n Memory Used: Memory currently being used by the listed process/service.
n Physical: RAM currently being used by the listed process/service.
n Virtual: Virtual memory currently being used by the listed process/service.
877
Sites
This resource shows the status of all monitored sites of the current IIS application.
n Name: Displays the name of the listed site in addition to the current performance status as
indicated by the icon. Clicking the name of the site takes you to the Site Details page.
n State: Displays the current state of the listed site. Possible states include: Stopped, Started,
Stopping, and Starting.
n Connections: Displays the current number of connections for the listed sites.
n Response Time (Avg): Displays the average response time of the listed site in milliseconds.
n Start Mode: Displays how the listed site begins running. The ServerAutoStart property indicates if
the server instance should start automatically when the server is powered on. This property is reset
automatically when a server instance is stopped or restarted to maintain the state across service
restarts.
You can search for a site by entering text in the Search field and clicking Search.
878
This resource displays the top 20 page requests by average server execution time. The Average Server
Execution Time is the average time of all page requests of the same type based on the URL stem. (The
URL stem is part of a dynamic URL that separates the URL request from the query parameters. This is
typically located before the question mark.)
By clicking Edit, you can change the number of URLs this resource displays. The data can be sorted
by clicking the headers of each column.
Important: This resource is only shown when AppInsight for IIS is being polled via an Agent. It will
not appear if the node is being polled via SNMP or WMI. Additionally, when the IIS log format is
missing the required fields, this resource appears to be missing information. If this is the case,
either enable the following fields through the IIS manager, or disable this component entirely. The
fields that need to be enabled are: Date, Time, URI Query, Client IP Address, and Method in the
WCW3 format. For more information, see Agents. Logging must be enabled. The W3C or IIS log
format should be configured on the IIS server.
Notes:
n This resource is specific to the IIS site. Another instance of this resource is available at the
application level for all sites.
n IIS logging must be enabled. The W3C or IIS log format should be configured on the IIS server.
n Site: Displays the site name with which the URL is associated. Clicking the arrow to the left of the site
name brings up detailed information about the listed web request (URL), including the following:
879
n Verb: Displays the web request action performed. Example verbs shown in this column are
GET, POST, PUT, DELETE, HEAD, DELETE, OPTIONS, and CONNECT.
n Request Date: Displays the date and time of the client web request.
n Elapsed Time: Displays the amount of server time that was needed to fulfill the listed request.
n Client IP: Displays the IP address of the client computer for the listed request.
n URL Query: Displays the query parameters associated with client's web request. If no query
parameters were specified in the request, this field will be blank.
n URL: Displays the URL stem of the listed request.
n Average Server Execution Time: Displays the average time of all page requests of the same type
based on the URL stem.
880
ASP.NET
This resource contains monitors specific to the current status of the ASP.NET IIS application requests
which contain all the websites for the current application. The icons of the listed performance counters in
the Statistic Name column change colors to reflect the listed counter's current state. Clicking any
performance counter in the Statistic Name column takes you to the Performance Counter Details page for
that performance counter.
Request Description: Sustained Sustained

Execution This displays the number of milliseconds that it took to execute the Status: 3 Status: 4
Time most recent request. out of 5 out of 4
polls polls
881
Information:
The execution time begins when the HttpContext for the
request is created, and stops before the response is sent to IIS.
Assuming that user code does not call HttpResponse.Flush, this
implies that execution time stops before sending any bytes to IIS, or
to the client. When the process model is enabled, the request
execution time includes the time required to write the response to
the client, and therefore depends upon the bandwidth of the
client's connection. There is no threshold for this counter. The
value of this counter should be stable. Experience helps you set a
threshold for a particular site.
Note: A baseline is required.
Request Description: > 300 > 900

Wait This displays the number of milliseconds that the most recent
Time request was waiting in the queue.
Information:
This does not include any time spent waiting in application queues.
The threshold for this counter is 1,000. The average request should
spend 0 milliseconds waiting in the queue.
Possible problems:
If this indicator is greater than 1,000 ms, the performance of the IIS
server is suffering.
Requests Description: > 2000 > 4000

Queued This displays the number of requests waiting to be processed. Sustained Sustained
Status: 3 Status: 3
out of 5 out of 5
polls polls
882
Information:
The Aspnet_wp process queue is a named pipe through which
the request is sent from one process to the other. The number of
requests in this queue increases if there is a shortage of available
I/O threads in the Aspnet_wp process. When the limit specified by
<processModel requestQueueLimit=/> is exceeded, requests
are rejected with a 503 error (Service Unavailable). Note that if a
request is rejected for this reason, it will never reach managed
code and error handlers will not be notified. Normally this only
occurs when the server is under a very heavy load. Virtual directory
queues maintain the availability of worker and I/O threads. The
number of requests in these queues increases if the number of
available worker threads or available I/O threads falls below the
limit specified by <httpRuntime minFreeThreads=/>. When
the limit specified by <httpRuntime
appRequestQueueLimit=/> is exceeded, the request is rejected
with a 503 error and the client is sent an HTTP exception with the
message, Service Unavailable.
Possible problems:
When this value starts to increment linearly with increased client
load, the web server computer has reached the limit of concurrent
requests that it can process.
Remediation:
The default maximum value for this counter is 5,000. You can
change this setting in the Machine.config file.
Requests Description: N/A >0

Rejected This displays the number of requests rejected because the request
queue was full.
Information:
Requests are rejected when one of the queue limits is exceeded.
Back-end latency, such as that caused by a slow computer running
SQL Server, is often preceded by a sudden increase in the number
of pipeline instances and a decrease in % Processor Time and
Requests/second. A server might be overwhelmed during times of
heavy load due to processor or memory constraints that ultimately
result in the rejection of requests.
Possible problems:
The value of this counter should be 0. Values greater than 0 should
be investigated.
883
Zooming
the resource.
884
AppInsight for IIS Website Details View
The IIS Website Details view provides a great deal of information about the current IIS website. The
available resources offered in this view include:
n Bindings
n Connections
n Files
n Log Size by File
n Management
n Network I/O
n This resource contains monitors specific to the current status of the IIS site requests. The icons of
the listed performance counters in the Statistic Name column change colors to reflect the listed
counter's current state. Clicking any performance counter in the Statistic Name column takes you
to the Performance Counter Details page for that performance counter.
n Zooming
n Site Details
n Site Size by Directory
n SSL Certificate Expiration
n Top Page Requests by Average Server Execution Time
n Web Server Response Time
885
Bindings
This resource monitors binding information for the current site.
Following are the column heads with their respective definitions:
n Type: This resource identifies and report the following types:

n Http
n Https
n Net.TCP
n Net.Pipe
n Net.MSMQ
n MSMQ.FormatName
n Binding Information: The asterisk (*) is the server's IP address that the site is bound to and refers
to all of the IP addresses on the server. This is directly followed by the port number (eg: *.80:). The
hexadecimal number is the IPv6 address.
n Browse...: Clicking Browse... on the selected binding takes you to the HTTP or HTTPS binding and
port for the current site that is being monitored by AppInsight for IIS.
886
Connections
This resource contains monitors specific to the current status of the active connections for the current
IIS website. The icons of the listed performance counters in the Statistic Name column change colors to
reflect the listed counter's current state. Clicking any performance counter in the Statistic Name column
takes you to the Performance Counter Details page for that performance counter.
Total Description:
Connections This displays the total number of connections to the Web or FTP service that have been
Attempts attempted since service startup. The count is the total for all Web sites or FTP sites
combined, regardless of what you choose for the instance.
Information:
This number does not include connection attempts that failed at the TCP (transport) or IP
(network) layer.
887
Total Logon Description:
Attempts This displays the total number of successful logons to the Web or FTP service since the
service started.
Information:
This does not include failed logon attempts.
Connections This displays the current number of connections established with the Web service.
Information:
This is the sum of both nonanonymous (authenticated) and anonymous
(unauthenticated) users.
Possible problems:
If this number is at or near the maximum allowable connections, the Web service is at
full capacity.
Remediation:
If the value is too high for a particular IIS server, then load balancing or clustering
technologies can be applied to lower the burden of the server in question. Also, check
the Web Site property page for the maximum connection limit.
Anonymous This displays the number of users who currently have an anonymous connection using
Users the Web service.
Information:
If anonymous connections are not permitted on the server, the value of all anonymous
user counters is always zero.
Non- This displays the number of users who currently have a non-anonymous connection
Anonymous using the Web service.
Users
Information:
If authentication is not enabled on the server, and none of the applications that run on
the server request or require authentication, then the value of all nonanonymous user
counters is always zero.
Zooming
the resource.
888
889
Files
This resource contains monitors specific to file traffic across the current website. The icons of the listed
Counter Expert Knowledge Critical
Files Description:
Received The displays the number of files that have been received by the WWW
service since the service started.
Files Sent Description:

The displays the number of files that have been sent by the WWW service
since the service started.
Information:
This value does not include cache hits. Note that this counter does not
increment when files are being served from the kernel-mode cache.
890
Files Description:
Transferred The displays the sum of Files Sent and Files Received by the WWW service
since the service started.
Information:
Note that this counter does not increment when files are being served from
the kernel-mode cache.
Locked Description: >0

Errors The displays the number of requests that have been made since the service Sustained
started and could not be satisfied by the server because the requested Status:
document was locked. 3 out of 5
polls
Information:
This is usually reported as HTTP error 423.
Not Found Description:

Errors The displays the number of requests that have been made since the service
started and were not satisfied by the server because the requested
document was not found.
Information:
This is usually reported as HTTP error 404.
Zooming
the resource.
891
Log Size by File
This resource lists the current quantity and size of log files as sorted by size. If the Warning or Critical
thresholds is breached, the color of the bar chart changes from green to yellow or red, respectively.
n Folder Path: Displays the path to the directory where log files are stored. The path displayed is
linked to the Custom Chart page and can be accessed by clicking the displayed path.
n Number of Files: Displays the total number of log files in the listed directory.
n Total File Size: Displays, in bytes, the amount of disk space being used to store the total number of
log files in the listed directory.
n Volume Usage: Numerically and graphically displays the percentage of volume space used by the
listed log files.
892
Management
This resource contains controls that are actionable for the current site. The controls in the following
illustration are SAM-specific.
n Restart: This stops the site from running and then restarts it.
n Start/Stop: Allows you to start or stop the site.
n Unmanage Web Site: Allows you to stop the polling and collecting of statistics of the current web
site.
893
Network I/O
This resource contains monitors specific to byte traffic across the current website. The icons of the listed
Total Bytes Description:

Received This displays the total number of bytes received by the Web service since the
service started.
Information:
This information can be used to determine network load on a specific Web site.
Total Bytes Sent Description:

This displays the total number of bytes sent by the Web service since the service
started.
Information:
Total Bytes Description:

Transferred This displays the total number of bytes sent and received by the Web service since
the service started.
894
Information:
Zooming
the resource.
895
Requests
This resource contains monitors specific to the current status of the IIS site requests. The icons of the
Total Description:
Method This displays the number of HTTP requests that have been made since the WWW service
Requests started.
896
Delete Description:
Requests This displays the number of HTTP requests that have used the DELETE method since the
WWW service started.
Get Description:
Requests This displays the number of HTTP requests that have used the GET method since the WWW
service started.
Information:
GET requests are generally used for basic file retrievals or image maps, though they can be
used with forms.
Head Description:
Requests This displays the number of HTTP requests that have used the HEAD method since the
Information:
HEAD requests typically indicate that a client is querying the state of a document they
already have to see if it needs to be refreshed.
CGI Description:
Requests This displays the number of all CGI requests that have been made since the WWW service
started.
Information:
CGI requests are custom gateway executable (.exe) files the administrator can install to add
forms processing or other dynamic data sources. CGI requests spawn a process on the
server which can be a large drain on server resources.
ISAPI Description:
Extension This displays the number extension of ISAPI requests that have been made since the WWW
Requests service started.
Information:
ISAPI Extension Requests are custom gateway DLLs which the administrator can install to
add forms processing or other dynamic data sources.
Put Description:
Requests This displays the number of HTTP requests using the PUT method since the WWW service
started.
Post Description:
Requests This displays the number of HTTP requests that have used the POST method since the
Information:
Post requests are generally used for forms or gateway requests.
897
Zooming
the resource.
898
Site Availability
This resource graphically shows the various states of a website's availability in a percentage format and is
made up of three sections: the legend, the main chart, and the lower chart. The colors of the main chart
Zooming
Once you have a time period selected, the lower chart will zoom to the starting and ending values of the
The main view of the chart will display the selected time period between the two sliders of the lower chart.
Moving the mouse over the main chart will reveal a tooltip with more detailed information about the
specific time period the mouse is hovering over. By default, all statistics are shown in the main chart.
899
Site Details
This resource provides details concerning the current site.
n Site Name: Displays the name of the current site.

n Site State: Displays the current state of the listed site. States reported are: Stopped, Started,
Stopping, and Starting.
n Start Automatically: This indicates whether or not the server instance should start automatically
when the service is started.
n URL: These are the URLs that can access the current site (e.g.: http://www.solarwinds.com,
http://www.solarwinds.net).
n Application Pool: Displays the name of the current application pool.
n Physical Path: Displays the folder location of the associated site.
n Log file Path: Displays the folder location of the log file for the current site.
n Limits:
n Limit Bandwidth Usage: Displays the maximum network bandwidth to which the web site
traffic is throttled.
n Connection Time-Out: Displays, in seconds, the elapsed time needed for a timeout to occur of
the current site.
n Limit Number of Connections: Displays the number of connections this site is limited to.
900
Site Size by Directory
This resource lists and details site size by directory for the current site.
The following defines the four columns of this resource:
n Folder Path: Displays the folder path for the current site.
n Number of Files: Displays the total number of files located in the folder path for the current site.
n Total File Size: Displays the total size, in MB, for all of the files located in the folder path for the
current site.
n Volume Usage: Numerically and graphically displays the total percentage of volume space
consumed by the current site.
901
SSL Certificate Expiration
This resource provides graphical and numerical information pertaining to the valid dates of your SSL
certificates as well as the number of days remaining before the listed certificates expire.
This resource only appears if the site is configured for HTTPS.
SSL Certificate Expiration Fields:
n CN (Common Name): An SSL certificate is required to be associated with one or more hostnames,
called Common Name. In this resource, CN is followed by the hostname with which it is associated.
n Days Remaining: The number of days remaining until the listed certificate expires is
represented both graphically and numerically.
n Valid Between: Displays the date range when the listed certificate is valid.
n Port: Displays the port to which the listed certificate is bound.
902
This resource displays the top 20 page requests by average server execution time. The Average Server
Execution Time is the average time of all page requests of the same type based on the URL stem.
The URL stem is part of a dynamic URL that separates the URL request from the query parameters.
This is typically located before the question mark.
By clicking Edit, you can change the number of URLs this resource displays. The data can be sorted by
clicking the headers of each column.
Important: This resource is only shown when AppInsight for IIS is being polled via an Agent. It will
not appear if the node is being polled via SNMP or WMI. Additionally, when the IIS log format is
missing the required fields, this resource appears to be missing information. If this is the case,
either enable the following fields through the IIS manager, or disable this component entirely. The
fields that need to be enabled are: Date, Time, URI Query, Client IP Address, and Method in the
WCW3 format. For more information, see SolarWinds Orion Agents . Logging must be enabled. The
W3C or IIS log format should be configured on the IIS server.
Notes:
n This resource is specific to the IIS site. Another instance of this resource is available at the
application level for all sites.
n IIS logging must be enabled. The W3C or IIS log format should be configured on the IIS server.
n Site: Displays the site name with which the URL is associated. Clicking the arrow to the left of the site
name brings up detailed information about the listed web request (URL), including the following:
903
n Verb: Displays the web request action performed. Example verbs shown in this column are
GET, POST, PUT, DELETE, HEAD, DELETE, OPTIONS, and CONNECT.
n Request Date: Displays the date and time of the client web request.
n Elapsed Time: Displays the amount of server time that was needed to fulfill the listed request.
n Client IP: Displays the IP address of the client computer for the listed request.
n URL Query: Displays the query parameters associated with client's web request. If no query
parameters were specified in the request, this field will be blank.
n URL: Displays the URL stem of the listed request.
n Average Server Execution Time: Displays the average time of all page requests of the same type
based on the URL stem.
904
Web Server Response Time
This resource contains monitors specific to the response time of the current web server. The icons of the
listed performance counters in the Statistic Name column will change color to reflect the listed counter's
current state. Clicking any performance counter in the Statistic Name column will take you to the
will display a yellow background. If the value of a listed monitor crosses the Critical threshold, the chart for
the listed counter will display a red background. Hovering over any time period within the chart will
display detailed information about that time period in the tooltip. Hovering over a counter will give you
detailed information about that performance counter.
HTTP Monitor Definition:
This performance counter returns the amount of time the listed web server
spends accepting incoming sessions and transmitting the requested page, in
milliseconds, for the HTTP protocol.
HTTPS Monitor Definition:
This performance counter returns the amount of time the listed web server
spends accepting incoming sessions and transmitting the requested page, in
milliseconds, for the HTTPS protocol.
The HTTPS monitor will not appear if the site is not configured for HTTPS. Similarly, if the Orion
server is unable access an HTTP site via its configured URL, this resource will not appear because
these components will automatically be disabled. You can re-enable and configure these monitors
via the application editor.
Zooming
905
the resource.
906
AppInsight for IIS Application Pool Details View
The IIS Application Pools Details view provides a great deal of information about the current IIS application
pool. The available resources offered in this view include:
n Application Pool Availability

n Application Pool Details
n Management
n Worker Process Activation Service
n Worker Process Cache
n Worker Process Details
n Worker Process Requests and Threads
907
Application Pool Availability
This resource graphically shows the various states of an application pool's availability in a percentage
format and is made up of three sections: the legend, the main chart, and the lower chart. The colors of the
main chart correspond to the labels in the legend.
Zooming
buttons; 1 hour, 12 hours, or 24 hours. Alternatively, you can have the chart show a specific time range by
dragging the mouse over a small area of the chart, or by adjusting the sliders in the smaller chart below
the main chart.
The Export button opens the Custom Chart allowing you to export this data to both MS Excel and HTML.
908
Application Pool Details
This resource provides details concerning the current application pool.
n Application Pool Name: Displays the name of the listed application pool.
n Application Pool State: Displays the current state of the listed application pool. Possible states
include Started, Stopped, and Unknown.
n Worker Process Status: Displays the current status of the listed worker processes. Possible
statuses include Up, Down, Not Running, Warning, Critical, and Unknown.
n Start Automatically: Displays how the listed application pool is started. Possible values include Yes
and No.
n Start Mode: Displays the current configuration mode. The Application Pool can be set to run in On
Demand Mode or Always Running Mode.
n .Net Framework Version: Displays the version of Microsoft's .Net framework currently utilized by
the application pool.
n Manage Pipeline Mode: Displays how ASP.Net is configured. Classic Mode is an ISAPI extension.
Integrated Mode is where managed code is integrated into the request processing pipeline. Possible
values include Classic Mode and Integrated Mode.
n Identity: Displays the configuration of the Application Pool as either a Built-in Account, Network
Service, Local System, Local Service, or as a Specific User Identity.
n Applications: Displays the number of applications that rely upon this Application Pool.
909
Management
This resource contains controls that are actionable for the application pool. The controls in the following
illustration are SAM-specific.
n Recycle: Allows the worker process that handles requests for that application pool to be terminated
and a new one started.
n Start/Stop: Allows you to start and stop the worker processes of the application pool.
n Unmanage Application Pool: Allows you to stop the polling and collecting of statistics of the
current application pool.
910
Worker Process Activation Service
This resource contains monitors specific to the worker process activation service for the current
application pool. The icons of the listed performance counters in the Statistic Name column will change
color to reflect the listed counter's current state. Clicking any performance counter in the Statistic Name
column will take you to the Performance Counter Details page for that performance counter.
Counter Expert Knowledge Warning
Current Worker Description:

Processes This displays the current number of worker processes that are
running in the application pool.
911
Recent Worker Description: > 0 (CaD
Process Failures This displays the number of times that the worker process for the enabled)
application pool failed during the rapid-fail protection interval.
Information:
This counter should be counted as difference with a threshold greater
than 0.
Total Application Description: > 0 (CaD

Pool Recycles This displays the number of times that the application pool has been enabled)
recycled since Windows Process Activation Service (WAS) started.
Information:
than 0.
Total Worker Description: > 0 (CaD

Process Failures This displays the number of times that worker processes have crashed enabled)
since the application pool was started.
Information:
than 0.

Process Ping This displays the number of times that Windows Process Activation enabled)
Failures Service (WAS) did not receive a response to ping messages sent to a
worker process.
Information:
than 0.

Process This displays the number of times that Windows Process Activation enabled)
Shutdown Service (WAS) failed to shut down a worker process.
Failures
Information:
than 0.

Process Startup This displays the number of times that Windows Process Activation enabled)
Failures Service (WAS) failed to start a worker process.
Information:
912
than 0.
Zooming
the resource.
913
Worker Process Cache
This resource contains monitors specific to worker process cache for the current application pool. The
icons of the listed performance counters in the Statistic Name column will change color to reflect the listed
counter's current state. Clicking any performance counter in the Statistic Name column will take you to the
914
File Cache This displays the current number of bytes used by the user-mode file cache.
Memory
Information:
Usage
The value of this counter and the value of Web Service Cache and Maximum File Cache
Memory Usage should be the same.
Possible problems:
If the values are different, this means the cache was flushed.
Remediation:
If this counter is significantly lower than Web Service Cache and Maximum File Cache
Memory Usage, consider recycling the worker process because the application might have
a memory leak.
Maximum Description:
File Cache This displays the maximum number of bytes used by the user-mode file cache since
Memory service startup.
Usage
Information:
The value of this counter and the value of Web Service Cache and Current File Cache
Memory Usage should be the same.
Possible problems:
If the values are different, this means the cache was flushed.
Remediation:
If this counter is significantly higher than Web Service Cache and Current File Cache
Memory Usage, consider recycling the worker process because the application might have
a memory leak.
Output Description:
Cache This displays the current number of bytes used by the output cache.
Current
Memory
Usage
File Description:
Cache This displays the total number of successful lookups in the user-mode file cache since
Hits service startup.
Information:
Understanding this output depends on the content. For example, if the content files cannot
be cached by HTTP.sys, a high value is good
915
File Description:
Cache This displays the total number of unsuccessful lookups in the user-mode file cache since
Misses service startup.
Information:
A file cache miss means the request for the file must go to the hard disk.
Possible problems:
File cache misses negatively impact performance and scalability. This value should be as
low as possible. Also note that kernel cache hits will cause this value to be low.
Metadata Description:
Cache This displays the total number of successful lookups in the user-mode metadata cache
Hits since service startup.
Metadata Description:
Cache This displays the total number of unsuccessful lookups in the user-mode metadata cache
Misses since service startup.
Information:
Output Description:
Cache This displays the total number of successful lookups in the output cache since service
Total Hits startup.
Output Description:
Cache This displays the total number of unsuccessful lookups in the output cache since service
Total startup.
Misses
URI Description:
Cache This displays the total number of successful lookups in the user-mode URI cache since
Hits service startup.
Information:
Understanding this output depends on the content. For example, if the content cannot be
cached in the HTTP.sys response cache, the value of this counter should be as high as
possible. If your content can be stored in the HTTP.sys response cache, the value of this
counter should be low.
URI Description:
Cache This displays the total number of unsuccessful lookups in the user-mode URI cache since
Misses service startup.
916
Information: A low value is preferable. The value of this counter increases when IIS
cannot locate the requested content in either the HTTP.sys response cache or the IIS file
cache, and must locate the requested content on the hard disk.
Possible problems:
If the value of this counter is high, IIS locates the requested content on the hard disk which
could slow overall performance.
Zooming
the resource.
917
Worker Process Details
This resource provides details concerning the listed worker process. Clicking >> View Details will take you
to Worker Process Statistic Monitor Details page for additional information.
n Monitored Process: Lists the process that is currently being monitored.

n Status: Displays the current status of the listed process. Possible statuses include Up, Down,
Warning, Critical, Not Running, and Unknown.
n Running Copies: Displays the current number of worker processes associated with this Application
Pool.
n Maximum Worker Processes: Displays the maximum number of allowed worker processes for this
Application Pool.
n Process ID(s): Displays the process ID number for the processes associated with this Application
Pool.
n CPU Load: Percentage of the CPU that the listed process is currently using.
n Physical Memory Load: RAM currently being used by the listed process.
n Virtual Memory Load: Virtual memory currently being used by the listed process.
918
Worker Process Requests and Threads
This resource contains monitors specific to worker process requests and threads for the current
application pool. The icons of the listed performance counters in the Statistic Name column will change
color to reflect the listed counter's current state. Clicking any performance counter in the Statistic Name
column will take you to the Performance Counter Details page for that performance counter.
Active Requests Description:

Current number of requests being processed by the worker process.
Requests/sec Description:
HTTP requests/sec being processed by the worker process.
Active Thread Count Description:

Number of threads actively processing requests in the worker process.
Zooming
919
the resource.
920
AppInsight for Exchange was designed exclusively for the mailbox role which offers a detailed view of your
Exchange environment. This application provides detailed metrics on mailboxes, databases, and a host of
performance counters without the use of agents or templates. Use Applnsight for Exchange to monitor
virtually every aspect of your Exchange environment.
After it is applied to a node, AppInsight for Exchange is considered an application. AppInsight for Exchange
is comprised of multiple component monitors.
To optimize your Exchange server performance, see 5 Tips to Optimize Exchange Server for
Improved Performance.
921
Find Exchange credentials
For an account to access Exchange
n The account must be a domain account.

n In order to modify IIS and PowerShell settings on the Exchange server, the account must be a Local
Administrator.
n The account is recommended to not be a member of the Domain Administrators group. (Typically,
this is handled by adding a custom domain security group which is used to define a specific type of
administrator with specific permissions to the Local Administrators group. In larger, more mature
environments, this is handled using GPOs, whereas smaller organizations may perform this task
manually).
The verify you have valid Exchange credentials, run the following cmdlet in the Exchange Management
Shell (EMS):
Get-ManagementRoleAssignment -RoleAssignee “USER_IDENTITY”
922
Attachment extensions acknowledged by AppInsight for Exchange
The following table lists the default attachment extensions that are acknowledged by AppInsight for
Exchange:
.accdb .doc .inf .mmp .ppt .swf .xml

.arj .dot .ini .mobi .ps1 .tar .xps
.avi .eml .iso .mov .pst .tmp .zip
.bak .epub .jar .mp3 .pub .txt
.bat .flv .jpg .mpeg .psd .vbs
.bin .gif .jpeg .msg .rar .wav
.bmp .gzip .lnk .pdf .reg .wks
.cab .hta .log .png .rtf .wma
.cmd .htm .mdb .pot .sql .wmv
.csv .img .mid .pps .svg .xls
923
Understand the AppInsight for Exchange Details view
The available resources offered in this view include:
n Active Alerts
n Application Availability
n Calendar and Resource Booking
n Critical Processes and Services
n Exchange Event Log Message Details
n Exchange Server
n Information Store
n Mailbox Database Copies
n Mailbox Database Size and Space Use
n Mailbox Database Status
n Mail Database
n Management
n Replication
n Replication Status Checks
n Storage
n Users By Mailbox Size
n Users By Percent Mailbox Quota Used
n Users By Messages Sent
924
Active Alerts
The following defines the three columns of this resource:
n Time of Alert: Displays the time and date the listed alert was triggered.
n Object Name: Displays the object that triggered the alert. Clicking the object takes you to the details
page for that object.
925
This resource graphically shows the various states of an application in a percentage format and is made
up of three sections: the legend, the main chart, and the lower chart. The colors of the main chart
Zooming
the main chart.
926
The Export button opens the Custom Chart allowing you to export this data to both MS Excel and
HTML.
927
Application Details
This resource provides details concerning the current Exchange application.
The following list defines each field of this resource:
n Application Name: This provides the name of the current application as well as the name of the
node on which it is active. Hovering over the node name reveals a detailed tooltip concerning the
health of that node.
n Status: Displays the current status of the application.
n Exchange Server Version: Displays the current version of Exchange that is being monitored.
n Exchange Server Build Number: This is Microsoft's internal versioning number system that
indicates the version of Exchange installed. For more information, refer to this article:
http://technet.microsoft.com/library/hh135098%28EXCHG.141%29.aspx
n Exchange Domain: The domain of the listed Exchange server.
928
n Database Availability Group (DAG): This contains information pertaining to the DAG of which the
local node belongs.
n DAG Name: Name of the listed Database Availability Group.
n Other Exchange Servers in DAG: Lists additional Exchange servers in the current DAG.
n File Share Witness: The File Share Witness (FSW) is the quorum directory for the DAG Cluster.
It is used to provide a majority node set in a DAG with an even number of members. In a DAG
with an odd number of members, the FSW still exists, but is not used to determine a majority
node set. For additional information, see:
http://blogs.technet.com/b/askpfeplat/archive/2012/06/27/clustering-what-exactly-is-a-file-
share-witness-and-when-should-i-use-one.aspx
n Witness Share in use: This is the current witness share in use.
Note: This field may be replaced with the Alternate File Share Witness field.
n (Alternate File Share Witness): The Alternate FSW is used when the primary site with the
FSW has failed. To use the Alternate FSW requires manual intervention from the Exchange
administrator.
Note: This field may be replaced with the Witness Share in use field.
929
Calendar and Resource Booking
This resource contains performance counters specific to the status of calendar and resource booking. The
icons of the listed performance counters in the Statistic Name column change colors to reflect the listed
Calendaring is the method of creating, changing, deleting, accepting, or declining a meeting via an email
message. Resource booking is an automated process of creating, changing, and deleting calendar requests
for resource mailboxes. The Calendar and Resource Booking Attendant are the processes used by
Exchange to fulfill requests for each. Once a request has been accepted, the free/busy data for the
mailbox is updated.
The following table lists the default performance counters for this resource along with their respective
definitions and troubleshooting information, including default Warning and Critical thresholds:
Average Definition: > 100 ms > 100

Resource Shows the average time to process an event in the Resource Booking for 5 ms for
Booking Attendant. polls 15
Processing polls
Information:
Time
Should be a low value at all times.
930
Possible problems:
High values may indicate a performance bottleneck.
Remediation:
Check Memory and CPU status for any bottlenecks.Review event logs for
related events examining log entries for each Assistants Infrastructure
and its corresponding assistant. Use the Exchange Troubleshooting
Assistant (ExTRA) to obtain Event Tracing for Windows traces.
Resource Definition: >0 > 0 for

Booking Shows the total number of failures that occurred while the Resource 15
Requests Booking Attendant was processing events. polls
Failed
Information:
Should be 0 at all times.
Possible problems:
Meeting Room bookings or updates may not be processed for some
users.
Remediation:
Review event logs for related events examining log entries for each
Assistants Infrastructure and its corresponding assistant. Use the
Exchange Troubleshooting Assistant (ExTRA) to obtain Event Tracing for
Windows traces. Verify your resource mailboxes are properly configured.
Average Definition: > 100 ms > 100

Calendar Shows the average time to process an event in the Calendar Attendant. for 5 ms for
Attendant polls 15
Information:
Processing polls
Time
Possible problems:
Remediation:
Check Memory and CPU for any bottlenecks. Review event logs for
related events examining log entries for each Assistants Infrastructure
and its corresponding assistant. Use the Exchange Troubleshooting
Assistant (ExTRA) to obtain Event Tracing for Windows traces.
Calendar Definition: >0 > 0 for

Attendant Shows the total number of failures that occurred while the Calendar 15
Requests Attendant was processing events. polls
Failed
Information:
931
Possible problems:
Automated calendaring activities may not function for some users.
Remediation:
Assistants Infrastructure and its corresponding assistant. Use the
Exchange Troubleshooting Assistant (ExTRA) to obtain Event Tracing for
Windows traces. Verify your resource mailboxes are properly configured.
Zooming
the resource.
Additional components on certain resources may be available for addition or deletion on the Edit
page
932
Critical Processes and Services
This resource numerically and graphically shows metrics concerning the Exchange's critical processes and
services. The icons of the listed component in the Component Name column change color to reflect the
listed counter's current state. Clicking any component in the Component Name column takes you to the
Component Details page for that component.
If the value of the listed component crosses the Warning threshold, the icon for the listed component
becomes yellow. If the value of the listed component crosses the Critical threshold, the icon for the listed
component becomes red.
The following list defines each column of this resource:
n Component Name: Display name of the listed component.

n Process Name (ID): Service name of the listed process or service with its identification number.
n CPU Load: This graphically and numerically represents the percentage of CPU resources currently
being used by the listed process.
n Memory Used:
n Physical: This graphically and numerically represents the percentage of physical memory
(RAM) currently being used by the listed process.
n Virtual: This graphically and numerically represents the percentage of virtual memory
currently being used by the listed process.
n IOPS: Displays the current total read and write I/O (Input/Output) operations occurring for the
current process per second.
The following tables list all possible processes and services:
Exchange 2010 Services/Processes
933
Display Name Description
Microsoft Provides Active Directory topology information to Exchange services. If this service is
Exchange stopped, most Exchange services are unable to start. This service has no dependencies.
Active
Directory
Topology
Microsoft Manages the Exchange Information Store. This includes mailbox databases and public folder
Exchange databases. If this service is stopped, mailbox databases and public folder databases on this
computer are unavailable. If this service is disabled, any services that explicitly depend on it fail to
Information
start. This service is dependent on the RPC, Server, Windows Event Log, and Workstation
Store
services.
Microsoft Submits messages from the Mailbox server to Exchange 2010 Hub Transport servers. This
Exchange Mail service is dependent upon the Microsoft Exchange Active Directory Topology service.
Submission
Microsoft Performs background processing of mailboxes in the Exchange store. This service is
Exchange dependent upon the Microsoft Exchange Active Directory Topology service.
Mailbox
Assistant
Microsoft Allows applications to call the Exchange diagnostic cmdlets. This service has no dependencies.
Exchange
Monitoring
Microsoft Provides replication functionality for mailbox databases on Mailbox servers in a database
Exchange availability group (DAG) and database mount functionality for all Mailbox servers. This service is
dependent upon the Microsoft Exchange Active Directory Topology service.
Replication
Microsoft Manages client RPC connections for Exchange. This service is dependent upon the
Exchange RPC Microsoft Exchange Active Directory Topology service.
Client Access
Microsoft Drives indexing of mailbox content, which improves the performance of content search. This
Exchange service is dependent upon the Microsoft Exchange Active Directory Topology and Microsoft
Search Indexer Search (Exchange Server) services.
Microsoft Enables Windows Server Backup users to back up and recover application data for Microsoft
Exchange Exchange. This service has no dependencies.
Server
Extension for
Windows
Server Backup
Microsoft Provides a host for several Microsoft Exchange services. On internal server roles, this service is
Service Host
934
Microsoft Forwards directory lookups to a global catalog server for legacy Outlook clients, generates e-mail
Exchange addresses and OABs, updates free/busy information for legacy clients, and maintains
permissions and group memberships for the server. If this service is disabled, any services that
System
explicitly depend on it fail to start. This service is dependent on the RPC, Server, Windows Event
Attendant
Log, and Workstation services.
Microsoft Limits the rate of user operations. This service is dependent upon the Microsoft Exchange Active
Exchange Directory Topology service.
Throttling
Microsoft Provides remote search capability for Microsoft Exchange Transport log files. This service
Exchange is dependent upon the Microsoft Exchange Active Directory Topology service.
Transport Log
Search
Microsoft This is a Microsoft Exchange-customized version of Microsoft Search. Quickly creates full-text
Search indexes on content and properties of structured and semi-structured data to allow fast linguistic
(Exchange) searches on this data. This service is dependent on the RPC service.
Exchange 2013 Services/Processes
Display Name Description
Microsoft Provides Active Directory topology information to Exchange services. If this service is
Exchange stopped, most Exchange services are unable to start. This service is dependent on the
Active Net.Tcp Port Sharing Service.
Directory
Topology
Microsoft The Microsoft Forefront Protection 2010 for Exchange Server anti-spam update service. This
Exchange Anti- service is dependent upon the Microsoft Exchange Active Directory Topology service.
spam Update
Microsoft This service, running on the Mailbox servers, receives mail items from the Exchange Transport
Exchange service, submits them to extension modules for processing and commits them into mailbox
database. This service is dependent upon the Microsoft Exchange Active Directory Topology
Mailbox
service.
Transport
Delivery
Microsoft Agent that monitors server health. This service has no dependencies.

Exchange
Diagnostics
Microsoft Replicates configuration and recipient data from the Hub Transport servers to the Edge
Exchange Transport servers. This service is dependent upon the Microsoft Exchange Active Directory
Topology service.
EdgeSync
935
Exchange Drives indexing and querying of data for Exchange. This service is dependent upon the
Search Microsoft Exchange Active Directory Topology service.
Microsoft Manages Exchange server health. This service is dependent on the Windows Event Log
Exchange service.
Health
Manager
Microsoft Provides Internet Message Access Protocol service to mailboxes. If this service is stopped,
Exchange mailboxes on this server cannot be accessed using the IMAP4 protocol. This service is
IMAP4
Backend
Microsoft This process controls all of the Store Worker processes. If a DB is dismounted, it is responsible
Exchange for terminating the associated Store Worker process and if a DB is mounted, it starts a new
Store Worker process. If this service is disabled, any services that explicitly depend on it fail to
Information
start. This service is dependent on the Microsoft Exchange Active Directory Topology, RPC,
Store
Server, Windows Event Log, and Workstation services.
N/A Each database hosted on a server creates a separate process for each one. This
process performs the same work as the 'store.exe process did in previous versions, just
on an individual DB basis. This process is dependent on the Microsoft Exchange
Information Store service.
Microsoft Performs background processing of mailboxes in the Exchange store. This service is
Mailbox
Assistant
Microsoft Processes mailbox move requests. This service is dependent on the Microsoft
Exchange Exchange Active Directory Topology and Net.Tcp Port Sharing services. This service is
Mailbox
Replication
Microsoft Allows applications to call the Exchange diagnostic cmdlets. This service has no
Exchange dependencies.
Monitoring
Microsoft Provides Post Office Protocol version 3 service to mailboxes. If this service is stopped,
Exchange mailboxes on this server cannot be accessed using the POP3 protocol.
POP3 Backend
Microsoft Provides replication functionality for mailbox databases on Mailbox servers in a database
Exchange availability group (DAG) and database mount functionality for all Mailbox servers. This service
is dependent upon the Microsoft Exchange Active Directory Topology service.
Replication
936
Microsoft Manages client RPC connections for Exchange. This service is dependent upon the
Exchange RPC Microsoft Exchange Active Directory Topology service.
Client Access
Microsoft Enables Windows Server Backup users to back up and recover application data for Microsoft
Exchange Exchange. This service has no dependencies.
Server
Extension for
Windows
Server Backup
Microsoft This service provides host level deployment and management services for applications.
Exchange This service is dependent upon the HTTP service.
Search Host
Controller
Microsoft Provides a host for several Exchange services. On internal server roles, this service is
Service Host
Microsoft This service, running on the Mailbox servers, receives the Submit events, processes the
Exchange messages by converting them from MAPI to MIME and hands them over to the Exchange
Transport service. This service is dependent upon the Microsoft Exchange Active Directory
Mailbox
Topology service.
Transport
Submission
Microsoft Limits the rate of user operations. This service is dependent upon the Microsoft
Exchange Exchange Active Directory Topology service.
Throttling
Microsoft Acts as a middle man and routes messages between Mailbox Transport Submission service
Exchange and the Front End Transport service. It is identical to the Hub Transport Server role in
Transport Exchange 2010. Never contacts the mailbox databases directly. This service is dependent
upon the Microsoft Exchange Active Directory Topology and Microsoft Filtering Management
services.
Microsoft Provides remote search capability for Microsoft Exchange Transport log files. This
Exchange service is dependent upon the Microsoft Exchange Active Directory Topology service.
Transport Log
Search
Microsoft Enables Microsoft Exchange Unified Messaging features. This allows voice and fax messages
Exchange to be stored in Microsoft Exchange and gives users telephone access to e-mail, voice mail,
calendar, contacts, or an auto attendant. If this service is stopped, Unified Messaging is not
Unified
available. This service is dependent upon the Microsoft Exchange Active Directory Topology
Messaging
service.
937
Exchange Event Log Message Details
This resource displays the Exchange event log messages while providing a search window and a filter. The
filter allows you to choose which types of log messages you want to display. The data can be sorted by
clicking the headers of each column. This resource shows Error, Warning, Information, Security Audit
Success, and Security Audit Failure events specific to the monitored Exchange server.
Clicking any event message in the list will open a new window, displaying the entire message.
938
Exchange Server
This resource contains performance counters specific to the current status of the Exchange Server. The
icons of the listed performance counters in the Statistic Name column will change color to reflect the listed
counter's current state. Clicking any performance counter in the Statistic Name column will take you to
939
RPC Definition: >1 > 1 for
Requests Shows the percentage of failed requests in the total number of RPC 15
failed (%) requests. Failed means the sum of failed with error code plus failed polls
with exception.
Information:
Should be less than 1 at all times
Possible problems:
Users may report slow performance, disconnects, or failures within their
client performing certain activities.
Remediation:
Review the Windows Event logs for any related events. Use ExBPA to
perform a Health scan of your server and review any issues reported. In
Exchange 2010, verify SP1 or higher has been installed on your system.
RPC Definition: >0 > 0 for

Requests Shows the current number of outstanding RPC requests. 15
Outstanding polls
Information:
Possible problems:
Server may stop accepting RPC requests.
Remediation:
perform a Health scan of your server and review any issues reported.
Use Exchange Server User Monitor application to review user
sessions. In Exchange 2010, verify SP1 or higher has been installed on
your system.
RPC Latency Definition: > 100 ms > 100

Average Shows the average latency, in ms, of RPC requests. The average is ms for
(msec) calculated over all RPCs since exrpc32 was loaded. 15
polls
Information:
The average is calculated over all RPCs since exrpc32 was loaded.
Should be less than 100 ms at all times.
Possible problems:
Users may report slow performance issues.
Remediation:
If the disk subsystem is not meeting demand, correcting the problem
may require additional disks, faster disks, or modifying the disk
configuration.
940
RPC Definition: N/A N/A
Requests RPC Requests sent/sec is the current rate of initiated RPC requests per
sent/sec second.
Information:
Used for determining current load.
RPC Slow Definition: N/A N/A

requests Shows the average latency, in ms, of slow requests.
latency
Information:
average
Used for determining the average latencies of RPC slow requests.
(msec)
Possible problems:
Client disconnects or slow performance issues.
Remediation:
Exchange 2010, verify SP1 or higher has been installed on your system.
RPC Slow Definition: > 1 > 1 for

requests (%) RPC Slow requests (%) is the percent of slow RPC requests among all 15
RPC requests. polls
Information:
A slow RPC request is one that has taken more than 500 ms.Should be
less than 1 at all times.
Possible problems:
Client disconnects or slow performance issues.
Remediation:
Exchange 2010, verify SP 1 or higher has been installed on your system.
ROP Definition: N/A N/A

Requests ROP Requests outstanding shows the total number of outstanding
Outstanding remote operations requests.
Information:
Used for determining current load.
Hub Servers Definition: > 0.99 >1

In Retry Shows the number of Hub Transport servers in retry mode.
Information:
941
(Only Possible problems:
available in Domain where you send large amount of email is unavailable, infected
Exchange machine on network sending messages, DNS resolution issues, or
2010) network connectivity to destination servers or the internet.
Remediation:
Determine the root cause and verify there aren't any network
connectivity issues.
Average Definition: > 30 > 30

Document Shows the average, in ms, of how long it takes to index documents. for 15
Processing polls
Information:
Time In
Should be less than 30 seconds at all times.
Milliseconds
Possible problems:
Verify content index state of all database copies.
Remediation:
For any database indexes not "healthy," update the content Index on the
server using the following command: Update-MailboxDatabaseCopy
<DBName> -CatalogOnly
Zooming
the resource.
page
942
Information Store
This resource contains performance counters specific to the status of the current Information Store. The
icons of the listed performance counters in the Statistic Name column changes color to reflect the listed
Performance Counter Details page for that counter.
The Exchange Information Store is a storage platform that is used to manage numerous types of
information within an Exchange server deployment.
943
Connection Definition: N/A N/A
Count Is the total number of client connections maintained.
(Only Information:
available in This is used to determine current load of the server's Information Store.
Exchange
Possible problems:
2013)
May cause memory bottlenecks on the server if the number is
excessively high.
Remediation:
Reduce the number of user mailboxes hosted on the server or increase
available resources.
Active User Definition: N/A N/A

Count Number of user connections that have shown some activity in the last 2
minutes.
Information:
Used to determine current user load on the server. Each active user
typically starts up to 5 active sessions (connections) on a server, in order
to sync various services.
Possible problems:
excessively high.
Remediation:
Determine if users are running applications not required for business
use, and request they do not run these applications which is causing an
increase in server logons. If this does not help, or is not possible, reduce
the number of users hosted on the server and move any Public Folders
on the server to a different server.
RPC Definition: > 100 ms > 100

Averaged Indicates the RPC latency, in ms, averaged for all operations in the last ms for
Latency 1,024 packets. 15
polls
Information:
For information about how clients are affected when overall server RPC
averaged latencies increase, see “Understanding Client Throttling
Policies” at http://technet.microsoft.com/en-us/library/dd297964.aspx.
Should not be higher than 100 ms on average.
Possible problems:
To determine if certain protocols are causing overall RPC latencies,
monitor MSExchangeIS Client (*)\RPC Average Latency to separate
latencies based on client protocol.
944
Remediation:
Faster disks, more disks, or redesigning existing disk arrays.
RPC Definition: > 70 > 70 for

Requests Indicates the overall RPC requests currently executing within the 15
information store process. polls
Information:
Should be below 70 at all times.
Possible problems:
When I/O counters fall outside of normal range, client performance is
directly impacted. For example, Outlook and Outlook Web App (OWA)
users report “Outlook is slow” when opening mail or moving between
folders.
Remediation:
Faster disks, more disks, or redesigning existing disk arrays.
Active Definition: N/A N/A

Connection Number of connections that have shown some activity in the last 10
Count minutes.
(Only Information:
available in This is used to determine current load of the server's Information Store.
Exchange
Possible problems:
2010)
excessively high.
Remediation:
Reduce the number of user mailboxes hosted on the server or increase
available resources.
Client: RPCs Definition: > 0 for 5 > 0 for

Failed: Shows the client-reported rate of failed RPCs (since the store was polls 15
Server too started) due to the Server Too Busy ROC error. polls
busy/sec
Information:
(Only Should be 0 at all times.
available in
Possible problems:
Exchange
Higher values may indicate RPC threads are exhausted or client
2010)
throttling is occurring for clients running versions of Outlook earlier
than Microsoft Office Outlook 2007. This can cause user mail clients
experiencing slowness.
945
Remediation:
Check if RPC latencies are high and determine the cause of the
performance issue (e.g. poorly performing disk I/O, excessive load,
insufficient memory, high number of users).
RPC Client Definition: N/A N/A

Backoff/sec The rate at which the server notifies a client to withdraw (backoff).
(Only Information:
available in Indicates the rate at which client backoffs are occurring.
Exchange
Possible problems:
2010)
Higher values may indicate that the server may be incurring a higher
load resulting in an increase in overall averaged RPC latencies, causing
client throttling to occur. This can also occur when certain client user
actions are being performed. Depending on what the client is doing and
the rate at which RPC operations are occurring, it may be normal to see
backoffs occurring.
Remediation:
Check if RPC latencies are high and determine the cause of the
performance issue (e.g. poorly performing disk I/O, excessive load,
insufficient memory, high number of users).
Active Definition: N/A N/A

Client Number of logons that have been active (issued any MAPI requests)
Logons within the last 10 minute time interval.
(Only Information:
available in Active client logons can be high if users are logging on and logging off
Exchange frequently.
2010)
Possible problems:
excessively high.
Remediation:
Determine if users are running applications not required for business
use, and request they do not run these applications which is causing an
increase in server logons. If this does not help, or is not possible, reduce
the number of server hosted on the server and move any Public Folders
Messages Definition: > 50 > 50 for

Queued for Shows the current number of submitted messages not yet processed by 15
Submission the transport layer. polls
946
(Only Information:
available in The queues should remain below 50 at any given time. Anything above
Exchange this amount should be cleared within 15 minutes.
2010)
Possible problems:
Mailbox server is not communicating properly with the transport server.
Remediation:
Verify network connectivity and transport server functionality.
Slow Definition: N/A N/A

FindRow Shows the rate at which the slower FindRow needs to be used in the
Rate mailbox store.
(Only Information:
available in Should be no more than 10 for any specific mailbox store.
Exchange
Possible problems:
2010)
Higher values indicate applications are crawling or searching mailboxes,
which is affecting server performance. These include desktop search
engines, customer relationship management (CRM), or other third-party
applications.
Remediation:
Run the ResetSearchIndex.ps1 script which is located in the scripts
directory at the root of the Exchange installation. Alternatively, you can
perform the process manually:
1. Rebuild the index catalog using: Update-MailboxDatabaseCopy

<DBName> -CatalogOnly command.
2. Stop the Microsoft Exchange Search Service.
3. Delete old catalog files.
4. Restart Microsoft Exchange Search Service.
Zooming
the resource.
page
947
Mailbox Database Copies
This resource shows the status of the Exchange mailbox database copies. The data can be sorted by
clicking the headers of each column.
Hovering over any Database Name in the list displays detailed information about that database in the
tooltip. Hovering over the node provides a tooltip with information about that node.
n Database Name: Name of the listed database copy.

n Copy Status: Displays the status of the listed database copy. (See Table 1 below for possible
statuses.)
n Content Index State: See the following table for returned status descriptions. (See Table 2 below
for possible statuses.)
n Exchange Server: Name of the Exchange application and the node it is on.

Table 1.
Mounted The active copy is online and accepting client connections. Only the active copy of the
mailbox database copy can have a copy status of Mounted.
Mounting The active copy is coming online and not yet accepting client connections. Only the active
copy of the mailbox database copy can have a copy status of Mounting.
Dismounting The active copy is going offline and terminating client connections. Only the active copy of
the mailbox database copy can have a copy status of Dismounting.
Dismounted The active copy is offline and not accepting client connections. Only the active copy of the
mailbox database copy can have a copy status of Dismounted.
948
Seeding The mailbox database copy is being seeded, the content index for the mailbox database
copy is being seeded, or both are being seeded. Upon successful completion of seeding,
the copy status should change to Initializing.
Seeding The mailbox database copy is being used as a source for a database copy seeding
Source operation.
Initializing The mailbox database copy is in an Initializing state when a database copy has been
created, when the Microsoft Exchange Replication service is starting or has just been
started, and during transitions from Suspended, Service Down, Failed, Seeding, or Single
Page Restore to another state. While in this state, the system is verifying that the database
and log stream are in a consistent state. In most cases, the copy status remains in the
Initializing state for about 15 seconds, but in all cases, it should generally not be in this
state for longer than 30 seconds.
Re- The mailbox database copy and its log files are being compared with the active copy of the
synchronizing database to check for any divergence between the two copies. The copy status remains in
this state until any divergence is detected and resolved.
Single Page This state indicates that a single page restore operation is occurring on the mailbox
Restore database copy.
Failed The mailbox database copy is in a Failed state because it is not suspended, and it is not
able to copy or replay log files. While in a Failed state and not suspended, the system
periodically checks whether the problem that caused the copy status to change to Failed
has been resolved. After the system has detected that the problem is resolved, and
barring no other issues, the copy status automatically changes to Healthy.
Service Down The Microsoft Exchange Replication service is not available or running on the server that
hosts the mailbox database copy.
Suspended The mailbox database copy is in a Suspended state as a result of an administrator

manually suspending the database copy by running the Suspend-
MailboxDatabaseCopy cmdlet.
Healthy The mailbox database copy is successfully copying and replaying log files, or it has
successfully copied and replayed all available log files.
Disconnected The mailbox database copy is no longer connected to the active database copy, and it was
and Healthy in the Healthy state when the loss of connection occurred. This state represents the
database copy with respect to connectivity to its source database copy. It may be reported
during DAG network failures between the source copy and the target database copy.
949
and Re- in the Re-synchronizing state when the loss of connection occurred. This state represents
synchronizing the database copy with respect to connectivity to its source database copy. It may be
reported during DAG network failures between the source copy and the target database
copy.
Failed and The Failed and Suspended states have been set simultaneously by the system because a
Suspended failure was detected, and because resolution of the failure explicitly requires
administrator intervention. An example is if the system detects unrecoverable divergence
between the active mailbox database and a database copy. Unlike the Failed state, the
system will not periodically check whether the problem has been resolved, and
automatically recover. Instead, an administrator must intervene to resolve the underlying
cause of the failure before the database copy can be transitioned to a healthy state.
Table 2.
State Description Status on

Active &
Passive
Copies
Crawling Database is in the process of indexing database content. Depending on the size Warning
of the database, this process could take some time to complete.
Disabled Indexing for the database has been disable by an administrator. Offline

(Active)
N/A
(Passive)
Failed An error has occurred causing the content index to fail. Critical
Failed and The Failed and Suspended states have been set simultaneously by the system Critical
Suspended because a failure was detected, and because resolution of the failure explicitly
requires administrator intervention.
Healthy This indicates the Content Index is up to date and has not detected any issues. Up
This is the only state in which a failover (automatic process) to a specific
database copy can occur.
Seeding A database copy is in the process of updating its Content Index from another Up
database copy.
Suspended The Suspended status occurs if an administrator manually pauses or suspends Warning
it from receiving updates from the active copy. This might be done to update a
failed Content Index or to perform troubleshooting for other issues.
950
Mailbox Database Size and Space Use
This resource numerically and graphically shows metrics concerning the Exchange mailbox database size.
Hovering over any Database Name in the list displays detailed information about that database in the
tooltip. Clicking any database in the Database column takes you to the Database Details page for that
database.
n Database Name: Name of the listed database.

n Database Size: Size of the listed database.
n White Space: The amount of space available at the root of a database for new mailboxes before the
file size increases.
n Space Usage: This graphically represents used data of the database, white space of the database,
and free space on the volume, respectively.
n Total Mailboxes: The total number of mailboxes on the listed database.
n Average Mailbox Size: The average size of an individual mailbox.
951
Mailbox Database Status
This resource provides details concerning the status of the current mailbox database being monitored by
the application.
n Database Name: Name of the listed database.

n Copy Status: Displays the status of the active database. The table below provides the possible status
with its definition:
Mounted The active copy is online and accepting client connections. Only the active copy of
the mailbox database copy can have a copy status of Mounted.
Mounting The active copy is coming online and not yet accepting client connections. Only the
active copy of the mailbox database copy can have a copy status of Mounting.
Dismounting The active copy is going offline and terminating client connections. Only the active
copy of the mailbox database copy can have a copy status of Dismounting.
Dismounted The active copy is offline and not accepting client connections. Only the active copy
of the mailbox database copy can have a copy status of Dismounted.
Seeding The mailbox database copy is being seeded, the content index for the mailbox
database copy is being seeded, or both are being seeded. Upon successful
completion of seeding, the copy status should change to Initializing.
Source operation.
created, when the Microsoft Exchange Replication service is starting or has just
been started, and during transitions from Suspended, ServiceDown, Failed,
Seeding, or SinglePageRestore to another state. While in this state, the system is
verifying that the database and log stream are in a consistent state. In most cases,
the copy status remains in the Initializing state for about 15 seconds, but in all
cases, it should generally not be in this state for longer than 30 seconds.
Re- The mailbox database copy and its log files are being compared with the active copy
synchronizing of the database to check for any divergence between the two copies. The copy status
remains in this state until any divergence is detected and resolved.
952
Failed The mailbox database copy is in a Failed state because it isnot suspended, and it
isnot able to copy or replay log files. While in a Failed state and not suspended, the
system periodically checks whether the problem that caused the copy status to
change to Failed has been resolved. After the system has detected that the problem
is resolved, and barring no other issues, the copy status will automatically change to
Healthy.
Service Down The Microsoft Exchange Replication service isnot available or running on the server
that hosts the mailbox database copy.
Disconnected The mailbox database copy is no longer connected to the active database copy, and
and Healthy it was in the Healthy state when the loss of connection occurred. This state
represents the database copy with respect to connectivity to its source database
copy. It may be reported during DAG network failures between the source copy and
the target database copy.
and Re- it was in the Re-synchronizing state when the loss of connection occurred. This state
synchronizing represents the database copy with respect to connectivity to its source database
Failed and The Failed and Suspended states have been set simultaneously by the system
requires administrator intervention. An example is if the system detects
unrecoverable divergence between the active mailbox database and a database
copy. Unlike the Failed state, the system will not periodically check whether the
problem has been resolved, and automatically recover. Instead, an administrator
must intervene to resolve the underlying cause of the failure before the database
copy can be transitioned to a healthy state.
n Copy Queue Length: The copy queue length is an integer indicating number of files. The Copy
Queue Length shows the number of transaction log files waiting to be copied to the passive copy log
file folder. A copy is not considered complete until it has been checked for corruption.
n Replay Queue Length: The Replay Queue Length shows the number of transaction log files waiting
to be replayed into the passive copy.
n Last Inspected Log Time: This is the date and time when the last log file was verified (inspected) by
the LogInspector for a particular database after being copied from the active copy. This field is only
relevant for passive copies of a database.
n Content Index State: See the following table for returned status descriptions.
953
Active &
Passive
Copies
Crawling Database is in the process of indexing database content. Depending on the Warning
size of the database, this process could take some time to complete.
(Active)
N/A
(Passive)
Failed and The Failed and Suspended states have been set simultaneously by the Critical
Suspended system because a failure was detected, and because resolution of the
failure explicitly requires administrator intervention.
Healthy This indicates the Content Index is up to date and has not detected any Up
issues. This is the only state in which a failover (automatic process) to a
specific database copy can occur.
Seeding A database copy is in the process of updating its Content Index from Up
another database copy.
Suspended The Suspended status occurs if an administrator manually pauses or Warning
suspends it from receiving updates from the active copy. This might be
done to update a failed Content Index or to perform troubleshooting for
other issues.
n Activation Preference: Indicates which database copy has preference over another copy. It is used
as part of the formula to determine which database copy will become active during a failover. The
value can range from 1 to 16 depending on the number of servers in the DAG. The lower the
number, the higher the preference.
954
Mail Database
This resource contains performance counters specific to the status of the current Mail Database. The icons
of the listed performance counters in the Statistic Name column change colors to reflect the listed
Database Definition: N/A N/A

Cache Shows the amount of system memory, used by the database cache
Size (MB) manager to hold commonly used information from the database files to
prevent file operations.
Information:
This and Database Cache Hit % are useful counters for gauging whether a
server's performance problems might be resolved by adding more physical
memory. Use this counter along with store private bytes to determine if
there are store memory leaks.
955
Possible problems:
Situation when the database cache size seems too small for optimal
performance and there is little available memory on the system (check the
value of Memory/Available Bytes) could negatively impact on performance.
If there is ample memory on the system and the database cache size is not
growing beyond a certain point, the database cache size may be capped at
an artificially low limit. Increasing this limit may increase performance.
Remediation:
Adding more memory to the system and/or increasing database cache size
may increase performance.
Database Definition: > 0 > 0 for

Page Shows the rate that database file page requests require of the database 15
Fault cache manager to allocate a new page from the database cache. polls
Stalls/sec
Information:
Possible problems:
If this value is nonzero, this indicates that the database is not able to flush
dirty pages to the database file fast enough to make pages free for new
page allocations.
Remediation:
If the disk subsystem is not meeting demand, correcting the problem may
require additional disks, faster disks, or modifying the disk configuration.
Version Definition: > 11500 >

Buckets Shows the total number of version buckets allocated. 12000
Allocated
Information:
Should be less than 12,000 at all times. The maximum default version is
16,384. If version buckets reach 70% of maximum, the server is at risk of
running out of the version store.
Possible problems:
Typically indicates a database transaction which is taking a long time to
save to disk. During Online DB defrags, the version buckets may increase.
Remediation:
Verify if the server has any applications running that have a long running
transaction which has not been saved to disk, causing the version store
memory resource to be exhausted.
956
Log Definition: > 10 for > 10 for
Record Shows the number of log records that can't be added to the log buffers per 15 polls 60
Stalls/sec second because the log buffers are full. If this counter is nonzero for a long polls
period of time, the log buffer size may be a bottleneck.
Information:
The average value should be below 10 per second. Spikes (maximum
values) should not be higher than 100 per second.
Possible problems:
If I/O log write latencies are high, check for RAID5 or synchronize
replication on log devices.
Remediation:
You can also use the MSExchange Database Instances (Information
store/<Database Name>)\log record stalls/sec counter to determine which
database(s) may be having issues. This assists you in determining which
drive(s) to focus on. This counter is an extended Exchange counter in
Performance Monitor. The solution can include additional disks,
reconfigured RAID configuration, adding new database(s), or re-balancing
mailboxes across databases or servers.
Log Definition: > 10 for > 10 for

Threads Shows the number of threads waiting for their data to be written to the log 15 polls 60
Waiting to complete an update of the database. If this number is too high, the log polls
may be a bottleneck.
Information:
Should be less than 10 on average.
Possible problems:
If this number is too high, the log may be a bottleneck. Regular spikes
concurrent with log record stall spikes indicate that the transaction log
disks are a bottleneck. If the value for log threads waiting is more than the
spindles available for the logs, there is a bottleneck on the log disks.
Remediation:
Zooming
the resource.
957
page.
958
Management
This resource contains controls that are actionable for both the application and the node. The controls in
the following illustration are SAM-specific.
Application:
n Edit Application Monitor: This allows you to edit the current application by changing the settings
specifically related to this application. This includes, but is not limited to: changing the polling
frequency, changing the Windows and PowerShell URLs, changing the Exchange Server credentials,
and adjusting threshold settings for component monitors that have thresholds. Changing some
settings may require you to override the template that this application is based upon. To do this,
simply click Override Template.
n Unmanage: Allows you to stop the polling and collecting of statistics of the current application for a
user-defined period of time.
n Poll Now: Allows the application to retrieve the most current statistics when clicked.
Note: By default, mailbox statistics are not polled when Poll Now is clicked.
Node:
n Real-Time Process Explorer: Opens the RTPE in a new window. For more information, see The Real
Time Process Explorer.
n Service Control Manager: Opens the SCM in a new window. For more information, see The Service
Control Manager.
n Real-Time Event Viewer: Opens the RTEV in a new window. For more information, see The Real
Time Event Log Viewer.
959
Replication
This resource contains performance counters specific to the status of the current replication process. The
icons of the listed performance counters in the Statistic Name column changes color to reflect the listed
Performance Counter Details page for that counter.
The purpose of using data replication is to maintain current replicas of the data. Exchange servers can use
the replicas to provide continuity of email service in the event of a storage or site outage in the primary
location.
960
CopyQueueLength Definition: >1 > 1 for
Shows the number of transaction log files waiting to be copied 5 polls
to the passive copy log file folder. A copy isn't considered
complete until it has been checked for corruption.
Information:
All nodes in a Database Availability Group (DAG) should be
monitored for this counter depending on the passive node.
Should be less than 1 at all times for continuous replication.
Possible problems:
Server recently rebooted or services restarted, network
connectivity issues, or multiple mailbox moves are in process.
Remediation:
Verify network connectivity between the various nodes in the
DAG. Verify Replication Service is running on all DAG members.
ReplayQueueLength Definition: > 50 for > 100

Shows the number of transaction log files waiting to be 5 polls for 5
replayed into the passive copy. polls
Information:
With DAG replication, transaction logs are shipped to the other
DAG members. They then replay the log file. (Thresholds
should be manually removed for DAG members configured to
be 'lagged copies.')
Possible problems:
The replay queue length should be as low as possible,
otherwise this could indicate a (performance) issue with the
DAG member containing the Copy database. A high number
could also negatively affect failover with some loss of data as a
possibility.
Remediation:
Check Memory, CPU, and Disk I/O for any bottlenecks. Review
the Windows Event logs for any related events.
Avg Log Copy Definition: N/A N/A

Latency (msec) Average number of milliseconds observed by the log copier
when sending messages over the network.
(Only available in
Exchange 2010)
Log Copy KB/sec Definition: N/A N/A

The size of the log files (in KB) that are copied per second.
961
Information:
Shows the size in KB/sec of the transaction logs being copied
to passive copies.
Log Replay Rate Definition: N/A N/A

(generations/sec) The number of log files that have been replayed per second.
Information:
Shows you the number of Transaction Logs being replayed on
the passive copies of a database.
Log Replay is Not Definition: >= 1 >= 1

Keeping Up LogReplayNotKeepingUp is 1 when log replay is falling behind for 60
and not able to keep up with log copying and inspection. polls
Information:
Exchange 2010/2013 uses continuous replication to create and
maintain database copies. To maintain a synchronized copy of
a mailbox database, transaction log files from the active
mailbox server are replayed into the passive database of
another server in the DAG. This provides high availability and
resiliency in the Exchange environment.
Possible problems:
Indicates a replication issue may exist with the mailbox
database copies in the DAG. If Transaction Log replay is not
able to keep up with the active copy, passive copies will not be
up of date.
Remediation:
Review the Windows Event logs for any related events. Examine
network topology between DAG members and verify
connectivity and network latency is below 250 ms. Examine
CPU utilization by the Information Store service on passive
copies. Examine the replication status for each replica
database using the Get-MailboxDatabaseCopyStatus
cmdlet.
Zooming
the resource.
962
page.
963
Replication Status Checks
This resource performs up to 16 checks in Exchange 2010 and up to 18 checks in Exchange 2013 (divided
into two columns. This resource only shows test results which apply to the server it is being run against,
whether the server contains only active databases, passive databases, or a combination of the two. The
fewest checks are performed when run against a server with only active databases (Seven checks for 2010,
12 checks for 2013). This is because check for databases replication status is not necessary because they
are all on the local server.
The status for each Health Check Test can be one of the following: Passed, Failed, or Warning.
The table below provides a list of all possible tests for this resource along with their definitions.
Health Check Test Name Description
TcpListener Verifies that the TCP log copy listener is running and reachable on the
specified DAG member, or if no DAG member is specified, on the local
server.
TasksRpcListener Verifies that the tasks remote procedure call (RPC) server is running and
reachable on the specified DAG member, or if no DAG member is
specified, on the local server.
ServerLocatorService Verifies the Active Manager client/server processes on DAG members

and on the Client Access Server that perform lookups in Active Directory
and Active Manager to determine where a user’s mailbox database is
active.
ReplayService Verifies that the Microsoft Exchange Replication service is running and
reachable on the specified DAG member, or if no DAG member is
QuorumGroup Verifies that the default cluster group (quorum group) is in a healthy
and online state.
964
FileShareQuorum Verifies that the witness server and witness directory and share
configured for the DAG are reachable.
DBLogReplayKeepingUp Verifies that replay activity for the passive copies of databases on the
server, is able to keep up with log copying and inspection activity.
DBLogCopyKeepingUp Verifies that log copying and inspection by the passive copies of
databases on the specified DAG member, or if no DAG member is
specified, on the local server, are able to keep up with log generation
activity on the active copy.
DBInitializing Checks whether any mailbox database copies are in a state of

Initializing on the specified DAG member, or if no DAG member is
DBDisconnected Checks whether any mailbox database copies are in a state of

Disconnected on the specified DAG member, or if no DAG member is
DBCopySuspended Checks whether any mailbox database copies are in a state of

Suspended on the specified DAG member, or if no DAG member is
DBCopyFailed Checks whether any mailbox database copies are in a state of Failed on
the specified DAG member, or if no DAG member is specified, on the
local server.
DatabaseRedundancy (Only Verifies that there is at least one healthy copy available of the databases
2013) on the specified DAG member, or if no DAG member is specified, on the
local server.
DatabaseAvailability (Only 2013) Verifies that the databases have sufficient availability on the specified
DAG member, or if no DAG member is specified, on the local server.
DagMembersUp Verifies that all DAG members are available, running, and reachable.
ClusterService Verifies that the Cluster service is running and reachable on the
server.
ClusterNetwork Verifies that all cluster-managed networks on the specified DAG

member, or if no DAG member is specified, the local server, are
available.
ActiveManager Verifies that the instance of Active Manager running on the specified
DAG member, or if no DAG member is specified, the local server, is in a
valid role (primary, secondary, or stand-alone).
965
Storage
This resource contains performance counters specific to the status of storage. The icons of the listed
I/O Database Definition: > 50 ms > 50

Reads Average Shows the average length of time, in ms, per database read ms for
Latency operation. 15 polls
Information:
Should be 20 ms on average. Spikes should not exceed 50 ms.
Possible problems:
Users may report sluggish responsiveness within their email
client.
966
Remediation:
If the disk subsystem is not meeting demand, correcting the
problem may require additional disks, faster disks, or modifying
the disk configuration.
I/O Database Definition: > 100 ms > 100

Writes Average Shows the average length of time, in ms, per database write ms for
Latency operation. 15 polls
Information:
Should be 50 ms on average. Spikes of up to 100 ms are
acceptable if not accompanied by database page fault stalls.
Possible problems:
client.
Remediation:
I/O Log Reads Definition: > 200 ms > 200

Average Indicates the average time, in ms, to read data from a log file. ms
Latency Specific to log replay and database recovery operations. for 15
polls
Information:
Average should be less than 200 ms with spikes up to 1000 ms
Possible problems:
client.
Remediation:
I/O Log Writes Definition: > 10 ms > 10 ms

Average Indicates the average time, in ms, to write a log buffer to the for 15
Latency active log file. polls
Information:
This count should be 10 ms or less on production servers.
Possible problems:
Indication that the MS Exchange Database\I/O Database Writes
Average Latency is too high
967
Remediation:
Zooming
the resource.
page.
968
Users By Mailbox Size
This resource numerically and graphically shows metrics concerning mailbox size per user. The data can
be sorted by clicking the headers of each column.
Hovering over any user in the User Name list will display detailed information about that user's mailbox in
the tooltip. Clicking any database in the Database column will take you to the Database Details page for
that database.
Notes
n If there are no user mailboxes on a given database, this resources will disappear from the Mailbox
Database Details page.
n If there are no user mailboxes in any of the active databases on an Exchange server, this resource
will disappear from the Application Details page.
n User mailbox information is collected only once a day after midnight, local time.
n User Name: Name of the listed user.

n Mailbox Size: Total size of the listed mailbox that is currently being used by the user.
n % Quote Used: Graphically and numerically shows the percentage used of the listed mailbox.
n Attachment Size: This is the total size of all emails that have an attachment. This includes the body
of the email as well as any attachments.
n Attachment Count: Shows the number of email messages that contain attachments, as opposed to
the actual number of attachments contained in each email.
Note: The maximum number of email messages with attachments that can be reported is 10,000.
n Last Accessed: Displays the time and date the listed mailbox was last accessed by the user.
n Database: This is the database that contains the listed user's mailbox.
For more information, see Attachment extensions acknowledged by AppInsight for Exchange.
969
Users By Percent Mailbox Quota Used
This resource shows metrics based on the percentage of a user's mailbox quota used. The data can be
sorted by clicking the headers of each column.
that database.
If there are no user mailboxes or mailbox quotas are not in use on a given database, this resources
will disappear from the Mailbox Database Details page. If there are no user mailboxes or mailbox
quotas are not in use in any of the active databases on an Exchange server, this resource will
disappear from the Application Details page. User mailbox information is collected only once a day
after midnight, local time.

n % Quota Used: Graphically and numerically shows the percentage used of the listed mailbox.
n Mailbox Size: Total size of the listed mailbox that is currently being used by the user.
n Attachment Size: This is the total size of all emails that have an attachment. This includes the body
of the email as well as any attachments.
n Attachment Count: This is the number of emails that have at least one attachment.
n Last Accessed: Displays the time and date the listed mailbox was last accessed by the user.
970
Users By Messages Sent
This resource shows metrics based on messages sent. The data can be sorted by clicking the headers of
each column.
that database.
If there are no user mailboxes on a given database, this resources will disappear from the Mailbox
Database Details page. If there are no user mailboxes in any of the active databases on an Exchange
server, this resource will disappear from the Application Details page. User mailbox information is
collected only once a day after midnight, local time. If Server Mailbox Accounts Statistics is disabled,
this resource, as well as the Messages Sent and Messages Received charts on the Mailbox Details
view, will disappear.

n Sent Yesterday: Current number of messages sent yesterday for the listed user.
n Sent Last 7 Days: This is the total number of emails that have been sent in the last seven days.
n Sent Last 30 Days: This is the total number of emails that have been sent in the last 30 days.
n Last Accessed: Displays the date the listed mailbox was last accessed by the user
971
AppInsight for Exchange Database Details View
1. On the web console, navigate to the AppInsight for Exchange Details view by clicking and AppInsight
for Exchange application in the All Applications resource.
2. From a Database resource, click any database in the list.
The available resources unique to this view include:
n Active Mounted Database Availability

n Database Copies
n Database Details
n Database Disk Input Output
n Database File Size
n Database Input and Output
n Database Metrics
n Events
n Messages
n Transaction Log File Size
n Transaction Log Disk Input and Output
If the name of a database is extremely long, certain performance counters may not be visible on the
Database Details page. If databases are grouped by a status of Unknown in Network Atlas,
AppInsight for Exchange databases will be displayed.
972
Active Mounted Database Availability
This resource graphically shows the various states of database availability in a percentage format and is
made up of three sections: the legend, the main chart, and the lower chart. The colors of the main chart
Zooming
You can have the chart show a predetermined, hourly time period of data by clicking on any one of the
three Zoom buttons; 1h, 12h, or 24h. Alternatively, you can have the chart show a specific time range by
dragging the mouse over a small area of the chart.
973
Database Copies
This resource provides details concerning the status of the current Exchange server being monitored by
the application.
n Exchange Server: Name of the listed Exchange Server.

n Copy Status: Displays the status of the active database. The table below provides the possible status
with its definition:
Mounted The active copy is online and accepting client connections. Only the active copy of
the mailbox database copy can have a copy status of Mounted.
Mounting The active copy is coming online and not yet accepting client connections. Only the
active copy of the mailbox database copy can have a copy status of Mounting.
Dismounting The active copy is going offline and terminating client connections. Only the active
copy of the mailbox database copy can have a copy status of Dismounting.
Dismounted The active copy is offline and not accepting client connections. Only the active copy
of the mailbox database copy can have a copy status of Dismounted.
Seeding The mailbox database copy is being seeded, the content index for the mailbox
database copy is being seeded, or both are being seeded. Upon successful
completion of seeding, the copy status should change to Initializing.
Source operation.
created, when the Microsoft Exchange Replication service is starting or has just
been started, and during transitions from Suspended, ServiceDown, Failed,
Seeding, or SinglePageRestore to another state. While in this state, the system is
verifying that the database and log stream are in a consistent state. In most cases,
the copy status remains in the Initializing state for about 15 seconds, but in all
cases, it should generally not be in this state for longer than 30 seconds.
Re- The mailbox database copy and its log files are being compared with the active copy
synchronizing of the database to check for any divergence between the two copies. The copy status
remains in this state until any divergence is detected and resolved.
974
Failed The mailbox database copy is in a Failed state because it isnot suspended, and it
isnot able to copy or replay log files. While in a Failed state and not suspended, the
system periodically checks whether the problem that caused the copy status to
change to Failed has been resolved. After the system has detected that the problem
is resolved, and barring no other issues, the copy status automatically changes to
Healthy.
Service Down The Microsoft Exchange Replication service isnot available or running on the server
that hosts the mailbox database copy.
and Healthy it was in the Healthy state when the loss of connection occurred. This state
represents the database copy with respect to connectivity to its source database
and Re- it was in the Re-synchronizing state when the loss of connection occurred. This state
synchronizing represents the database copy with respect to connectivity to its source database
Failed and The Failed and Suspended states have been set simultaneously by the system
requires administrator intervention. An example is if the system detects
unrecoverable divergence between the active mailbox database and a database
copy. Unlike the Failed state, the system will not periodically check whether the
problem has been resolved, and automatically recover. Instead, an administrator
must intervene to resolve the underlying cause of the failure before the database
copy can be transitioned to a healthy state.
n Copy Queue: The Copy Queue length is an integer indicating number of files. The Copy Queue
Length shows the number of transaction log files waiting to be copied to the passive copy log file
folder. A copy is not considered complete until it has been checked for corruption.
n Replay Queue: The Replay Queue Length shows the number of transaction log files waiting to be
replayed into the passive copy.
n Inspected Log Time: This is the date and time when the last log file was verified (inspected) by the
LogInspector for a particular database after being copied from the active copy. This field is only
relevant for passive copies of a database.
n Content Index: See the following table for returned status descriptions.

Active &
Passive
Copies
975
Crawling Database is in the process of indexing database content. Depending on the Warning
size of the database, this process could take some time to complete.
(Active)
N/A
(Passive)
Failed and The Failed and Suspended states have been set simultaneously by the Critical
Suspended system because a failure was detected, and because resolution of the
failure explicitly requires administrator intervention.
Healthy This indicates the Content Index is up to date and has not detected any Up
issues. This is the only state in which a failover (automatic process) to a
specific database copy can occur.
Seeding A database copy is in the process of updating its Content Index from Up
another database copy.
Suspended The Suspended status occurs if an administrator manually pauses or Warning
suspends it from receiving updates from the active copy. This might be
done to update a failed Content Index or to perform troubleshooting for
other issues.
n Activation Preference: Indicates which database copy has preference over another copy. It is used
as part of the formula to determine which database copy will become active during a failover. The
value can range from 1 to 16 depending on the number of servers in the DAG. The lower the
number, the higher the preference.
976
Database Details
This resource provides details concerning the current database.
n Database Name: This provides the name of the current database.

n Summary Status: Displays the current status of the database. (See Table 1 for possible statuses.)
n Active Copy Status: Displays the current status of the database of the Exchange application that is
being monitored. (See Table 2 for possible statuses.)
n Preferred Server: The database copy with an activation preference of 1 is the preferred server.
n Master: This refers to the name of the DAG or the name of the Server which maintains the copy
status information.
n Total Number of Mailboxes: Displays the total number of mailboxes on the listed database.
n Average Mailbox Size: Displays the average size of user mailboxes.
n Last Full Backup: Displays the time and date of the last full backup of the database.
977
n Last Incremented Backup: Displays the time and date of only those files that have been altered
since the last full backup of the database.
n Circular Logging: Circular logging is a method of conserving disk space by deleting transaction log
files after they have been committed to the database. Circular Logging should only be enabled if the
mailbox server is part of a DAG with a minimum of three database copies and one of those should be
set as a "lagged copy."
n Storage Quota Defaults:
n Issue Warning: Displays the minimum size the mailbox must be before a Warning is issued to
the user's mailbox.
n Prohibit Send: Displays the minimum size the mailbox must be before sending email is
prohibited from the user's mailbox.
n Prohibit Send and Receive: Displays the minimum size the mailbox must be before sending
and receiving email is prohibited from the user's mailbox.
Table 1.
This table shows how the value for the Summary Status field is calculated. If the conditions in the first four
columns are met, the status in the Final SAM Status column is displayed in the Summary Status field.
DB Copy Status DB Copy Status (Passive) DB Content DB Content Final

(Active) Index State Index State SAM
(Active) (Passive) Status
Dismounted Any Any Any Offline
Dismounting Any Any Any Warning
Failed Any Any Any Down
Initializing Any Any Any Warning
Mounted, Seeding, or DisconnectedAndHealthy Healthy, Seeding, Any Warning

SeedingSource or SeedingSource
Mounted, Seeding, or DisconnectedAndHealthy Any other Any Critical

SeedingSource
Mounted, Seeding, or DisconnectedAndResynchronizing Healthy, Seeding, Any Warning

Mounted, Seeding, or DisconnectedAndResynchronizing Any other Any Critical

SeedingSource
Mounted, Seeding, or Failed Healthy, Seeding, Any Warning

Mounted, Seeding, or Failed Any other Any Critical

SeedingSource
978
Mounted, Seeding, or FailedAndSuspended Healthy, Seeding, Any Warning
Mounted, Seeding, or FailedAndSuspended Any other Any Critical

SeedingSource
Mounted, Seeding, or Healthy Healthy, Seeding, Healthy, Seeding, Up

SeedingSource or SeedingSource or SeedingSource
Mounted, Seeding, or Healthy Healthy, Seeding, Any other Warning

Mounted, Seeding, or Healthy Crawling Any Warning

SeedingSource
Mounted, Seeding, or Healthy Any other Healthy, Seeding, Warning

Mounted, Seeding, or Healthy Any other Any other Critical

SeedingSource
Mounted, Seeding, or Initializing Healthy, Seeding, Any Up

Mounted, Seeding, or Initializing Any other Any Warning

SeedingSource
Mounted, Seeding, or Resynchronizing Healthy, Seeding, Healthy, Seeding, Up

SeedingSource or SeedingSource or SeedingSource
Mounted, Seeding, or Resynchronizing Healthy, Seeding, Any other Warning

Mounted, Seeding, or Resynchronizing Any other Healthy, Seeding, Warning

Mounted, Seeding, or Resynchronizing Any other Any other Critical

SeedingSource
Mounted, Seeding, or Seeding Healthy, Seeding, Any Up

Mounted, Seeding, or Seeding Any other Any Warning

SeedingSource
Mounted, Seeding, or SeedingSource Healthy, Seeding, Any Up

Mounted, Seeding, or SeedingSource Any other Any Warning

SeedingSource
979
Mounted, Seeding, or Service Down Healthy, Seeding, Any Warning
Mounted, Seeding, or Service Down Any other Any Critical

SeedingSource
Mounted, Seeding, or SinglePageRestore Healthy, Seeding, Any Warning

Mounted, Seeding, or SinglePageRestore Any other Any Critical

SeedingSource
Mounted, Seeding, or Suspended Healthy, Seeding, Any Warning

Mounted, Seeding, or Suspended Any other Any Critical

SeedingSource
Mounting Any Any Any Warning
Service Down Any Any Any Down
SinglePageRestore DisconnectedAndHealthy Healthy, Seeding, Any Warning

or SeedingSource
SinglePageRestore DisconnectedAndHealthy Any other Any Critical
SinglePageRestore DisconnectedAndResynchronizing Healthy, Seeding, Any Warning

or SeedingSource
SinglePageRestore DisconnectedAndResynchronizing Any other Any Critical
SinglePageRestore Failed Any Any Critical
SinglePageRestore FailedAndSuspended Any Any Critical
SinglePageRestore Healthy Healthy, Seeding, Any Warning

or SeedingSource
SinglePageRestore Healthy Crawling Any Critical
SinglePageRestore Healthy Any other Any Critical
SinglePageRestore Initializing Any Any Critical
SinglePageRestore Resynchronizing Healthy, Seeding, Any Warning

or SeedingSource
SinglePageRestore Resynchronizing Any other Any Critical
SinglePageRestore Seeding Healthy, Seeding, Any Warning

or SeedingSource
980
SinglePageRestore Seeding Any other Any Critical
SinglePageRestore SeedingSource Healthy, Seeding, Any Warning

or SeedingSource
SinglePageRestore SeedingSource Any other Any Critical
SinglePageRestore Service Down Any Any Critical
SinglePageRestore SinglePageRestore Any Any Critical
SinglePageRestore Suspended Healthy, Seeding, Any Warning

or SeedingSource
SinglePageRestore Suspended Any other Any Critical

Table 2.
Mounted The active copy is online and accepting client connections. Only the active copy of the
mailbox database copy can have a copy status of Mounted.
Mounting The active copy is coming online and not yet accepting client connections. Only the active
copy of the mailbox database copy can have a copy status of Mounting.
Dismounting The active copy is going offline and terminating client connections. Only the active copy of
the mailbox database copy can have a copy status of Dismounting.
Dismounted The active copy is offline and not accepting client connections. Only the active copy of the
mailbox database copy can have a copy status of Dismounted.
Seeding The mailbox database copy is being seeded, the content index for the mailbox database
copy is being seeded, or both are being seeded. Upon successful completion of seeding,
the copy status should change to Initializing.
Source operation.
created, when the Microsoft Exchange Replication service is starting or has just been
started, and during transitions from Suspended, Service Down, Failed, Seeding, or Single
Page Restore to another state. While in this state, the system is verifying that the database
and log stream are in a consistent state. In most cases, the copy status remains in the
Initializing state for about 15 seconds, but in all cases, it should generally not be in this
state for longer than 30 seconds.
Re- The mailbox database copy and its log files are being compared with the active copy of the
synchronizing database to check for any divergence between the two copies. The copy status remains in
this state until any divergence is detected and resolved.
981
Failed The mailbox database copy is in a Failed state because it is not suspended, and it is not
able to copy or replay log files. While in a Failed state and not suspended, the system
periodically checks whether the problem that caused the copy status to change to Failed
has been resolved. After the system has detected that the problem is resolved, and
barring no other issues, the copy status automatically changes to Healthy.
Service Down The Microsoft Exchange Replication service is not available or running on the server that
hosts the mailbox database copy.

and Healthy in the Healthy state when the loss of connection occurred. This state represents the
database copy with respect to connectivity to its source database copy. It may be reported
during DAG network failures between the source copy and the target database copy.
and Re- in the Re-synchronizing state when the loss of connection occurred. This state represents
synchronizing the database copy with respect to connectivity to its source database copy. It may be
reported during DAG network failures between the source copy and the target database
copy.
Failed and The Failed and Suspended states have been set simultaneously by the system because a
Suspended failure was detected, and because resolution of the failure explicitly requires
administrator intervention. An example is if the system detects unrecoverable divergence
between the active mailbox database and a database copy. Unlike the Failed state, the
system does not periodically check whether the problem has been resolved, and
automatically recover. Instead, an administrator must intervene to resolve the underlying
cause of the failure before the database copy can be transitioned to a healthy state.
982
Database Disk Input Output
This resource provides details concerning the database disk I/O being monitored by the application.
n File Path: Path of the listed database.

n Volume: Displays the name of the listed volume.
n Disk Queue Length: Displays the length of the disk queue of the listed volume.
n Total IOPS: Displays the total number of Input/Output operations per second of the listed volume.
n Latency: Numerically displays the average time the disk transfers took to complete, in seconds.
n Exchange Server: Displays the name of the listed Exchange Server.
983
Database File Size
This resource provides details concerning the size of the listed database copies being monitored by the
application.
n File Path: Path of the listed database.

n Total File Size: Displays the size of the listed database file.
n Database Usage: Depending on how your database is configured, this value is showing you how
close you are to running out of space. If your database is configured as a fixed size, auto-grow, or a
restricted auto-grow, the percentages relate to what is going to cause your database to run out of
space.
n Volume Usage: Numerically and graphically displays the volume usage as a percentage.
n Exchange Server: Displays the name of the listed Exchange server.
984
Database Input and Output
This resource contains performance counters specific to the status of database I/O. The icons of the listed
I/O Definition: > 50 ms > 50

Database Shows the average length of time, in ms, per database read operation. ms for
Reads 5 polls
Information:
Average
Should be 20 ms on average. Spikes should not exceed 50 ms.
Latency
Possible problems:
Users may experience decreased performance, including delayed message
deliveries.
985
Remediation:
Review the event logs for related events. Verify network topology between
mailbox servers and storage resources. Examine CPU & Memory usage to
determine possible bottlenecks. Examine replication status for replica
database.
I/O Definition: > 100 ms > 100

Database Shows the average length of time, in ms, per database write operation. ms for
Writes 5 polls
Information:
Average
Should be 50 ms on average. Spikes of up to 100 ms are acceptable if not
Latency
accompanied by database page fault stalls.
Possible problems:
deliveries.
Remediation:
require additional disks, faster disks, or modifying the disk
configuration. Review the event logs for related events. Verify network
topology between mailbox servers & storage resources. Examine CPU and
Memory usage to determine possible bottlenecks. Examine replication
status for replica database.
I/O Log Definition: > 200 ms > 200

Reads Indicates the average time, in ms, to read data from a log file. Specific to log ms
Average replay and database recovery operations. for 5
Latency polls
Information:
Average should be less than 200 ms with spikes up to 1,000 ms
Possible problems:
deliveries.
Remediation: If the disk subsystem is not meeting demand, correcting the

problem may require additional disks, faster disks, or modifying the disk
986
I/O Log Definition: > 10 ms > 10
Writes Indicates the average time, in ms, to write a log buffer to the active log file. ms for
Average 5 polls
Information:
Latency
This count should be 10 ms or less on production servers.
Possible problems:
Indication that the Exchange Database\I/O Database Writes Average Latency
is too high
Remediation: If the disk subsystem is not meeting demand, correcting the

problem may require additional disks, faster disks, or modifying the disk
Log Definition: > 10 for > 10

Threads Shows the number of threads waiting for their data to be written to the log 5 polls for 15
Waiting to complete an update of the database. If this number is too high, the log polls
may be in a bottleneck situation.
Information:
Should be less than 10 on average.
Possible problems:
If this number is too high, the log may be a bottleneck. Regular spikes
concurrent with log record stall spikes indicate that the transaction log
disks are in a bottleneck situation. If the value for log threads waiting is
more than the spindles available for the logs, there is a bottleneck on the
log disks.
Remediation:
require additional disks, faster disks, or modifying the disk
topology between mailbox servers and storage resources. Examine CPU and
Memory usage to determine possible bottlenecks.
Zooming
the resource.
987
page.
988
Database Metrics
This resource contains performance counters specific to the status of database metrics. The icons of the
Active Client Logons Definition: N/A N/A

The number of clients that performed any action within the
(Only available in
last 10 minute interval.
Exchange 2010)
Information:
Active client logons can be high if users are logging on and
logging off frequently.
Possible problems:
May cause memory bottlenecks on the server if the number
is excessively high.
989
Remediation:
Determine if users are running applications not required
for business use and request they do not run these
applications which is causing an increase in server logons.
If this does not help, or is not possible, reduce the number
of server hosted on the server and move any public folders
Slow Findrow Rate Definition: > 10 > 10 for

Shows the rate at which the slower FindRow needs to be 15
(Only available in
used in the mailbox store. polls
Exchange 2010)
Information:
Should be no more than 10 for any specific mailbox store.
Possible problems:
Higher values indicate applications are crawling or
searching mailboxes, which is affecting server performance.
These include desktop search engines, customer
relationship management (CRM), or other third-party
applications.
Remediation:
Run the ResetSearchIndex.ps1 script which is located
in the scripts directory at the root of the Exchange
installation. Alternatively, you can perform the process
manually:
1. Rebuild index catalog using Update-

MailboxDatabaseCopy <DBName> -CatalogOnly
command.
2. Stop the Microsoft Exchange Search Service.
3. Delete old catalog files.
4. Restart the Microsoft Exchange Search Service.
Average Document Definition: Shows the average, in ms, of how long it takes to > 30 > 30 for
Indexing Time index documents. 15
polls
(At the database level, Information: Should be less than 30 seconds at all times.
this is only available in
Possible problems: Verify content index state of all
Exchange 2010. At the
database copies.
application level, this is
available for both Remediation: For any database indexes not "healthy,"
Exchange 2010 and update the content index on the server using the Update-
2013.) MailboxDatabaseCopy <DBName> -CatalogOnly
command.
990
Mailboxes Definition: Shows the rate of mailboxes processed by time- N/A N/A
processed/sec based assistants per second.
(Only available in Information: Determines current load statistics for this

Exchange 2013) counter.
Zooming
the resource.
page.
991
Events
This resource contains performance counters specific to the status of database events. The icons of the
Average Definition: >2 > 2 for

Event Shows the average processing time of the events chosen. 15
Processing polls
Information:
Time In Should be less than 2 at all times.
Seconds
Possible problems:
Indicates the Mail Submission Assistant is not able to handle the
number of submission requests being made to the database. May
occur when server is experiencing a heavy load which can cause
messages to queue on the server.
Remediation:
Assistant's infrastructure and its corresponding assistant.
Events in Definition: > 20 > 50

Queue Shows the number of events in the in-memory queue waiting to be
processed by the assistants.
992
Information:
Possible problems:
Remediation:
Review event logs for related events. Monitor CPU and memory for
bottlenecks.
Events Definition: N/A N/A

Polled/sec Shows the number of events polled per second.
Information:
Determines current load statistics for this counter.
Zooming
the resource.
page.
993
Messages
This resource contains performance counters specific to the status of messages. The icons of the listed
Messages Definition: > 30 > 50

Queued For Shows the current number of submitted messages not yet processed
Submission by the transport layer.
(Only available Information:

in Exchange The queues should remain below 50 at any given time. Anything
2010) above this amount should be cleared within 15 minutes.
Possible problems:
Mailbox server is not communicating properly with the transport
server.
Remediation:
Verify network connectivity and transport server functionality.
Additional bottlenecks may include disk reads or writes, processor
time, available memory, and network configuration.
994
Messages Definition: N/A N/A
Sent/sec Shows the rate that messages are sent to transport.

in Exchange Used to determine current messages sent to transport.
2010)
Messages Definition: N/A N/A

Delivered/sec Shows the rate that messages are delivered to all recipients.

in Exchange Indicates current message delivery rate to the store.
2010)
Zooming
the resource.
page.
995
Transaction Log Disk Input and Output
This resource provides details concerning the status of the current transaction log disk I/O of database
copies being monitored by the application.
n File Path: Path to the transaction log directory.

n Volume: Displays the name of the listed volume.
n Disk Queue Length: Displays the length of the disk queue of the listed volume.
n Total IOPS: Displays the total number of Input/Output operations per second of the listed volume.
n Latency: Numerically displays the average time the disk transfers took to complete, in seconds.
996
Transaction Log File Size
This resource provides details concerning the status of the current transaction log file size of database
copies being monitored by the application.
n File Path: Path to the transaction log directory.

n Number of Files: Lists the total number of log files associated with the database.
n Total File Size: Displays the total file size of all the transaction log files.
n Volume Usage: Numerically and graphically displays the current volume usage as a percent of the
total size of the transaction log files.
997
Understand the AppInsight for Exchange Mailbox Details view
The Mailbox Details view provides information about the selected Exchange mailbox. The available
resources offered in this view include:
n Mailbox Details
n Mailbox Synced Devices
n Received Mail
n Sent Mail
n Total Mailbox and Attachments Sizes
998
Mailbox Details
This resource provides details about the current user's mailbox.
n User Logon Name: User's domain account name.

n Display Name: Name of the listed user as it is displayed as a mailbox.
n Mailbox Database: Displays the database that contains the listed mailbox as well as the server that
contains the database. The colors of the displayed icons display the status of the object the icon
represents.
n Type: Lists the role of the listed mailbox.
n Organizational Unit: This is the location of the User’s Active Directory account within the Active
Directory tree.
n Primary SMTP Address: This is the primary email address for a user. A user can have secondary
email addresses which routes mail to the same mailbox.
n Mailbox Size:
n Total Size: Current size of all mailbox items shown numerically and as a percentage with a bar
graph.
n Total Items: Total number of mailbox items in the listed mailbox.
n Attachment Size: Shows the total size of those email messages that include attachments,
including the email message body.
n Attachment Count: Shows the number of email messages that contain attachments, as
opposed to the actual number of attachments contained in each email.
n Last Polled: The time and date the listed mailbox was polled for information.
n Last Logged On: The time and date the listed user logged in to the mailbox.
n Mailbox Last Modified: The time and date the listed mailbox was last modified.
n Alias: The legible name for the listed user's email address.
999
n Mailbox Limits:
n Issue Warning: Displays the size limit of the mailbox before it issues a usage warning.
n Prohibit Send: Displays the size limit of the mailbox when it is no longer able to send emails.
n Prohibit Send and Receive: Displays the size limit of the mailbox when it is no longer able to
send or receive emails.
1000
Mailbox Synced Devices
This resource provides details about the current user's synced mailbox status.
n Device Type: Lists the device the mailbox is being synced with.
n Device User Agent: Displays the operating system and build of the listed device.
n Last Successful Sync: Displays the last time the listed device was successfully synced with the
current mailbox.
1001
Received Mail
This resource graphically details the value history of the current performance counter, in this case, the
total amount of received mail for the selected mailbox. Hovering over any time period within the chart
displays detailed information about that time period in the tooltip.
The colors of the main chart correspond to the labels in the legend. You can choose which data to display
by using the check boxes in the legend.
Zooming
1002
Sent Mail
number of messages sent for the selected mailbox. Hovering over any time period within the chart
Zooming
1003
Total Mailbox and Attachments Sizes
total size of the selected mailbox and its attachments. Hovering over any time period within the chart
Attachment Size shows the total size of those email messages that include attachments, including
the email message body.
For more information, see Mailbox Details.
Zooming
1004
The AppInsight Performance Counter Details view
This view is equivalent to the Component Details view in a typical SAM application. This view is common to
all AppInsight applications and can be accessed by clicking any performance counter found in any
resource.
Additionally, this view contains the Management resource and Expert Knowledge resource.
1005
Average Site Response Time
This resource graphically details the average value history of the current performance counter, in this
case, the average response time of for the HTTP Bindings monitor. Hovering over any time period within
the chart displays detailed information about that time period in the tooltip.
This resource is only available with AppInsight for IIS.
Zooming
1006
Performance Counters
This resource displays all the available performance counters associated with the current application or
database.
The list of performance counters displayed changes depending on how you enter this view. For example, if
you enter this view by drilling down from the database level, just the counters associated with that
database are displayed. If you enter this view by drilling down from the application view, then only the
performance counters associated with the application are shown.
Clicking any performance counter in the list displays detailed information about that performance counter
in the Performance Counter Details resource.
1007
Performance Counter Details
This resource provides tools and detailed information about the current performance counter (Component
Monitor).
n Name: Name of the current performance counter.

n Status: Status of the current performance counter.
n Current Value: The value of the current performance counter.
n Group: Displays the group, or resource, this performance counter belongs to as it would be viewed
on the Application Details view. For example:
n Component Type: The type of the current performance counter.
n Expert Knowledge: This resource provides information about the performance counter, including
possible problems that may occur as a result of the returned value being abnormal. Remediation
information is also provided, where applicable, to help you resolve typical issues that may be
occurring if abnormal values are returned.
1008
History Chart
This resource graphically details the value history of the current performance counter. Hovering over any
time period within the chart displays detailed information about that time period in the tooltip.
Zooming
1009
The AppStack environment
The Application Stack, or AppStack, is a term used to describe the various layers that make up a complex
application delivery infrastructure. The AppStack Environment view is an interactive visual mapping within
Orion that provides an in-depth perspective through the entire environment to help identify the root cause
of performance and availability issues.
AppStack automatically gathers information about objects in your environment, as well as their respective
relationships, and display them. Some relationships, such as groups and dependencies can be defined by
the user.
Important: As a standalone product, AppStack is available in the software versions listed below. If
you own two or more of the listed products, AppStack does not function properly unless each
version of the software is upgraded to the versions listed.
n Server & Application Monitor 6.2

n Storage Resource Monitor 6.0
n Virtualization Manager 6.2
n Web Performance Monitor 2.2
n Introduction to the AppStack Environment view

n AppStack categories and data
n Understand status and colors
n Understand Quick Links
n Understand Categories
n Understand the Overview bar
n Understand filtering options
n Understand filter properties
n Understand layouts
n Understand the AppStack resource
n Customize the AppStack Environment view
1010
Introduction to the AppStack Environment view
The AppStack Environment view is designed to provide you with a powerful layer of troubleshooting
visibility by exposing all participating objects in your environment, as well as their relationships to one
another. This view is useful in assessing the overall health of your environment, as well as troubleshooting
specific and related problems.
To help you better understand how this visualization of your environment can be used for troubleshooting,
the following analogy was designed to provide you with a simple, high-level overview of how AppStack
processes and displays information.
The AppStack Environment View Analogy
Imagine you work for a company comprised of many employees that work in various departments. In this
example, you work in the Engineering department as an engineer:
Now imagine you call in sick and are unable to work for two weeks. Certain employees in various
departments are affected by your absence. Others are not be affected. The illustration below highlights
the employees who are affected by your absence by fading those who are not affected.
1011
Focusing on only the people who are affected by your absence can be beneficial from a task management
perspective. Therefore, completely hiding those not affected by your absence gives a clean and concise
view, displaying only the necessary information.
Now, instead of employees, imagine we are talking about your entire IT environment. The goal of the
AppStack Environment view is to help you quickly assess the impact a given object has on its related
objects. This relational view is the AppStack Environment view found in the web console.
1012
The AppStack Environment View
The AppStack Environment, shown below, displays the status of individual objects in your IT environment
through the Orion web console. Objects are categorized and ordered from left to right, with the worst
status being shown on the left side of the view.
Clicking an object shows everything related to that object by fading unrelated objects, as shown:
1013
Clicking Spotlight removes the faded, unrelated objects from the view entirely.
Clicking the selected object at the top, or double-clicking it in the view, takes you to the Details page for
that object for further investigation.
1014
AppStack categories and data
The following matrix outlines all of the categories associated with the AppStack Environment view.
Different categories are available with each SolarWinds product, as indicated with the check mark.
Category Storage Server Virtualization Web Definition

Resource & Application Manager Performance
Monitor Monitor (VMan) Monitor
(SRM) (SAM) (WPM)
Groups Groups enable you to

more effectively
manage your
environment by giving
you the ability to
logically organize
monitored objects,
regardless of device
type or location.
Applications In SAM, an application

is a collection of
component monitors
grouped together to
collect specific metrics
concerning the
application as a whole.
Transactions A transaction is a
recording of web
browser steps
assigned to a specific
location.
Steps A step is a collection of

actions. For example,
the actions required to
navigate to a specific
URL make up one step.
1015
Servers A server is a computer
capable of accepting
requests from the
client and giving
responses accordingly.
The server makes
services, as access to
data files, programs,
and peripheral
devices, available to
workstations on a
network.
Hosts A Host is defined as a

server running a
Hypervisor for
virtualization. (E.g. It
hosts multiple virtual
machines.)
Virtual Virtual clusters are

Clusters built with VMs
installed at distributed
servers from one or
more physical clusters.
The VMs in a virtual
cluster are logically
connected by a virtual
network across several
physical networks.
Each virtual cluster is
formed with physical
machines or a VM
hosted by multiple
physical clusters.
Virtual A virtual datacenter is

Datacenters a centralized virtual
repository for the
storage, management,
and dissemination of
data and information
organized around a
1016
particular body of
knowledge or
pertaining to a
particular business.
Virtual A VMware virtual

Centers center (vCenter) server
is a centralized
management
application that lets
you manage virtual
machines and ESXi
hosts centrally. The
vSphere client is used
to access vCenter
Server and ultimately
manage ESXi servers.
Data Stores A data store is a

repository of a set of
data objects. These
objects are modeled
using classes defined
in a database schema.
A data store is a
general concept that
includes not just
repositories like
databases, but also
simpler store types
such as flat files. Some
data stores represent
data in only one
schema, while other
data stores use several
schemas for this task.
Volumes A volume, or logical

drive, is a single
accessible storage
area with a single file
system, typically
resident on a single
1017
partition of a hard
disk.
LUNS A Logical Unit Number,

or LUN, is a number
used to identify a
logical unit, which is a
device addressed by
the SCSI protocol or
Storage Area Network
protocols which
encapsulate SCSI, such
as Fibre Channel or
iSCSI. A LUN may be
used with any device
which supports
read/write operations,
such as a tape drive,
but is most often used
to refer to a logical
disk as created on a
SAN.
NAS Volumes Network-attached
storage (NAS) is a type
of dedicated file
storage device that
provides local-area
network (LAN) users
with centralized,
consolidated disk
storage through a
standard Ethernet
connection.
1018
Pools A storage pool (also
called a RAID array) is
a collection of disk
drives that become a
logical entity. When
you create a storage
pool, you select the
desired capacity
(number of disk drives)
and assign a RAID level
to it which provides a
redundancy level.
VServers A virtual storage server

(VServer) contains data
volumes and one or
more LIFs through
which it serves data to
the clients. A VServer
can either contain one
or more FlexVol
volumes, or a single
Infinite Volume.
A VServer securely
isolates the shared
virtualized data
storage and network,
and appears as a
single dedicated
server to its clients.
Each VServer has a
separate administrator
authentication domain
and can be managed
independently by a
VServer administrator.
1019
In a cluster, a VServer
facilitates data access.
A cluster must have at
least one VServer to
serve data. VServers
use the storage and
network resources of
the cluster. However,
the volumes and LIFs
are exclusive to the V-
Server. Multiple
Vservers can coexist in
a single cluster
without being bound
to any node in a
cluster. However, they
are bound to the
physical cluster on
which they exist.
Storage Storage Arrays consist

Arrays of two or more disk
drives built into a
stand-alone unit.
Storage arrays provide
increased availability,
resiliency, and
maintainability by
using existing
components
(controllers, power
supplies, fans, and so
on) often up to the
point where all single
points of failure are
eliminated from the
design.
1020
Understand status and colors
Objects in the AppStack Environment view are colored based on their current status, providing you a quick
summary of your environment. Objects will be in one of the following states, represented by its icon's color
and shape that corresponds to the following table:
Status Color Example
Down Red
Critical Pink
Warning Yellow
Unknown Gray
Unreachable Black
Up Green
Other Blue -
External Purple -
Statuses only become available for filtering when an object in your environment is in that state. For
example, if no objects have a status of Down, the Down status will not be available when filtering.
Status reporting
Servers can only provide an Up or Down status. To check CPU, memory, or hardware health status, hover
the mouse over the server icon to view the detailed tooltip. The reported status for applications and LUNs
is based on performance thresholds.
Understand mixed icons
The AppStack Environment view offers a parent/child relationship. (Parents can be either servers or hosts.)
This relationship is represented as a mixed icon. The parent is the larger of the two icons that is hosting
the child. For example, the following illustration graphically shows that an application (child) is Down on a
node (parent) that is Up.
1021
Understand Quick Links
The Quick Links bar allows you to quickly open and close all visible object categories. Additionally, you can
toggle whether or not to show the names of objects that have a distressed status.
n Expand All: Opens all categories, revealing the visible objects within each category. Each category
can be individually expanded and collapsed by clicking [+] and [-] next to the category name.
n Collapse All: Closes all categories, hiding the objects within each category. Each category can be
individually expanded and collapsed by clicking [+] and [-] next to the category name.
1022
n Show/Hide Names: Allows you to toggle between showing and hiding the names for each object
that is in a distressed state. If more objects exist than are allowed to be displayed on the screen, the
category name will display the number of displayed objects followed by the total number of objects.
For example, (87 of 111), meaning only 87 objects of 111 total objects in this category are being
displayed. This provides a numerical summary of your environment. Clicking More (located after the
last visible object in the category) will display, by default, an additional 50 objects that are hidden
from view. Related objects may be found by clicking More. The default number of 50 can be changed
in the Settings page.
1023
Understand Categories
By default, the following AppStack Environment categories are available within Server & Application
Monitor.
n Groups
n Applications
n Servers
n Virtual Hosts
n Virtual Clusters
n Virtual DataCenters
n Virtual Centers
n Volumes
Other Orion products offer additional categories. Empty categories can be hidden via the Change
Layout Settings option in the drop down menu.
Understand the Category Status Summary
The Category Status Summary (located to the right of each category) parses, enumerates, and displays the
number of objects in a given category, emphasizing the status as indicated by the colors. The Category
Status Summary can be toggled to either be displayed at all times, or only when categories are collapsed.
This option exists under the Change Layout Settings settings drop down option.
If no objects in a category exist with a particular status, that status is not shown in the summary.
1024
Understand the Overview bar
The Overview Bar summarizes your environment in a compact space. If your view is currently filtered, the
filtered objects will be displayed above the Overview Bar, as shown. Individual filtered objects
The doughnut chart in the Overview section graphically displays the ratio of objects to one another in all
possible states using indicative colored slices. The total number of objects in your environment is also
displayed.
Objects under the Issues header are parsed and enumerated according to status. Objects shown here will
be in one of the following distressed states: Down, Critical, Warning, Unknown and Unreachable. An icon
and count will only appear if at least one object is currently in that state.
1025
Understand filtering options
By default, every object is displayed when you enter the AppStack Environment view. If you are concerned
only about objects with a certain status, you can filter the view by selecting one or more statuses and then
applying the filter. Additionally, you can filter objects based on various properties, as well as one or more
keywords. The illustration below details each tool and feature of the filtering sidebar:
Statuses only become available for filtering when an object in your environment is in that state. For
example, if no objects have a status of Down, the Down status will not be available when filtering.
1026
Understand filter properties
Filter the AppStack Environment view
1. On the Web Console, click My Dashboards > Environment, and then click [+] Add Filter Properties.
2. From the pop-up menu, select an object from the Orion Object drop down list:
Note: Multiple items can be added.
3. When done, click Add column. The new filter appears in the filter column, as shown:
1027
If no relations are shown in the AppStack resource on the Group Details view, then it is likely that
this group contains no objects represented within the AppStack, such as switches, routers, and so
on. If you have created a group that contains only objects which have no representation within the
AppStack environment (e.g.: Nodes that are switches, routers, wireless access points, interfaces, and
so on) then they will not have relationships and the only item displayed within the AppStack
resource on the Group Details view is the group itself. This is normal behavior. Servers and virtual
servers are the only node types that are represented within the AppStack environment. Groups
made up of other object types which are not supported by the AppStack environment will not
appear within the AppStack resource.
1028
Understand layouts
A Layout is a user-defined filter (view-limitation), along with settings, that can be saved and recalled later
within the Appstack Environment view. User-defined layouts can be used to tailor the AppStack
Environment view to specific objects of interest. A default layout is provided and contains all objects visible
in the AppStack Environment that is currently being monitored. The default layout cannot be modified.
New layouts are created by first filtering your environment, and then saving the changes via the Save As
New Layout action in the Layout menu.
For example, to create a Layout where only IIS objects in the AppStack Environment view are shown, add
the IIS filter property, apply the filter, then save it as a new layout, naming the layout appropriately.
Once saved, the layout is added to the drop down menu, allowing you to easily navigate to that layout with
its defined filter and settings. The dot to the left of the name of the layout in the menu represents the
layout currently in use, as shown:
Modify filter properties of a saved layout
1. Make changes to the filter.

2. Click Apply Filter, and then click Save (or Save as New Layout...) in the drop down menu.
1029
Modify settings of a saved layout
1. Click Change Layout Settings from the drop down menu.
2. Click Save (or Save as New Layout...).
Delete a saved layout
Select the layout from the drop down menu and then click Delete this Layout.
1030
Understand the AppStack resource
The full AppStack Environment view is designed to provide you with a powerful layer of troubleshooting
visibility by exposing all participating objects in your environment, as well as their relationships to one
another. By comparison, the AppStack resource only displays objects related to the target of the current
Details page.
In essence, this resource displays the related objects you would see in the full AppStack Environment view
after an object had been selected and then highlighted by clicking, Spotlight.
For more information, see Understanding AppStack.
1031
Customize the AppStack Environment view
Administrators can customize this view by clicking Change Layout Settings in the Layout drop down menu
of the AppStack page.
The following options are available:
n Refresh Rate: Change the time between AppStack refreshes.

n Limit on Up Objects Shown per Category: Objects in the AppStack Environment view are ordered
from left to right, with the worst status being shown on the left side of the view. Limiting the number
of Up objects can provide more room for objects needing attention. Additionally, limiting the number
of Up objects displayed can improve AppStack performance.
n Object Names: Highlights distressed objects by displaying the names of these objects.
n Align Objects: By default, all objects are left-aligned. This can be changed by selecting either Center
or Right-Aligned.
n Show Category Status Summary: The Category Status Summary are the colored numbers to the
right of each category, indicating the number of objects in a particular state. This can visible at all
times, or only when categories are collapsed.
n Empty Categories: Selecting this option hides categories with no objects, giving the view a cleaner
look.
1032
The Template and Application relationship
The following illustration explains the Template and Application relationship and is true for all templates,
including all AppInsight applications.
Here you can see that if you change something at the template level, the applications based on that
template are affected. Conversely, if you change something on the application level, only the individual
application are affected.
This inheritance relationship is beneficial if you need to make a great deal of changes quickly. For example,
rather than change one item on 100 applications that are based on a single template (which requires 100
changes), you can more easily change the one item on the template. That one change in the template
trickle down to all 100 applications that are based on the template.
1033
Understand component monitors
Component monitors are the building blocks of SolarWinds SAM. Each monitors the status and
performance of a different aspect of an application. Managing components can be achieved using the
commands on the SAM Settings page.
1034
View the component monitor library
The component monitors in the library are grouped by monitor type in the tree view display. For each
component monitor, two numbers are displayed.
n The first number represents the number of Application Monitor templates that contain the specified
component monitor.
n The second number represents the number of Application Monitors that contain the specified
component monitor.
Expanding a component monitor shows two categories:
n Application Monitor templates that contain the specified component monitor

n Application Monitors that contain the specified component monitor
Expanding a category displays the names of the templates or Application Monitors for the category,
respectively. Clicking the name of a template or Application Monitor takes you to a page where you can
edit that item.
1035
Choose component monitors and templates based on protocol
If you have a choice between components or templates that return the needed value using different
protocols, consider the following guidelines for making your choice, based on the protocol:
1. SNMP is the best protocol to use from the reliability and speed perspective. It is much faster and
more reliable than both Performance counters and WMI, and it has lowest impact on system
performance.
2. WMI calls can sometimes take a relatively long time, and they have a significant overhead.
RPC vs. WMI
The reason some SAM templates only use RPC is primarily customer demand. RPC is generally considered
more reliable. It also uses less overheard making it faster than WMI and it is firewall friendly. There are
distinct advantages and disadvantages to both RPC and WMI, which is why SAM utilizes both methods
for retrieving information.
1036
Monitor external nodes
To monitor services and applications on a server you do not directly manage, add the server to the Orion
database as an external node. External nodes skip all network performance data collection and polling
tasks, but allow you to assign applications to them.
For example, you could add www.google.com as an external node, and then assign several HTTP monitors
to monitor Google search results.
1037
Application availability and status
On any given poll, an application’s availability is either 100% or 0% based on the status of the
application. Availability is 100% if the application status is available, warning, or critical. For any other
status on that poll, SAM marks the availability at 0%.
The status of an application is determined by the worst status of the individual component monitors for
that application. For example, if one component for an application is down, then the application is marked
as down. If one component is in a warning state and the rest of the components are up, then the
application is given a warning status.
With respect to how an application’s availability is calculated over time, SAM aggregates the availability
values to Hourly/Daily tables during database maintenance, which is how the average is calculated.
Availability for component monitors is calculated in the same way.
1038
Charts in the SolarWinds web console
Clicking any chart opens the Custom Chart view in a new window, displaying the selected chart with
additional chart customization options.
You can also configure any custom chart resource in the SolarWinds Web Console directly from the
resource title bar either by selecting from the drop down menu of options or by clicking Edit to display the
Edit Chart Title view, as described in the following sections.
Chart Information
n If SAM is upgraded to version 6.0 or higher, legacy charts already assigned to views will be
upgraded.
n Charts from earlier versions of SAM will be renamed to have the prefix "Legacy" and must be added
manually.
Custom Chart Resource Title Bar Options
The title bar menu of the custom chart resource provides the following options for viewing chart data:
n View chart data over the Last 7 Days or over the Last 30 Days
n Select Edit Chart to view and modify chart settings.
Note: This is the same as clicking Edit in the title bar.
n View Chart Data as an HTML format document
n View Chart Data in Excel to see chart data in an Excel™-compatible format
Edit Chart Title View
Click Edit in the title bar of a custom chart resource to display the Edit Chart Title view. This view provides
the following options to configure your chart resource:
Select a Chart allows you to change the chart type displayed in the current resource. Chart options are
determined in accordance with the type of view displaying the resource you are currently editing.
The Time Period for the selected chart may be any of the following:
Last Hour Last 2 Hours Last 24 Hours Today
Yesterday Last 7 Days This Month Last Month
Last 30 Days Last 3 Months This Year Last 12 Months
The Sample Interval for the selected chart may be any of the following:
Every Minute Every 5 Minutes Every 10 Minutes Every 15 Minutes
Every 30 Minutes Every Hour Every 2 Hours Every 6 Hours
Every 12 Hours One a Day Every 7 Days
1039

Notes:
n Each sample interval is represented on a chart by a single point or bar. Data within a selected
sample interval is summarized automatically.
n Due to limits of memory allocation, some combinations of time periods and sample intervals require
too many system resources to display, due to the large number of polled data points. As a result,
charts may not display if the time period is too long or if the sample interval is too small.
The Trend Line option allows you to enable the trend line feature of SolarWinds SAM charts. By enabling
trend lines on SolarWinds SAM charts, you can see potential future results as they are extrapolated from
collected historical data.
Due to the broad array of factors that can affect the performance of devices on your network, trend
lines provided on SolarWinds SAM charts are intended as approximate predictions of future data
only.
1040
The Windows Scheduled Task Monitor
The Windows Scheduled Task Monitor (WSTM) is a resource designed to provide you with quick visual
access to the status of scheduled tasks configured on your Windows nodes.
Only tasks from root directory can be monitored. The WSTM will not work for tasks from every level
of the Task Scheduler Library.
The WSTM comes with an alert that will notify you of any task execution failures, as well as web-based
reports that show all scheduled tasks configured across all servers in your environment. Additionally, there
is a dedicated Task Failure Report you can view on-screen or have emailed to you.
This resource is hidden when the WSTM is not being monitored on a node.
1041
The Real Time Event Log Viewer
View Windows event logs in real time using the WMI protocol with the Real Time Event Viewer (RTEV). Event
logs can be filtered by log type, event source, and the level of severity. You can also select which event logs
you want to monitor from within this resource.
1042
The Real Time Process Explorer
Manager to retrieve that machine's vital statistics. Information for monitored and unmonitored processes
is displayed directly through SAM using the RTPE.
Notes:
n Only SAM administrators can end processes as well as enable and disable the RTPE.
n The User Name and Command Line columns are hidden by default.
n Using the RTPE on a node monitored via ICMP, which has no working component, requires you to
select Windows credentials manually. Consider promoting the selected node to SNMP or WMI to
avoid this prompt.
1043
The Service Control Manager
The Service Control Manager (SCM) is similar to the Real Time Process Explorer, except with the SCM you
manage the services of monitored Windows nodes instead of processes. The advantage of the SCM is that
you no longer need to physically, or remotely, log in to a Windows computer to view and control its
services. Information for running and stopped services is displayed directly through SAM using the Service
Control Manager.
Services viewed in the Service Control Manager are polled every 25 seconds using WMI.
Monitor hardware health

SAM monitors hardware by polling nodes and utilizing the Hardware Monitoring Agent software provided
by the hardware manufacturer. SAM can monitor hardware from VMware hosts, HP ProLiant, Dell
PowerEdge, and the IBM X-Series using this software, which can be found using the links below:
n HP System Insight Manager(SIM v6.2 or higher is recommended)

n Dell OpenManage Server Administrator
n IBMDirector (Common Agent, v6.3 or higher is recommended)
SAM can also monitor the health of the following Server Blade Chassis without the need for additional
software:
n HP C7000
n HP C3000
n Dell M1000e
Hardware monitoring is achieved by polling via SNMP or WMI, depending upon the node. For SNMP and
WMI nodes, hardware monitoring must be enabled manually through SAM's web console.
If you run a scheduled Network Sonar Discovery of your existing servers, SAM automatically collects
any servers that support hardware health information the next time the discovery runs.
Monitoring your hardware's health does not count against your allotted licenses.
Only SAM administrators can enable hardware health monitoring.
1044
Enable hardware health monitoring
When you add nodes using Network Sonar Discovery, the hardware health sensors are enabled for
devices that support hardware health monitoring automatically.
When adding individual nodes with the Add Node wizard, you can enable or disable hardware health
monitoring in the wizard.
To verify that hardware health statistics are being collected, list monitored resources for the node and
ensure that hardware health monitoring is enabled.
Enable monitoring from the Add Node wizard
When selecting resources for monitoring a node in the Add Node wizard, select the Hardware Health
Sensors box to enable hardware health monitoring.
Enable hardware health monitoring ona node
1. Click My Dashboards > Home in the Orion Web Console.

2. In the All Nodes resource, click the node you want to monitor.
3. In the Management resource on the Summary tab of the Node Details view, click List Resources.
4. Make sure the Hardware Health Sensors box is selected, and click Submit.
Hardware health statistics for enabled hardware sensors are collected for the node.
1045
Change hardware health temperature units
By default, hardware health resources display temperature in degrees Fahrenheit.

2. Navigate to a node details view.
3. Go to the Current Hardware Health resource, and click Edit.
4. Select the unit for temperature display (Fahrenheit or Celsius).
5. Click Submit.
The selected unit will be applied in all hardware health resources in the Orion Web Console. This setting is
user-specific, and it is connected with your user account.
You can also access the temperature unit setting when editing a user in the Hardware Health
Package Settings.
1046
Edit hardware health thresholds
Hardware states displayed in the Orion Web Console change based on thresholds set for the sensors. You
can either use thresholds available on the device, set a sensor to always appear to be up, or customize
thresholds.
When values polled on a node reach the threshold value, an event triggers together with the alert
"Hardware is in warning or critical state."
1. Go to Manage Hardware Sensors view (Settings > All Settings > Node & Group Management >
Manage Hardware Sensors).
2. Select the sensor that you want to edit, and click Edit Thresholds.
To find all sensors available on a node, select Node in the Group By list, and select the node.
3. Select how you want to change the selected hardware sensor's status:
Use Orion Defaults
Use thresholds configured on the device. This is the default setting.
Force to Up
If you are not concerned about a sensor, select this option. The sensor will always be displayed
as UP, ignoring the real data from the sensor.
Set Custom Thresholds
Use the dynamic query builder to define the status for the selected sensor.
4. Click Submit.
The status of the hardware health sensor will now be governed by the specified threshold.
1047
Agents
The Verisign Root Certificate Authority (CA) must be current. This is required because the agent software is
signed using a Verisign certificate. If your certificate is not current, you must download the Root CA
certificate and install it to the Local Computer\Trusted Root Certification Authority store on
the server hosting the agent.
For more information, search for "Add the Certificates Snap-in to an MMC" at technet.microsoft.com.
1048
Agent performance counters
SolarWinds: Agent Service
NAME DESCRIPTION
Messages Sent The number of messages sent to the Agent Management Service.
Messages Received The number of messages received from the Agent Management Service.
Exchange Received The number of times the Exchange Receive method was called.
Exchange Sent The number of times the Exchange Send method was called.
NAME DESCRIPTION
Messages Sent to Agent Count The number of messages sent to the agent.
Messages Received From Agent

The number of messages received from the agent.
Count
Incoming Timed Out Messages The number of incoming messages that timed out before being
Count processed by the recipient.
Outgoing Timed Out Messages The number of outgoing messages that timed out before they were
Count sent to the target agent.
Incoming Failed Messages

The number of incoming messages that failed to process.
Count
Outgoing Failed Messages

The number of outgoing messages that failed to process.
Count
Total Agents Fully Connected The number of total agents fully connected.
Active Agents Fully Connected The number of active agents fully connected.
Passive Agents Fully Connected The number of passive agents fully connected.
Passive Agents Disconnected The number of passive agents disconnected.
Total Agents Connected to

The number of agents connected to the messaging hub.
Messaging Hub
Total Agents Connected to Files

The number of agents connected to the files hub.
Hub
Messages Processed per

The number of messages processed per second.
Second
1049
NAME DESCRIPTION
Incoming Messages Processed
The number of incoming messages processed per second.
per Second
Outgoing Messages Processed

The number of outgoing messages processed per second.
per Second
Incoming Processing Queue

The number of messages waiting in the incoming processing queue.
Size
Outgoing Processing Queue

The number of messages waiting in the outgoing processing queue.
Size
Incoming Persistence Queue

The number of messages waiting in the incoming persistence queue.
Size
Outgoing Persistence Queue

The number of messages waiting in the outgoing persistence queue.
Size
Incoming SignalR Messages The number of messages received from SignalR.
Outgoing SignalR Messages The number of messages passed to SignalR to send.
Incoming Exchange Queue Size The number of messages in the incoming queue with Exchange items.
1050
Viewing and customizing application and component
performance and status
The following sections provide a short list and overview of the views and resources provided with Server &
Application Monitor that reveal performance and status information:
n Volume details
n Understand interface details
n View event details in the web console
n Understand component monitors and application monitor templates
n Available data transformations
n Web service monitoring
1051
Volume details
SAM has the ability to monitor Disk Volume with great detail. Windows mount points are treated as
regular volumes. Monitoring mount points can only be done on nodes that are monitored via WMI
Navigate to the volume details page

2. In the All Nodes resource, click any node.
3. From the Node Details page, click any volume in the Disk Volumes resource.
Add Disk Volumes to the current view
1. On the Web Console, click Customize Page.

2. Click [+] in either column, then search for Disk Volumes, and then click Add Selected Resources.
3. Click Done.
1052
Understand interface details
SAM offers the added ability to monitor Windows based interfaces using WMI.
Navigate to the Interface Details page

2. In the All Nodes resource, click Manage Nodes.
3. From the Show drop down list, select Interfaces.
4. Click on an interface in the list.
The Interface Details page comes with a variety of resources and charts that provide details about the
interface being monitored. Most are self-explanatory. Those that are not are listed below:
Using the Enterprise Operations Console (EOC) with a standalone version of SAM 5.5 or earlier will not
allow interfaces to be monitored via WMI. For more information, refer to the following KB article:
/Monitored_interfaces_are_not_displayed_in_EOC_with_standalone_SAM_5.5
1053
SolarWinds logs network events and lists them in the readily customizable Events view of the Web Console.
Events are shown in order of occurrence, and they may be viewed by device, date and time, and event or
device type.
days).
1. On the Web Console, click Alerts & Activity > Events.

2. Select the desired filter options, and then click Refresh to complete your events view configuration.
1054
Understand component monitors and application monitor templates
The following terms are used throughout this guide to describe the SolarWinds SAM concepts that allow
you to monitor your applications.
Component Monitors
Component monitors are the building blocks of SolarWinds SAM. Each monitors the status and
performance of a different aspect of an application. There are several different types of component
monitors, each containing settings that define what is monitored and how to monitor it.
Some types of component monitors allow you to set threshold conditions on the monitored
parameters. You can set separate thresholds to indicate warning and critical conditions. For
example, if you are monitoring the percentage of free space remaining on a volume, you can set a
warning threshold at 15%, and a critical condition at 5%.
As an analogy, pretend SolarWinds SAM is monitoring a car. You would have component monitors to
check tire pressure, engine RPM, water temperature, battery voltage, and other important
subsystems of that vehicle. You can set alerts to give notification if the water gets too hot, or if the
battery voltage drops too low.
Application Monitor Templates
A template is a group of component monitors modeling the total availability and performance level
of an application. A complicated application such as Windows Server may require dozens of
component monitors to accurately assess its current status and performance.
Instead of creating component monitors one-by-one for every application server, you can assign a
pre-made template. The template can either be one included with SolarWinds SAM, or a custom
template you make yourself. For example, you can assign the included Microsoft Windows Server
2003-2008 template to your Windows 2003 and Windows 2008 computers and obtain vital statistics
on all of them.
A template is only a blueprint and does not perform any monitoring on its own. Only after assigning
the template to a server node are active assigned component monitors created.
To continue the car analogy, pretend you want to monitor a fleet of 50, 2010, blue Dodge Charger
automobiles. Instead of defining the component monitors for 50 cars, you can define all the
component monitors in a Dodge Charger template.
Assigned Component Monitors
Assigned component monitors are created by assigning Application Monitor templates to server
nodes. Each actively monitors its assigned node according to its settings. Component monitors
inherit these initial settings from the template. If you make a change to a template, that same
change is rolled out to all assigned Application Monitors based on the template.
1055
You can override the template settings at any time, breaking the inheritance relationship between
the component monitor and its template. For example, the user name and password usually differ
for each node, and you would select a different credential for each assigned Application Monitor,
thus overriding the template setting for the Credentials field.
To restore the inheritance relationship between a component monitor and its template, click Inherit
From Template next to the setting.
Continuing the car analogy, when you assign the Dodge Charger template to a Dodge Charger
vehicle, you now have a set of assigned component monitors for monitoring the vehicle’s tire
pressures, engine RPM, and so forth.
Assigned Application Monitors
An assigned Application Monitor runs its assigned component monitors at regular intervals,
and then uses the status results from the component monitors to determine an overall status
for the application.
If some of the component monitors are up and others are down, the Application Monitor follows the
Status Rollup Mode setting in the SolarWinds Web Console Settings to show either the worst status
of the group or a warning status.
The difference between an assigned Application Monitor and a template is that the template is only
a blueprint and does not perform any monitoring on its own. Only after assigning the template to a
server node does SolarWinds SAM conduct any actual monitoring on the node.
To complete the car example, you assign the Dodge Charger template to all the Dodge Charger
vehicles to create the assigned Application Monitor for determining the overall status for your Dodge
Charger fleet. For example, the fleet may be 95% available at a given time due to warnings for some
of the cars.
1056
Available data transformations
SolarWinds SAM provides a number of predefined transformation functions that may be applied to one or
more monitors to generate mathematically manipulated results. The following table lists transformation
functions that are currently available in SolarWinds SAM:
Data Transformation Syntax Definition
Euler’s Number E() Euler’s number, commonly called the number e, is

defined as the base of the natural logarithm as the
limit of a certain sequence, or as the sum of a
certain series.
Pi Pi() Pi is the mathematical constant whose value is the

ratio of any circle's circumference to its diameter.
Rounding Round({value}, Provides a number that is rounded to the specified

{number of number of digits.
decimal
places})
Truncate Truncate Truncates a monitored value to a designated

({value}, number of decimal places.
{number of
decimal
places})
Square Root Sqrt({value}) Provides the square root of a given number.
Exponentiation Pow({base Provides the result from repeated multiplication of

value}, the base number.
{exponent
value})
Temperature: Celsius to CToF({value}) Provides the Fahrenheit result originally presented

Fahrenheit in Celsius
Temperature: Fahrenheit to FToC({value}) Provides the Celsius result originally presented in

Celsius Fahrenheit
X to Kilobyte XToKilo Provides the number of Kilobytes originally

({value}) presented in Bytes
X to Megabyte XToMega Provides the number of Megabytes originally

X to Gigabyte XToGiga Provides the number of Gigabytes, originally

X to Terabyte XToTera Provides the number of Terabytes, originally

1057
Kilobyte to KiloToMega Provides the number of Megabytes, originally
Megabyte ({value}) presented in Kilobytes
Kilobyte to KiloToGiga Provides the number of Gigabytes, originally

Gigabyte ({value}) presented in Kilobytes
Kilobyte to KiloToTera Provides the number of Terabytes, originally

Terabyte ({value}) presented in Kilobytes
Megabyte to MegaToGiga Provides the number of Gigabytes, originally

Gigabyte ({value}) presented in Megabytes
Megabyte to MegaToTera Provides the number of Terabytes, originally

Terabyte ({value}) presented in Megabytes
Gigabyte to GigaToTera Provides the number of Terabytes, originally

Terabyte ({value}) presented in Gigabytes
Terabyte to Kilobyte TeraToKilo Provides the number of Kilobytes, originally

({value}) presented in Terabytes
Terabyte to Megabyte TeraToMega Provides the number of Megabytes, originally

Terabyte to Gigabyte TeraToGiga Provides the number of Gigabytes, originally

1058
Web service monitoring
For custom web services that need to be monitored, SAM offers the ability to utilize the following
technologies:
n JSON: JavaScript Object Notation (JSON) is an open standard format that uses human-readable text
to transmit data objects consisting of attribute–value pairs. It is used primarily to transmit data
between a server and web application, as an alternative to XML.
Note: Inserted JSON content cannot exceed 1MB in size.
n SOAP: Simple Object Access Protocol (SOAP) is a protocol used for exchanging information in the
implementation of web services in computer networks. It relies on XML for its message format, and
usually relies on other application layer protocols. The SOAP monitor is useful if you have custom
web services that need to be monitored.
Currently, the SOAP monitor within SAM can return a status of either Up or Down, or return a
status of Warning or Critical based on response time thresholds. This monitor also has the ability
to search for the presence of a string.
n JSON
n SOAP Monitor
n Configure the SOAP monitor
1059
JSON
JSON is accepted in the HTTP monitor and HTTPS monitor, as shown below.
Following is an example of JSON code:
{
"firstname": "Kate"
"lastname": "Asaff"
"age" : 29
"city" : "Austin"
}
Inserted JSON content cannot exceed 1MB in size. SolarWinds Technical Support does not provide
support for custom scripts.
1060
SOAP Monitor
Definitions
n SOAP: (Simple Object Access Protocol) is a protocol used for exchanging information in the
implementation of web services in computer networks. It relies on XML for its message format, and
usually relies on other application layer protocols, most notably Hypertext Transfer Protocol (HTTP).
n WSDL: (Web Services Description Language). The Web Services Description Language is an XML-
based interface description language that is used for describing the functionality offered by a web
service.
n XML: Extensible Markup Language is a markup language that defines a set of rules for encoding
documents in a format that is both human-readable and machine-readable.
About the SOAP Monitor
You can test the SOAP monitor in Edit mode. If the test poll throws a web exception (indicating that there
was a problem on the target) the response content is extracted and you are able to view the message to
help identify the issue.
Currently, the SOAP monitor within SAM can return a status of either Up or Down, or return a
status of Warning or Critical based on response time thresholds. This monitor also has the ability
to search for the presence of a string.
1061
Configure the SOAP monitor
The are two ways to configure the SOAP monitor:
n Loading a WSDL file.

n Manually entering XML.
Load WSDL Files
The SOAP monitor within SAM currently supports the WSDL schema, which must be exposed on a URL.
Once the WSDL file is successfully loaded, the file is parsed automatically and the fields, highlighted
below, populates. Once the WSDL file has been successfully loaded, you can specify values for the
available arguments. There are two types of arguments, simple, and complex.
A simple argument is one where you can define the value directly. A complex argument (e.g. structures,
classes, list, and so on) must be user-defined in the XML format. It is recommended that complex
arguments be used only by experienced users.
The Advanced Settings are read-only and displays additional information. Because the SOAP
envelope is based on the WSDL schema, the Advanced Settings values should not be changed.
The SOAP XML field contains the SOAP envelope which is generated by the WSDL and dynamically
changes as you make changes to the SOAP settings. In this field you can check what is to be sent to the
web service.
Important: If changes are made to any of the base SOAP settings, the content of the SOAP XML is
re-generated and your changes become lost.
1062
Manually Enter XML
The following is an example of a Complex argument and would be placed in the Parameters field.
SAM automatically takes the code and place it where it belongs in the envelope:
<tempPhoneNumber
xmlns:ns2="http://schemas.xmlsoap.org/soap/encoding/"
xsi:type="ns2:Array" ns2:arrayType="ns1:TemporaryPhoneNumber[3]">
1063
</item>
</item>
</item>
</tempPhoneNumber>
XML can also be entered manually by typing or pasting XML.
1064
View the Asset Inventory dashboard
The Asset Inventory Dashboard is comprised of various resource modules and provides detailed insight
about the selected asset. The dashboard information can be found on a separate sub-view tab.

2. Click any node to be taken to the Node Details page.
3. With sub-views enabled, click the Asset Inventory tab.
All Asset Inventory resources contain a blue icon in the upper left-hand corner of the resource. This
will allow you to better identify this as an Asset Inventory resource should you decide to place
individual resources on different views.
corner of any resource.
Resources for the Asset Inventory dashboard can be added and deleted by clicking Customize Page in the
upper right-hand corner of the web console.
n If no information can be collected for a particular resource, that resource will become hidden for
that node.
n Clicking the title of any resource will open that resource in a new window.
1065
Custom Asset Information
This resource displays custom properties you have created relating to Asset Information.
Following is an example of how this can be used:
n InServiceDate: Displays the first day of service for the asset

n PONumber: Displays the Purchase Order number for the asset.
n PurchaseDate: Displays the purchase date of the asset.
n PurchasePrice: Displays the purchase price of the asset.
Add custom properties and have them displayed in this resource
1. In the Custom Asset Information resource, click Edit.

2. Click Use the Custom Property Editor.
3. Follow the steps of the Wizard.
4. If available, check Asset Inventory to have the item displayed in the Custom Asset Information
resource.
1066
Drivers
This resource displays driver software currently installed on the current node while providing a search
window. The data can be sorted by clicking the headers of each column.
n Device: Displays the device that relies on the driver listed.

n Name: Displays the name of the driver listed.
n Publisher: Displays the publisher of the driver listed.
n Version: Displays the version of the driver listed.
n Driver Date: Displays the date that the listed driver was created.
1067
Firmware
This resource displays the firmware currently installed on the current node while providing a search
window. The data can be sorted by clicking the headers of each column.
n Name: Displays the name of the firmware listed.

n Publisher: Displays the publisher of the firmware listed.
n Version: Displays the version number of the firmware listed.
n Release Date: Displays the release date of the version of the firmware listed.
1068
Graphics and Audio
This resource provides detailed information about the current graphics and audio devices associated with
the node.
In systems that contain multiple video cards or monitors, only the first of each will be displayed in
the Graphics and Audio resource for that node.
n Name: Displays field information about the listed graphics/audio device.

n Monitor Manufacturer – Displays the manufacturer of the current monitor.
n Monitor Model Number – Displays the model number of the current monitor.
n Monitor Resolution – Displays the current resolution of the current monitor.
n Video Card – Displays details about the listed video card.
n Video Chipset – Displays the current video chipset information for the listed device.
n Video Memory - Displays the amount of memory currently installed on the listed video card.
n Sound Card – Displays details about the installed sound card.
l Details: Displays details about the current device.
1069
Hard Drives
This resource provides information about the current hard drives associated with the node.
n Model: Displays the model of the listed hard drive

n Serial Number: Displays the serial number of the listed hard drive.
n Capacity: Displays the total storage space of the current hard drive in gigabytes.
1070
Hosted Virtual Machines
This resource details the amount of resources allocated to each virtual machine. Both VMware and Hyper-V
hosts can be displayed in this resource.
Only VMware 4.0 and higher is supported.
n VM Name: Displays the name of the virtual machine listed.

n Operating System: Displays the operating system of the virtual machine listed.
n State: Displays the on/off status of the virtual machine listed.
n Memory Size: Displays the memory allocated to the virtual machine listed.
n CPU Count: Displays the number of CPUs associated with the virtual machine listed.
n CPU Shares: Displays the percentage of CPU resources being used by the listed virtual machine.
n IP Address: Displays the IP address of the virtual machine listed.
For more information, see "Hardware Monitoring and VMware".
1071
Logical Volumes
This resource provides detailed information about the current logical volumes associated with the node.
Volumes call be polled via all protocols except VMware CIM for ESX hosts. Any logical volume that can be
monitored by SolarWinds appears in this resource.
n Name: Displays the name of the volume listed.

n Type: Displays the type of volume listed.
n File System: Displays the file system employed on the volume listed.
n Serial Number: Displays the serial number of the volume listed.
n Size: Displays the total size of the volume listed.
n Space Used: Displays the amount of space used on the volume listed.
n Available Space: Displays the free space on the listed volume as a number of bytes.
n % Available Space: Displays the amount of free space on the volume listed as a percentage and a
bar chart.
1072
Memory
This resource provides detailed information about the memory associated with the node.
Memory Summary
n Total RAM: Displays the total amount of RAM on the current node.
n Free RAM: Displays the total amount of free RAM on the current node.
n Total Virtual Memory: Displays the total amount of virtual RAM on the current node.
n Free Virtual Memory: Displays the total amount of free virtual RAM on the current node.
Memory Modules
n Slot: Displays the slot number in the server where memory is installed. SAM also shows empty slots
that could be populated with additional memory modules to increase the server's RAM.
n Capacity: Displays the maximum available RAM installed in the current memory slot, in megabytes.
n Model: Displays the model part number which can be used for purchasing a replacement part.
n Speed: Displays the frequency on which the memory module runs, in megahertz.
1073
Network Interfaces
This resource provides detailed information about current network interfaces associated with the node.
n Name: Displays the name and model of the listed interface. For more information about a network
interface, click [+] to the left of the interface name to expand the tree view and reveal the following
information:
n NetMask: Displays the configured netmask.
n Gateway: Displays the address of the gateway.
n DHCP Server: Displays the address of the DHCP server.
l Manufacturer: Displays the manufacturer of the listed interface.
l MAC Address: Displays the MAC address of the listed interface.
l IP Address: Displays the IP address of the listed interface.
1074
Operating System Updates Applied
This resource displays operating system updates that have been applied on the current node while
providing a search window. The data can be sorted by clicking the headers of each column.
This resource is only visible for Windows Nodes polled via WMI
n Name: Displays the name of the listed update. Clicking the name in this field may take you to the
website with information concerning the listed update.
n Type: Displays the type of update installed.
n Install Date: Displays the date that the listed update was installed.
n Installed By: Displays the user responsible for installing the listed update.
1075
Out of Band Management
This resource provides details about out of band management controllers installed on the node.
n Management Card: Displays the current management card.

n Type: Displays the type of the current management card.
n Firmware Version: Displays the current firmware version for the listed management card.
n IP Address: Displays the current IP address of the listed management card.
n MAC Address: Displays the current MAC address of the listed management card.
1076
Peripherals
This resource provides information about the current peripherals associated with the node.
n Type: Displays the type of peripheral listed

n Details: Displays details about the peripheral listed.
1077
Ports and USB Controllers
This resource provides detailed information about the current ports and USB controllers associated with
the node.
Ports
n Ports: Displays the type of port.

n Number: Displays the number of ports.
USB Controllers
n USB Controllers: Displays detailed information about the listed USB controller.
1078
Processors
This resource provides detailed information about the processors associated with the node.
Notes:
n Some IBM nodes may not provide processor information which results in missing information from
this resource.
n If a monitored computer is running the Solaris operating system, processor information will not be
available in this resource.
Important: Data for the number of cores will not be available for computers running Windows
Server 2003 unless the following Microsoft hotfix is applied:
http://support.microsoft.com/kb/932370.
n Processor: Lists the processors associated with the selected node.

n Manufacturer: Displays the manufacturer of the listed processor.
n Speed: Displays the current speed of the listed processor in gigahertz.
n Cores: Displays the number of cores (CPUs) within the listed processor.
n Threads: Displays the number of threads (concurrent processes) per core.
n Model: Displays the processor manufacturing technology and design generation for the listed
processor.
n Stepping: Displays the revision number of the listed processor.
1079
Removable Media
This resource provides information about the current removable media associated with the node.
n Name: Displays the name of the media listed.

n Type: Displays the technology of the media listed.
n Manufacturer: Displays the manufacturer of the media listed.
1080
Software Inventory
This resource displays software currently installed on the current node while providing a search window.
n Name: Displays the name of the software listed.

n Publisher: Displays the publisher of the software listed.
n Version: Displays the version of the software listed.
n Install Date: Displays the date that the listed software was installed.
1081
Storage Controllers
This resource provides detailed information about the current storage controllers associated with the
node. The data can be sorted by clicking the headers of each column.
n Name: Displays the name of the listed storage controller.

n Model Number: Displays the model number of the listed storage controller.
n Serial Number: Displays the serial number of the listed storage controller.
n Firmware Version: Displays the firmware version of the listed storage controller.
n Driver Version: Displays the driver version of the listed storage controller.
1082
System Information
This resource provides a general overview of the selected node. To update the details of this resource, click
Poll Now, which forces all Asset Inventory information to be polled immediately. To navigate to the Node
Details page of the current node, click the name of the node in the System Name field.
1083
1084
When the listed machine is on Microsoft Hyper-V virtual hardware, certain fields are populated with
virtual machine related information. Because SAM collects physical enclosure information from this
class when using WMI, the following fields may read as follows:
n Manufacturer will read, "Microsoft."

n Model will read, “Virtual Machine.”
n Serial Number will read a GUID string.
The fields for this resource are defined as follows:
General
n Last Inventory Collection: The date when SAM last collected inventory data on the selected node.
n System Name: Name of the current node.
n Host Name: Name of the current host. This only applies to Windows hosts polled via WMI
n Domain/Workgroup Name: Name of the domain or workgroup this node belongs to.
n DNS: This is the DNS name of the current node. The IP address of the node can change while the
DNS name remains the same.
n Domain Role: Shows the role of the current node. This only applies to Windows hosts polled via
WMI
n IP Address: Shows the IP address of the current node.
n Dynamic IP: Shows if the current IP address is dynamic or static.
Hardware
n Asset Type: Defines the current node as a specific type of hardware.

n Hardware: Shows the hardware status as being either physical or virtual.
n Manufacturer: Shows the company that produced this hardware.
n Model: Shows the model number of the hardware as defined by the manufacturer. This only applies
to physical nodes.
n Serial Number/Service Tag: Shows the serial number of the current node. This only applies to
physical nodes.
n Warranty Status: Shows the warranty information about the current node with a link to that
vendor's site. This only applies to physical servers that are Dell, HP, or IBM.
Note: One alert is included for Warranty Status:

n Alert me when a node warranty expires in 30 days - Disabled by default.
n Location: Displays the geographical location of the current node.
n Device Time Zone: Shows the time zone set in the system. This only applies to Windows nodes
polled via WMI.
1085
Operating System
n Operating System: Shows the operating system of the current node.

n OS Version: Shows the current version of the operating system.
n OS Architecture: Shows the design (32-bit or 64-bit) of the operating system.
n OS Language: Shows the language the current operating system is using on the current node.
n Service Pack: Displays the current service pack installed on the operating system. This only applies
to Windows nodes polled via WMI.
n Last Boot: Shows the date of the last boot for the current node.
n Last Logged in User: Displays the last user to log in on the current node. This only applies to
Windows nodes polled via WMI.
n Firewall Status: Displays whether or not the built-in Windows firewall is currently enabled on the
node. This only applies to Windows nodes polled via WMI.
n Hardware Agent: Displays the Hardware Monitoring Agent Software currently installed on the
node.
1086
Windows Update Information
This resource provides information about the current Windows update status associated with the node.
This only applies to Windows nodes polled via WMI.
n Windows Update Status: Displays whether or not Windows Update is enabled.

n Most Recent Check for Updates: Displays the time and date of the last successful check for
updates.
n Updates Last Installed: Displays the time and date of the last successful installation of updates.
n Update Method: Displays how updates are managed on the host. This value can be Automatically
Applied, Download And Notify, or Notify Only.
1087
SolarWinds SAM Charts and Resources
Following is a list of the available charts within SAM:
n Application Availability Chart

n Custom Area Chart
n Custom Bar Chart
n Custom Chart View
n Custom Line Chart
n Custom Node Charts
n Custom Volume Charts
n Custom Table
n Custom Query resource
n Event Log Message Details
n Min/Max Average Chart
n Multiple Object Chart
n Multiple Statistic Chart
n Multi Chart
1088
Application Availability Chart
This chart lets you visualize the amount of time an application was in a particular state of availability. This
chart is interactive. Hover over any part of the chart to display detailed information.
The tooltip indicates the number of times the application was in a certain state. For example, in the
previous illustration, an application was polled 12 times in one hour (every five minutes) and was deemed
available (up) 10 times, in a Critical state once, and in a Warning state once.
Zooming
the main chart.
1089
The Export button opens the Custom Chart allowing you to export this data to both MS Excel and
HTML.
1090
Custom Chart
The Custom Chart resource allows you to easily view data based on your needs. To customize it, click Edit
in the upper right corner of the resource.
From the Edit page, you can define the titles, datasource, time period, labels, units displayed, the type of
chart to be used, and an optional sum of the data.
Customize the chart
1. After adding this resource to a page, click Edit.

2. Enter a Title and optional Subtitle.
3. Select a datasource by clicking Select Datasource.
4. Select a time period for the data from the Time Period drop down list.
5. Enter a label for the left Y axis.
6. Select the units to be displayed from the Units Displayed drop down list.
7. Select the type of chart to be displayed from the Chart Type drop down list.
8. Optionally choose to display the sum of the data by checking, Show the sum of all data.
1091
9. Clicking More allows you to customize further by optionally changing the Display Name, Color,
showing the 95th percentile, and trend line.
10. Optionally repeat Steps 5 - 9 for the Y axis on the right side of the chart.
11. Select a Sample Interval from the drop down list.
12. Optionally filter the results from the options provided.
Zooming
the resource.
1092
Custom Area Chart
The Custom Area Chart resource allows you to easily view data as shown in percentage format. To
customize it, simply click Edit in the upper right-hand corner of the resource.
Use the check box in the legend as a toggle to show/hide data on the chart. Clicking Export lets you export
the data to either an HTML or Excel file.
Zooming
the resource.
1093
Custom Bar Chart
The Custom Bar Chart resource allows you to easily view data as shown in percentage format. To
Use the check box in the legend as a toggle to show/hide data on the chart. Clicking Export lets you export
the data to either an HTML or Excel file.
Zooming
the resource.
1094
Component Availability Chart
The Component Availability Chart is a straightforward bar chart that provides a visual representation of
the percentage of availability of a selected component.
Clicking Edit will provide a menu of components to choose from to have represented on the chart, as the
following illustration depicts:
This option is only available on the Application Details page and not the Component Details page.
Clicking the chart itself, as opposed to the Edit button, brings up additional, self-explanatory
options.
Zooming
the main chart.
1095
The Export button will allow you to export this data to both MS Excel and HTML.
1096
Custom Chart View
Charts in the SolarWinds Web Console are easily customizable. Clicking a chart opens the Custom Chart
view in a new window. The following sections describe options that are available on the Custom Chart
page to modify the presentation of a selected chart.
Click Refresh at any time to review changes you have made.
Printing Options
To print your customized chart, click Printable Version and a printable version of your
customized chart displays in the browser.
Chart Titles
Chart Titles are displayed at the top center of a generated chart. The Chart Titles area allows
you to modify the Title and Subtitles of your generated chart.
Note: SolarWinds may provide default chart titles and subtitles. If you edit any of the Chart
Titles fields on the Custom Chart page, you can restore the default titles and subtitles by
clearing the respective fields, and then clicking Submit.
Time Period
Predefined and custom time periods are available for generated charts. You may designate the
time period for a chart by either of the following methods:
n Select a predefined period from the Select a Time Period: menu.

n Provide custom Beginning and Ending Dates/Times in the appropriate fields in the Time
Period area.
Sample Interval
The sample interval dictates the precision of a given chart. A single point or bar is plotted for
each sample interval. If a sample interval spans multiple polls, data is automatically
summarized and plotted as a single point or bar on the chart.
Note: Due to limits of memory allocation and the large number of polled data points, some
combinations of time periods and sample intervals may require too many system resources to
display. As a result, charts may not display if the time period is too long or if the sample
interval is too small.
Chart Size
Chart Size options configure the width and height, in pixels, of the chart. You can maintain the
same width/height aspect ratio, or scale the chart in size, by entering a width in the Width field
and then entering 0 for the Height.
Font Size
Font sizes for generated charts are variable. The Font Size option allows you to select a Small,
1097
Medium, or Large size font for your chart labels and text.
Note:Font Size selections are maintained in the printable version of your chart.
Data Export Options
The Display Data from Chart area provides the following options to export chart data as either
Excel-compatible Raw Data or as HTML-formatted Chart Data:
n To view chart data in an Excel-compatible format, click Raw Data, and then follow the
prompts, if provided, to open or save the resulting raw data file.
n To view HTML-formatted chart data in a new browser, click Chart Data.
1098
Custom Line Chart
The Custom Line Chart resource allows you to easily view data as shown in percentage format. To
Use the check box in the legend as a toggle to show/hide data on the chart. Clicking Export lets you to
export the data to either an HTML or Excel file.
Zooming
the resource.
1099
Custom Query resource
The Custom Query resource allows you to create a custom resource based on a SolarWinds Query
Language (SWQL) query. The query provided in this resource is run against your SolarWinds database, and
the results are displayed in an appropriate grid.
Clicking Edit allows you to configure your Custom Query resource, as indicated in the following procedure.
Configure the Custom Query resource
1. Click Edit in the Custom Query resource.

2. Provide an appropriate Title.
3. Provide an appropriate Subtitle.
4. Enter your custom SWQL query in the Custom SWQL Query field.
Notes:
n For more information about creating valid custom SWQL queries, see Trigger Conditions.
n Do not end your custom SWQL query with a comment. Closing your query with a comment
may comment out required query clauses that are automatically appended to your custom
query to ensure full resource functionality in the web console.
5. Designate the Number of Rows Per Page in the resource.
Note: If your query returns a large number of objects, you can decrease the load on your SolarWinds
server by breaking your results into pages. This setting indicates the number of objects the web
console should display in the resource at any given time.
6. Click Submit.
1100
Custom Table
The Custom Table resource allows you to easily view data that can be customized to suit your needs. To
customize it, click Edit in the upper right-hand corner of the resource.
Edit the Custom Table resource
Once in Edit mode, You can select and adjust the following options for this resource:
n Title and subtitle: Used to change the labels of the Title and Subtitle.
n Datasource: This lets you to create queries and add conditions. When you add a condition, you
have the option to add a field or use pre-existing fields. Your choices are reflected in the Custom
Table resource once it has been updated.
n Time Period: Select the time period for data to be displayed in the resource.
n Table Layout: Once a Datasource is selected, you can add columns and then arrange them by
dragging them into position. Clicking [X] deletes the column from view.
n Sort Results: Allows you to choose how the data is sorted and displayed.
n Group Results: Allows you to choose how the data is grouped.
n Filter Results: Allows you to choose how many records are displayed based on either a set number
or a percentage.
1101
Custom Node Charts
The following node-related charts, grouped by type, are available as resources within the SolarWinds Web
Console. To add any of these charts to a web console view dealing with monitored nodes, add the Custom
Node Chart resource to the Node Details view.
Availability
The following charts are available to display node availability information over custom time periods for
nodes monitored by SolarWinds.
n Availability
n Availability - Autoscale
n Availability and Response Time
CPU Load
The following charts display CPU loading information over specified periods of time for nodes monitored
by SolarWinds.
n Average CPU Load

n Min/Max/Average CPU Load
Memory Usage
The following charts present memory usage information over custom time periods for nodes monitored by
SolarWinds.
n Average Memory Usage

n Memory/Buffer Failures
n Min/Max/Average Memory Usage
n Percent Memory Used
Packet Loss and Response Time
The following charts are available to display historical statistics about packet loss and response time for
nodes monitored by SolarWinds.
n Availability and Response Time

n Average Response Time
n Average Response Time and Packet Loss
n Min/Max/Average Response Time
n Min/Max/Average Response Time and Packet Loss
n Percent Loss - Bar Chart
n Percent Loss - Line Chart
1102
Custom Volume Charts
The following volume-related charts, grouped by type, are available as resources within the SolarWinds
Web Console. To add any of these charts to a web console view dealing with monitored volumes, add the
Custom Volume Chart resource to the Volume Details view.
Allocation Failures
Shows the number of disk allocation failures that have occurred on the selected volume.
Min/Max/Average Disk Usage
Shows both the total disk space available and the average amount of disk space used on the selected
volume. Bars are also included to show minimum and maximum levels of disk usage.
Percent Disk Usage
Shows the total available disk space and the average amount of disk space used, as a percentage of
the total available, on the selected volume.
Volume Size
Shows the total disk space available on the selected volume.
1103
Event Log Message Details
The Event Log Message Details resource allows you to read each message of the event log in its entirety.
This resource is found on the Component Details page and can return the following information:
n Number of events matching the criteria as defined by the user

n Event type / Level (Error, Warning, Information, and so on).
n Event code / Event ID
n Log file (Application, Security, and so on).
n Time generated
n Computer name
n User
n Message
Clicking on Show More expands the resource to fill a separate screen. Clicking on any message in this
resource brings up the entire message that was created in the event log.
Alerts with this resource can be used with the complete message text of events.
1104
Min/Max Average Chart
The Min/Max Average Chart has been updated from previous releases to show more information and
provide more flexibility. These charts can be found by navigating to the Component Details page or the
Application Details page.
Add the Chart
1. Navigate to the Component Details page or the Application Details page.
2. Click Customize Page.
3. Click the [+] in either column.
4. Select a category to group items by from the Group by drop down menu:
Note: The Classic category reflects the tree views found in previous versions of SAM for this
resource.
5. Select the charts you want, and then click Add Selected Resources.
6. Click Done.
Customize the Chart
This chart can be customized to view the following data by clicking the Edit button at the top-right of the
chart. The available data to this chart are as follows:
n CPU Load
n Physical Memory
n Virtual Memory
n Response Time
n Statistic Data
Clicking Edit also reveals several self-explanatory options. Clicking Export allows you to export the data to
both Excel and HTML formats.
This resource is made up of three sections: the toolbar, the main chart, and the lower chart. This allows
you to visualize the selected data by viewing the minimums, maximums, and averages of the data for a
selected time period.
Zooming
buttons; 1 Day, 1 Week, or 1 Month, as highlighted in the above illustration. Alternatively, you can have the
chart show a specific date range by dragging the mouse over a small area of the chart, or by typing in
specific dates in the From and To fields, also highlighted.
selected time period. With the lower chart you can zoom in further by fine tuning the view with the sliders,
highlighted above. The main view of the chart will display the selected time period between the two sliders
of the lower chart.
1105
Moving the mouse over the main chart will reveal a tooltip with more detailed information about the
specific time period the mouse is hovering over.
By default, all statistics are shown in the main chart. You can add or remove any statistic from the chart by
checking and unchecking any statistic from the legend at the lower left of the resource.
1106
Multiple Object Chart
The Multiple Object Chart resource allows you to simultaneously view data for multiple objects on the
same chart. Objects may be on the same node or on different nodes. Clicking Edit allows you to configure
the characteristics of a selected multiple objects chart.
Add the Multiple Object Chart to the home page
1. On the Web Console, click Customize Page .

2. Click the green [+] to the right of where you want to add this chart.
3. From Add Resources to SolarWinds Home Summary page, select and expand Multiple Series Charts.
4. Check Multiple Object Chart, and then click Submit, and then click Done.
Configure the Multiple Object Chart
1. Once the chart is on your Home Summary page, click Edit.
2. From this page, you can have multiple options to choose from, including:
a. Title: This allows you to change the title of your chart.
b. Subtitle: This allows you to add a subtitle to your chart.
c. Choose Objects: This allows you to choose the type of objects to display from the drop
down menu provided. You can remove an object from the list by clicking the red X to its
right.
d. Select a Chart: This allows you to chart various aspects of what you intend to monitor.
e. Choose Objects: Click the Select SolarWinds Object button to choose which objects you
want charted based on your selection in step iii.
f. Limit Series: Checking this box and setting the number of series limits the number of
items displayed on the chart to the specified amount.
1107
g. Show Sum in Data Series: This allows you to chart the total of the other objects graphed
and is represented by its own plot line.
h. Time Period: This allows you to set the range displayed on the chart.
i. Sample Interval: This allows you to set the interval that this chart is updated.
1108
Multiple Statistic Chart
This chart provides the ability to graphically visualize multiple statistics simultaneously, as well as view the
statistics in the table below. The advantage of this view is that you can easily determine how certain
processes and services are performing in relation to others. For example, you may notice that a spike in
RAM usage results in higher CPU usage. This charted information allows you to get a quick overview of
what is being monitored and may answer why certain unexpected events are occurring.
Zooming
buttons at the top of the chart. Alternatively, you can have the chart show a specific time range by
the main chart.
The Multiple Statistic Chart can be added to either the Application Details page or the SAM Component
Details page.
Add the Multiple Statistic Chart to either page
1. Drill down to either the Application Details page or the SAM Component Details page.
2. Click Customize Page on the far top right of the page.
1109
3. Click the green [+] to the right of the column in which you want to add this chart.
4. Select and expand SAM Charts - Historical charts for SAM.
5. Check Multiple Statistic Chart, and then click Submit, then click Done.
Configure the Multiple Statistic Chart
1. Once the chart is on your Details page, click Edit at the top right of the chart.
2. From this page, you can have several options to choose from, including:
n Title: This allows you to change the title of your chart.

n Select a Time Period: This allows you provide a range for your chart.
n Select a Sample Interval: This allows you to select how often the chart is updated.
n Chart All or Selected Statistics: This allows you to chart certain or all aspects of what you intend to
monitor.
1110
Multi Chart
This chart provides the ability to graphically visualize multiple statistics simultaneously at the application
level without the need to drill down into each component monitor.
The advantage of this view is that you can easily determine how certain processes are performing in
relation to others. For example, you may notice that a spike in RAM usage results in higher CPU usage. This
charted information allows you to get a quick overview of what is being monitored and may answer why
certain unexpected events are occurring.
Zooming
buttons at the top of the chart. Alternatively, you can have the chart show a specific time range by
the main chart.
The Multi Chart can be added from the Application Details page.
Add the Multi Chart to the Application Details page
1. Navigate to the Application Details page.

2. Click Customize Page on the far top right of the page.
3. Click the green [+] to the right of the column in which you want to add this chart.
4. Search for "Multi Chart."
5. Check Multi Chart, and then click Add Selected Resources, then click Done.
Configure the Multi Chart
1. Once the chart is on your Application Details page, click either Edit, Select a chart, or
Configure this resource.
1111
2. From this page, you have several options to choose from, including:
i) Title: This allows you to change the title of your chart.
ii) Subtitle: This allows you to change the subtitle of your chart.
iii) Select components: Check the components you want to use.
iv) Show Thresholds: This allows Warning and Critical Thresholds to be displayed
as yellow and red bands, respectively.
v) Default zoom range: Allows you to choose the time period of data to be
displayed.
vi) Amount of historical data to load: Allows you to select the amount of
historical data to be displayed.
vii) Sample interval: Allows you to set the polling time for the components in this
chart.
1112
Reading the Application Summary view
The SAM Application Summary is the first view displayed after launching Server & Application Monitor.
This view provides insight into application health and performance conditions over your entire network.
The resources listed in this section are the default views included in the SAM Application Summary.
1113
Active application alerts
This resource provides the current application-specific alerts, including the time the alert fired, the name
of the application that caused the alert, and the alert message. Click the Network Node to see the
SolarWinds Node Details view. Click the Application Name to see the SAM Application Details view.
1114
Application Health Overview
This resource provides a status overview of all your assigned application monitors. Click a status to list the
assigned application monitors in that status.
The following statuses are depicted on the Application Health Overview:
Application Up
Assigned application monitors with all component monitors responding and operating within their
thresholds.
Application Critical
Assigned application monitors with at least one component monitor operating past the critical
threshold.
Application Down
Assigned application monitors with at least one unresponsive component monitor.
Application Warning
Assigned application monitors with at least one component monitor operating past the warning
threshold.
Other
Assigned application monitors that are suspended due to licensing restrictions.
Unknown
Assigned application monitors with status that cannot yet be determined.
1115
Applications with Problems
This resource lists the assigned application monitors reporting any status other than up.
1116
Last 25 Application Events
This resource provides a list of application-centric events from the time period you specify. The default
time period shows the last 25 application events. Click Edit to change the time period, limiting the events
displayed in the resource.
1117
Thwack Latest Application Templates
This resource lists the newest application monitor templates that have been added to the Thwack
community web site. Click a template to open its download web page.
1118
Top 10 Components Monitored by Response Time
This resource provides a list of the component monitors with the slowest response time.
1119
Top 10 Monitored Processes by CPU Load
This resource provides a list of the component monitors consuming the most CPU.
1120
Top 10 Monitored Processes by Physical Memory
This resource provides a list of the component monitors consuming the most physical memory.
1121
Top 10 Monitored Processes by Virtual Memory
This resource provides a list of the component monitors consuming the most virtual memory.
1122
Top 10 Monitored Processes by I/O Reads/Sec
This resource displays the total number of I/O Read operations per second.
Fields:
n Process Name: Displays the name of the listed process. Clicking a process in the list will take you to
the Component Details page for that process.
n Application Name: Displays the name of the listed application that contains the listed process.
Clicking an application in the list takes you to the Application Details page for that application.
n Network Node: Displays the name of the listed node that contains the listed application and
process. Clicking a node in the list takes you to the Node Details page for that node.
n IO Reads: Displays the current rate of Input/Output reads.
Clicking Edit lets you to change the Title, Sub-Title, and Maximum Number of Monitors to Display.
Hovering the mouse over any part of this resource reveals a tooltip with detailed information about the
item listed.
1123
Top 10 Monitored Processes by I/O Writes/Sec
This resource displays the total number of I/O Write operations per second.
Fields:
n Process Name: Displays the name of the listed process. Clicking a process in the list takes you to
n IO Writes: Displays the current rate of Input/Output writes.
Hovering the mouse over any part of this resource will reveal a tooltip with detailed information about the
item listed.
1124
Top 10 Monitored Processes by I/O Total Operations/Sec
This resource displays the total number of I/O operations per second.
Fields:
n Process Name: Displays the name of the listed process. Clicking a process in the list takes you to
n Total IOPS: Displays the current rate of Input/Output.
Hovering the mouse over any part of this resource will reveal a tooltip with detailed information about the
item listed.
1125
Server Warranty Summary
This resource displays warranties currently expired and set to expire on the current node. This is done by
SAM periodically checking the status of each server's warranty against Dell, HP, and IBM's online warranty
validation servers.
Click a node in the summary list to display Node Details view for that node.
You can visually see warranties nearing their expiration dates by examining the dates in the Expiration
Date column. Also, if a warranty expiration date crosses a Warning or Critical threshold, progress bars
appear as yellow and red, respectively. Click Edit to customize threshold values as well as filter the
warranties to display.
1126
n Expired Warranties: Lists the nodes that currently have expired warranties.
n Warranties Due to Expire: Lists the nodes that have warranties nearing their expiration date.
n Next 5 Warranties Set to Expire: Lists the top five warranties nearing their expiration date.
Clicking Edit lets you to fine tune the information displayed in this resource.
Server Warranty Summary Alerts
One alert is included with Server Warranty Summary:
n Alert me when a node warranty expires in 30 days - Disabled by default
1127
Application Monitor Thresholds
Thresholds are markers that indicate certain levels have been reached. Many component monitors used in
SAM applications have thresholds that can be adjusted and set.
Once set, thresholds can act as trigger points. For example, if you are monitoring CPU usage, a Critical
threshold set at 90% would be typical. You can use this threshold as a trigger to send an email alert to
inform you of the Critical status once that threshold has been breached.
Normally, an administrator would need to monitor applications for several weeks in order to collect
enough data to be used as a baseline. Once a baseline has been established, the administrator can make
an educated guess how to set Warning and Critical thresholds for the component monitors. Note, if
thresholds are set too low, the administrator would be getting alerts all the time. If set too high, problems
can occur without the administrator's knowledge.
Baseline data, as well as Warning and Critical thresholds for application monitors, can be gathered and
calculated automatically. The option to enter thresholds manually remains available.
For more information, refer to the following sections:
n Threshold Adjustments at the Template Level

n Change the amount of data used in baseline calculations
n Multi-Value scripts and thresholds
n Apply baseline thresholds at the template level
n Apply baseline thresholds at the application level
n View the Latest Baseline Details Page
1128
Multi-Value scripts and thresholds
The format for using the threshold macros with multi-value scripts is as follows:
n ${Threshold.Warning.DisplayName}
n ${Threshold.Critical.DisplayName}
1129
Understand latest baseline details
The two tabbed charts and table below them detail how baseline statistics and thresholds are calculated
for individual component monitors based on the collected data.
Clicking Use Recommended Thresholds do not affect the chart.
Understanding the Occurrences Chart
The horizontal (X) axis displays the range of values collected by the current component monitor during the
data collection period. The vertical (Y) axis displays the frequency of each value collected during the data
collection period.
The three colors of the chart show the values of the component monitor during different time periods: Day,
Night, and All Hours. You can show or hide these time periods by checking and un-checking their
respective boxes in the legend.
You can have the chart show a specific time range by dragging the mouse over a small area of the chart.
Hovering over any area of the chart provides a tooltip with detailed information about that area of the
chart.
1130
If you zoom in, a Reset Zoom button appears.
The yellow and red shading of the chart indicates the recommended Warning and Critical thresholds,
respectively. These shaded areas are taken from the values recorded in the Latest Baseline Statistics table.
The ability to check and uncheck the boxes in the legend is for visual purposes only and does not
affect the values generated for calculated thresholds.
Understanding the Metric Over Time chart
The horizontal (X) axis displays the time period for when the values were collected for the current
component monitor. The vertical (Y) axis displays the range of all the values collected during the charted
time.
In other words, the light blue bars show the range of values for the statistics collected during the charted
time period. The bottom of the bars indicates the lowest statistic collected, or the minimum. The top of the
bars indicates the highest statistic collected, or the maximum. The blue line of the chart shows the average
values of the component monitor through time.
Using the legend, you can show or hide these statistics by checking and un-checking their respective
boxes.
You can have the chart show a specific time range by dragging the mouse over a small area of the chart or
by using the sliders located at the bottom of the chart. Hovering over any area of the chart provides a
tooltip with detailed information about that area of the chart.
1131
The yellow and red of the chart indicates the recommended Warning and Critical thresholds, respectively.
These shaded areas are taken from the values recorded in the Latest Baseline Statistics table.
The ability to check and un-check the boxes in the legend is for visual purposes only and does not
affect the values generated for calculated thresholds.
Understanding the Latest Baseline Statistics Table
Along with the minimum and maximum values displayed, the Latest Baseline Statistics table at the bottom
of the display shows the average baseline statistics surrounded by three levels of standard deviation for
both day and night data. This table highlights the recommended Warning and Critical thresholds in yellow
and red, respectively.
In addition to using the recommended threshold values, you can hover the mouse over any value in the
table to bring up a tooltip dialog. The tooltip dialog allows you to visualize, but not change, the value for
the Warning or Critical threshold to the value you are hovering over by simply clicking either link in the
dialog. Visualizing a value in this way affects the chart above the table by repositioning the shading
indicating the Warning and Critical threshold areas.
Understand baseline details and setting thresholds
The right column of this view provides information about the data's calculation and usage and allows you
to set thresholds.
1132
In the Current Thresholds Settings area, you can manually change the values for both the Warning and
Critical thresholds, or use the recommended values by clicking Use Recommended Thresholds.
Additionally, you can add logic for these thresholds by selecting an operator from the drop down list such
as Greater Than, Less Than, Equal To, and so on. The logical operator selected applies to both the Warning
and Critical thresholds and cannot be separated. For example, if you select the Greater Than or Equal to
operator with a Warning threshold value of 80 and a Critical threshold of 90, the thresholds are considered
met if the returned value for the current performance counter meets or exceeds 80 for Warning or 90 for
Critical.
1133
Understand sustained thresholds
The highlighted fields in the following illustration are available for configuring sustained thresholds:
The following two tables demonstrate possible sustained threshold conditions based on the illustration
above and how the Warning and Critical conditions are met:
1134
SolarWinds Variables and Examples
Filter syntax reference
Filter syntax reference and navigation
There are two filter syntax types: Structured Query Language (SQL) syntax and SolarWinds Query Language
(SWQL) syntax. The main differences between SQL and SWQL are:
n The SWQL wildcard character is %. The SQL wildcard character is *.

n When using SWQL, you must look up the SWQL name and use that as a prefix instead of a SQL table
name.
If the resource you are trying to filter creates its list by joining two tables together that contain
properties that share the same name, you cannot filter on that property unless you attach a
particular SQL table name to the beginning of the property name.
SQL or SWQL?
Generally, the resources that have recently been added to SolarWinds Orion use SWQL syntax, the oldest
ones require SQL syntax.
Look for additional guidance at the bottom of the Edit Resource page.
Navigate to the SWQL query page
1. On the web console, click Settings > All Settings

2. Replace default_orion.aspx with swis.aspx.
Example: http://127.0.0.1/orion/admin/swis.aspx.
The following screen is displayed where you can enter and execute queries.
1135
SolarWinds SAM SWQL resource matrix
The resource matrix helps you find the SWQL aliases you need to create filter criteria for your resources.
The SWIS entity names are provided so that you know exactly how the SWQL alias maps to the SWIS
entities in your SolarWinds product databases.
SolarWinds SAM resources
Resources for SolarWinds Server & Application Monitor (SAM) use a mix of SWQL and SQL filters. Tables
that start with APM_ are SQL tables and use SQL filters. The remaining are SWIS tables and use SWQL
filtering.
SAM RESOURCE TABLE NAME SWQL ALIAS

Orion.APM.Application Application
Orion.APM.ApplicationTemplate ApplicationTemplate
All Applications Tree
Orion.APM.CurrentApplicationStatus Status
Orion.Nodes Nodes
Orion.APM.Application Application
Orion.APM.ApplicationTemplate Template
Applications with Problems
Orion.APM.CurrentApplicationStatus Status
Orion.Nodes Nodes
APM_CurrentComponentStatus MonitorStatus
APM_PortEvidence pe
APM_ComponentExt Monitor
APM_Application Application
Top XX Components by Statistic

APM_CurrentApplicationStatus ApplicationStatus
Data APM_ThresholdsByComponent thresholdRT
APM_ThresholdsByComponent thresholdStat
APM_ErrorCode ec
APM_StatusCodeType sct
APM_StatusCode sc
1136
SAM RESOURCE TABLE NAME SWQL ALIAS
APM_PortEvidence pe
Top XX Components by Response

Time APM_Application Application
APM_ThresholdsByComponent Threshold
APM_PortEvidence pe
Top XX Processes by CPU Load APM_ComponentExt Monitor
APM_Application Application
APM_PortEvidence pe
Top XX Processes by Physical

Memory APM_Application Application
APM_PortEvidence pe
Top XX Processes by Virtual

Memory APM_Application Application
1137
SolarWinds EOC SWQL resource matrix
All SolarWinds Enterprise Operations Console (EOC) resources use SWQL filtering.
Alert Resources
RESOURCE SWIS ENTITY NAME SWQL ALIAS

EOC.Alert2 Alert
EOC.Node Node
Global Last XX Active Alerts
EOC.Node.CustomProperty Node.CustomProperty
EOC.Orion SWServer
EOC.Alert2 Alert
Triggered Alerts for All Network

EOC.Node Node
Devices EOC.Node.CustomProperty NodeCustomProperty
EOC.Orion SWServer
Event Resources

EOC.Event Event
Global Events Summary EOC.EventType EventType
EOC.Orion SWServer
EOC.Event Event
EOC.EventType EventType
Global Last XX Events EOC.Node Node
EOC.Orion SWServer
EOC.EventName EventName
Groups Resources

EOC.Alert2 Alert
Global Active Group Alerts
EOC.Orion SWServer
1138
EOC.Groups Groups
Global All Groups EOC.Orion SWServer
EOC.StatusInfo StatusInfo
EOC.Groups Groups
Global Groups With Problems
EOC.Orion SWServer
Inventory Resources

EOC.Interface I
Number of Interfaces by Type
EOC.Orion SWServer
EOC.Node Node
Number of Nodes by Device Type
EOC.Orion SWServer
EOC.Node Node
Number of Nodes by IOS/OS
EOC.Orion SWServer
SolarWinds EOC Resources

EOC.Interface I
Global Top XX Errors & Discards
EOC.Node N
This Hour
EOC.Orion SWServer
EOC.Interface I
Global Top XX Error & Discards
EOC.Node N
Today
EOC.Orion SWServer
EOC.Interface I
Global Top XX Interfaces by
EOC.Node N
Percent Utilization
EOC.Orion SWServer
1139
EOC.Interface I
EOC.Node N
Relative Multicast Packet Rate
EOC.Orion SWServer
EOC.Interface I
EOC.Node N
Traffic
EOC.Orion SWServer
Global Top XX Nodes by Average

EOC.Node Node
Response Time EOC.Orion SWServer
EOC.Node Node
Global Top XX Nodes by CPU Load
EOC.Orion SWServer
Global Top XX Nodes by Current

EOC.Node Node
Response Time EOC.Orion SWServer
Global Top XX Nodes by Percent

EOC.Node Node
Memory Used EOC.Orion SWServer
Global Top XX Nodes by Percent

EOC.Node Node
Packet Loss EOC.Orion SWServer
EOC.Node N
Global Top XX Volumes by Disk

EOC.Orion SWServer
Space Used EOC.Volume V
EOC.Volume.Stats VS
SolarWinds IPAM Resources
Global Top XX DHCP Scopes by

EOC.IPAM.GroupNode Scope
Utilization EOC.Orion SWServer
Global Top XX Subnets By % IP

EOC.IPAM.GroupNode Subnet
Address Used EOC.Orion SWServer
SolarWinds NCM Resources
1140
EOC.NCM.Nodes NCMNode
Global Configuration
EOC.Node Node
Manager Nodes
EOC.Orion SWServer
EOC.NCM.ConfigArchive ConfigArchive
Global Devices Backed EOC.NCM.Nodes NCMNode

Up versus Not Backed
Up EOC.Node Node
EOC.Orion SWServer
EOC.NCM.CacheDiffResults CacheDiffResults
EOC.NCM.ComparisonCache ComparisonCache
Global Last XX Config
EOC.NCM.Nodes NCMNode
Changes
EOC.Node Node
EOC.Orion SWServer
EOC.NCM.LatestPolicyReportViolations LPR
Global Policy Violations
For Each SolarWinds EOC.NCM.PolicyReports PR
Server
EOC.Orion O
SolarWinds NTA Resources

EOC.EventType EventType
Global Last XX Traffic Analysis
EOC.Node Node
Events
EOC.Orion SWServer
1141
EOC.Interface I
EOC.Interface I1
EOC.NetFlow.Source S
Global NetFlow Sources EOC.NetFlow.Source S1
EOC.Node N
EOC.Node N1
EOC.Orion SWServer
EOC.NetFlow.Engine S
NetFlow Collector Services
EOC.Orion SWServer
SolarWinds SAM (APM) Resources

EOC.APM.Application A
EOC.APM.ApplicationTemplate AT
EOC.APM.CurrentApplicationStatus CAS
Global All Applications
EOC.Node N
EOC.Node.CustomProperty NodeCustomProperty
EOC.Orion SWServer
EOC.APM.Application Application
Global Application Health

EOC.APM.CurrentApplicationStatus Status
Overview EOC.Node Node
EOC.Orion SWServer
1142
Global Applications by
Status EOC.Node N
EOC.Orion SWServer
Global Applications with
High Process CPU Load
EOC.Node N
EOC.Orion SWServer
EOC.APM.CurrentStatistic CS
High Process Memory Used
EOC.Node N
EOC.Orion SWServer
High Response Time
EOC.Node N
EOC.Orion SWServer
Issues
EOC.Node N
EOC.Orion SWServer
1143
EOC.APM.Component Monitor
Global Top XX Monitors by

EOC.APM.CurrentComponentStatus CCS
Response Time EOC.APM.CurrentStatistic CS
EOC.Node N
EOC.Orion SWServer
Global Top XX Process
Monitors by CPU Load
EOC.Node N
EOC.Orion SWServer
Monitors by Physical EOC.APM.CurrentStatistic CS
Memory
EOC.Node N
EOC.Orion SWServer
Monitors by Virtual EOC.APM.CurrentStatistic CS
Memory
EOC.Node N
EOC.Orion SWServer
Total Applications By Type EOC.APM.ApplicationTemplate AT

for Each Local SolarWinds
Server EOC.Orion SWServer
SolarWinds UDT Resources

Global Total Ports Currently Used EOC.Orion SWServer
1144
Top XX Nodes by Percent Ports
EOC.Node N
Used
EOC.Orion SWServer
EOC.UDT.NodeCapability S
EOC.UDT.NodeStatistics NS
SolarWinds VNQM (IP SLA) Resources

EOC.AlertDefinition AlertDefinition
EOC.AlertStatus AlertStatus
Global Active IP SLA
EOC.IpSla.Operation IpSlaOperation
Operation Alerts
EOC.IpSla.OperationType IpSlaOperationType
EOC.Orion SWServer
EOC.AlertStatus AlertStatus
EOC.AlertDefinition AlertDefinition
EOC.IpSla.OperationStatus ipSlaOperationStatus
Global All IP SLA Operations EOC.IpSla.OperationType IpSlaOperationType
EOC.IpSla.Site SourceSite
EOC.IpSla.Site TargetSite
EOC.Node Node
EOC.Orion SWServer
EOC.Event Event
Global Last XX IP SLA Events EOC.IpSla.Event IpSlaEvent
EOC.Orion SWServer
1145
EOC.IpSla.OperationCurrentStat IpSlaOperationCurrentStat
EOC.IpSla.OperationStatus ipSlaOperationStatus
EOC.IpSla.OperationType IpSlaOperationType
Global Top XX All Operations EOC.IpSla.Site SourceSite
EOC.IpSla.Site TargetSite
EOC.Node SourceNode
EOC.Node TargetNode
EOC.Orion SWServer
EOC.Node N1
EOC.Node N2
EOC.Orion SWServer
Global Top XX Call Paths by
EOC.Voip.Link L
Jitter
EOC.Voip.Site S1
EOC.Voip.Site S2
EOC.Voip.UdpResultDetail D
EOC.Node N1
EOC.Node N2
EOC.Orion SWServer
EOC.Voip.Link L
Latency
EOC.Voip.Site S1
EOC.Voip.Site S2
1146
EOC.Node N1
EOC.Node N2
EOC.Orion SWServer
EOC.Voip.Link L
MOS
EOC.Voip.Site S1
EOC.Voip.Site S2
EOC.Node N1
EOC.Node N2
EOC.Orion SWServer
EOC.Voip.Link L
Packet Loss
EOC.Voip.Site S1
EOC.Voip.Site S2
EOC.Node N1
EOC.Node N2
EOC.Orion SWServer
Global Top XX VoIP Call Paths EOC.Voip.Link L
EOC.Voip.Site S1
EOC.Voip.Site S2
EOC.Node N
Global VoIP Call Managers EOC.Orion SWServer
EOC.Voip.CCMStatistic C
EOC.Orion SWServer
Global VoIP Collector Services
EOC.Voip.Engine S
1147
EOC.IpSla.Operation L
EOC.IpSla.OperationCurrentStat D
EOC.IpSla.OperationStatus OperationStatus
Global VoIP Sites Overview
EOC.IpSla.Site S
EOC.Node Node
EOC.Orion SWServer
SolarWinds WPM Resources

EOC.SEUM.Agent A
Global All Locations
EOC.Orion O
EOC.SEUM.Transaction T
Global All Transactions
EOC.Orion O
EOC.SEUM.TransactionStep TS
EOC.Orion O
Global Steps With Problems EOC.SEUM.Transaction T
EOC.StatusInfo s
EOC.StatusInfo s2
EOC.SEUM.TransactionStep TS
Global Top XX Steps by Duration
EOC.Orion O
Global Top XX Transactions by

Duration EOC.Orion O
Global Transaction Health
EOC.Orion O
Overview
EOC.StatusInfo S
Global Transactions With
EOC.Orion O
Problems
EOC.StatusInfo S
1148
Summary Report Resources

EOC.Interface I
Global Down Interface EOC.Node Node
EOC.Orion SWServer
EOC.Node Node
Global Down Nodes
EOC.Orion SWServer
Global High Errors & Discards

EOC.Interface I
Today EOC.Node N
EOC.Node Node
Global Node Status by Site EOC.Node.CustomProperty NodeCustomProperty
EOC.Orion SWServer
EOC.Node Node
Global Nodes with High CPU Load
EOC.Orion SWServer
Global Nodes with High Memory

EOC.Node Node
Utilization EOC.Orion SWServer
Global Nodes with High Packet

EOC.Node Node
Loss EOC.Orion SWServer
Global Nodes with High Response

EOC.Node Node
Time EOC.Orion SWServer
EOC.Node Node
Global Top XX Nodes with
Problems
EOC.Orion SWServer
EOC.Node N
Global Volumes with High Percent
EOC.Orion SWServer
usage
EOC.Volume V
SolarWinds Servers Summary

EOC.Orion SWServer
Statistics
1149
SysLog Resources

EOC.Node Node
EOC.Orion SWServer
SysLog Messages from All
EOC.SysLog SysLog
Network Devices
EOC.SysLogFacility SysLogFacility
EOC.SysLogSeverity SysLogSeverity
EOC.Orion SWServer
Syslog Summary
EOC.SysLog SysLog
Trap Resources

Global Trap Resource EOC.Orion SWServer
Global Trap Resource EOC.Trap Trap
EOC.Node Node
EOC.Orion SWServer
Traps from All Network Devices
EOC.Trap Trap
EOC.TrapVarbind TrapVarBind
Wireless Resources

EOC.Node N
Global Wireless Clients EOC.Orion SWServer
EOC.Wireless.Interface WI
EOC.Node N
Top XX Access Points by Number
EOC.Orion SWServer
of Clients
EOC.Wireless.Interface WI
EOC.Node N
Top XX Wireless Clients by Traffic
EOC.Orion SWServer
Rate
EOC.Wireless.Client WC
1150
SWQL filter syntax examples
The following sections detail how to filter in SWQL by using the most frequently requested examples.
Wildcards
The wildcard character in SWQL syntax is: %.
Example: NodesData.Caption Like 'AX3%'
Filter by a custom property
The data types that support custom properties are:
n Interface
n Node
n Volume
Use the SWQL alias for these data types when selecting custom properties for your queries. The property
syntax to filter by custom property is:
alias.CustomProperties.propertyName
Example filter to only show nodes with the custom property City that matches Atlanta:
NodesCustomProperties.CustomProperties.City = 'Atlanta'
Filter by built-in properties
Use the SWQL alias when selecting properties for your queries.
Examples
Example filter to show data from Cisco devices:
NodesData.Vendor = 'Cisco'
Example filter to show data from Windows Server 2003-2008 applications:
Status.Application.Name = 'Windows Server 2003-2008'
Example filter to show data from devices beginning with "AX3":
NodesData.Caption Like 'AX3%'
Example filter to show data from Process Monitor – SNMP type component monitors:
Monitor.ComponentType = 8
Filtering by status
To filter by the status property, you must know the valid status levels.
LEVEL STATUS
0 Unknown
1151
LEVEL STATUS
1 Up
2 Down
3 Warning
14 Critical
Example filter to only show monitors that are not down:
MonitorStatus.Availability<>2
1152
SQL Filter Syntax Examples
The following sections detail how to filter in SQL by using the most frequently requested examples.
Wildcards
The wildcard character in SQL syntax is: *.
Example: NodesData.Caption Like 'AX3*'
Filtering by Custom Property
The property syntax to filter by custom property is:
dataType.CustomProperty.propertyName
Example filter to only show nodes with the custom property City that matches Atlanta:
NodesCustomProperties.CustomProperty.City = 'Atlanta'
Examples
Example filter to show only Cisco devices:
Vendor = 'Cisco'
Example filter to show data only from component monitors named Server Load Monitor:
Monitor.Name like 'Server Load Monitor'
Example filter to show data from devices beginning with "AX3":
NodesData.Caption Like 'AX3*'
Example filter to show only Nortel devices that are Down:
Filtering by Status
To filter by the status property, you must know the valid status levels.
LEVEL STATUS
0 Unknown
1 Up
2 Down
3 Warning
14 Critical
Example filter to only show monitors that are not down:
MonitorStatus.Availability<>2
1153
Variable Modifiers
Variables can be modified by using any of the variable modifiers in the following table.
VARIABLE
MODIFIER DESCRIPTION
-Raw Displays the raw value for the statistic. For example, if Transmit Bandwidth is set to 10
Mbps, then the raw value would be“10000000”. The cooked value would be “10 Mbps”.
-Previous Displays the previous value for the statistic before the Alert was triggered
-Cooked Displays the cooked value for the statistic. For example, if Transmit Bandwidth is set to
10 Mbps, then the raw value would be “10000000” and cooked value would be “10
Mbps”.
- Displays the previous cooked value for the statistic before the Alert was triggered
PreviousCooked
Add modifiers to variables by the following examples below:
${N=context;M=Modifier(macroName)}
${N=Alerting;M=Previous(AcknowledgedBy)}

${Acknowledged} Acknowledged status.
${AcknowledgedBy} Who the alert was acknowledged by.
${AcknowledgedTime} Time the alert was acknowledged.
${AlertTriggerCount} Count of triggers.
Date and time of the last event for this Alert. (Windows control panel defined
${AlertTriggerTime}
“Short Date” and “Short Time”).
${Application} SolarWinds application information.
${CR} Line Feed – Carriage Return.
${Copyright} Copyright information.
${ObjectName} Description/Name of the object in the alert.
${Release} Release information.
${Version} Version of the SolarWinds software package.
1154
Date Time
The following are valid date and time variables.
${N=Generic; M=AMPM} AM/PM indicator
${N=Generic; Current day of the week. Three character abbreviation.

M=AbreviatedDOW}
${N=Generic; M=Day} Current day of the month
${N=Generic; M=Date; F=Date} Current date. (Short Date format)
${N=Generic; M=DateTime; Current date and time. (Windows control panel defined “Long Date”
F=DateTime} and “Long Time” format)
${N=Generic; M=DayOfWeek} Current day of the week.
${N=Generic; M=DayOfYear} Numeric day of the year
${N=Generic; M=Hour} Current hour
${N=Generic; M=HH} Current hour. Two digit format, zero padded.
${N=Generic; M=Past2Hours} Last two hours
${N=Generic; M=Past24Hours} Last 24 hours
${N=Generic; Last seven days (Short Date format)

M=Last7Days;F=Date}
${N=Generic; M=PastHour} Last hour
${N=Generic; M=LocalDOW} Current day of the week. Localized language format.
${N=Generic; Current month name in the local language.

M=LocalMonthName}
${N=Generic; M=LongDate} Current date. (Long Date format)
${N=Generic; M=Month} Current numeric month
${N=Generic; M=MM} Current month. Two digit number, zero padded.
${N=Generic; Current month. Three character abbreviation.

M=AbbreviatedMonth}
${N=Generic; M=MonthName} Full name of the current month
1155
${N=Generic; M=MediumDate} Current date. (Medium Date format)
${N=Generic; M=Minute} Current minute. Two digit format, zero padded.
${N=Generic; M=Second} Current second. Two digit format, zero padded.
${N=Generic; M=Time} Current Time. (Short Time format)
${N=Generic; M=Today; Today (Short Date format)

F=Date}
${N=Generic; M=Year} Four digit year
${N=Generic; M=Year2} Two digit year
${N=Generic; M=Yesterday; Yesterday (Short Date format)

F=Date}
Group Variables
The following are valid group variables.
Group Variable Description
${N=OrionGroup; URL of the Group Details view for a selected group

M=GroupDetailsURL}
${N=OrionGroup; Interval on which group membership is evaluated and group

M=GroupFrequency} snapshots are taken.
${N=OrionGroup; M=GroupID} Designated identifier for a defined group
${N=OrionGroup; Display name of group member type: Node, Volume,

M=GroupMemberDisplayName} Component, Application, etc.
${N=OrionGroup; Display name of multiple group members of a type: Nodes,

M=GroupMemberDisplayNamePlural} Components, Applications, etc.
${N=OrionGroup; Full name of a group member, including location

M=GroupMemberFullName}
${N=OrionGroup; Name of a group member

M=GroupMemberName}
1156
Group Variable Description
${N=OrionGroup; Percent availability of a group member when group member

M=GroupMemberPercentAvailability} status is Up, Warning, or Critical and 0% if status is anything
else.
${N=OrionGroup; Unique identifier of group member snapshot.

M=GroupMemberSnapshotID}
${N=OrionGroup; Identifier assigned to a group member indicating its status. For

M=GroupMemberStatusID} more information see Status Variables.
${N=OrionGroup; Name of group member status. For more information see Status
M=GroupMemberStatusName} Variables.
${N=OrionGroup; Uri used by SolarWinds Information Service (SWIS) to refer to the

M=GroupMemberUri} selected group member within the web console.
${N=OrionGroup; M=GroupName} Name of the group.
${N=OrionGroup; M=GroupOwner} Orion product appropriate to the group type
${N=OrionGroup; 100% when group status is Up, Warning, Critical and 0% if status
M=GroupPercentAvailability} is anything else.
${N=OrionGroup; Name of roll-up logic calculator that evaluates status of group

M=GroupStatusCalculatorID} based on member statuses. (0 = Mixed, 1 = Worst, 2 = Best)
${N=OrionGroup; Name of roll-up logic calculator that evaluates status of group

M=GroupStatusCalculatorName} based on member statuses. (Mixed, Worst, Best)
${N=OrionGroup; M=GroupStatusID} Identifier assigned to a group indicating its status. For more
information see Status Variables.
${N=OrionGroup; M=GroupStatus} Name of group status. For more information see Status
Variables.
${N=OrionGroup; A list of all group members that are not Up

M=GroupStatusRootCause}
SQL Query
Any value you can collect from the database can be generated, formatted, or calculated using a SQL query
as a variable. To use a SQL query as a variable in Orion Platform products, use ${SQL:{query}} as shown
in the following example that returns the results of the SQL query:
Select Count(*) From Nodes:
1157
Note: SolarWinds does not support SQL queries directly. Visit our user forums on thwack for help from our
community.
Status Variables
When using the ${Status} variable with a monitored object, status values are returned, as appropriate.
The following table provides a description for each status value.
STATUS VALUE DESCRIPTION
0 Unknown
1 Up
2 Down
3 Warning
4 Shutdown
5 Testing
6 Dormant
7 Not Present
8 Lower Layer Down
9 Unmanaged
10 Unplugged
11 External
12 Unreachable
14 Critical
15 Mixed Availability
16 Misconfigured
17 Could Not Poll
19 Unconfirmed
22 Active
24 Inactive
25 Expired
1158
STATUS VALUE DESCRIPTION
26 Monitoring Disabled
27 Disabled
28 Not Licensed
Important: As of Orion Platform version 2015.1, SolarWinds alerts use a new variable format. See General
Alert Variables for more information.
Node variables
The following are valid node variables.
Node Variable Description
${N=SwisEntity;M=AgentPort} Node SNMP port number
${N=SwisEntity;M=Node.Allow64BitCounters} Node allows 64-bit counters (1), or not (0)
Average node response time, in msec, to ICMP

${N=SwisEntity;M=AvgResponseTime}
requests
Day, date, and time until which node polling

${N=SwisEntity;M=BlockUntil}
is blocked
Device-dependent count of big buffer misses

${N=SwisEntity;M=BufferBgMissThisHour} on node in current hour, queried with MIB
1.3.6.1.4.9.2.1.30
Device-dependent count of big buffer misses

${N=SwisEntity;M=BufferBgMissToday} on node in current day, queried with MIB
1.3.6.1.4.9.2.1.30
Device-dependent count of huge buffer

${N=SwisEntity;M=BufferHgMissThisHour} misses on node in current hour, queried with
MIB 1.3.6.1.4.9.2.1.62
Device-dependent count of huge buffer

${N=SwisEntity;M=BufferHgMissToday} misses on node in current day, queried with
MIB 1.3.6.1.4.9.2.1.62
Device-dependent count of large buffer

${N=SwisEntity;M=BufferLgMissThisHour} misses on node in current hour, queried with
MIB 1.3.6.1.4.9.2.1.38
Device-dependent count of large buffer

${N=SwisEntity;M=BufferLgMissToday} misses on node in current day, queried with
MIB 1.3.6.1.4.9.2.1.38
1159
Device-dependent count of medium buffer

${N=SwisEntity;M=BufferMdMissThisHour} misses on node in current hour, queried with
MIB 1.3.6.1.4.9.2.1.22
Device-dependent count of medium buffer

${N=SwisEntity;M=BufferMdMissToday} misses on node in current day, queried with
MIB 1.3.6.1.4.9.2.1.22
Count of buffer errors due to low memory on

${N=SwisEntity;M=BufferNoMemThisHour}
node in current hour
Count of buffer errors due to low memory on

${N=SwisEntity;M=BufferNoMemToday}
node in current day
Device-dependent count of small buffer

${N=SwisEntity;M=BufferSmMissThisHour} misses on node in current hour, queried with
MIB 1.3.6.1.4.9.2.1.14
Device-dependent count of small buffer

${N=SwisEntity;M=BufferSmMissToday} misses on node in current day, queried with
MIB 1.3.6.1.4.9.2.1.14
${N=SwisEntity;M=Caption} User friendly node name
${N=SwisEntity;M=Community} Node community string
Contact information for person or group

${N=SwisEntity;M=Contact}
responsible for node
${N=SwisEntity;M=CPULoad} Node CPU utilization rate at last poll
Day, date, and time of last poll attempt on

${N=SwisEntity;M=CustomPollerLastStatisticsPoll}
node
Day, date, and time that node was last

${N=SwisEntity;M=CustomPollerLastStatisticsPollSuccess}
successfully polled
${N=SwisEntity;M=NodeDescription} Node hardware and software
${N=SwisEntity;M=DNS} Fully qualified node name
If node supports dynamic IP address

${N=SwisEntity;M=DynamicIP} assignment via BOOTP or DHCP (1); static IP
address return (0)
Internal unique identifier of the polling

${N=SwisEntity;M=EngineID}
engine to which node is assigned
1160
Filename of status icon for node and, in NPM,

${N=SwisEntity;M=GroupStatus}
its interfaces
${N=SwisEntity;M=IOSImage} Family name of Cisco IOS on node
${N=SwisEntity;M=IOSVersion} Cisco IOS version on node
${N=SwisEntity;M=IP_Address} Node IP address
${N=SwisEntity;M=IPAddressType} Node IP address version (IPv4 or IPv6)
${N=SwisEntity;M=LastBoot} Day, date and time of last node boot
Time and date of last node database and

${N=SwisEntity;M=LastSync}
memory synchronization
${N=SwisEntity;M=Location} Physical location of node
Node manufacturer or distributor and family

${N=SwisEntity;M=MachineType}
or version information
Maximum node response time , in msec, to

${N=SwisEntity;M=MaxResponseTime}
ICMP requests
${N=SwisEntity;M=MemoryUsed} Total node memory used over polling interval
Minimum node response time , in msec, to

${N=SwisEntity;M=Stats.MinResponseTime}
ICMP requests
Day, date and time of next scheduled node

${N=SwisEntity;M=NextPoll}
polling
${N=SwisEntity;M=NextRediscovery} Time of next node rediscovery
${N=SwisEntity;M=NodeID} Internal unique identifier of node
ICMP packet loss percentage when node last

${N=SwisEntity;M=PercentLoss}
polled
Percentage of total node memory used over

${N=SwisEntity;M=PercentMemoryUsed}
polling interval
${N=SwisEntity;M=PollInterval} Node polling interval, in seconds
${N=SwisEntity;M=RediscoveryInterval} Node rediscovery interval, in minutes
Node response time, in milliseconds, to last

${N=SwisEntity;M=ResponseTime}
ICMP request
1161
${N=SwisEntity;M=SNMPv3Credentials. SNMPv3 read/write credential authentication

RWAuthenticationKey} key
${N=SwisEntity;M=SNMPv3Credentials. States if the SNMPv3 read/write credential

RWAuthenticationKeyIsPassword} authentication key is the password
${N=SwisEntity;M=SNMPv3Credentials. SNMPv3 read/write credential authentication

RWAuthenticationMethod} method
${N=SwisEntity;M=SNMPv3Credentials. SNMPv3 read/write security context

RWContext} information
${N=SwisEntity;M=SNMPv3Credentials.
SNMPv3 read/write credential key
RWPrivacyKey}
${N=SwisEntity;M=SNMPv3Credentials. States if the SNMPv3 read/write credential

RWPrivacyKeyIsPassword} privacy key is the password
${N=SwisEntity;M=SNMPv3Credentials. SNMPv3 read/write credential privacy

RWPrivacyMethod} encryption method
${N=SwisEntity;M=SNMPv3Credentials. User friendly name for SNMPv3 read/write

RWUsername} credential
A network health score determined additively

by scoring the status of monitored objects. In
NPM 1 point is provided for an interface in a
warning state, 1000 points for a down
${N=SwisEntity;M=Severity} interface, and 1 million points for a down
node. In SAM, 100 points is provided for an
application in a warning state, 200 points for
an application in critical state, 500 is status is
unknown, and 1000 for a down application.
SNMPv3 authentication key
AuthenticationKey}
${N=SwisEntity;M=SNMPv3Credentials. States if node SNMPv3 authentication key is

AuthenticationKeyIsPassword} password
${N=SwisEntity;M=SNMPv3Credentials. SNMPv3 authentication type
1162
AuthenticationMethod}
${N=SwisEntity;M=SNMPv3Credentials. Group or domain of user with SNMPv3 access

Context} to node
SNMPv3 credential key
PrivacyKey}
${N=SwisEntity;M=SNMPv3Credentials. States if node SNMPv3 credential key is the

PrivacyKeyIsPassword} password
SNMPv3 credential key type
PrivacyMethod}
User friendly name for SNMPv3 credential
Username}
${N=SwisEntity;M=SNMPVersion} States the version of SNMP used by the node
${N=SwisEntity;M=StatCollection} Statistics collection frequency, in minutes
Numerical node status. For more information,

${N=SwisEntity;M=Status;F=Status}
see Status Variables.
${N=SwisEntity;M=StatusDescription} User friendly node status
${N=SwisEntity;M=StatusLED} Filename of node status icon
${N=SwisEntity;M=SysName} String reply to SNMP SYS_NAME OID request
Vendor ID of the network management

${N=SwisEntity;M=SysObjectID} subsystem in OID form. Clearly determines
the type of node.
Time, in hundredths of a second, either since

${N=SwisEntity;M=SystemUpTime} network monitoring started (WMI) or since the
monitored device rebooted (SNMP).
${N=SwisEntity;M=TotalMemory} Total node memory available
${N=SwisEntity;M=UnManaged} States if node is currently unmanaged
Day, date, and time when node is set to

${N=SwisEntity;M=UnManageFrom}
“Unmanaged”
1163
Day, date, and time when node is scheduled

${N=SwisEntity;M=UnManageUntil}
to be managed
${N=SwisEntity;M=Vendor} Node manufacturer or distributor
${N=SwisEntity;M=VendorIcon} Filename of node vendor logo
Volume variables for Network Atlas tooltips

${Caption} User-friendly volume name.
User-friendly volume name including captions of parent node and

${FullName}
interface.
Time and date volume last synchronized in database and memory

${LastSync}
models.
${NodeID} Internal unique identifier of parent node.
Numerical volume status: (0=”Unknown”, 1=”Up”, 2=”Shutdown”,

${Status}
3=”Testing”).
${StatusLED} Filename of volume status icon.
${VolumeAllocationFailuresThisHour} Number of volume allocation errors for this volume in last hour.
Number of volume allocation errors for this volume in current

${VolumeAllocationFailuresToday}
day.
${VolumeDescription} User-friendly volume description.
${VolumeID} Internal unique identifier of volume.
${VolumeIndex} Unique index of volume within the parent node.
${VolumePercentUsed} Percentage of volume currently in use.
${VolumeResponding} (Y) = volume is currently responding to SNMP queries.
${VolumeSize} Size of volume, in bytes.
${VolumeSpaceAvailable} Total space available on volume, in bytes.
${VolumeSpaceUsed} Total space used on volume, in bytes.
Volume type, as reported by hrStorageType OID (Removable

${VolumeType}
Disk/Fixed Disk/Compact Disc/Virtual Memory/RAM/etc).
${VolumeTypeIcon} Filename of icon for volume type.
1164
View monitored objects on maps
Maps in the Orion Web Console can show monitored nodes, interfaces and volumes, SAM applications and
components, and network links.
Open Street Map
Display nodes on maps powered by Open Street Map.
Network Maps
Create customized maps in Network Atlas, including wireless heat maps, and display them in the
Orion Web Console.
Wireless Heat Maps
In the Network Atlas, you can also create wireless heat maps to visualize the signal strength
provided by your wireless access points.
1165
The Worldwide Map
The Worldwide Map resource represents nodes and groups of nodes on a realistic geographical map that
can be displayed on Orion Web Console views. When a map is viewed in the console, you can zoom in and
out, view concise information pop-ups for nodes and groups, and access Node detail pages by double
clicking an object.
Only one Worldwide map can be created, but can be included in as many views as required.
However, the Worldwide Map in each view can have its own title, and you can apply filters to show a
different selection of objects.
Set up the Worldwide map
You can add nodes and groups of nodes to the Worldwide map automatically or manually. If you decide to
add objects automatically, GPS co-ordinates and street address information, held within each node's
Custom Properties, is used to determine each object's location. Objects that do not have this information
can be added manually.
Automatically add objects to the Worldwide map

2. Click Web Console Settings in the Product Specific Settings section.
3. Scroll down to the Worldwide Map Settings settings, and select the Automatic Geolocation check
box.
4. Click Submit.
5. Click Manage World Map in the Node & Group Management section.
If objects have been automatically located they will be displayed on the world map within an hour.
If you try to drag an automatically placed object to another location on the map, a warning
message is displayed to inform you that the object will be treated as a manually placed object
once it is moved.
Manually add objects to the Worldwide map

3. Click Place objects on the map manually, and click on the map where you want to place the node or
group.
4. Select Groups or Nodes from the Show drop-down, and how to display these objects from the Group
by drop-down.
5. Check the required nodes or groups in the Available Objects column.
6. Enter a name for this location in the Name of Location field, if required.
7. Click Place on Map.
If the icon in not displayed in exactly the right place, you can drag-and-drop it into the correct
location, or click Edit Location and amend the Latitude and Longitude coordinates.
1166
Map objects
The icons used on the Worldwide map are shown below:
Single node Click to open this node's details page.
Click to open the Worldwide map, showing a description

A group or nodes at the same location of the nodes within the group in the right column. Click
on a node description to open the node's details page.
Multiple nodes closely located Zoom in to see individual nodes.
Edit a map object

3. Click on the object. The icon will change from blue to orange to show it has been selected. The
location name and Node name are displayed in the right column.
4. To change the object or the name of the location:
a. Select the object on the map to display the column on the right, and click Edit at the top of
the column.
b. To change the object, click X next to the current object for this location, then select a new
object from the Available Objects list.
c. To change the name of the location, replace the text in the Name of location field.
d. Click Save changes.
5. To move the object to a precise location:
a. Click Edit Location.
b. Enter the co-ordinates in the Latitude and Longitude fields.
c. Click Save.
6. Click Submit.
Remove a map object

3. Move the cursor over the object to display pop-up information, and ensure you have the correct
object.
4. Click on the object to select it, and click Remove from map.
5. On the confirmation popup, click Yes, Remove Selection.
1167
Network Atlas Maps
Orion Network Atlas is a powerful tool for creating custom maps and network diagrams. The maps created
in Orion Network Atlas enable users to view a graphical depiction of their network in the Orion Web
Console. You can also use the maps to create network documentation, which can then be printed and
exported as needed.
Map objects may include monitored NPM nodes, interfaces, and volumes; SAM applications and
components; nested maps; and network links. The numerous presentation options for your network maps
include the following:
l A large set of predefined background colors, textures, and images is available for you to use in your
maps. You can also provide your own custom background graphics.
l Real-time weather or natural disaster maps may be projected directly onto your network maps using
linked web graphics as a background.
l The shape, size, color, and style of map links may be customized to illustrate the status or the
relative bandwidth of associated objects.
l Map objects may be presented in a unique set of graphical styles to portray network status.
l Maps may be nested to selectively reveal increasing levels of map detail, and the status of nested
map child objects may be bubbled up to the parent map.
Orion Network Atlas is also fully compatible with all network maps created with Orion Map Maker used
with earlier versions of Orion products. For more information, see the SolarWinds Orion Network Atlas
Administrator Guide.
For information on adding Network maps to your Console views, see Display a Network Atlas map in the
Orion Web Console.
1168
Understand the Credentials Library
You typically need to associate credentials with component monitors to enable them to retrieve application
data. For example, to use a WMI monitor, you must provide valid domain or computer credentials. Or, if
your web server requires credentials, you must provide the appropriate credentials to access the
protected sections of your site.
You can work with credentials by:
n Adding credentials to the Credentials Library for use later. See the section Adding Credentials to the
n Creating credentials on the spot (Quick Credentials) when editing templates and component
monitors. See the section Using Quick Credentials.
n Editing credentials. See the section Editing Credentials in the Credentials Library.
n Deleting credentials. See the section Deleting Credentials from the Credentials Library.
Set up a user account on a SQL server

1. Open Enterprise Manager.
2. In the console tree, double-click Microsoft SQL Servers, click SQL Server Group, and then
SQLComputerName (Windows NT).
3. Double-click Databases, and then double-click your database of choice.
4. Right-click Users, and then click the New Database User menu.
5. Next to Login name, type:
domain\username
6. Next to User name, type your user name.
7. Select the Public check box, and then select all of the following objects:
n db_owner
n db_accessadmin
n db_securityadmin
n db_ddladmin
n db_datareader
n db_datawriter
n db_backupoperator
Important: Do not select db_denydatareader or db_denydatawriter. These objects allow

members to deny Read or Write permissions to data in the database.
For more information, see http://technet.microsoft.com/en-us/library/cc787483%28v=ws.10%29.aspx
Notes:
1169
n SolarWinds Server & Application Monitor uses the same SNMP credentials that you entered during
node discovery. There is no need to specify additional credentials for SNMP operations.
n SolarWinds SAM stores credentials encrypted in the database.
n The ability to Inherit Windows credentials from node is available in the drop down list.
1170
Add credentials to the Credentials Library
1. On the Web Console, click Settings > All Settings > SAM Settings > Credentials
Library > Add New Credential.
2. Provide a name for the credential set. SolarWinds Server & Application Monitor
displays this name in the Credential for Monitoring field of monitors that
accept credentials.
3. Provide the user name and password, and then confirm the password and click
Submit. If you are providing windows credentials for accessing and harvesting
information through WMI, ensure you provide the account name in the
following syntax: domainOrComputerName\user name for domain level
authentication or User Name for workgroup level authentication.
You can assign credentials to all the associated components of a template or

application monitor.
Edit credentials in the Credentials Library
1. From the Credentials Library, click Edit for the desired credential.
2. Modify the information as needed and then click Submit.
Delete credentials from the Credentials Library
1. On the Web Console, click Settings > All Settings > SAM Settings > Credentials
Library.
2. Click Delete for the desired credential.
3. Click OK to confirm the deletion.
1171

Create and assign credentials using Quick Credentials when editing a template or application monitor.
1. If the credential you want to assign does not exist, create it by following these
instructions:
a. Select <New Credential> in the Choose Credential field.
b. Type a name for the new credential in the Credential Name field.
c. Type the user name for the credential in the User Name field.
d. Type the password in the Password field, and type it again in the
Confirm Password field.
2. To assign an existing credential, select the credential from the Choose
Credential field.
3. Click Set Component Credentials to set this credential as the credential for all
the components in the Application Monitor or template.
The ability to Inherit Windows credentials from node is available in the

drop down list. Anywhere you have the option to specify credentials for
an application template or component monitor, you also have the the
option to utilize the existing WMI credentials already used to manage
the host.
1172
Component Monitor Types
The available component monitors are as follows:
n DHCP User Experience Monitor

n Directory Size monitor
n DNS Monitor - TCP
n DNS Monitor - UDP
n DNS User Experience monitor
n Download Speed monitor
n Exchange Web Services User Experience monitor
n File Change monitor
n File Count monitor
n File Existence monitor
n File Size monitor
n FTP monitor
n FTP User Experience monitor
n HTTP Form Login monitor
n HTTP monitor
n HTTPS monitor
n IMAP4 monitor
n IMAP4 User Experience monitor
n JMX monitor
n LDAP User Experience Monitor
n Linux/Unix Script monitor
n MAPI User Experience monitor
n Nagios Script monitor
n NNTP monitor
n ODBC User Experience monitor
n Oracle User Experience monitor
n Performance Counter monitor
n POP3 monitor
n POP3 User Experience Monitor
n Process monitor - SNMP
n Process monitor - WMI
n RADIUS User Experience monitor
n Service Status – SNMP
1173
n SSL Certificate Expiration Date monitor
n SMTP monitor
n SNMP monitor
n SOAP component monitor
n SQL Server User Experience monitor
n TACACS+ User Experience monitor
n TCP Port monitor
n Tomcat Server monitor
n VMware Performance Counter monitor
n Web Link monitor
n Windows Event Log monitor
n Windows PowerShell monitor
n Windows Script monitor
n Windows Service monitor
n WMI monitor
1174
DHCP User Experience Monitor
This component monitor measures how long it takes to get a lease from a DHCP server. The monitor
verifies that the DHCP responds with an IP address, but neither confirms nor accepts the lease.
Statistic
This component monitor does not compute a statistic.
Field Descriptions
Description
description by adding to or replacing the text, which is automatically saved. The variable to access
this field is ${UserDescription}.
Enable Component
Determines whether the component is enabled. Disabling the component leaves it in the application
in a deactivated state not influencing either SolarWinds SAM application availability or status.
UDP Request Port
The UDP port used for the DHCP request. The default value is 67.
UDP Response Port
The UDP port used for the DHCP response. The default value is 68.
Sender Adapter IP Address (optional)
For SolarWinds servers with multiple network adapters configuration, this field specifies which of the
multiple network adapters is used for the DHCP User Experience monitor. If this setting is not
specified, the default (primary) network adapter is used.
Note: This setting does not affect SolarWinds servers with only one network adapter.
DHCP Discovery Request Type
Select the DHCP Discovery Request Type:
Unicast - This is the default DHCP Discovery Request Type. The broadcast flag is not set, the
ciaddr (Client IP Address) is set to the local address, and the giaddr (Relay Agent IP Address) is
not set. The DHCP client sends a unicast DHCP DISCOVER to the DHCP server IP address and
the UDP Request Port (defaults to 67). The DHCP server then sends a unicast DHCP Offer to the
ciaddr address and the UDP Response Port (defaults to 68).
This option can be used to monitor DHCP servers on the same subnet as the SolarWinds SAM
server or on a different subnet.
1175
Broadcast - The broadcast flag is set, the ciaddr (Client IP Address) is set to the local address,
and the giaddr (Relay Agent IP Address) is not set. The DHCP client sends a unicast DHCP
DISCOVER to the DHCP server IP address and the UDP Request Port (defaults to 67). The DHCP
server then sends a broadcast DHCP Offer to the UDP Response Port (defaults to 68).
server
Relay Agent - The broadcast flag is not set, the ciaddr (Client IP Address) is set to the local
address, and the giaddr (Relay Agent IP Address) is set to the local address. The DHCP client
sends a unicast DHCP DISCOVER to the DHCP server IP address and the UDP Request Port
(defaults to 67). The DHCP server then sends a unicast DHCP Offer to the giaddr (Relay Agent IP
Address) and the UDP Request Port (defaults to 67).
server or on a different subnet.
Note: You can use the Broadcast or Relay Agent DHCP discovery request type to handle the
issue with some DHCP servers (for example Internet Systems Consortium DHCP Server) that do
not send a DHCP Offer back to the SolarWinds SAM Server IP address. They send it to the newly
leased IP address (the IP address being offered) instead. To handle this issue, set the DHCP
Discovery Request Type to either Broadcast or Relay Agent.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the response time. The
response time is the time in milliseconds it takes SolarWinds SAM to determine that a component is
not Down and to retrieve any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the response time. The response
time is the time in milliseconds it takes SolarWinds SAM to determine that a component is not Down
and to retrieve any statistical data.
User Notes
${UserNotes}.
1176
Directory Size monitor
This component monitor determines the disk space used by the files in a directory, optionally including all
subdirectories. Files that do not match the File Extensions Filter are not included in the disk space
calculation.
It may be difficult to monitor the size of a folder containing hundreds or thousands of files, because
the monitor timeout duration may lapse before the target computer can finish computing the file
sizes and sending the response.
Statistic
The disk space used in bytes.
Field Descriptions
Description
Enable Component
Select a credential that has read access to the file. If the credential you need is not already present
in the credentials list, use the Quick Credentials section to add a new credential.
Full directory Path
The path to the monitored directory. Specify the path in Universal Naming Convention (UNC) format.
For example: \\computername\c$\logfiles\. The path can include the variable ${IP} , which represents
the target node's IP address.
File Extensions Filter
Determines which file extensions are included in the disk space usage calculations for the directory
size. It is a text matching filter, and * is a wildcard.
Include Subdirectories
Determines whether the contents of sub-directories are included in the disk space usage
calculations for the directory size.
Convert Value
Checking the Convert Value check box opens the Formula box. From here, you have the ability
1177
to manipulate the returned value with a variety of mathematical possibilities. You can choose
common functions from the drop down lists to manipulate the returned value, or you can
select the Custom Conversion option. For more information, see Conversion Value.
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning level has been breached.
Logical operators are in the drop down followed by a blank field for you to enter the value of this
threshold. For example: Less than 15.
Statistic Critical Threshold
This field allows you to specify when a threshold that indicates a critical level has been breached.
User Notes
${UserNotes}.
1178
DNS Monitor - TCP
This component monitor tests a DNS server's ability to respond to a record query and measures its
response time. The record query is an A Name lookup for a.root-servers.net. The component monitor
passes if it receives a valid DNS response (positive or negative).
Statistic
Field Descriptions
Description
Enable Component
Port Number
The TCP port used for DNS queries. The default value is 53.
User Notes
${UserNotes}.
1179
DNS User Experience monitor
This component monitor tests a DNS server's ability to respond to a record query, compares the query
response against a list of IP addresses, and measures the response time. The component monitor passes if
the DNS response matches the expected IP addresses.
The DNS Monitor measures the time it takes the DNS “get" for the record query referenced in the
component monitor to load. This response time is measured in milliseconds.
Statistic
Field Descriptions
Description
Enable Component
Port Number
The port used for DNS queries. The default value is 53.
Protocol
The protocol to use for the DNS query.
Name (IP Address) To Resolve
The fully-qualified domain name (FQDN) or IP address to use for the DNS query. If you specify an IP
address, the query result should be a FQDN. If you specify a FQDN, the query result should be one or
more IP addresses.
Expected DNS Query Results
The IP addresses or FQDN you expect to result from the DNS query. Type each entry on a new line. If
you do not care about the DNS query result, you can type the asterisk (*) as a wildcard character that
successfully matches any DNS query result.
Expect All Matches
Specifies that the result of the DNS query must include all expected entries to be considered a
successful test. If this check box is not checked, a single match indicates a successful test.
1180
User Notes
${UserNotes}. For more information, see "Configuring SolarWinds SAM Alerts"
1181
DNS Monitor - UDP
This component monitor tests a DNS server's ability to respond to a record query and measures its
response time. The component monitor passes if it receives a valid DNS response (positive or negative)
within the response time threshold. UDP is the primary method of communication for DNS servers.
Statistic
Description
Port Number
The UDP port used for DNS queries. The default value is 53.
User Notes
${UserNotes}.
1182
Download Speed monitor
This component monitor measures the time it takes to download data from the target node, and reports
the speed in KB/s (1024 bytes per second). The target node must be running a Character Generator
service.
Statistic
The statistic for this component monitor is the download speed in KB/s (1024 bytes per
second).
Field Descriptions
Description
Enable Component
Port Number
The port used for the character generator service. The default value is 19.
Download Sample Size (kb)
The amount of data in kilobytes (kb) you want to download from the node for testing the download
speed.
Convert Value
select the Custom Conversion option.
1183
User Notes
${UserNotes}.
1184
Exchange Web Services User Experience monitor
This component monitor simulates an email round trip to test the ability of your SMTP server to receive
and distribute email, and the ability of your users to retrieve email through Exchange Web Services.
Credentials: Credentials used for this monitor should be the user for whom the mailbox will be
monitored.
If you receive a server error while browsing Exchange Web Services, refer to the following Microsoft
KB article located at: http://support.microsoft.com/kb/2020789
Field Descriptions
Description
Enable Component
in a deactivated state, not influencing SolarWinds SAM application availability or status.
If the credential you need is not already present in the credentials list, use the Quick Credentials
section to add a new credential.
This credential must be the email address of the account which is to be simulated and
not the credentials of the Windows computer. (Name, ovacha (@), domain). For example:
Username@domain.com. (Credentials used for this monitor should be the user for
whom the mailbox will be monitored.)
Send Email From
Enter the email address where you want an email to be sent from
Send Email To
Enter the email address where you want an email to be sent to
Exchange Web Service URL
This field allows you to specify the URL of your Exchange Web Server.
Ignore CA Errors
Allows to choose whether or not to ignore Certificate Authority errors.
Ignore CN Errors
Allows to choose whether or not to ignore Common Name errors.
1185
SMTP Server
Enter your SMTP server address here.
SMTP Port
Enter your SMTP port number here.
Use Credentials for SMTP
Check this box if needed.
Credential for SMTP
If needed, select the proper credentials from the drop down list.
SMTP Encryption
Choose the method of encryption from the drop down list.
Response Time Threshold
Select the conditions from the drop down lists for the Warning and Critical thresholds, then set the
time, in seconds, for these conditions to be met.
User Notes
${UserNotes}.
1186
File Age Monitor
This component monitor determines when a file was last modified. The statistic is the number of elapsed
hours since the file modification date.
This component monitor uses TCP/445 and UDP/445 ports.
Statistic
The number of elapsed hours since the file modification date.
Field Descriptions
Description
Enable Component
in a deactivated state not influencing SolarWinds SAM application availability or status.
File Path
This field is the path to the monitored file, including the file name. Specify the path in Universal
Naming Convention (UNC) format. For example: \\computername\c$\logfile\errors.log.
The path can include the variable ${IP} which represents the target node's IP address.
Convert Value
1187
User Notes
${UserNotes}.
1188
File Count monitor
This component monitor counts the number of files in a directory, optionally including its subdirectories.
Files that do not match the file extension or file attribute type are ignored.
This monitor may fail if you attempt to count more than 20,000 files in a directory using the wildcard *
filter extension. To get an accurate count of the files in such large directories, you must instead create a
Windows Script monitor that runs the File Count script located in the script examples folder C:\Program
Files\SolarWinds\Orion\APM\SampleScriptMonitors\WindowsScripts.
Statistic
The number of files in the directory that match the file extensions filter.
Field Descriptions
Description
Enable Component
Full Directory Path
This field is the path to the directory. Specify the path in Universal Naming Convention (UNC) format.
For example: \\computername\c$\. The path can include the variable ${IP} which represents the
target node's IP address. There is a limit of 260 characters for this field.
File Extensions Filter
Specifies which files to include in the count based on the file extension. You can specify multiple file
extensions separated by commas or spaces. To include all files, specify *.
Example for counting all files regardless of file extension

File Extensions Filter:*Example for counting files with .exe, .dll, and .bat extensions
File Extensions Filter: exe, dll, bat
File Attributes Filter
Specifies which files to include in the count based on the file attributes. The default value is All Files.
1189
Include Subdirectories
Specifies the file count should also include files located inside subdirectories
Convert Value
User Notes
${UserNotes}.
1190
File Existence monitor
This component monitor tests if a file exists at the given file path and uses ports TCP/445 and UDP/445 .
Statistic
Field Descriptions
Description
Enable Component
File Path
Naming Convention (UNC) format. For example: \\computername\c$\logfile\errors.log. The path can
include the variable ${IP} which represents the target node's IP address.
File Exist Setting
This field specifies whether the component monitor should test for whether the file must exist file or
must not exist.
User Notes
${UserNotes}.
1191
File Change monitor
This component monitor tests if a file has been modified and then reports the time in hours since the file
was modified as a statistic. The component monitor performs an MD5 checksum comparison on the file to
verify it was not modified. If SolarWinds SAM detects the monitored file was modified, the component
monitor will remain in a Down state until you recalculate the checksum.
Statistic
The number of elapsed hours since the file was modified.
Field Descriptions
Description
Enable Component
File Path
Convert Value
Current Snapshot Checksum
This field is the calculated checksum against which SolarWinds SAM is comparing the monitored file.
To calculate a new checksum, click Update Checksum.
1192
Select and upload a file for snapshot creation
This field is the local path to a file on the user's computer (where the web browser is running) used
to calculate the checksum against which the monitored file is compared. Click Browse to open a
Windows Choose File dialog from which you can select the file directly. Click Update Checksum to
calculate the new checksum.
User Notes
${UserNotes}.
1193
File Size monitor
This component monitor measures the size of a file at the given file path and then reports the file size in
bytes as a statistic.
This monitor cannot monitor files larger than 2 gigabytes in size.
Statistic
The statistic for the component monitor is the file size in bytes.
Field Descriptions
Description
Enable Component
File Path
Convert Value
1194
User Notes
${UserNotes}.
1195
FTP User Experience monitor
This component monitor tests the ability of an FTP server to accept an incoming session, process the user
login, and then transmit the specified file to the SolarWinds SAM server. After receiving the file,
SolarWinds SAM performs a file integrity test comparing the SHA1 checksum of the downloaded file
against a previously generated checksum. If the checksums match, the component monitor reports its
status as Up.
The FTP Monitor measures the time it takes the FTP “get” for the reference in the component monitor to
load. This response time is measured in milliseconds.
Configure the FTP User Experience Monitor and generate a snapshot checksum
1. Provide a credential that can log on to the FTP server.

2. If the FTP server is on a different port than the default port of 21, change the value in the Port
Number field.
3. Upload a file named test.txt to the FTP server. The contents of the file do not matter.
4. Change the Url field to match the path of the test.txt file you uploaded to the FTP server.
5. Copy the same test.txt file to a local directory on the SolarWinds SAM server.
6. Click Browse next to the Select and upload a file for snapshot creation field, navigate to and select
the local test.txt file, and then click Open.
7. Click Update Checksum to create a snapshot checksum of the local test.txt file.
8. Click Test.
9. If the test fails, correct the problem described in the error message and try again.
You must use the Update Checksum command to create a new snapshot checksum each time you
update or modify the test.txt file on the FTP server.
Statistic
Field Descriptions
Description
Enable Component
1196
Select a credential that can log on to the FTP server. For example, to monitor an anonymous FTP
server, select or add a credential containing anonymous as the user name and your email address
as the password. If the credential you need is not already present in the credentials list, use the
Quick Credentials section to add a new credential.
Port Number
This field is the port number used for FTP sessions. The default value is 21.
Url
Allows you to specify the URL of the file you want to monitor. The URL can include the variable ${IP}
which represents the target node's IP address, and the variable ${PORT} which represents the value
in the Port Number field.
Use Proxy
This check box allows you to use a web proxy to access the web site.
Proxy Address
This field allows you to specify the address of a web proxy to access the web site.
Passive Mode
This check box allows you to monitor the file using passive mode FTP. This mode is typically used to
circumvent a firewall that would otherwise filter the incoming connection to the SolarWinds SAM
server.
Current Snapshot Checksum
This field is the calculated checksum against which SolarWinds SAM is comparing the monitored file.
To calculate a new checksum, click Update Checksum.
Select and upload a file for snapshot creation
This field is the local path to a file on the SolarWinds SAM server that is used to calculate the
checksum against which the monitored file is compared. Click Browse to open a Windows Choose
File dialog from which you can select the file directly. Click Update Checksum to calculate the new
checksum.
1197
User Notes
${UserNotes}.
1198
FTP monitor
This component monitor tests the ability of an FTP server to accept incoming sessions and respond with
the correct codes.
Statistic
Field Descriptions
Description
Enable Component
Port Number
This field is the port number used for FTP sessions. The default value is 21.
User Notes
${UserNotes}.
1199
HTTP Form Login monitor
This component monitor tests the ability of a web server to serve web pages secured behind a forms-
based login page. The test is performed by using the credential as the user name and password for the
login form, retrieving the page behind the login form, and then searching the retrieved page for keywords
that indicate either a successful or a failed login attempt.
The HTTP Form Login Monitor does not work on any login screens that are pop up.
Statistic
Troubleshooting
For most form-based login pages, this component monitor functions without any
customizations. But, some form-based login pages use unconventional HTML form tag names
or form input tag names, and you need to assist the component monitor in identifying the
names of these tags before the component monitor can function correctly.
This monitor does not work if the login control is located within an IFRAME HTML
control.
If the component monitor cannot match the tag names in the login page against the list of
expected keywords, you must add the actual tag name to the keywords list. SolarWinds SAM
assists you with this by displaying an error status message if the component monitor is in a fail
state: the error message lists all the form and form input names found in the HTML page,
allowing you to identify the correct name so that you can type it in the appropriate Keywords
field.
For example, consider the following HTML snippet with tags defining a form and some form
inputs:
<form name="login_form" method="post" action="Login.aspx"><p>Status

(optional): <input name="status" type="text" /></p><p>Username: <input
name="nick" type="text" /></p><p>Password: <input name ="pswd"
type="password" /></p><input type="submit" value="Submit" /></form>
In the example code, the actual login input tag name is "nick,” but testing the component
monitor results in an error similar to the following:
Response page matches login error keywords Page contains 1 form(s).

Form 'login_form' inputs: ( 'cust_id' 'nick' 'pswd' ); Assumed form
with name = login_form as login form Assumed login input: name =
status, password input: name = pswd
The error status message informs you that the component monitor incorrectly assumed the
input tag with the name "status" was the login input. Recognizing this error, you correct it by
adding the correct tag name "nick" to the list of keywords in the Login Control Keywords field:
1200
(login)|(name)|(email)|(nick)
Field Descriptions
Description
Enable Component
Select a credential that can log on to the web site. If the credential you need is not already present in
the credentials list, use the Quick Credentials section to add a new credential.
Port Number
This field is the port number used for HTTP forms-based login sessions. The default value is 80.
Url
Allows you to specify the URL you want to monitor. The SolarWinds SAM variable ${IP} contained in
the default value for this field attempts to monitor a web site at the IP address of the assigned node.
Host Header
Enter the address of the host header. For example, www.solarwinds.com.
Use Proxy
Proxy Address
Ignore CA Errors
If checked, this indicates that Certificate Authorization (CA) errors will be ignored.
Ignore CN Errors
If checked, this indicates that Common Name (CN) errors will be ignored.
Accept Compression
If checked, indicates that compression is supported.
1201
Login Form Keywords
This field lists the expected keywords that identify an HTML login form. The keywords are matched
against the name attribute of the <form> tags found in the HTML of the login page. Each keyword in
this list must be enclosed in parentheses '( )', and then separated from other keywords by a vertical
bar '|'. The default keywords are: (login)|(auth)|(email).
Login Control Keywords
This field lists the expected keywords that identify the form's user name input element. The
keywords are matched against the name attribute of the <input> tags found in the HTML of the login
page. Each keyword in this list must be enclosed in parentheses '( )', and then separated from other
keywords by a vertical bar '|'. The default keywords are (login)|(name)|(email).
Password Control Keywords
This field lists the expected keywords that identify the form's password input element. The keywords
are matched against the name attribute of the <input> tags found in the HTML of the login page.
Each keyword in this list must be enclosed in parentheses '( )', and then separated from other
keywords by a vertical bar '|'. The default keywords are (password)|(pwd)|(passwd)|(psswd)|(pswd).
Login Failed Regular Expression
This field contains the regular expression for matching an unsuccessful login. This expression may
appear anywhere in the HTML source of the page.
Login Success Keywords
This field contains the regular expression for matching a successful login. This expression may
appear anywhere in the HTML source of the page.
User Notes
${UserNotes}.
1202
HTTP monitor
This component monitor tests a web server's ability to accept incoming sessions and transmit the
requested page. The component monitor can optionally search the delivered page for specific text strings
and pass or fail the test based on that search.
The HTTP Monitor measures the time it takes the HTTP “get” for the page referenced in the component
monitor to load. This response time is measured in milliseconds.
If a web page redirects to another page, the response time measures the entire time from the
original request until the last redirected page is loaded.
This monitor supports the following additional macros:
n ${Node.SysName}
n ${Node.Caption}
n ${Node.DNS}
n ${Node.ID}
Statistic
Field Descriptions
Description
Enable Component
If the web site is password-protected, select a credential that can access the web site. If the
credential you need is not already present in the credentials list, use the Quick Credentials section
to add a new credential.
If the web site is not password protected, do not specify a credential.
Port Number
The port used for the web site. The default value is 80.
1203
Url
This field allows you to specify the URL you want to monitor. The SolarWinds SAM variables
contained in the default value for this field attempt to monitor a web site at the IP address of the
assigned node ${IP} and on the port specified in the Port Number field ${PORT} .
Proxy Servers: To prevent proxy servers from caching the monitored URL, you can append a unique
query string to the URL with the ${TimeStamp} variable.
Example "cache buster" for simple URL: http://${IP}:${Port}/?_cb=${TimeStamp}
Example "cache buster" for URL with existing query string:

http://${IP}:${Port}/?page.aspx?var=value&_cb=${TimeStamp}
Host Header
Host Request
Enter the type of content. For example, POST.
Content Type:
Enter the type of content. For example, application/json.
Request Body:
Enter the type of content. For example:
{
"firstname": "Kate"
"lastname": "Asaff"
"age" : 29
"city" : "Austin"
}
Follow Redirect
This allows you to specify the component monitor to automatically follow server-side redirects.
Use Proxy
Proxy Address
1204
User Agent
This field allows you to emulate a specific user agent or browser type when contacting the web site.
For example, to emulate Internet Explorer version 7, type Mozilla/4.0 (compatible; MSIE 7.0b;
Windows NT 6.0). For more information about user agent strings, see
http://www.useragentstring.com
Search String
This field contains the text string indicating successful page retrieval. If the specified string is found
in the web page content, the monitor is considered up.
Note: The search string is not case-sensitive.
Fail if Found
This check box allows you to reverse the default behavior of the search string. If the search string is
found in the web page content, the monitor is considered down instead of up.
Head Request
This field allows you to ensure the web site responds to the HTTP protocol, but without checking the
validity of the web page content. Search strings are ignored if you select this option.
Accept Compression
User Notes
${UserNotes}.
1205
HTTPS monitor
This component monitor tests a web server's ability to accept incoming sessions over a secure channel and
then transmit the requested page. The component monitor can also test the security certificate.
The HTTPS Monitor measures the time it takes the HTTPS “get” for the page referenced in the component
monitor to load. This response time is measured in milliseconds.
If a web page redirects to another page, the response time measures the entire time from the
original request until the last redirected page is loaded.
This monitor supports the following additional macros:
n ${Node.SysName}
n ${Node.Caption}
n ${Node.DNS}
n ${Node.ID}
Statistic
Field Descriptions
Description
Enable Component
If the web site is password-protected, select a credential that can access the web site. If the
Port Number
The port used by the web site. The default value is 443.
1206
Url
This field allows you to specify the URL you want to monitor. The SolarWinds SAM variables
contained in the default value for this field attempt to monitor a web site at the IP address of the
assigned node ${IP} and on the port specified in the Port Number field ${PORT} .
Proxy Servers: To prevent proxy servers from caching the monitored URL, you can append a unique
query string to the URL with the ${TimeStamp} variable.
Example "cache buster" for simple URL: http://${IP}:${Port}/?_cb=${TimeStamp}
Example "cache buster" for URL with existing query string:

http://${IP}:${Port}/?page.aspx?var=value&_cb=${TimeStamp}
Host Header
Host Request
Enter the type of content. For example, POST.
Content Type:
Enter the type of content. For example, application/json.
Request Body:
Enter the type of content. For example:
{
"firstname": "Kate"
"lastname": "Asaff"
"age" : 29
"city" : "Austin"
}
Follow Redirect
This allows you to specify the component monitor to automatically follow server-side redirects.
Use Proxy
Proxy Address
Certificate Subject
This is used for selecting a private key when client authentication is used.
1207
This field allows you to specify the X.509 certificate subject (DN). Use spaces ( ) or commas (,) to
separate the different subject fields. Semicolons, commas with spaces after them, and newline or
carriage returns are not acceptable separators.
It allows you to select a certificate from Current User > Personal certificate store using its
subject. The subject must equal the exact format to find the certificate using .NET.
For example: To find a specific certificate, you need to use the following format:
CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE
Ignore CA Errors
This check box allows you to specify the component monitor to ignore the certificate authority (CA).
Ignore CN Errors
This check box allows you to specify the component monitor to ignore the certificate name (CN).
User Agent
This field allows you to emulate a specific user agent or browser type when contacting the web site.
For example, to emulate Internet Explorer version 7, type Mozilla/4.0 (compatible; MSIE 7.0b;
Windows NT 6.0). For more information about user agent strings, see
http://www.useragentstring.com
Search String
This field contains the text string indicating successful page retrieval. If the specified string is found
in the web page content, the monitor is considered up.
Note: The search string is not case-sensitive.
Fail if Found
This check box allows you to reverse the default behavior of the search string. If the search string is
found in the web page content, the monitor is considered down instead of up.
Head Request
This check box allows you to ensure the web site responds to the HTTPS protocol, but without
checking the validity of the web page content. Search strings are ignored if you select this option.
Accept Compression
1208
User Notes
${UserNotes}.
1209
IMAP4 monitor
This component monitor tests the ability of an IMAP4 server to accept incoming connections and respond
with the correct code.
Statistic
Field Descriptions
Description
Enable Component
Port Number
This field is the port number used for IMAP4 sessions. The default value is 143.
User Notes
${UserNotes}.
1210
IMAP4 User Experience monitor
This component monitor tests an email round trip from your SMTP mail server to your IMAP4 server and
measures the time it takes to complete the trip. This response time is measured in milliseconds.
This component monitor uses the following ports when used with a Microsoft Exchange mail server:
n 143 and 993 - IMAP4

n 25 - SMTP
Statistic
Field Descriptions
Description
Enable Component
Select a credential that can retrieve email from an IMAP4 server. If the credential you need is not
Credentials used for this monitor should be the user for whom the mailbox will be monitored.
Send Email From
This field allows you to specify the From address of the test email message.
Send Email To
This field allows you to specify the recipient of the test email message. The recipient should have a
mailbox on the IMAP4 server you are monitoring.
IMAP4 Port
This field is the port number used for IMAP 4 sessions. The default value is 143. For Secure IMAP
(IMAP4-SSL), use port 585. For IMAP4 over SSL (IMAPS), use port 993.
IMAP4 Encryption
This list allows you to select an encryption protocol to connect to IMAP4 servers that support SSL or
TLS encryption.
1211
SMTP Server
This field allows you to specify the SMTP server that sends the test email message.
SMTP Port
This field is the port number used for SMTP sessions. The default value is 25.
This check box allows you to use the user name and password from Credentials for Monitoring to
connect to SMTP servers that support or require authentication.
SMTP Encryption
This list allows you to select an encryption protocol to connect to SMTP servers that support SSL or
TLS encryption.
User Notes
${UserNotes}.
1212
JMX monitor
This template tests the overall performance of a Java Application Server
Prerequisites: The JMX connector must be enabled on the Java application server.
Credentials: You may need either JMX credentials or none at all. This depends on the credentials
required based on the configuration of your Java application server.
Polling via the JMX Component Monitor is not supported using an agent.
Field Descriptions
Description
Component Type
Enable Component
This allows you to set JMX credentials for querying MBeans. If the credential you need is not already
present in the credentials list, use the Quick Credentials section to add a new credential.
Port Number
This field allows you to specify the port number used for JMX connections.
Protocol
This field allows you to choose between using Remote Method Invocation (RMI) and Invocation over
Internet Inter-Orb Protocol (IIOP). Note: RMI should be correctly referred to as RMI/JRMP and IIOP as
RMI/IIOP based on JMX Specifications.
URL Path
This field is for the last part of the JMX service URL. This follows hostname:portnumber and
begins with a slash. For example:
service:jmx:rmi:///jndi/rmi://HostName:portnumber/jmxrmi
Object Name
This field is for the unique string identifier of an MBean in the form of <domain-name>:<key
property>.
1213
Attribute Name
This field is for the name of an MBean attribute.
Key
This is used for monitoring composite attributes, which consist of key:value pairs. Note: SAM
only supports monitoring of numerical data type attributes.
Count Statistic as Difference
Changes the statistic to be the difference in query values between polling cycles.
Convert Value
User Notes
${UserNotes}.
1214
LDAP User Experience Monitor
This component monitor tests the capabilities of a Lightweight Directory Access Protocol (LDAP) server, and
measures the time it takes to perform an LDAP query.
Statistic
The number of entries returned by the LDAP query.
Field Descriptions
Description
Enable Component
Select a credential that has administrator access to the LDAP server. If the credential you need is not
Port Number
The port used for LDAP connections. The default value is 389. For LDAP over SSL, use port 636.
Encryption Method
Specifies an encryption method for the LDAP connection. The default setting is None.
Authentication Method
Specifies the authentication method for the LDAP connection. The default setting is Simple.
Realm (user domain)
Specifies the realm to use for LDAP authentication.
LDAP Search Root
Specifies the LDAP root or suffix to use for the search.
LDAP Filter
Specifies the search parameters of the LDAP query. The default LDAP Filter value is (&
(objectClass=Person)(cn=someuser)), and it searches for all entries that have objectClass=Person and
cn=someuser.
1215
Convert Value
threshold.
threshold.
User Notes
${UserNotes}.
1216
Linux/Unix Script monitor
This component monitor uses SSH to upload a script to a Linux/Unix server, runs the script on the server,
and then processes the return value and text output.
Statistic
The statistic for this component monitor is the Statistic value returned by the script.
Field Descriptions
Description
Enable Component
Authentication Type
Choose either User name and Password or User name and Private Key. The second option allows you
to use certificates for authentication.
Select a credential that can access the Linux or Unix server over SSH, and that has sufficient rights to
run scripts. If the credential you need is not already present in the credentials list, use the Quick
Credentials section to add a new credential.
Port Number
This field allows you to specify the port number used for the SSH connection. The default value for
this field is 22.
1217
Command Line
This field allows you to specify the shell command run after the SSH connection is established. The
default command line value perl ${SCRIPT} arg1 arg2 attempts to run in a Perl interpreter the script
defined in the Script Body field using the parameters arg1 arg2.
Note: The length of the Command Line field is limited to 266 characters for Solaris systems,
minus the length of the ${SCRIPT} variable after being resolved to a file name such as the
following: APM_937467589.pl. Since the length of the file name will typically be around 16
characters, this means that the actual user Command Line input cannot be longer than 266 –
16, or about 250 characters (not including the length of the 9 characters for the “${SCRIPT} ”
variable itself).
If you need to pass a longer command line to the target node, you can create a shell script on
the target node (for example myscript.sh) that contains the long command line, and place the
call to this script in the Command Line field, for example: /opt/sw/myscript.sh
Script Body
This field allows you to specify the script you want to run on the Linux or Unix server.
User Notes
${UserNotes}.
1218
MAPI User Experience monitor
This component monitor sends an email from your SMTP mail server to your Microsoft Exchange Server
Mailbox and measures the time it takes to complete the trip. You can use this component monitor to
monitor the performance of Outlook. This response time is measured in milliseconds.
The Exchange Server computer uses port 135 for client connections to the RPC endpoint mapper service.
After a client connects to a socket, the Exchange Server computer allocates the client two random ports to
use to communicate with the directory and the information store.
For a complete list of network ports used by Microsoft Server Products, refer to the following article:
http://technet.microsoft.com/en-us/library/cc875824.aspx
Install the MAPI Client on Your SolarWinds SAM Server
This component monitor requires you to install the Microsoft Exchange Server MAPI Client and
Collaboration Data Objects on your SolarWinds SAM server. You can download the MAPI Client from: The
Microsoft Download Center. http://www.microsoft.com/downloads/details.aspx?FamilyID=E17E7F31-079A-
43A9-BFF2-0A110307611E
Statistic
This component monitor does not compute a statistic. The response time is the difference
between the time SolarWinds SAM sends the email and the time it is received by the recipient.
Notes:
1. This component monitor waits for the email to arrive based on the default job timeout of 20 minutes.
If the email does not arrive within this period, SolarWinds SAM marks the monitor as down.
2. The monitor goes through the following steps with respect to the mail flow:
a. Sends an email to the user mailbox via SMTP. The email has a unique temporary subject
name that starts with APM_prefix.
b. Connects to the user mailbox through MAPI, then searches the emails by Subject.
c. If it does not find the email it is looking for, it waits and then searches again. It stops when: it
finds the email, the timeout is reached, or the maximum number of attempts is reached.
d. Once it finds the email, the monitor deletes it from the user inbox.
e. The monitor collects the total round trip time for the email and compares it with the
thresholds set.
f. Once it knows the round trip time, status is given according to where it falls with regard to
the thresholds set.
If the email is not found within the timeout or the maximum number of attempts, or SMTP or
MAPI reported an error, SolarWinds SAM marks the monitor as Down.
3. Emails the monitor sends are deleted from user inboxes, but only if the monitor successfully
connected via MAPI. If the SMTP call succeeded, but MAPI failed, the email remains in the user inbox.
4. It is not currently possible to use the monitor without SMTP and send the email from the same
server the monitor is running on via MAPI.
1219
Field Descriptions
Description
Enable Component
Select a credential that is both a user who can log on to the SolarWinds SAM server, and that has an
Exchange account on the MAPI server. If the credential you need is not already present in the
credentials list, use the Quick Credentials section to add a new credential. Credentials used for this
monitor should be the user for whom the mailbox will be monitored.
Send Email From
Send Email To
mailbox on the MAPI server you are monitoring.
MAPI Profile Name
Allows you to specify the name of the MAPI profile
SMTP Server
SMTP Port
SMTP Encryption
TLS encryption.
1220
User Notes
${UserNotes}.
1221
Nagios Script monitor
This component uses SSH to upload a Nagios script to a Linux/Unix server, runs the Nagios script on the
server and then processes the script's exit code and text output. This monitor has the ability to return
multiple values.
excess output pairs or they are ignored.
Field Descriptions
Description
Component Type
Enable Component
has sufficient rights on the target node to do whatever the script needs to do. For example, if the
script does something with WMI, the credentials also need WMI rights on the target node. If the
Port Number
This field allows you to specify the port number used for the SSH connection. The default value is 22.
Check Type
This determines how the return code is evaluated.
Return Code Service State Host State
0 OK Up
1 Warning Up or Down/Unreachable†
1222
2 Critical Down/Unreachable
3 Unknown Down/Unreachable
_______________________
† If the Use Aggressive Host Checking option is enabled, return codes of 1 result in a host state
of DOWN, otherwise return codes of 1 will result in a host state of UP.
Command Line
This field is in the script editing window and allows you to specify the script you want to run on the
target node followed by the arguments. To enter your script, click the Edit button that reveals the
script editing window. For more information, see http://nagios.sourceforge.net/docs/3_
0/pluginapi.html.
Body
Status Roll-Up
This option allows you to choose how you would like the monitor to report based on the output
provided by the script. The default selection is “Show worst status.”
User Notes
${UserNotes}.
1223
NNTP monitor
This component monitor tests the ability of an NNTP server to accept incoming connections and respond
Statistic
Field Descriptions
Description
Enable Component
Port Number
This field is the port number used for NNTP connections. The default value is 119.
User Notes
${UserNotes}.
1224
ODBC User Experience monitor
This component monitor uses synthetic transactions to test the abilities of an ODBC-accessible database
such as MySQL. The component monitor connects to the database, performs a query, and then retrieves
the data. ODBC drivers for your database type must be installed on the SolarWinds SAM server.
The SQL statement you use for this query must return a numerical value, not a varchar.
This monitor has the ability to capture message text in the first row, second column of SQL query
results. This string value is shown in the Messages field of the component monitor.
Statistic
The statistic for this component monitor is the first row and column of the data retrieved by
the query. It must be a numerical value.
Install ODBC Drivers on the SolarWinds SAM Server.
You must install on the SolarWinds SAM server the ODBC drivers for your database. For more
information on acquiring or installing the ODBC drivers, consult your database documentation.
Note: In some situations, monitors derived from this ODBC component can fail because the bit
mode setting (x32/x64) is set incorrectly. This can happen to database servers that only install
x64 drivers on a x64, making this monitor inaccessible in x32 mode.
TCP Ports
This component monitor uses port TCP/1630. Oracle Connection Manager provides the
listening port for Oracle client connections to Oracle Connection Manager. You can configure
Oracle Connection Manager either through a custom installation, or configure it after
installation using Net Configuration Assistant.
Field Descriptions
Description
Enable Component
Select a database credential that can access the database. If the credential you need is not already
1225
Connection String
This field allows you to specify the ODBC connection string for the database. If you do not know the
connection string to your ODBC-accessible database, you can look it up on
http://www.connectionstrings.com. The connection string may include the variables ${IP}, ${USER},
and ${PASSWORD}, which are replaced respectively by the IP address of the database server, the
credential user name, and the credential password.
If you are using the ODBC User Experience Monitor instead of the SQL Server User Experience
monitor for a SQL Server database that is not using the default port 1433, perform the following to
create a connection string.
To create the SQL Server connection string:
1. Using notepad, create an empty .udl file.

2. Double-click the .udl file to open the Data Link Properties dialog. Click Next to navigate from tab to
tab and configure and test your ODBC connection.
Note: Remember to select the desired database provider on the Provider tab, in this case the
provider for SQL Server.
3. If the option is present for the provider, check the “allow saving password” option, as this will ensure
that the connection string contains the password when you next retrieve it.
4. When you are finished, and have tested that the connection works, click OK.
5. Open the .udl file again in Notepad, and retrieve the connection string.
For additional information about creating and configuring Universal Data Link (.udl) Files, refer to
the MSDN article.
Sql Query
This field allows you to specify the SQL query used to test the database. The retrieved data is then
used as the component monitor statistic. You may enter up to 4,000 characters.
Query Timeout
The amount of time, in seconds, until the SQL query will timeout.
Convert Value
1226
User Notes
${UserNotes}.
1227
Oracle User Experience monitor
This component monitor uses synthetic transactions to test the abilities of an Oracle database. The
component monitor connects to the database, performs a query, and then retrieves the data. Oracle Net
Services from the Oracle Client must be installed on the SolarWinds SAM server.
This monitor has the ability to capture message text in the first row, second column of SQL query
results. This string value is shown in the Messages field of the component monitor.
Statistic
Install Oracle Client on the SolarWinds SAM Server.
This component monitor requires you to install the Oracle Net Services from the Oracle Client
on your SolarWinds SAM server. You can download the Oracle Client from:
n The SolarWinds customer portal "Additional Components" section.

http://www.solarwinds.com/customerportal/
n The Oracle Database Software Downloads web site.
http://www.oracle.com/technology/software/products/database/index.html
Note: For information about using this monitor without the ODBC connection, see the
following SolarWinds knowledgebase article:
http://knowledgebase.solarwinds.com/kb/questions/2067/
TCP Ports
This component monitor uses ports TCP/1521 and TCP/1526. The Oracle SQL*Net Listener
allows Oracle client connections to the database over Oracle's SQL*Net protocol. You can
configure it during installation. To reconfigure this port, use Net Configuration Assistant.
Field Descriptions
Description
Enable Component
1228
Select a database credential that can access the database. If the credential you need is not already
Port Number
This field allows you to specify the port number used to communicate with the Oracle database. The
default value for this field is 1521.
SQL Query
used as the component monitor statistic. You may enter up to 4000 characters.
Destination Point Type
This option tells SolarWinds SAM whether you are accessing the database by its Oracle System ID
(SID) or by its service name.
SID:
Select this to access the database by its System ID.
Service_Name:
Select this to access the database by its service name. Though we call this option 'net service
name', do not enter the net service name.
Destination Point Name
This field allows you to specify either the service name or the SID to access the Oracle database over
a network. Do not enter the net service name. To determine the name or SID of the database, refer to
the tnsnames.ora Oracle configuration file or ask your database administrator.
Example of a service name as a destination point name
Destination Point Name: sales.us.example.com

Destination Point Type: SERVICE_NAME
tnsnames.ora:
ORA11 = (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL =
TCP)(HOST = 127.0.0.1)(PORT = 1521)) ) (CONNECT_DATA = (SERVICE_
NAME = sales.us.example.com) ))
Example of a SID as a destination point name
Destination Point Name: ORA11DATABASE

Destination Point Type: SID
tnsnames.ora:
ORA11 = (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL =
TCP)(HOST = 127.0.0.1)(PORT = 1521)) ) (CONNECT_DATA = (SID =
1229
ORA11DATABASE) ))
Oracle Driver Type
Allows you to select the driver from the drop down list.
Convert Value
User Notes
${UserNotes}.
Scenario:
SAM requires two additional components in order to monitor Oracle databases:
n Oracle's Instant Client

n SolarWinds Oracle Plug-in.
The steps below should result in a successfully tested and monitored database.
1230
1. The first item to install is the Oracle Instant Client Basic. (In this scenario, we also install
the Instant Client ODBC and SQLPlus packages).
n Download the version specific to your architecture:

n http://www.oracle.com/technetwork/database/features/instant-client/index-
097480.html
n Instant Client Package - Basic (the core Instant Client).
n Instant Client Package - ODBC (ODBC functionality, requires additional
configuration).
n Instant Client Package - SQLPlus (SQLPlus functionality).
2. Create the directory where the products will be stored. (i.e.: c:\Oracle)
3. Unzip the files into the created directory and preserve the path. ( i.e.: Instantclient_11_2).
4. Modify your path to reference the directory that the Instant Client files were extracted to:
n Path: Add c:\oracle\instantclient_11_2

n Tns_Admin: Create if necessary, c:\oracle\instantclient_11_2
5. Log out to ensure Windows identifies the variables you defined.
6. Create a TNSNAMES.ora file and save it in to c:\oracle\instantclient_11_2. (Note: An
example of TNSNAMES.ora can be found at: http://www.orafaq.com/wiki/Tnsnames.ora)
7. Install the SolarWinds Oracle Plug-in
a. Log in to the SolarWinds Customer Portal

b. Click on Additional Components
c. Click on Download Server & Application Monitor Components
d. Click on the Oracle Client
e. Run and install the OracleClientInstaller.exe file
Log in to SolarWinds and browse to the SAM Monitor
n Each application item was set up using a SERVICE_NAME point type, with the database name as the
Destination Port Name.
n The User ID to be used for this test cannot be limited or restricted, otherwise it will return errors.
n Test each component monitor.
1231
Performance Counter monitor
This component monitor reads Windows Performance Counter data using Remote Procedure Calls (RPC)
instead of Windows Management Instrumentation (WMI). All performance counters are assumed to exist
within the root/CIMV2 namespace.
This monitor uses RPC, requiring the following ports:
TCP/135; RPC/named pipes (NP) TCP 139, RPC/NP TCP 445, RPC/NP UDP 137, RPC/NP UDP 138
Statistic
The statistic for this component monitor is the performance counter value.
Optionally, the statistic may be set as the difference in query values between polling cycles by
checking the option for Count statistic as difference.
Note: The Count Statistic as Difference option is applicable only for monitors whose counter
value increases consistently during each polling interval. Examples of when this option is not
applicable include cases such as the following:
n Counter values sometimes increase and sometimes decrease from one polling interval to
another (typical behavior for many counters)
n Counter values consistently decrease from one polling interval to another
n In these cases where the option is not applicable, negative statistic data values are
replaced with zero (0), and the counter monitor shows 0 as the statistic data value in
resources and 0 as the value on statistic data charts for this interval.
Field Descriptions
Description
Component Type
Identifies the component type as a Performance Counter Monitor.
Enable Component
Select a Windows credential that has RPC access to the target node. This is typically a Windows
administrator-level credential.
Count statistic as difference
This option changes the statistic to be the difference in counter values between polling cycles.
1232
Counter
Enter the name of the performance counter. For example: % Processor Time.
Instance
Enter the instance name of the performance counter. For example: _Total.
If the performance counter has multiple instances, you can monitor each instance separately by
creating a Performance Counter Monitor for each instance. For example, the performance counter
% Processor Time has two instances if you have a dual-CPU system: 0 for the first CPU and 1 for the
second CPU. You can create a separate Performance Counter Monitor to monitor each instance of the
counter.
Category
Enter the category of the performance counter. All performance counters are assumed to exist
within the root/CIMV2 namespace. For example: Processor.
Convert Value
User Notes
${UserNotes}.
1233
POP3 monitor
This component monitor tests the ability of a POP3 server to accept incoming connections and respond
This component monitor uses the following ports when used with a Microsoft Exchange mail server:
n 102 X.400 MTA

n 110 POP3
n 119 NNTP
n 143 IMAP4
n 389 LDAP
n 563 POP3 over SSL.
n 636 LDAP over SSL.
n 993 IMAP4 over SSL.
n 995 POP3 over SSL.
Statistic
Field Descriptions
Description
Enable Component
Port Number
This field is the port number used for POP3 connections. The default value is 110. For Secure POP3
(SSL-POP) use port 995.
1234
User Notes
${UserNotes}.
1235
POP3 User Experience Monitor
This component monitor tests an email round trip from your SMTP mail server to your POP3 mail server
and measures the time it takes to complete the trip. This response time is measured in milliseconds.
Statistic
Field Descriptions:
Description
Enable Component
Select a credential that has sufficient access rights to retrieve email from the POP3 server. If the
to add a new credential. Credentials used for this monitor should be the user for whom the mailbox
is monitored.
Send Email From
Send Email To
mailbox on the POP3 server you are monitoring.
POP3 Port
This field is the port number used for POP3 sessions. The default value is 110. For Secure POP3 (SSL-
POP) use port 995.
POP3 Encryption
This list allows you to select an encryption protocol to connect to POP3 servers that support SSL or
TLS encryption.
SMTP Server
1236
SMTP Port
SMTP Encryption
TLS encryption.
User Notes
${UserNotes}.
1237
Process monitor - SNMP
This component monitor uses SNMP communication to test if a specified process is running, and reports
the CPU and physical memory used by all instances of the process.
Statistic
Field Descriptions
Description
Enable Component
Command Line Filter
This optional field allows you to select which instances of a process you want to monitor, based on
the command line arguments of the process. This is a text match, and partial matches are also valid.
Example to monitor only instances launched with –myOption=NorthAmerica

Command Line Filter:–myOption=NorthAmerica
Example to monitor any instances launched with America in any argument

Command Line Filter:America
Process Name
This field allows you to specify the process name you want to monitor. If you do not know the process
name, SolarWinds SAM can help you find processes to monitor.
CPU Threshold
These fields allow you to set warning and critical threshold conditions based on the percentage of
CPU resources in use by the monitored process.
Physical Memory Threshold
These fields allow you to set warning and critical threshold conditions based on the amount of
physical memory in use by the monitored process.
User Notes
${UserNotes}.
1238
Process monitor - WMI
This component monitor uses WMI or RPC communication to test if a specified Windows process is
running, and reports the CPU, virtual memory, and physical memory used by all instances of the process.
The WMI Process Monitor retrieves two samples (after 5 seconds) from the Win32_PerfRawData_PerfProc_
Process class (PercentProcessorTime and TimeStamp_Sys100NS properties). It then calculates the CPU
usage from these two samples.
Statistic
Field Descriptions
Description
Enable Component
Select a Windows credential that has WMI rights on the target node. This is typically a Windows
administrator-level credential. If the credential you need is not already present in the credentials
list, use the Quick Credentials section to add a new credential.
Fetching Method
Select the Fetching Method (Communication Type):
n WMI (Windows Management Instrumentation) - Use WMI communication to test if the

specified Windows process is running.
n RPC (Remote Procedure Call) - Use RPC communication to test if the specified Windows
process is running.
Command Line Filter
This optional field allows you to select which instances of a process you want to monitor, based on
the command line arguments of the process. This is a text match and partial matches are also valid.
Example to monitor only instances launched with –myOption=NorthAmerica

Command Line Filter:–myOption=NorthAmerica
Example to monitor any instances launched with America in any argument

Command Line Filter:America
1239
Process Name
This field allows you to specify the process name you want to monitor. If you do not know the process
name, SolarWinds SAM can help you find processes to monitor using the Component Monitor Wizard
wizard.
CPU Threshold
Virtual Memory Threshold
virtual memory in use by the monitored process.
User Notes
${UserNotes}.
1240
RADIUS User Experience monitor
This component monitor uses synthetic transactions to test user authentication through the RADIUS
protocol. The synthetic transaction does the following:
1. Connect to server.

2. Send RADIUS credential and shared secret.
3. Validate response.
4. Measure response time.
This component monitor will not work using an agent as the polling method.
Statistic
Field Descriptions
Description
Enable Component
Select a RADIUS credential or create one in the Quick Credentials section.
Authentication Port Number
This field is the RADIUS protocol authentication port. The default value is 1812. Cisco devices may
require port 1645.
Accounting Port Number
This field is the RADIUS protocol accounting port. The default value is 1813. Cisco devices may
require port 1646.
Secret Key
This field is the RADIUS protocol shared key.
These fields allow you to set warning and critical threshold conditions based on the response time.
The response time is the time in milliseconds it takes SolarWinds SAM to determine that a
component is not Down and to retrieve any statistical data.
1241
User Notes
${UserNotes}.
1242
Service Status – SNMP
This component monitor tests and reports the status of a service using SNMP. Service statuses are:
1. Running
2. Continue Pending
3. Pause Pending
4. Paused
Statistic
The statistic for this component monitor is the value for one of the reported statuses: 1-4.
Field Descriptions
Description
Enable Component
Net Service Display Name
This field is the Display name of the service to monitor. You can find the Display name on Windows
systems by clicking Start > Administrative Tools > Services and then locating the desired service. The
Display name for the service is the value in the Name column.
User Notes
${UserNotes}.
1243
SMTP monitor
This component monitor tests the ability of an SMTP server to accept incoming connections and respond
Statistic
Field Descriptions
Description
Enable Component
Port Number
This field is the port number used for SMTP connections. The default value is 25. For Secure SMTP
(SSMTP), use port 465.
This field allows you to set the Warning threshold conditions based on the response time. The
User Notes
${UserNotes}.
1244
SNMP monitor
This component monitor uses the SNMP protocol to retrieve an entry in a Management Information Base
(MIB) by its Object Identifier (OID), and returns the value of the entry as a statistic.
Statistic
Value of the entry retrieved from the MIB.
Field Descriptions
Description
Component Type
Describes how the component monitor works.
Enable Component
Method Type
Get - A manager-to-agent request to retrieve the value of a variable or list of variables. Desired
variables are specified in variable bindings (values are not used). Retrieval of the specified variable
values is to be done as an atomic operation by the agent. A Response with current values is
returned.
Get Next - A manager-to-agent request to discover available variables and their values. Returns a
Response with variable binding for the lexicographically next variable in the MIB. The entire MIB of
an agent can be walked by iterative application of GetNextRequest starting at OID 0. Rows of a table
can be read by specifying column OIDs in the variable bindings of the request.
Object Identifier (OID)
Specify the OID of the entry in the MIB you want to retrieve.
Custom SNMP port (set to 0 to use default SNMP port)
This field is the port number of the custom SNMP port. Set this field to 0 to use the default SNMP
port defined in the Node’s properties.
Convert Value
1245
User Notes
${UserNotes}.
1246
SOAP component monitor
SOAP is a communication system that delivers and receives messages and instructions.
Currently, the SOAP monitor within SAM can only detect the presence of a string and return a status
of either Up or Down.
Field Descriptions
Description
Component Type
Enable Component
Select the credentials needed for monitoring this component.
SOAP XML Request
You can either choose to load XML from a WSDL file or manually enter the XML. If you choose to
manually enter the SOAP XML request, you must populate the following fields:
Manually entering the SOAP XML request displays the following fields
n Web Service Server URL: The http(s) address of web server. For example:
https://localhost:17778/SolarWinds/v3/OrionBasic
n SOAP Action: Indicates the intent of the SOAP HTTP request. For example:
http://schemas.solarwinds.com/2007/08/informationservice/QueryXml
n SOAP Version: Select either 1.1 or 1.2 from the drop down list.
n SOAP XML: This is the XML envelope.
Loading the SOAP XML from a WSDL displays the following fields once the WSDL is
successfully loaded:
n Web Service Server URL:The http(s) address of web server. For example:
https://localhost:17778/SolarWinds/v3/OrionBasic
n Binding: Displays the type of binding detected in the WSDL.
n Service Name: Displays the service name detected in the WSDL.
n Method Name: Displays the method name detected in the WSDL.
1247
n Query: This is a dynamically generated field for Simple and Complex method
parameters where you can input values that you can include as part of the SOAP
message. (May not be present depending upon the type of argument used.)
n Parameters: This is a dynamically generated field for Simple and Complex method
parameters where you can input values that you can include as part of the SOAP
message. (May not be present depending upon the type of argument used.)
n Method Name Space: The unique identifier for the method. This definitional
information is extracted from the WSDL file.
n Schema Name Space: The unique identifier for the schema. This definitional
n SOAP Action: The unique name for the method itself. This definitional information is
extracted from the WSDL file.
n SOAP Version: Displays the SOAP version detected in the WSDL. This definitional
n SOAP XML: Content for this field is dynamically generated by changing the other SOAP
settings. This field serves for reviewing the envelope. Advanced users can edit the
content in this field.
For more information, see SOAP Monitor.
HTTP User Agent
This identifies the client that is making the request. For example, Google Chrome identifies
itself as “Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/32.0.1667.0 Safari/537.36” Some web services may behave differently based on the
user agent.
HTTP Content Type
Indicates the format of the content of the message. With SOAP, this can either be
application/soap+xml or text/xml.
Accept Compression
Indicates to the server whether or not the client supports compression of the data.
Certificate Subject
The subject of the certificate to match against.
Ignore CA Errors
Decide whether or not to ignore any errors verifying the Certificate Authority. This can occur if
the certificate is self-signed or if the certificate was not installed correctly on the server.
Ignore CN Errors
Ignore Common Name error. This occurs when the Common Name of the certificate does not
1248
match the name of the server that is in the URL.
Use Proxy
This option allows you to tell the monitor whether or not it is going through a proxy connection.
Proxy Address
Enter the address for the proxy connection, if enabled.
Search String
Allows you to enter a string to test for its presence.
Fail if Found
Select either Yes or No to determine if this monitor reports a status of Fail if the string is found.
Select and enter appropriate thresholds for Warning and Critical statuses.
User Notes
${UserNotes}.
1249
SQL Server User Experience monitor
This component monitor uses synthetic transactions to test the abilities of a Microsoft SQL Server
database. The component monitor connects to the database, performs a query, and then retrieves the
data.
This monitor has the ability to capture message text in the first row, second column of SQL query results. This string value
is shown in the Messages field of the component monitor.
Statistic
Field Descriptions
Description
Enable Component
Port Number
Select the Default Port or a Static Port from the drop down menu. If a static port is chosen, only
values between 1 and 65535 are acceptable. Typically, port 1433 is used for this monitor.
Select a Windows credential or SQL Server credential that can access the database. If the credential
you need is not already present in the credentials list, use the Quick Credentials section to add a
new credential.
Sql Query
used as the component monitor statistic. You may enter up to 4000 characters.
SQL Server Instance
This field allows you to specify the SQL Server instance required to access the SQL Server database.
Enter only the instance name. Do not prefix the instance name with the server name. To access the
default instance, leave this field blank.
1250
Initial Catalog
This field allows you to specify the initial database (catalog) for the connection.
Use Windows Authentication first, then SQL authentication
Select this check box to access a SQL Server that supports or requires Windows Authentication, and
specifies that the credential is a Windows credential instead of a SQL Server credential.
Query Timeout
Allows you to specify when this query should timeout in seconds. The default timeout period is 30
seconds.
Convert Value
User Notes
${UserNotes}.
1251
SSL Certificate Expiration Date monitor
This component monitor tests a web server's ability to accept incoming sessions over a secure channel and
then test the security certificate's expiration date.
This monitor does not currently support proxies.
Field Descriptions
Description
Enable Component
Port Number
The default value for this port is 443.
Convert Value
1252
User Notes
${UserNotes}.
1253
TACACS+ User Experience monitor
This component monitor uses synthetic transactions to test user authentication through the TACACS+
protocol. The synthetic transaction does the following:
1. Connect to server.

2. Send TACACS+ credential and shared secret.
3. Validate response.
4. Measure response time.
Statistic
Field Descriptions
Description
Enable Component
Select a TACACS+ credential or create one in the Quick Credentials section.
Port Number
This field is the TACACS+ protocol connection port. The default value is 49.
Secret Key
This field is the TACACS+ protocol shared key.
1254
User Notes
${UserNotes}.
1255
TCP Port monitor
This component monitor tests the ability of a TCP/IP-based service to accept incoming sessions. The
Monitor tries to establish a socket connection using the Connect method of System.Net.Sockets.TcpClient
class in the .NET framework. The elapsed time for a connection is saved as Response Time in the result.
More information can be found at http://msdn.microsoft.com/en-us/library/8s2yca91.aspx).
Statistic
Field Descriptions
Description
Enable Component
Port Number
This field is the TCP protocol connection port. The default value is 80.
User Notes
${UserNotes}.
1256
Tomcat Server monitor
This component monitor collects server resource information from Apache Tomcat servers by retrieving
status information from http://{$IP}:{$PORT}/manager/status/?XML=true.
Statistic
One of the following Tomcat variables as specified in the Tomcat Variables Name field.
Free Memory
Amount of heap space currently available to the Java Virtual Machine.
Total Memory
Total memory currently allocated to the Java Virtual Machine heap space.
Max Memory
Maximum size of the heap space not including the permanent generation area.
Total Processing Time
Total processing time in milliseconds since server start.
Total Request Count
Total requests from server since server start.
Total Bytes Sent
Total bytes sent from server since server start.
Total Bytes Received
Total bytes sent to server since server start.
Total Error Count
Total error count from all request processors.
Field Descriptions
Description
Enable Component
1257
Select a credential that can access the password-protected portion of the web site. If the credential
new credential.
Port Number
This field allows you to specify the port number used by the web site. The default value for this field
is 8080.
Url
Allows you to specify the URL you want to monitor. The SolarWinds SAM variables ${IP} and ${PORT}
contained in the default value for this field attempts to monitor a web site at the IP address of the
assigned node.
Tomcat Variables Name
Specifies the Tomcat server variable to monitor.
Convert Value
1258
User Notes
${UserNotes}.
1259
VMware Performance Counter monitor
The VMware Performance Counter monitor reads VMware performance counter data using the VMware
vSphere Web Services API.
The currently used vSphere Web Services API version is 4.0, which supports vSphere 4.0 servers and also is
compatible with previous releases of ESX/ESXi and VirtualCenter Server, including the following:
n ESX/ESXi 3.5.x or later

n VirtualCenter Server 2.5 and VirtualCenter Server 2.0.x.
n The vSphere Web Services SDK package includes WSDL files for vSphere API 4.0, which is a superset
of API versions starting with API 2.5, and for VI API 2.0.
Statistic
The statistic for this component monitor is the value of the performance counter data retrieved
by the VMware API.
Optionally, the statistic may be set as the difference in retrieved values between polling cycles
by checking the option for Count statistic as difference.
Note: The Count statistic as difference option is applicable only for monitors whose counter
In these cases where the option is not applicable, negative statistic data values will be
replaced with zero (0), and the counter monitor will show 0 as the statistic data value in
Field Description
Description
Component Type
Identifies the component type as a VMware Performance Counter Monitor.
Enable Component
1260
Select a VMware credential that can access the VMware API. This is typically a vCenter/ESX Server
Note: Read-Only credentials are sufficient since VMware objects are accessed solely in read-only
mode.
Port Number
Port number to use for VMware API. The default is 443.
Url
URL to use for connecting to the VMware API.
Entity Type
Select one of the following:
Cluster Compute Resource
(Only applicable if you are monitoring VirtualCenter Server) – Data object that
aggregates the computation resources of its associated Host System objects into
one single computation resource for use by virtual machines. The cluster services
such as HA (High Availability), DRS (Distributed Resource Scheduling), and EVC
(Enhanced vMotion Compatibility), enhance the usefulness of this single
computation resource. This Entity Type is specific to vCenter systems.
Host System – Managed object type that provides access to a virtualization host platform.
l Resource Pool – Represents a set of physical resources which may be a single host, a subset of a
host's resources, or resources spanning multiple hosts. You can subdivide Resource pools by
creating child resource pools. In order to run, a virtual machine must be associated as a child of a
resource pool. In a parent/child hierarchy of resource pools and virtual machines, the root resource
pool is the single resource pool that has no parent pool.
l Virtual Machine – Managed object type for manipulating virtual machines, including templates that
can be repeatedly deployed as new virtual machines. This object type provides methods for
configuring and controlling a virtual machine.
Entity Name
Specifies the VMware entity name to monitor, for example VirtualMachine1. For VMs, you can view
these values using the VMware console.
1261
This field may contain the special ${VMWARE_ENTITY_NAME} variable. When the monitor runs, this
variable will be resolved to the first available entity on a target host with the desired Entity Type (for
example, the first Host System).
Group
Specifies the VMware group to which the counter belongs, for example: CPU, memory, and so forth.
Counter
Specifies the VMware counter to fetch, for example: coreUtilization, and so forth.
Note: Click Component Monitor Wizard on the SAM Settings page to browse the counters available
for monitoring, including their groups, rollup types, and instance names. Then select one of the
following component monitor types, depending on what you want to monitor:
n VMware ESX Performance Counter Monitor – monitors performance counters for ESX
servers
n VMware vCenter Performance Counter Monitor – monitors performance counters for
vCenter servers
Rollup Type
Specifies the way to roll up the VMware counter data, for example: average, latest, summation, and
so forth.
Instance
Specifies the instance to be fetched, for example: 0, 1, 2, and so forth.
Convert Value
User Notes
${UserNotes}.
1262
Web Link monitor
This component monitor collects the number of broken or invalid links on a web page.
Prerequisites: None
Credentials: None
Statistic
The number of broken or invalid links collected.
Field Descriptions
Description
Enable Component
Select a credential that can access the password-protected portion of the web site. If the credential
new credential.
Url
Allows you to specify the URL you want to monitor. The SolarWinds SAM variable ${IP} contained in
the default value for this field attempts to monitor a web site at the IP address of the assigned node.
Accept Compression
Exclusion Filter
Allows you to create an exclusion filter if there are links the component monitor should not attempt
to validate. It is a text matching filter.
Example that excludes any links to .png graphics files

Exclusion Filter: png
Ignore External Links
This option excludes external links from validation. External links are links that do not link back to
the same second-level domain as the original URL.
1263
Convert Value
User Notes
${UserNotes}.
1264
Windows Event Log monitor
This component monitor can use both WMI and RPC communication to scan Windows Event Logs for recent
events matching your defined criteria. Events are considered recent based on the age of the event as
compared to the application polling frequency. If a matching event is found, the component monitor
changes status.
The component monitor eventually returns to its original status as time passes so you may not notice a
matching event unless you create an alert to email you when the component goes down.
This component monitor uses the following ports:
n TCP/135; RPC/named pipes (NP) TCP 139, RPC/NP TCP 445, RPC/NP UDP 137, RPC/NP UDP 138
Statistic
The number of recent events matching your defined criteria.
Field Descriptions
Description
Enable Component
Select a Windows credential that has access to the Windows event logs on the target node. This is
typically a Windows administrator-level credential. If the credential you need is not already present
Fetching Method
Select either WMI or RPC.

Note: RPC uses significantly more bandwidth than WMI.
Log to Monitor
Select Any Log to match events found in any log or select a specific log to restrict your search. If the
log you want is not listed, select Custom.
Custom Log to Monitor
Enter the log names as they appear in the Windows event log viewer. Separate multiple log
names with commas. Example: Internet Explorer, SolarWinds.net
1265
Match Definition
Select Any error in log generates a match if that is sufficient for your needs, or select Custom to
further restrict the match criteria.
Log Source
Enter a log source to further restrict the match criteria or leave the field blank to match all
possible log sources.
Event ID
Select the desired option to further restrict the match criteria for event IDs or leave the field
blank to find all possible event IDs:
n Find all IDs – match all event IDs

n Match only specific IDs – match all event IDs listed (separate multiple IDs with commas)
Note: When you use multiple event IDs separated by commas, the logic used to combine these event
IDs is “OR,” so all events that contain one of the event IDs listed are matched.
n Exclude specific IDs – exclude all event IDs listed (separate multiple IDs with commas)
Event Type
Select Any Event to match any event type in the log, or select a specific event type to further
restrict the match criteria.
User who generated Events
Enter a user name to further restrict the match criteria. Leave this field blank to match any
users. Enter "N/A" to select only events with no specific user.
Include events
Select With Keywords Below to specify keywords or phrases as the match criteria. Select
Matching Regular Expression Below to specify regular expressions that match text that
appears in the events. For information about the regular expressions syntax, see .”NET
Framework Regular Expressions,” http://msdn.microsoft.com/en-
us/library/hs600312%28VS.80%29.aspx.
Exclude events
Select With Keywords Below to specify keywords or phrases as the match criteria. Select
Matching Regular Expression Below to specify regular expressions that match text that
appears in the events. For information about the regular expressions syntax, see .”NET
Framework Regular Expressions,” http://msdn.microsoft.com/en-
us/library/hs600312%28VS.80%29.aspx.
Number of past polling intervals to search for events:
Enter the number of polling intervals worth of time you want to search the event logs. For
example, to always search the past 20 minutes of event logs, you could set the application
1266
polling interval to five minutes and then set the Number of Past Polling Intervals to four (4 x
5mins = 20mins). Fractional values are valid.
Collect Detailed Data of Matched Events
Message and other details of matched events will be available for viewing and alerting when
enabled.
If a match is found in a polling period, component is:
Select whether a found match should set the component status to Up or Down. You can also take
action using the Based on Event Types, or Based on Event Count options.
l Based on Event Types: With this option, the result status of the component monitor will never be
down for a successful poll:
o Critical (When there is at least one event with a severity of Error or FailureAudit.)
o Warning (When there is at least one event with a severity of Warning.)
o Up (When all matched events are either Informational or SuccessAudit.)
l Based on Event Count: With this option, the status of the component monitor will never be down for
a successful poll and the thresholds for the returned value will be applied against the number of
matched events.
Convert Value
User Notes
${UserNotes}.
1267
Windows PowerShell monitor
This component monitor runs a Windows PowerShell script on the SolarWinds SAM server or a remote
target node and then processes the script's exit code and text output.
The Windows PowerShell Monitor requires Windows PowerShell 2.0. It does not work with Windows
PowerShell 1.0.
If you are having trouble using the Windows PowerShell Monitor, see the following KB article for some
useful tips:
https://support.solarwinds.com/success_center/Server_%26_Application_Monitor_(SAM)/Problems_using_
the_Orion_APM_Windows_PowerShell_Monitor
Statistic
The statistic for this component monitor is the Statistic value returned by the script.
Field Descriptions
Description
Enable Component
The PowerShell monitor handles requests from PowerShell for the credentials to run the script and
resolves them using the selected Credential for Monitoring. However some PowerShell commands
used in scripts require the use of the ${CREDENTIAL} variable. See the note in the Script Body
section below regarding the use of the ${CREDENTIAL} variable.
Execution Mode
This field allows you to specify where to run the PowerShell script:
1268
Run the script under specified account
Select this option to enable impersonation with the component's credentials. (This works only
in local script execution mode.)
n Local Host can run scripts only locally, that is, on the SolarWinds SAM server. This is the
default value.
n Remote Host can execute scripts remotely (on the selected target node) using the
Windows Remote Management (WRM) system component. WRM should be configured
separately to get it working with the Windows PowerShell monitor.
n If Remote Host is selected, the following options are available:
n Use HTTPS Protocol - if checked, specifies that the secure HTTPS protocol should be
used to send and receive WS-Management protocol requests and responses. Otherwise
the HTTP protocol is used.
n URL Prefix - specifies a URL prefix on which to accept HTTP or HTTPS requests. The
default is wsman.
n Port Number - specifies the TCP port for which this listener is created. For WinRM 1.1
and earlier, the default HTTP port is 80. For WinRM 2.0, the default HTTP port is 5985.
Script Body
This field allows you to specify the PowerShell script you want to run.
Use the ${CREDENTIAL} variable in the script where the credentials are required, as shown in the
following example:
$avg = Get-WmiObject win32_process -ComputerName '${IP}' -Credential '${CREDENTIAL}'

| Where-Object {$_.Name -eq "lsass.exe" } | Measure-Object -property ReadOperationCount -
Average;
Some PowerShell commands (such as Get-WmiObject as shown in the example above) require the
use of this ${CREDENTIAL} variable. Therefore, the user name from the specified Credential for
Monitoring is stored automatically in the ${CREDENTIAL} variable for you by the monitor. As a result,
the ${CREDENTIAL} variable should not be placed in the Script Arguments field, since it is set
automatically. When the script is run by PowerShell, since no password has been provided, it
prompts for a password and the password from the specified Credential for Monitoring is provided
automatically by the monitor.
Custom Properties can be passed by using the following format: ${Node.Custom.XXX} where xxx
is the name of the custom property.
1269
Script Arguments
This field allows you to specify arguments to pass to the script. You may include the variable ${IP},
which is replaced by the IP address of the target node.
User Notes
${UserNotes}.
1270
Windows Script monitor
This component monitor runs a Windows script on the SolarWinds SAM server and then processes the
script's exit code and text output. Beginning in version 4.2, this monitor has the ability to return up to ten
pairs, i.e.: 10 statistic values + 10 [optional] messages.
Statistic
The statistic for this component monitor is the value returned by the script.
Field Descriptions
Description
Component Type
Enable Component
Script Engine
This field allows you to specify the scripting language to be used. The default value is vbscript. Below
is a list of scripting engines that the Windows Script Host supports:
Name File Extensions Availability
VBScript .vbs Installed by default
JScript .js Installed by default
PerlScript .pls Freeware
1271
ooRexxScript .rxs Freeware
PythonScript .pys Freeware
TclScript .tcls Freeware
ActivePHPScript .phps Freeware
RubyScript .rbs Freeware
Object Rexx engine Commercial
Delphi scripting engine Commercial
Script
This field allows you to enter the script you want to run on the target node. To enter your script, click
the Edit button that reveals the script editing window.
Script Arguments
This field is in the script editing window and allows you to specify arguments to pass to the script.
You may include the variables ${IP}, ${USER}, and ${PASSWORD}, which are replaced
respectively by the IP address of the target node, the credential user name, and the credential
password.
Body
User Notes
${UserNotes}.
1272
Windows Service monitor
This component monitor uses WMI or RPC communication to test if a specified Windows service is running,
and reports the CPU, virtual memory, and physical memory used by the service.
Statistic
Field Descriptions
Description
Enable Component
Fetching Method
Select the Fetching Method (Communication Type):
n WMI (Windows Management Instrumentation) - Use WMI communication to test if the

specified Windows process is running.
n RPC (Remote Procedure Call) - Use RPC communication to test if the specified Windows
process is running.
SAM will poll the service state, and information about CPU/memory usage will be retrieved
using performance counters.
Net Service Name
This field is the Service name of the service to monitor. You can find the Service name on Windows
systems by clicking Start > Administrative Tools > Services and then locating the desired service.
Right-click the service and select Properties from the context menu. The Service name is the value of
the Service name field in the Properties dialog.
CPU Threshold
1273
Virtual Memory Threshold
virtual memory in use by the monitored process.
User Notes
${UserNotes}.
1274
WMI monitor
Formerly known as the WMI Performance Counter Monitor, this component monitor uses WMI
communication to obtain the result of a WMI Query Language (WQL) query. The typical result retrieves the
performance data calculated by WMI providers such as the Windows operating system or Microsoft
Exchange Server.
All WQL queries are run within the root/CIMV2 namespace.
Named instances of SQL Server may have custom class names that do not match the built-in
templates. You must manually change the class name in any WMI Monitor monitoring a named SQL
Server instance. For example, if the named instance is "NAMED,” you must change Win32_
PerfFormattedData_MSSQLSERVER_SQLServerBufferManager to Win32_PerfFormattedData_
MSSQLNAMED_SQLNAMEDServerBufferManager.
Statistic
The statistic for this component monitor is the value of the first row and column of the data
retrieved by the query.
Optionally, the statistic may be set as the difference in query values between polling cycles by
checking the option for Count statistic as difference.
Note: the Count statistic as difference option is applicable only for monitors whose counter
In these cases where the option is not applicable, negative statistic data values will be
replaced with zero (0), and the counter monitor will show 0 as the statistic data value in
Field Descriptions
Description
Enable Component
1275
administrator-level credential.
WMI Namespace
Specifies the name of the namespace within which all WQL queries are run. The default value is
root\CIMV2.
WQL Query
Type the WQL query you want to run on the target node. This is typically a performance counter
Query, but it can be any WQL query. All WQL queries are run within the root/CIMV2 namespace. The
WQL query for this monitor returns a numeric value. It will not report errors.
Convert Value
User Notes
${UserNotes}.
1276
Worldwide Map of Orion Nodes Resource
Worldwide Map of Orion Nodes Resource

The following topics provide directions for using the Worldwide Map of Orion Nodes
resource:
n Worldwide Map of Orion Nodes Resource

n Managing the Worldwide Map of Orion Nodes Resource
1277

SolarWinds SAM provides a number of predefined transformation functions that may
be applied to one or more monitors to generate mathematically manipulated results.
The following table lists transformation functions that are currently available in
SolarWinds SAM:
Data Syntax Definition

Transformation
Euler’s Number E() Euler’s number, commonly called the

number e, is defined as the base of
the natural logarithm as the limit of a
certain sequence, or as the sum of a
certain series.
Pi Pi() Pi is the mathematical constant whose

value is the ratio of any circle's
circumference to its diameter.
Rounding Round({value}, Provides a number that is rounded to

{number of the specified number of digits.
decimal
places})
Truncate Truncate Truncates a monitored value to a

({value}, designated number of decimal places.
{number of
decimal
places})
Square Root Sqrt({value}) Provides the square root of a given

number.
Exponentiation Pow({base Provides the result from repeated

value}, multiplication of the base number.
{exponent
value})
1278
Temperature: CToF({value}) Provides the Fahrenheit result
Celsius to originally presented in Celsius
Fahrenheit
Temperature: FToC({value}) Provides the Celsius result originally

Fahrenheit to presented in Fahrenheit
Celsius
X to Kilobyte XToKilo Provides the number of Kilobytes

({value}) originally presented in Bytes
X to Megabyte XToMega Provides the number of Megabytes

X to Gigabyte XToGiga Provides the number of Gigabytes,

X to Terabyte XToTera Provides the number of Terabytes,

Kilobyte to KiloToMega Provides the number of Megabytes,

Megabyte ({value}) originally presented in Kilobytes
Kilobyte to KiloToGiga Provides the number of Gigabytes,

Gigabyte ({value}) originally presented in Kilobytes
Kilobyte to KiloToTera Provides the number of Terabytes,

Terabyte ({value}) originally presented in Kilobytes
Megabyte to MegaToGiga Provides the number of Gigabytes,

Gigabyte ({value}) originally presented in Megabytes
Megabyte to MegaToTera Provides the number of Terabytes,

Terabyte ({value}) originally presented in Megabytes
Gigabyte to GigaToTera Provides the number of Terabytes,

Terabyte ({value}) originally presented in Gigabytes
1279
Terabyte to Kilobyte TeraToKilo Provides the number of Kilobytes,

({value}) originally presented in Terabytes
Terabyte to TeraToMega Provides the number of Megabytes,

Megabyte ({value}) originally presented in Terabytes
Terabyte to TeraToGiga Provides the number of Gigabytes,

Gigabyte ({value}) originally presented in Terabytes
1280
Regular Expression Pattern Matching
Regular Expression Pattern Matching

When editing comparison criteria, the following regular expressions can be used for
pattern matching. Examples are provided at the end of this section.
Characters
CHARACTER DESCRIPTION EXAMPLE
Any character All characters except the listed special a matches a

except characters match a single instance of
[,\,^,$,.,|,?,*,+,(,), themselves.
\ (backslash) A backslash escapes special characters to \+ matches +

followed by suppress their special meaning.
any of
[,\,^,$,.,|,?,*,+,(,),
\xFF where FF Matches the character with the specified \xA9 matches ©
are 2 ASCII/ANSI value, which depends on the code when using the
hexadecimal page used. Can be used in character classes. Latin-1 code
digits page.
\n, \r and \t Match an LF character, CR character and a tab \r\n matches a

character respectively. Can be used in DOS/Windows
character classes. CRLF line break.
1281
Character Classes or Character Sets [abc]
CHARACTER
CLASSES OR
SETS DESCRIPTION EXAMPLE
[ (opening Starts a character class. A character class matches a

square single character out of all of the possibilities offered
bracket) by the character class. Inside a character class,
different rules apply. The rules in this section are
only valid inside character classes. The rules outside
this section are not valid in character classes, except
\n, \r, \t and \xFF
Any character All characters except the listed special characters. [abc]
except ^,-,],\ matches a,
add that b or c
character to
the possible
matches for
the character
class.
\ (backslash) A backslash escapes special characters to suppress [\^\]]

followed by their special meaning. matches ^
any of ^,-,],\ or ]
- (hyphen) Specifies a range of characters. (Specifies a hyphen [a-zA-Z0-9]

except if placed immediately after the opening [) matches
immediately any letter
after the or digit
opening [
1282
Anchors
CHARACTER
CLASSES OR
SETS DESCRIPTION EXAMPLE
^ (caret) Negates the character class, causing it to match a [^a-d]

immediately single character not listed in the character class. matches x
after the (Specifies a caret if placed anywhere except after the (any
opening [ opening [) character
except a, b,
c or d)
\d, \w and \s Shorthand character classes matching digits 0-9, [\d\s]

word characters (letters and digits) and whitespace matches a
respectively. Can be used inside and outside character
character classes that is a
digit or
whitespace
Anchors
ANCHORS DESCRIPTION EXAMPLE
^ (caret) Matches at the start of the string to which the regular ^. matches
expression pattern is applied. Matches a position rather a in
than a character. Most regular expression flavors have an abc\ndef.
option to make the caret match after line breaks (i.e. at the Also
start of a line in a file) as well. matches d
in "multi-
line"
mode.
1283
ANCHORS DESCRIPTION EXAMPLE
$ Matches at the end of the string to which the regular .$ matches

(dollar) expression pattern is applied. Matches a position rather f in
than a character. Most regular expression flavors have an abc\ndef.
option to make the dollar match before line breaks (i.e. at Also
the end of a line in a file) as well. Also matches before the matches c
very last line break if the string ends with a line break. in "multi-
line"
mode.
\A Matches at the start of the string to which the regular \A.

expression pattern is applied to. Matches a position rather matches a
than a character. Never matches after line breaks. in abc
\Z Matches at the end of the string to which the regular .\Z

expression pattern is applied. Matches a position rather matches f
than a character. Never matches before line breaks, except in
for the very last line break if the string ends with a line abc\ndef
break.
\z Matches at the end of the string to which the regular .\z

expression pattern is applied. Matches a position rather matches f
than a character. Never matches before line breaks. in
abc\ndef
Quantifiers
QUANTIFIERS DESCRIPTION EXAMPLE
? (question Makes the preceding item optional. The optional item is abc?
mark) included in the match, if possible. matches
ab or abc
1284
Quantifiers
?? Makes the preceding item optional. The optional item is abc??

excluded in the match, if possible. This construct is matches
often excluded from documentation due to its limited ab or abc
use.
* (star) Repeats the previous item zero or more times. As many .*

items as possible will be matched before trying matches
permutations with fewer matches of the preceding item, "def"
up to the point where the preceding item is not matched "ghi" in
at all. abc "def"
"ghi" jkl
*? (lazy Repeats the previous item zero or more times. The .*?
star) engine first attempts to skip the previous item before matches
trying permutations with ever increasing matches of the "def" in
preceding item. abc "def"
"ghi" jkl
+ (plus) Repeats the previous item once or more. As many items .+

as possible will be matched before trying permutations matches
with fewer matches of the preceding item, up to the "def"
point where the preceding item is matched only once. "ghi" in
abc "def"
"ghi" jkl
+? (lazy Repeats the previous item once or more. The engine .+?
plus) first matches the previous item only once, before trying matches
permutations with ever increasing matches of the "def" in
preceding item. abc "def"
"ghi" jkl
{n} where Repeats the previous item exactly n times. a{3}

n is an matches
integer >= aaa
1
1285
{n,m} Repeats the previous item between n and m times. Will a{2,4}
where n >= try to repeat m times before reducing the repetition to n matches
1 and m >= times. aa, aaa or
n aaaa
{n,m}? Repeats the previous item between n and m times. Will a{2,4}?
where n >= try to repeat n times before increasing the repetition to matches
1 and m >= m times. aaaa, aaa
n or aa
{n,} where Repeats the previous item at least n times. Will try to a{2,}
n >= 1 match as many items as possible before trying matches
permutations with fewer matches of the preceding item, aaaaa in
up to the point where the preceding item is matched aaaaa
only m times.
{n,}? where Repeats the previous item between n and m times. The a{2,}?
n >= 1 engine first matches the previous item n times before matches
trying permutations with ever increasing matches of the aa in
preceding item. aaaaa
Dot
DOT
. (dot) Matches any single character except line . matches x or most any
break characters \r and \n. other character
1286
Word Boundaries
Word Boundaries
W ORD
BOUNDARY DESCRIPTION EXAMPLE
\b Matches at the position between a word character .\b

(anything matched by \w) and a non-word character matches
(anything matched by [^\w] or \W) as well as at the start c in abc
and/or end of the string if the first and/or last characters
in the string are word characters.
\B Matches at the position between two word characters (i.e., \B.\B

the position between \w\w) as well as at the position matches
between two non-word characters (i.e., \W\W). b in abc
Alternation
ALTERNATION
| Causes the regular expression engine to match abc|def|xyz

either the part on the left side or the part on the matches abc,
(vertical bar
right side. Can be strung together into a series of def or xyz
or “pipe”)
options.
| The vertical bar has the lowest precedence of all abc(def|xyz)

operators. Use grouping to alternate only part of matches
(vertical bar
the regular expression. abcdef or
or “pipe”)
abcxyz
1287

The 95th percentile, a well-known statistical standard used to discard maximum
spikes, is based on 5 minute data samples. The calculation gathers these values
every 5 minutes for the duration you select, throws away the top 5%, yielding the 95th
percentile value at the beginning of the list.
The following example shows how the 95th percentile is calculated for a 10 hour work
day from 8am to 6pm (600 minutes).
1. Over the 10 hours, the following 120 values were collected for inbound traffic
(Mb/s):
0.149 0.623 0.281 0.136 0.024 0.042 0.097 0.185 0.198 0.243 0.274 0.390 0.971
0.633 0.238 0.142 0.119 0.176 0.131 0.127 0.169 0.223 0.291 0.236 0.124 0.072
0.197 0.105 0.138 0.233 0.374 0.290 0.871 0.433 0.248 0.242 0.169 0.116 0.121
0.427 0.249 0.223 0.231 0.336 0.014 0.442 0.197 0.125 0.108 0.244 0.264 0.190
0.471 0.033 0.228 0.942 0.219 0.076 0.331 0.227 0.849 0.323 0.221 0.196 0.223
0.642 0.197 0.385 0.098 0.263 0.174 0.690 0.571 0.233 0.208 0.242 0.139 0.186
0.331 0.124 0.249 0.643 0.481 0.936 0.124 0.742 0.497 0.085 0.398 0.643 0.074
0.590 0.771 0.833 0.438 0.242 0.092 0.376 0.231 0.627 0.249 0.663 0.181 0.636
0.224 0.342 0.697 0.285 0.108 0.211 0.074 0.490 0.271 0.133 0.338 0.242 0.519
0.376 0.331 0.227
2. The values are reordered from high to low.
0.971 0.942 0.936 0.871 0.849 0.833 0.771 0.742 0.697 0.690 0.663 0.643 0.643
0.642 0.636 0.633 0.627 0.623 0.590 0.571 0.519 0.497 0.490 0.481 0.471 0.442
0.438 0.433 0.427 0.398 0.390 0.385 0.376 0.376 0.374 0.342 0.338 0.336 0.331
0.331 0.331 0.323 0.291 0.290 0.285 0.281 0.274 0.271 0.264 0.263 0.249 0.249
0.249 0.248 0.244 0.243 0.242 0.242 0.242 0.242 0.238 0.236 0.233 0.233 0.231
0.231 0.228 0.227 0.227 0.224 0.223 0.223 0.223 0.221 0.219 0.211 0.208 0.198
0.197 0.197 0.197 0.196 0.190 0.186 0.185 0.181 0.176 0.174 0.169 0.169 0.149
0.142 0.139 0.138 0.136 0.133 0.131 0.127 0.125 0.124 0.124 0.124 0.121 0.119
0.116 0.108 0.108 0.105 0.098 0.097 0.092 0.085 0.076 0.074 0.074 0.072 0.042
0.033 0.024 0.014
1288
3. The first 6 values are dropped, as these equal the top 5% of the values.
0.771 0.742 0.697 0.690 0.663 0.643 0.643 0.642 0.636 0.633 0.627 0.623 0.590
0.571 0.519 0.497 0.490 0.481 0.471 0.442 0.438 0.433 0.427 0.398 0.390 0.385
0.376 0.376 0.374 0.342 0.338 0.336 0.331 0.331 0.331 0.323 0.291 0.290 0.285
0.281 0.274 0.271 0.264 0.263 0.249 0.249 0.249 0.248 0.244 0.243 0.242 0.242
0.242 0.242 0.238 0.236 0.233 0.233 0.231 0.231 0.228 0.227 0.227 0.224 0.223
0.223 0.223 0.221 0.219 0.211 0.208 0.198 0.197 0.197 0.197 0.196 0.190 0.186
0.185 0.181 0.176 0.174 0.169 0.169 0.149 0.142 0.139 0.138 0.136 0.133 0.131
0.127 0.125 0.124 0.124 0.124 0.121 0.119 0.116 0.108 0.108 0.105 0.098 0.097
0.092 0.085 0.076 0.074 0.074 0.072 0.042 0.033 0.024 0.014
4. The 95th percentile is 0.771.
1289
Required SolarWinds account permissions
Required SolarWinds account permissions

The following table lists account permissions SolarWinds requires to specific folders
on your server.
Acces
s Account Folder the account needs to access
Level
NETWORK
read C:\Program Files (x86)\SolarWinds\Orion\
SERVICE
read IUSR C:\Program Files (x86)\SolarWinds\Orion\
read Administrato C:\Program Files (x86)\SolarWinds\Orion\

r
NETWORK
read C:\Windows\Microsoft.NET\Framework\v4.0.30319\Tempora
SERVICE
ry ASP.NET Files
read IUSR C:\Windows\Microsoft.NET\Framework\v4.0.30319\Tempora

ry ASP.NET Files
NETWORK
write C:\ProgramData\Application Data\SolarWinds
SERVICE
NETWORK
write C:\InetPub\SolarWinds\web.config
SERVICE
NETWORK
write C:\Windows\TEMP
SERVICE
NETWORK
read C:\Windows\TEMP
SERVICE
Authenticate
write C:\ProgramData\Application Data\SolarWinds\Logs
d Users
1290
Acces
s Account Folder the account needs to access
Level
NETWORK
read C:\
SERVICE
The following table lists account permissions SolarWinds requires to specific cer-
tificates on your server.
Access Level Account Certificate the account needs to access
read NETWORK SERVICE SolarWinds-Orion
read NETWORK SERVICE SolarWinds-Orion
read Administrator SolarWinds-Orion
read SYSTEM SolarWinds-Orion
read NETWORK SERVICE SolarWinds Job Scheduler
read NETWORK SERVICE SolarWinds Job Scheduler
read Administrator SolarWinds Job Scheduler
read SYSTEM SolarWinds Job Scheduler
1291

Click the bell icon in the top-right corner to display unread notifications.
Notifications include the following messages:
n If you configured the Orion Web Console to check for product updates, an
announcement displays when an update, such as any upgrade, service pack, or
hotfix becomes available.
n If you configured the Orion Web Console to store blog posts, new and unread
posts to the Orion Product Team Blog are announced in the notification bar.
n If you configured a scheduled discovery, results display in the notification bar
when the discovery completes.
n If you are monitoring any VMware ESX or ESXi Servers, the notification bar
displays the number of ESX nodes found during any discovery, and inform you
if any discovered ESX nodes require credentials.
n If you are monitoring Hyper-V nodes, the notification bar informs you when
Hyper-V servers were found during a discovery.
1292
SAM Glossary of Terms
SAM Glossary of Terms

Here is a list of fundamental terms with which you should be familiar. A tree-like map
is also provided to visualize how SAM operates.
Component Monitor – A component monitor is the fundamental element of an

application. Component monitors return the current status or value of a monitored
service or process. All component monitors return at least one value or one status
condition.
Node - A node is considered to be any endpoint of a given network. For example, any
server or computer on a network is considered a node. Sometimes a node is referred
to as a device.
Application - An application in SolarWinds SAM is a collection of component

monitors.
1293
Template - A template is the blueprint for an application. It is a collection of
component monitors designed to monitor a server or application. You can customize
numerous templates using only the component monitors you need for a specific
environment.
The type of information returned by the component monitor is based upon the type
of monitor being utilized. For example, one type of monitor can report the up or down
status of a service or process, another monitor can return the percentage of free
space of a volume. Another type of component monitor can return up to ten values.
Each monitor type, along with its parameters and returned values and/or states, is
unique.
Each node, along with its applications and component monitors, can be viewed from
the SolarWinds SAM web console as shown in the diagram below. The view can be
customized to suit your needs.
1294
Solutions
If you have problems with a SolarWinds product, the causes are usually related to an incorrect
configuration or corrupted files. The suggestions listed in this section can often clear up these problems.
You can also talk to other users as well as the SolarWinds staff by logging on to thwack.com
Back Up Your Data
As a first step in any troubleshooting procedure, you should back up your Orion database. For more
information, see Creating Database Backups.
Verify Program Operation
SolarWinds runs many components at the same time to deliver a view of your network status. Confirm that
the following components are running on your SolarWinds server:
Services:
n Message Queuing
n Net.Tcp Port Sharing Service
n SNMP Trap Service
n SolarWinds Alerting Engine service
n SolarWinds Collector Data Processor, Management Agent, and Polling Controller services
n SolarWinds Information Service
n SolarWinds Job Engine and Job Engine v2
n SolarWinds Job Scheduler
n SolarWinds Network Performance Monitor Service. All SolarWinds products use this service. It is not
exclusive to SolarWinds SAM.
n SolarWinds Product services
n SolarWinds Information Service
n SolarWinds Module Engine
n SolarWinds Syslog and Trap Services
n SQL Server
n Internet Information Service (IIS)
Stop and Restart
Many problems disappear when programs are restarted. Stopping and restarting Internet Information
Service (IIS) may eliminate web page problems. Problems with polling or data gathering may be eliminated
by stopping and restarting the SolarWinds Network Performance Monitor Service using the available
shutdown tool that you can locate as follows:
1. Click Start > All Programs > SolarWinds > Advanced Features > Orion Service Manager.
For a complete refresh of the system, reboot the computer.
1295
Run the Configuration Wizard
Running the Configuration Wizard, which refreshes files on the web server and performs checks on the
structure of your database, may solve many problems.
Note: Before you run the Configuration Wizard, you should close all open applications and stop the
SolarWinds Network Performance Monitor Service in the Windows Services Control Panel. It is restarted by
the Wizard at the end of its process.
Using Full Variable Names
If you are having difficulty acquiring expected values from a selected variable, using the ${VariableName}
format, it may be helpful to include the database table name within the variable name, as in
${Nodes.IP_Address}.
Move the SQL server temporary directory

The SQL Server temporary directory, tempdb, where temporary database objects generated during table
creation and sorting are stored, is typically created in the same location on your Orion database server as
the master, model, and msdb databases. Moving the tempdb database to a physical drive separate from
your Orion database can significantly improve overall system performance.
n For more information about moving the SQL Server 2008 temporary directory, tempdb, see “Moving
System Databases - Example A: Moving the tempdb Database.”
SAM WMI monitors show a status of Unknown

To monitor SAM applications containing WMI component monitors, the following conditions must be
true:
n WMI on the remote server is enabled and functioning properly.

n The remote server is accessible through a RPC connection in order to run the WMI queries.
If these conditions cannot be met, the WMI component monitors in SAM show an Unknown status.
Examples of some issues that can prevent these conditions from being met include, but are not limited to:
n Trying to connect to a remote computer where you do not have local Administrator rights.
n A firewall blocking the WMI traffic.
n An operating system that is not configured for WMI.
n Mistyping the credential password in the SAM component monitor.
To help diagnose and fix these issues and others, we can test the WMI services, the remote WMI
connections, and the SolarWinds SAM component configuration to discover and correct the issues that can
prevent your WMI component monitors from functioning correctly.
1296
Redefine Windows system temporary directories
Following established Windows standards, the SolarWinds installer may use Windows User and System
TEMP and TMP variable directories as temporary scratch spaces for file expansion and execution. If you do
not have the required scratch space available in the default User or System TEMP and TMP directories, use
the following procedure to redefine your default locations.
Regardless of where you actually install SolarWinds, some common files may be installed where the
operating system of your SolarWinds server are located.
1. Log on to your SolarWinds server as a user with administrative rights.

2. Locate your environment variables.
3. Select the variable name representing the directory you want to redefine, and then provide a new
path as the Variable value for the selected temporary directory variable.
Troubleshooting
If you have problems with an Orion product, the causes are usually related to an incorrect configuration or
corrupted files. The following suggestions can often clear up these problems.
Back up your data

As a first step in any troubleshooting procedure, you should back up your SolarWinds Orion database.
Back up your SolarWinds Orion database using the SQL Server Management Studio. For more information,
search for "back up a database" on the Microsoft TechNet web portal at https://technet.microsoft.com,
and consult the help for the appropriate SQL Server Management Studio version.
Verify program operation

SolarWinds Orion runs many components at the same time to deliver a view of your network status.
Confirm that the following components are running:
l Services:
o Message Queuing
o Net.Tcp Port Sharing Service
o SolarWinds Alerting Engine service
o SolarWinds Collector Data Processor, Management Agent, and Polling Controller services
o SolarWinds Information Service
o SolarWinds Job Engine and Job Engine v2
o SolarWinds Job Scheduler
o SolarWinds Orion Product services
o SolarWinds Orion Information Service
1297
o SolarWinds Orion Module Engine
o SolarWinds Syslog and Trap Services
l SQL Server
l Internet Information Service (IIS)
l SolarWinds Web Console
Stop and restart

Many problems disappear when programs are restarted.
Stopping and restarting appropriate services may eliminate some issues:
n To resolve web page problems, stop and restart Internet Information Service (IIS).
n To resolve problems with polling or data gathering, stop and restart Job Engine or Collector services.
To restart SolarWinds services:
1. Navigate to the Orion Service Manager via Start > All Programs > SolarWinds Orion > Advanced
Features.
2. Click Shutdown Everything, and then click Start Everything.
For a complete refresh of the system, reboot the computer.
Run the Configuration Wizard

Running the Configuration Wizard, which refreshes files on the web server and performs checks on the
structure of your database, may solve many problems.
Before you run the Configuration Wizard, you should close all open applications.
To launch the Configuration Wizard, navigate to Configuration Wizard by clicking Start > All Programs >
SolarWinds Orion > Configuration and Auto-Discovery .
Slow Performance on Windows Server 2008

If Orion is installed on Windows Server 2008 and there are any devices on your network, between your
Orion server and your database server, that do not support RFC 1323, the TCP window size auto-tuning
feature of Windows Server 2008 may prevent your Orion server from successfully connecting with your
Orion database.
This TCP auto-tuning feature is intended as a network-sensitive restriction, applied by the receiver—your
SolarWinds Orion server—on the amount of data it is allowed or able to receive. If any devices along the
network path between your Orion server and your Orion database do not support the TCP window scaling
detailed in RFC 1323, the allowed size of the TCP window in packets sent to your Orion server may not
match the TCP window size reported by packets sent from your Orion server. This mismatch may lead to
failed connections between your Orion server and your Orion database. The following procedure disables
this TCP auto-tuning feature, resetting the TCP receive window to 64kB.
1298
To disable tcp auto-tuning:
1. Click Start > All Programs > Accessories.

2. Right-click Command Prompt, and then click Run as administrator.
3. If you are prompted by User Account Control, click Continue to open the elevated command
prompt.
Note: In some cases, having User Account Control (UAC) enabled on Windows Server 2008 can lead to
installation errors. For more information about disabling UAC, see the article "Disabling User
Account Control (UAC)" in the SolarWinds Knowledge Base.
4. At the prompt, enter the following:
netsh interface tcp set global autotuninglevel=disabled
5. Close the command prompt window, and then restart your Orion server.
Troubleshoot Windows Server memory over 100%

When Orion Platform products poll a Windows server for CPU load and memory utilization, they pull the
amount of physical memory to define the 100% level. Then they total the amount of memory in use by each
allocation to compute what percentage of the physical memory is in use. This can result in memory
utilization readings over 100%, as many applications pre-allocate memory and swap before it is actually
needed.
Workaround
Add physical memory as a volume for monitoring these servers. When monitored as a volume, the
values will be more in line with your expectations.
Troubleshoot slow performance on Windows Server 2008

If SolarWinds is installed on Windows Server 2008 or Windows Vista and there are any devices on your
network, between your SolarWinds server and your database server, that do not support RFC 1323, “TCP
Extensions for High Performance,” the TCP window size auto-tuning feature of Windows Server 2008 and
Windows Vista may prevent your SolarWinds server from successfully connecting with your Orion
database. This TCP auto-tuning feature is intended as a network-sensitive restriction, applied by the
receiver-your SolarWinds server-on the amount of data it is allowed or able to receive. If any devices along
the network path between your SolarWinds server and your Orion database do not support the TCP
window scaling detailed in RFC 1323, the allowed size of the TCP window in packets sent to your
SolarWinds server may not match the TCP window size reported by packets sent from your SolarWinds
server. This mismatch may lead to failed connections between your SolarWinds server and your Orion
database. The following procedure disables this TCP auto-tuning feature, resetting the TCP receive window
to 64kB.
Disable TCP Auto-tuning
1. Click Start > All Programs > Accessories.

2. Right-click Command Prompt, and then click Run as Administrator.
1299
3. If you are prompted by User Account Control, click Continue to open the elevated command
prompt.
Note: In some cases, having User Account Control (UAC) enabled on Windows Server 2008 and
Windows Vista (evaluation-only) can lead to installation errors. For more information about disabling
UAC, see the article, “Disabling User Account Control (UAC)” in the SolarWinds Knowledge Base.
4. At the prompt, enter the following: netsh interface tcp set global
autotuninglevel=disabled
5. Close the command prompt window, and then restart your SolarWinds server.
Error When Creating New Group

If you try to create a new group and you receive an error message about MSDTC, you should enable the
MSDTC service on your SolarWinds Orion server and your SQL server.
This is an intermittent issue that is resolved by enabling MSDTC.
For information, search MSDN.
Why can't I connect to thwack?

Your SolarWinds Orion server must be able to open internet connections to connect to thwack. If the
connection is blocked by a firewall or a proxy the list of shared pollers cannot be retrieved from thwack,
and any operation that relies on communication with thwack, such as the upload or download of a poller
will fail.
Check your firewall and proxy settings to make sure that your SolarWinds Orion server can connect to the
internet.
1300
WMI troubleshooting flowchart for SolarWinds SAM
The following Microsoft article describes how to set permissions in a workgroup after an upgrade
from Microsoft Windows 2000 Professional to Microsoft Windows XP Professional.
http://support.microsoft.com/?kbid=290403
1301
Test local WMI services
Testing the local WMI services helps isolate any faults on the target server. The testing program is a
Microsoft program named WBEMTest that comes already installed on Microsoft Windows operating
systems.
Test WMI on the target server
1. Log on to the target server with an administrator account, then click Start > Run, enter wbemtest.exe
and then click OK.
2. Click Connect on the Windows Management Instrumentation Tester window.
3. Enter root\cimv2 in the field at the top of the dialog box next to the Connect button.
1302
4. Click Connect, then click Enum Classes.
5. Select the Recursive radio button without entering a superclass name, and then click OK.
6. If the list does not appear or does not contain the desired WMI class, WMI is not functioning
correctly.
7. Click Close, and then click Exit.
Manually reset the WMI counters
At times, the WMI performance counters may not get transferred to WMI because services were delayed or
started out of order (http://support.microsoft.com/kb/820847).
1. Stop the Windows Management Instrumentation service.

2. Click Start, click Run, type cmd, and then click OK.
3. At the command prompt, type winmgmt /resyncperf, and then press Enter.
4. At the command prompt, type wmiadap.exe /f, and then press Enter.
5. Type exit, and then press Enter to close the command prompt.
6. Start the Windows Management Instrumentation service.
After resetting the WMI counters, retest WMI.
Test remote WMI connectivity
Testing the remote WMI connectivity of the target server helps isolate faults that could prevent the target
server from receiving or responding to remote WMI requests. The testing program is a Microsoft program
named WBEMTest that comes already installed on Microsoft Windows operating systems. For more
information, see Remotely test WMI on the target server.
1303
Remotely test WMI on the target server
Complete the following procedure to check whether the target server is responding appropriately to
remote WMI requests that originate from the SolarWinds SAM server.
1. Log on to the SolarWinds SAM server with an administrator account, then click Start > Run, enter
wbemtest.exe and then click OK.
2. Click Connect on the Windows Management Instrumentation Tester window.
3. Enter \\Target_Primary_IP_Address\root\cimv2 in the field at the top of the dialog box.
Replace Target_Primary_IP_Address in the above example with the actual Hostname or Primary IP
Address of the target server.
4. Enter the user name in the User field, the password in the Password field, and
NTLMDOMAIN:NameOfDomain in the Authority field. Replace NameOfDomain with the domain of
the user account specified in the User field.
5. Click Connect, then click Enum Classes.
1304
6. Select the Recursive radio button without entering a superclass name, and then click OK.
7. If the list does not appear, remote WMI is not functioning correctly. Click Close, and then click Exit.
Verify administrator credentials
Only a credential that has administrator rights on the target server has the necessary permissions to
access the target server’s WMI services. Make sure that the username and password you are using belongs
to an administrator on the target server.
If the administrator credential is a domain member, be sure to specify both the user name and the domain
in the standard Microsoft syntax. For example: DOMAIN\Administrator.
Enable Remote Procedure Call (RPC)
Remote WMI connections use RPC as a communications interface. If the RPC service is disabled on the
target server, remote WMI connections cannot be established.
1. Log on to the target server with an administrator account.

2. Click Start > Run, then type services.msc, and then press Enter.
3. Scroll the list to Remote Procedure Call (RPC)
4. Right-click Remote Procedure Call (RPC), and then click Start on the shortcut menu.
Configure Distributed Component Object Model (DCOM) and User Account Control (UAC)
If the target computer is running Windows Vista or Windows Server 2008, you may be required to make
settings changes to allow remote WMI requests (http://msdn.microsoft.com/en-us/library/aa822854
(VS.85).aspx).
Item Need
1305
n Default and Limits permissions edited to allow the following actions:
DCOM n Local launch (default permission)

n Remote launch (default permission)
n Local activation (limits permission)
n Remote activation (limits permission)
WMI n Modify the CIMV2 security to enable and remote enable the account used to access
Namespaces the server or workstation through WMI. You must ensure the security change
applies to the current namespace and sub-namespaces.
User n Remote UAC access token filtering must be disabled when monitoring within a
Account workgroup environment.
Control
Enable DCOM permissions for your SAM credentials
WMI uses DCOM to communicate with monitored target computers. Therefore, for Server & Application
Monitor to use WMI, DCOM must be enabled and properly configured.
1. Log on to the target server with an administrator account.

2. Click Start > Control Panel > Administrative Tools > Component Services > Computers.
3. Right-click My Computer, and then select Properties.
4. Select the COM Security tab, and then click Edit Limits in the Access Permissions grouping.
5. Ensure the user account you want to use to collect WMI statistics has Local Access and Remote
Access, and then click OK.
6. Click Edit Default, and then ensure the user account you want to use to collect WMI statistics has
Local Access and Remote Access, then click OK.
7. Click Edit Limits in the Launch and Activation Permissions grouping.
8. Ensure the user account you want to use to collect WMI statistics has Local Launch, Remote Launch,
Local Activation, and Remote Activation, and then click OK.
9. Click Edit Default, and then ensure the user account you want to use to collect WMI statistics Local
Launch, Remote Launch, Local Activation, and Remote Activation.
10. Click OK.
Enable Account Privileges in WMI
The account you specify in the Credentials Library must possess security access to the namespace and
sub-namespaces of the monitored target computer.
Enable namespace and sub-namespaces privileges
1. Log on to the computer to monitor with an administrator account.

2. Click Start > Control Panel > Administrative Tools > Computer Management > Services and
Applications.
3. Click WMI Control, and then right-click and select Properties.
1306
4. Select the Security tab, and then expand Root and click CIMV2.
5. Click Security and then select the user account used to access this computer and ensure you grant
the following permissions:
Enable Account
Remote Enable
6. Click Advanced, and then select the user account used to access this computer.
7. Click Edit, select This namespace and subnamespaces in the Apply to field, and then click OK.
8. Click OK on the Advanced Security Settings for CIMV2 window.
9. Click OK on the Security for Root\CIMV2 window.
10. Click Services in the left navigation pane of Computer Management.
11. Select Windows Management Instrumentation in the Services result pane, and then click Restart.
Disable Remote User Account Control for workgroups
If you are monitoring a target in a workgroup, you need to disable remote User Account Control (UAC). This
is not recommended but it is necessary when monitoring a workgroup computer. Disabling remote user
account control does not disable local user account control functionality.
Warning: The following procedure requires the modification or creation of a registry key. Changing
the registry can have adverse effects on your computer and may result in an unbootable system.
Consider backing up your registry before making these changes.
Disable remote UAC for a workgroup computer
1. Log on to the computer you want to monitor with an administrator account.
2. Click Start > Accessories > Command Prompt, then enter regedit.
3. Expand HKEY_LOCAL_
MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.
4. Locate or create a DWORD entry named LocalAccountTokenFilterPolicy and provide a
DWORD value of 1.
To re-enable remote UAC, change this value to 0.
Add a Windows firewall exception for remote WMI connections
If the target computer has Windows Firewall enabled, it must have a Remote WMI exception to allow
remote WMI traffic through (http://msdn.microsoft.com/en-us/library/aa389286(VS.85).aspx).
1. Click Start, click Run, type cmd and then press Enter.
2. At the command prompt, type netsh advfirewall firewall set rule group="Windows
Remote Management" new enable=yes, and then press Enter.
3. At the command prompt, type exit, and then press Enter.
1307
Determine if an additional polling engine is needed
Symptoms that may indicate you need an additional polling engine include, but are not limited to, the
following:
n Polling completion rates are lower than expected which leads to gaps in data.
n Sporadic component monitor timeouts usually resulting in component monitors showing an
"Unknown" status, reporting the error, "Connection timeout. Job cancelled by scheduler."
n Resource exhaustion on the SQL server.
For more information, see Additional Polling Engine and Web Console.
Verify SAM component configuration
Make sure that the credential you are using for remote WMI is the same credential that you are using in
the SAM component. After you click Set Component Credentials to set the component credentials, you
must also click Submit at the bottom of the page.
Service reporting, "Invalid Class"
There are various possibilities for this to occur. Read the following section to help troubleshoot this issue.
In APM v4 and higher, services can be polled via RPC or WMI. Ensure the correct service is running by
navigating to Edit Application > RPC or WMI.
1308
Repair the WMI Repository according to this KB article:
http://knowledgebase.solarwinds.com/kb/questions/633/Error+message+%22Invalid+Class%22+wh
en+using+WMI+monitors
Vista and Windows 2008 have a built-in method for repairing the WMI repository. Open an
Administrator command prompt and run: winmgmt /salvagerepository
The culprit may be the last query.
1. Re-sync the counters by opening a command prompt and typing: winmgmt /resyncperf
2. Check to make sure performance counters are not disabled:
http://thwack.com/forums/68/application--server-management/21/application-performance-
monitor/23124/win32perfrawdataperfprocpro/
WMI is an operating system component. If the previous steps do no work, you may need to contact
Microsoft for further information.
WMI is still not working. Now what?
This guide depicts only the most common scenarios that can cause WMI services to fail. If you are unable
to get WMI services to work at this point, it is time to consult Microsoft on this topic.
n “WMI Troubleshooting.” Microsoft Developer Network. http://msdn.microsoft.com/en-

us/library/aa394603.aspx
Working with Temporary Directories

The following sections provide procedures for moving Windows and SQL Server temporary directories to
optimize Orion server performance and resources.
Moving the SQL Server Temporary Directory
The SQL Server temporary directory, tempdb, where temporary database objects generated during table
creation and sorting are stored, is typically created in the same location on your Orion database server as
the master, model, and msdb databases. Moving the tempdb database to a physical drive separate from
your Orion database can significantly improve overall system performance.
For more information about moving the SQL Server 2008 temporary directory, tempdb, see "Moving
System Databases – Example A: Moving the tempdb Database".
Redefining Windows System Temporary Directories
Following established Windows standards, the SolarWinds Orion installer may use Windows User and
System TEMP and TMP variable directories as temporary scratch spaces for file expansion and execution. If
you do not have the required scratch space available in the default User or System TEMP and TMP
directories, use the following procedure to redefine your default locations.
Note: Regardless of where you actually install SolarWinds Orion, some common files may be installed
where the operating system of your Orion server are located.
1309
To redefine default system temporary directories:
1. Log on to your Orion server as a user with administrative rights.

2. Right-click My Computer, and then click Properties.
3. Click Advanced, and then click Environment Variables.
4. Select the variable name representing the directory you want to redefine, click Edit, and then provide
a new path as the Variable value for the selected temporary directory variable.
Troubleshooting agents
The most common issues with agents occur during installation or configuration. The agent may be unable
to connect to the SolarWinds Orion server, or the server may be unable to connect to the agent.
For more troubleshooting information, see the following topics:
n Troubleshooting agent installation

n Troubleshooting agent deployment
n Troubleshooting agent configuration
n Troubleshooting agent connections
For information about what a plug-in status means, see View the status of agent plug-ins.
Troubleshooting agent installation
If your agent does not deploy correctly, use the following questions to help you troubleshoot the issue. You
can also install the agent manually on the target computer.
Are you installing other software on the target computer?
n Some software installations, such as Windows Updates, prevent other installations from finishing
successfully.
n Install the agent when the other installations have completed.
Is the target computer waiting to be restarted?
n Deployment can fail when the computer is waiting to be restarted after installing software.
n Restart the computer and try again.
Is the SolarWinds agent server already installed and running on the target computer?
n The agent may have connectivity issues.
Can you ping the SolarWinds Orion server or connect to the web console from the target computer?
n The SolarWinds agent requires port 17778 to be open on the server.

n Verify that the Orion server can ping the computer that has the agent installed.
n This is not required for agents with server-initiated communication.
Do you use group policies in your organization?
n You may have a network policy that interferes with deploying agents.
1310
Troubleshooting agent deployment
Agent deployment fails
Agent is not able to connect to the SolarWinds Orion server
n Ensure that you can ping the Orion server from the client machine.
n Ensure that port 17778 is open on the Orion server and that the client machine can connect to it.
n Ensure that you are using the correct Orion administrator credentials.
Credential test for deployment fails
n Ensure that the account can access and create a folder at the following location: \\<hostname_or_
ip>\admin$\temp
n Ensure that Remote Procedure Call (RPC), a Windows service, is running
n Ensure the required ports are open
n If you are using a domain account, use the complete name when entering credentials. For example:
domain\username
Agent deployment fails
n Ensure there are no other installations in progress. For example, Windows updates prevent other
installations from finishing successfully. If this is the case, retry installing the agent after the other
installations complete.
n On the target machine, check if the SolarWinds Agent service is installed and running. If it is, the
agent may be experiencing connectivity issues with the Orion server. Ping the Orion server from the
client machine, and ensure that port 17778 is open on the Orion server. Ensure the client machine
can connect to the Orion server web console.
n Install the agent manually on the target machine, and set the permissions correctly.
Agent deployment can fail if a previous installation or upgrade is awaiting a reboot. To resolve
this issue, you must reboot the server before the agent installation can proceed.
n Install the agent manually on the target machine, ensuring that permissions are set correctly.
n If a host name or Fully Qualified Domain Name was used, ensure that it can be resolved from the
client computer.
n If the Orion server or the additional poller is behind a NAT, ensure that the IP address specified
when creating the MST file is the correctly routed IP address the client uses to access the Orion
server.
Troubleshooting agent configuration
Connection refused for a passive agent
n Specify an agent shared secret to connect to a passive agent, or specify a proxy.

n Verify that the agent port is accessible.
1311
Agent is not running in passive mode
n The agent is running in the agent-initiated communication mode and you cannot connect to it.
n Change the communication mode to server-initiated. You can uninstall and install the agent from the
server, or manually install it.
n You can change the communication mode on the remote host through the Control Panel > Orion
Agent Settings.
Agent is not running in passive mode
n The agent version is empty or zero. This indicates that something is wrong with the agent.
n Install the agent again.
Agent GUID is different than the request ID
n The agent may be connected to another Orion server, or is broken.

n Install the agent again.
Troubleshooting agent connections
If your agent and your SolarWinds Orion server cannot communicate, the agent cannot respond to queries
or the SolarWinds Orion server cannot receive data from the agent.
You must have access to the remote host for most troubleshooting steps.
Is the agent service running?
n You can check the Manage Agents page for the agent status, or log in to the remote host with the
agent installed to check the status.
n If the agent is not running or has stopped, start the SolarWinds Agent service.
Are all plug-ins installed correctly?
n Select the agent in the Manage Agents page and click More Actions > View installed agent plug-ins.
n If there is a problem with a plug-in, restart the agent. The agent checks for new plug-ins when it
restarts.
Do the communication modes match between the agent and the server?
n On the remote host, open the Control Panel > Orion Agent Settings. The communication mode must
match the communication mode in the Manage Agents page on the SolarWinds Orion server.
n If the modes do not match, change one to match the other.
Does the server initiate communication?
n Log in to the server host and ping the remote host.

n Server-initiated communication requires port 17790 to be open on the remote host.
1312
Does the agent initiate communication?
n Log in to the remote host and ping the server.

n Agent-initiated communication requires port 17778 to be open on the server.
Troubleshoot hardware health

This following sections describe possible causes and solutions concerning hardware resources either not
being reported or being reported incorrectly:
n Hardware troubleshooting flowchart

n Troubleshoot an SNMP node
n Troubleshoot a WMI node
n Troubleshoot a VMWare node
n Hardware prerequisite checklist
1313
Hardware troubleshooting flowchart
Dell does not make array and hard disk health information visible from WMI managed nodes. To
monitor storage health on Dell servers, use SNMP.
1314
Troubleshoot hardware health
Incorrect hardware health statistics
If you can see that Orion Web Console does not display correct status information about your
sensors, consider changing the MIB tree used for polling your Cisco device. See Change MIB used for
polling hardware health statistics.
Temperature shown in unsuitable units
Temperature statistics can be displayed in degrees Celsius or Fahrenheit. See Change hardware
health temperature units.
Data are not available in custom hardware health charts
When monitoring hardware health, there might be sensors which do not report values, just the
sensor status. These sensors cannot be displayed in charts because the data used for creating the
chart are missing.
How can I improve polling performance?
Consider how often you need to poll the hardware statistics, and how long you need to archive them.
To improve the performance, poll for the statistics less frequently, or shorten the retention periods.

3. In the Thresholds & Polling grouping, click Polling Settings, and scroll down to the Hardware
Health Polling section.
4. Enter a longer polling interval.
5. Shorten the retention periods.
6. Click Submit.
Hardware health statistics will be polled according to the polling frequency, and retained for
the defined retention periods.
Troubleshoot an SNMP node
The most common issue customers face is that hardware information is not available via SNMP because
the Hardware Monitoring Agent software was installed before SNMP was installed. This means MIBs were
never installed and/or configured correctly. The easiest solution is to uninstall and then re-install the
Hardware Monitoring Agent software after installing SNMP on the server. If this is not the case, follow the
troubleshooting steps as outlined below:
1315
Verify the node was successfully added using SNMP
1. Verify the polling method on the Node Details page as shown below:
2. Verify the Hardware Monitoring Agent software is installed on the remote server and running.
3. Determine if SNMP responds for the proper OID. Below are the correct OIDS for each vendor:
For HP:1.3.6.1.4.1.232.2.2.2.1.0
For Dell:1.3.6.1.4.1.674.10892.1.300.10.1.8.1
For IBM:1.3.6.1.4.1.2.6.159.1.1.60.3.1
To determine if the remote server responds to the correct OID, you can use the MIB browser from
SolarWinds Engineer’s Toolset, which can be downloaded from http://www.solarwinds.com/downloads/.
Additionally, you can use other applications capable of making SNMP requests.
If you do not have a tool for checking OIDs on the remote server, you can create an SNMP walk by using the
SNMPWalk.exe installed with SAM, normally located at C:\Program Files (x86)
\SolarWinds\Orion\SnmpWalk.exe. SNMPWalk.exe is used in this demonstration.
Use SNMPWalk.exe
1316
1. Start SNMPWalk.exe and type in the IP address of the remote server and the community string for
SNMP.
2. Click Scan then save the SNMP walk in a text file.
3. Open the text file and manually search for the OIDs.
If the Remote Server does not respond on this OID, the Hardware Monitoring Agent software may not be
properly configured. Check to see if the Hardware Monitoring Agent software has imported the correct
MIBs as outlined in the following table.
HP Dell IBM
CPQSTDEQ-MIB MIB-Dell-10892 IBM-SYSTEM-HEALTH-MIB
CPQSINFO-MIB StorageManagement-MIB IBM-SYSTEM-ASSETID-MIB
CPQIDA-MIB IBM-SYSTEM-LMSENSOR-MIB
CPQHLTH-MIB IBM-SYSTEM-MEMORY-MIB
CPQSTSYS-MIB IBM-SYSTEM-POWER-MIB
CPQIDE-MIB IBM-SYSTEM-PROCESSOR-MIB
IBM-SYSTEM-RAID-MIB
ADAPTEC-UNIVERSAL-STORAGE-MIB
Troubleshoot a WMI node
The following conditions must be met before you can proceed troubleshooting WMI nodes:
n The node has successfully been added via WMI.

n WMI is working properly on the remote server.
n The Hardware Monitoring Agent software is installed on the remote server and running.
Use Wbemtest.exe to troubleshoot WMI
1. Open wbemtest.exe, usually located at C:\Windows\System32\wbem\wbemtest.exe.

2. Connect from the problematic node (either the SAM server or the additional poller server) to the
remote server using wbemtest.exe.
3. Click Connect. In the Namespace field enter:
For IBM and HP enter: \\RemoteServerIpAddress\root
For Dell enter: \\RemoteServerIpAddress\root\cimv2
1317
5. Enter administrator credentials and click Connect.
6. Once connected, click Query… from the main screen. The Query dialog appears.
7. Enter: select * from __Namespace
8. Replace Namespace with the following:

n For HP nodes, replace Namespace with HPQ
n For Dell nodes, replace Namespace with Dell
n For IBM nodes, replace Namespace with IBMSD
9. If the proper Namespace is found, connect to this Namespace.
n \\RemoteServerIpAddress\root\IBMSD for IBM.
n \\RemoteServerIpAddress\root\HPQ for HP.
n \\RemoteServerIpAddress\root\cimv2\Dell for Dell.
1318
10. Run a Query for specific information:
Select Manufacturer, Model, SerialNumber from CIM_Chassis
11. If the test was not successful, re-install the platform or Hardware Monitoring Agent software on the
remote server with the latest release.
Troubleshoot a VMWare node
VMWare nodes can be polled for Hardware information either through the vCenter or directly by using the
CIM protocol. Polling through the vCenter uses VMWare's native API interface. Polling the ESX server
directly uses the CIM protocol to get Hardware information.
Determine if a node is polled through the vCenter or directly
1. On the Web Console, click Settings > Virtualization Settings.

2. Listed is the table of all the currently polled VMWare nodes. This table contains the Polling Through
column.
Note: This column may be hidden. If the column is hidden, unhide it by clicking the drop down menu
of an adjacent column and check the Polling Through option:
1319
3. Use the illustration below to determine how your VMWare is being polled.
Hardware prerequisite checklist
If the following conditions cannot be met, the Hardware Health resources will not be displayed. To monitor
hardware in SAM, the following must be true:
n The monitored node must be HP Proliant, Dell PoweEdge, IBM X-Series, HP C7000, HP C3000, or Dell
M1000e.
n The node must be monitored using one of the following protocols:
n SNMP
n WMI
n ICMP nodes are allowed for VMWare when the Poll for VMware option is selected.
l The Hardware Monitoring Agent software, (provided by the vendor), is installed on the remote server.
This applies for both SNMP and WMI. Required software can be found at "Monitoring Hardware
Health".
l For VMware, the minimum requirements are as follows: ESX server version 3.5, 4.0, 4.1, ESXi version
5.0, vCenter version 4.0, 4.1, 5.0.
The following systems have been verified to work properly with SAM's hardware monitoring
features.
Other systems may work as well.
n Dell PowerEdge M610, R210, R610, R710, R900, 1950, 2850, 2950, 2970, 6850
n HP ProLiant DL320 G4, DL360 G3, DL360 G4, DL380 G4, DL380 G6, ML570 G3
n IBM IBM System x3550, System x3550 M2, System x3550 M3, System x3650, System x3650 M2, System
x3650 M3, x3850, eServer 306m
n HP C7000, HP C3000
n Dell M1000e.
1320
IBM's ServeRAID Manager software must be installed on IBM X-Series servers for storage hardware
health information to be displayed in SolarWinds SAM. HP’s WBEM providers are required for HP
servers polled via WMI.
Troubleshoot AppInsight for Exchange

The following sections will help you identify and correct AppInsight for Exchange errors concerning
configuration and performance counters:
n Troubleshoot permissions
n Troubleshoot Exchange performance counters
n Troubleshoot error codes in AppInsight for Exchange
Important: The following log file contains all the information and errors related to the WinRM
configuration process:
C:\ProgramData\Solarwinds\Logs\APM\RunWinRMConfigurator.log
Troubleshoot permissions
The following information helps you troubleshoot issues with the following:
n Non-Domain Accounts
n Adding Local Administrative privileges to Active Directory Account
n Exchange Access
n Mailbox Exchange Access
Mailboxes with an empty primary SMTP address can be polled; however, their Sent and Received
statistics are not available.
Non-Domain Account
Local accounts (Non-Domain) cannot access Exchange Management interfaces and therefore are not
supported by AppInsight for Exchange. Please select an Active Directory account or create a new one to
use with AppInsight for Exchange.
Add Local Administrative privileges to Active Directory Account
1. On the server where you wish to grant local administrative privileges, open a Computer Management
console.
2. Navigate to the Administrators group.
3. Add the type in the Active Directory user name of the account you want to grant administrative
privileges. (Ensure the location is set to either the domain where the account is located or Entire
Directory.)
4. Save your changes.
1321
Alternatively, you can add an Active Directory group to the local administrators group and add the
Active Directory user accounts to that group.
To verify the account and local group membership has been configured properly, run the
following in a PowerShell session
$Recurse = $true
$GroupName = 'Administrators'
Add-Type -AssemblyName System.DirectoryServices.AccountManagement
$ct = [System.DirectoryServices.AccountManagement.ContextType]::Machine
$group =
[System.DirectoryServices.AccountManagement.GroupPrincipal]::FindByIdentity
($ct,$GroupName)
$LocalAdmin = $group.GetMembers($Recurse) | select @{N='Domain'; E=
{$_.Context.Name}}, samaccountName, @{N='ObjectType'; E=
{$_.StructuralObjectClass}} -Unique
$LocalAdmin = $LocalAdmin | Where-Object {$_.ObjectType -eq "user"}
Exchange Access
Users and Computers (ADUC)
1. From the Start Menu, open ADUC and navigate to the Microsoft Exchange Security Groups OU.
2. Double click on the View-Only Organization Management group. After the window opens, click the
Members tab and then click Add.
1322
3. Type the user name of the account you want to grant access to the Exchange organization, and then
click OK.
4. Click Apply and then click OK, then close the ADUC window.
Access can also be granted using the Exchange Management Shell with the following
command
Replace the word "user" with the correct user name of the service account.
Add-RoleGroupMember -Identity "View-Only Organization Management" -

Member "USER"
To verify the management role is properly assigned, use the following commands:
Get-RoleGroupMember -Identity "View-Only Organization Management" |

Where-Object {$_.SamAccountName -eq "USER"}
Get-RoleGroupMember -Identity "Organization Management" | Where-
Object {$_.SamAccountName -eq "USER"}
or
Get-ManagementRoleAssignment -RoleAssignee “USER” | Where-Object

{$_.RoleAssigneeName -eq "View-Only Organization Management" -or
$_.RoleAssigneeName -eq "Organization Management"}
Mailbox Search Access
Mailbox Search access is required to determine attachment counts and sizes. It can be granted using the
Exchange Management Shell (EMS).
1. From the Start Menu, open the EMS.

2. Type: New-ManagementRoleAssignment -Role "Mailbox Search" -User "USER" and
press Enter.
To verify the management role has been properly assigned, use the following
command:
Get-ManagementRoleAssignment -RoleAssignee “USER” -Role "Mailbox

Search" | Where-Object {$_.RoleAssignmentDelegationType -eq
"Regular"}
Exchange Management Roles can be assigned to role assignees using either regular or
delegating role assignments.
n Regular role assignments enable the role assignee to access the permissions provided
by the management role entries on this role.
n Delegating role assignments give the role assignee the ability to assign this role to Role
Groups, Users, or Universal Security Groups.
1323
Troubleshoot Exchange performance counters
Occasionally, you may encounter an Exchange server which is missing some of the expected performance
counters. If this happens, you need to verify whether the counters are simply disabled or if they are
completely missing. The simplest way to do this is through the registry.
Warning: The following procedure requires modification to the registry and should be approached
with caution. It is highly recommended that you backup the registry before performing this
procedure. For instructions on backing up the registry, visit www.microsoft.com.
1. From the Registry editor, navigate to the service with the missing performance counters.
Note: Individual services are listed under HKLM\SYSTEM\CurrentControlSet\Services.
2. Expand the service and click on the Performance key. The important values we want to ensure exist
are listed below and displayed in Figure 1.
[HKEY_LOCAL_
MACHINE\SYSTEM\CurrentControlSet\Services\<ServiceName>\Performance]
Example: [HKEY_LOCAL_
MACHINE\SYSTEM\CurrentControlSet\Services\ESE\Performance]
"Close"="ClosePerformanceData"
"Collect"="CollectPerformanceData"
"Library"="<Path to performance counter DLL file>"
Example: "Library"="C:\\Program Files\\Microsoft\\Exchange

Server\\V15\bin\\perf\\%PROCESSOR_ARCHITECTURE%\\eseperf.dll"
"Open"="OpenPerformanceData"
"PerfIniFile"="<Name of performance counter INI file>"
Example:"PerfIniFile"="eseperf.ini"
The "Library" file path is typically "C:\Program Files\Microsoft\Exchange

Server\%ExchangeVersion%\Bin\perf\%Processor_
Architecture%\%DLLFileName%"
Figure 1.
1324
3. Verify the counters have not been disabled by expand the service and then clicking on the
"Performance" key.
4. Check for the value, Disable Performance Counters (See Figure 2.) If this value exists, ensure the data
value is 0. Any other value disables the counters.
5. Once the value is confirmed to be set to 0, close all PerfMon windows and then reopen them.
Note: The performance counters should be visible at this time. If the performance counters are not
visible, proceed to the next step.
Figure 2.
6. If the values First Counter, First Help, Last Counter, and Last Help are listed (See Figure 3), it is
highly recommended to unload the performance counters prior to reloading them.
Figure 3.
1325
Unload performance counters: (See Figure 4)
1. Close all Performance Monitor windows and stop any services which may be using these counters.
2. Open the Exchange Management Shell (EMS) in the Run as Administrator context.
3. Type: Add-PSSnapin Microsoft.Exchange.Management.PowerShell.Setup and then press
Enter.
4. Type: Remove-PerfCounters -DefinitionFileName "<Path to counter definition
XML file> and then press Enter.
a. The default location for Exchange counter definition files is: C:\Program
Files\Microsoft\Exchange
Server\%ExchangeVersion%\Setup\perf\%XMLFileName%
Reload performance counters: (See Figure 4)
1. Close all Performance Monitor windows and stop any services which may be using these counters.
2. Open the Exchange Management Shell (EMS) in the Run As Administrator context.
3. Type: Add-PSSnapin Microsoft.Exchange.Management.PowerShell.Setup and then
press Enter.
4. Type: New-PerfCounters -DefinitionFileName "<Path to counter definition XML
file> and then press Enter.
a. The default location for Exchange counter definition files is: C:\Program
Files\Microsoft\Exchange
Server\%ExchangeVersion%\Setup\perf\%XMLFileName%
5. Check the application log to verify the counters were properly loaded and no PerfLib errors exist.
Reopen PerfMon to ensure the counters are available.
Figure 4.
1326
Troubleshoot error codes in AppInsight for Exchange
Following are the possible error messages associated with AppInsight for Exchange. Included are possible
causes and solutions.
The following log file contains all the information and errors related to the WinRM configuration
process: C:\ProgramData\Solarwinds\Logs\APM\RunWinRMConfigurator.log
Configuration Errors
Error Message, Information, and Remediation
Error message: Remote configuration was unsuccessful due to the following: "The deployment service
executable was not found on the Orion server." For details, see the log on the Orion server:
([ALLUSERSPROFILE]\ProgramData\Solarwinds\Logs\APM\RemoteExecutableStarter.log).
Description: Internal error. The Remote Installation Service.exe file was not found. (Default
file location: C:\Program Files (x86)\SolarWinds\Orion\APM). This can be caused by an
incorrect SAM installation or Remote Installation Service.exe was deleted or modified.
Remediation: Add the Remote Installation Service.exe file to the following folder:
C:\Program Files (x86)\SolarWinds\Orion\APM.
Error message: Remote configuration was unsuccessful due to the following: "Failed to start Windows
Remote Management" For details, see the log on the Orion server: ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\RemoteExecutableStarter.log).
Remediation:
1. On the target Exchange server, navigate to the Windows Services console and find the Windows
Remote Management (WS-Management) service.
2. Set Startup type to Automatic.
3. Start the Windows Remote Management (WS-Management) service.
Error: Unable to access remote administrator share.
Cause: The remote administrator share cannot be accessed.
Resolution: Try enabling this feature manually by taking the following steps:
1. Ensure that both computers belong to the same Workgroup.

2. Specify which user(s) can access the Administrator Shares (Disk Volumes).
3. Enable File and print sharing through the Windows firewall.
4. Check to see if you can access the Administrator share from another computer.
1327
5. When complete, rerun the AppInsight for Exchange Automatic Configuration Wizard.
Error message: Remote configuration was unsuccessful due to the following: "The configurator
executable was not found on the Orion server." For details, see the log on the Orion server:
Description: Internal error. SolarWinds.APM.RemoteWinRmConfiguratorFull.exe file was not

found (Default file location: C:\Program Files (x86)\SolarWinds\Orion\APM). This can be
caused by an incorrect SAM installation or SolarWinds.APM.RemoteWinRmConfiguratorFull.exe
was deleted or modified..
Remediation: Add SolarWinds.APM.RemoteWinRmConfiguratorFull.exe to the following folder:

C:\Program Files (x86)\SolarWinds\Orion\APM.
Error message: Remote configuration was unsuccessful due to the following: "Access denied." For
details, see the log on the Orion server: ([ALLUSERSPROFILE]
Description: The provided user account does not have access to the Administrator share on the remote
Exchange server.
Remediation: Connect to the Administrator share with \\ExchangeComputerName\<drive

letter>$\ from the Orion server.
Error message: Remote configuration was unsuccessful due to the following: "The configurator
executable has an invalid signature." For details, see the log on the Orion server: ([ALLUSERSPROFILE]
Description: The configuration executable cannot be started on the remote Exchange server due to any
of the following:
n The high level of User Account Control settings

n The provided user account does not have privileges high enough to run *.exe files
n SolarWinds.APM.RemoteWinRmConfiguratorFull.exe is not signed with a Solarwinds
certificate.
Remediation:
n Reduce User Account Control settings on the remote Exchange server;

n Ensure the user's account has privileges to run *.exe files
1328
Error message: Remote configuration was unsuccessful due to the following: "The network path was not
found." For details, see the log on the Orion server: ([ALLUSERSPROFILE]
Description: This is a Windows error indicating that a networking component is malfunctioning.
Remediation:
n Ensure you have access to the Shared Storage drive.

1. In Windows Explorer, navigate to My Network Places > Entire Network > Microsoft Windows
Network > (workgroup name) > (Shared Storage drive name).
n Firewalls can block traffic to the network which could generate this message. Try temporarily
disabling any software or hardware firewalls to isolate the problem.
n Anti-spyware tools can block network traffic. Try temporarily disabling any anti-spyware programs
and restart the computer to isolate the problem.
Error message: Remote configuration was unsuccessful due to the following: "Executable configuration
file was not found on the Orion server." For details, see the log on the Orion server:
Description: Internal error. SolarWinds.APM.RemoteWinRmConfiguratorFull.exe.config was

not found (Default file location: C:\Program Files (x86)\SolarWinds\Orion\APM.) This can be
caused by an incorrect SAM installation or
SolarWinds.APM.RemoteWinRmConfiguratorFull.exe.config was deleted or modified.
Remediation: Add SolarWinds.APM.RemoteWinRmConfiguratorFull.exe.config to the

following location: C:\Program Files (x86)\SolarWinds\Orion\APM.
Error message: Remote configuration was unsuccessful due to the following: "PowerShell 2.0 was not
detected on the Exchange server." Learn how to correct this. For details, see the log on the remote
computer. ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\RunWinRMConfigurator.log).
Description: PowerShell 2.0 is not installed on the remote Exchange server.
Remediation: PowerShell 2.0 should be installed on Exchange server.
For Server 2008, download the installation file for PowerShell 2.0 at
http://support.microsoft.com/kb/968929/en-us and install it on the server.
PowerShell 2.0 is automatically installed on Server 2008 R2 and therefore no

additional installation is required.
1329
1. Open Server Manager.

2. Click on the Manage menu, and the select Add Roles and Features.
3. After the wizard opens, click Next until you get to the Installation Type page.
4. Select Role-based or feature-based installation.
5. Click Next until you reach the Features page.
6. Scroll down to Windows PowerShell. It likely shows itself as partially installed (square
inside box).
7. Check the box next to Windows PowerShell 2.0 Engine.
8. Click Next and then Install.
9. When the installation finishes, click Close.
Error message: Remote configuration was unsuccessful due to the following: "This account must be an
Active Directory account with local administrative privileges." Learn how to correct this. For details, see
the log on the remote computer. ([ALLUSERSPROFILE]
Description: The provided user account does not have Local Administrative privileges.
Remediation:
Add Local Administrative privileges to Active Directory Account
1. On the server where you wish to grant local administrative privileges, open a Computer
Management console.
2. Navigate to System Tools > Local Users and Groups > Groups and double click the Administrators
group.
3. Click Add and type in the Active Directory user name of the account you want to grant
administrative privileges, and then press Enter. (Ensure the location is set to either the domain
where the account is located or Entire Directory.)
4. Click Apply and then click OK.
Note: Alternatively, you can add an Active Directory group to the local administrators group and
add the Active Directory user accounts to that group.
Error message: Remote configuration was unsuccessful due to the following: "This account must be an
Active Directory account with organization wide Exchange access (View-Only-Organization Management
and Mailbox Search Management Role)." Learn how to correct this. For details, see the log on the remote
computer. ([ALLUSERSPROFILE]
1330
Description: The provided user account does not have View-Only-Organization Management or Mailbox
Search Management privileges.
Remediation:
Grant View-Only-Organization Management privileges
Users and Computers (ADUC). To accomplish this, take the following steps:
1. From the Start Menu, open ADUC and navigate to the Microsoft Exchange Security Groups OU.
2. Double click on the View-Only Organization Management group.
3. After the window opens, click the Members tab and then click Add.
4. Type the user name of the account you want to grant access to the Exchange organization, and
then click OK.
5. Click Apply, and then click OK.
6. Close the ADUC window.
Grant Mailbox Search Access
Mailbox Search access is required to determine attachment counts and sizes. This can be granted using
the Exchange Management Shell (EMS).
1. From the Start Menu, open the EMS.

2. Type: New-ManagementRoleAssignment -Role "Mailbox Search" -User <Username
of account being granted access> and then press Enter.
3. To verify the management role has been properly assigned, enter the following command:
Get-ManagementRoleAssignment -RoleAssignee <Username of account>
Error message: Remote configuration was unsuccessful due to the following: "An error occurred during
Exchange Server Confiduration. Multiple connections to a server or shared resource by the same user,
using more than one user name, are not allowed."
Cause: This is a Windows Limitation when trying to map multiple drives to the same computer using
different user accounts.
Resolution:
1. Open the Computer Manager on the Exchange server

2. Expand Shared Folders and select Sessions.
3. Right-click on the users in the list and click Close Session.
4. Once the session list is empty, retry the Configure Server button in AppInsight for Exchange.
For more information, see SWKB5583
1331
Error message: Remote configuration was unsuccessful due to the following: "WinRM test was
successful. PowerShell Exchange web site testing failed with the following error: Connecting to remote
server..."
Description: There are no default HTTPS bindings for all unassigned ports, (i.e. “HTTPS 443 *”.)
Remediation: Establish the missing default HTTPS binding with an Exchange certificate.
For information about Microsoft error codes, see: http://msdn.microsoft.com/en-us/library/cc231199.aspx
Troubleshooting AppInsight for IIS

The following sections help you identify and correct AppInsight for IIS errors concerning configuration and
performance counters.
n Change between 32-bit and 64-bit polling

n Credentials test failed
n Polling fails due to a missing certificate.
n IIS polling failed
n Node unreachable
n IIS version failed
n WinRM testing failed
n Error code 1367
n Error code 1726
n Error code 16004
n Error code 16005
n Error code 16006
n Error code 16007
n Error code 16008
n Error code 16009
n Error code 16013
n Error code 16022
n Error code 16023
n Error code 16024
n Error code 16029
n Error Code 16049
n Error code 16090
n Other errors
n WinRM 2.0
n Event IDs
1332
Access is denied when configuring AppInsight for IIS
Issue: You may encounter access denied errors when you choose not to use the built-in administrator
account for IIS polling. This can occur if you create a new user and then add this user to the
Administrator's group.
Cause: If the group policy or the local policy has Administrator Approval Mode set to Enable, the polling
fails with an error. This is usually because the administrator account does not have enough permissions.
Resolution:
1. In your local security policy, navigate to Local Policies > Security Options > User Account Control: Run
all administrators in Admin Approval Mode.
Note: This should be set to Disabled to let administrators poll properly.
2. Navigate to Local Policies > Security Options > User Account Control: Admin Approval Mode for the
Built-in Administrator Account.
Note: This should be Disabled for the built-in administrator to poll properly.
3. When complete, rerun the AppInsight for IIS Automatic Configuration Wizard.
Change between 32-bit and 64-bit polling
Using AppInsight applications with 32-bit polling on 64-bit computers via an agent prevents certain
performance counters from collecting information and should be changed to 64-bit polling.
Changing this at the application level
2. Select an AppInsight Application (Exchange, SQL, IIS) and then click Edit Application Monitor.
3. Expand Advanced, and then click Override Template.
4. In the Platform to run polling job field, change the value to x64.
5. Click Submit.
Changing this at the template level
2. Select an AppInsight application and click Edit.
1333
3. Expand Advanced, and in the Platform to run polling job on field, change the value to x64.
4. Click Submit.
Credentials test failed
Error: The credentials given are not valid. Please provide the correct credentials for an account with WMI
permissions.
Resolution: Enter valid credentials.
For more information, see Inherit Credentials from Node.
Polling fails due to a missing certificate.
Issue: You receive an error similar to the following: The SSL connection cannot be established. Verify that
the service on the remote host is properly configured to listen for HTTPS requests.
Cause: A PowerShell listener was created but its certificate is missing.
Resolution: Manually remove the existing PowerShell listener and re-run the IIS configuration wizard. This
process creates a new listener along with the appropriate certificate needed.
IIS polling failed
Error: Application polling failed because IIS information is currently unavailable.
1334
Cause: This is a general error message returned by Windows when a networking component is
malfunctioning.
Resolution: For details, see the log on the Orion server located at: ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\RemoteExecutableStarter.log). Following are some of
the more common reasons why this error message might be returned by Windows:
For example: Restart the remote registry service, check that TCP port 445 is open between the Orion
server and the remotely monitored IIS server.
When complete, rerun the AppInsight for IIS Automatic Configuration Wizard.
Node unreachable
Error: Credentials test failed. Node is unreachable.
Resolution: Ensure the node is currently being managed. For more information, see Schedule tasks to be
stopped using the Unmanage Scheduling utility. When complete, rerun the AppInsight for IIS Automatic
Configuration Wizard.
IIS version failed
Error: The current version of IIS is 6.0. Version 7.0 or higher is required.
Resolution: Install IIS version 7.0 or higher. When complete, rerun the AppInsight for IIS Automatic
WinRM testing failed
Error: WinRM testing failed with the following error: Connecting to remote server failed with the following
error message: Access is denied.
Resolution: Set the appropriate permissions for PowerShell on the target server. When complete, rerun
the AppInsight for IIS Automatic Configuration Wizard.
Set the appropriate permissions for PowerShell on the target server

2. Execute the following PowerShell command: Set-PSSessionConfiguration
Microsoft.PowerShell -ShowSecurityDescriptorUI -force (The permissions dialog
should appear.)
3. Enable Full Control for everyone.
4. Ensure that the group to which the polling user belongs has access to Microsoft PowerShell.
Error code 1367
Error: Incorrect user name or password.
Resolution: Enter a valid user name and password combination. When complete, rerun the AppInsight for
IIS Automatic Configuration Wizard.
For more information, see Inherit Credentials from Node.
1335
Error code 1726
Error: An error occurred during Server configuration.
Cause: This can be due to a temporarily slow network or a heavily taxed computer at the moment of
configuration causing the remote installer not to receive the necessary exit codes. Configuration is most
likely successful at this point and the displayed error message is simply a response to the exit codes not
being returned.
Resolution: Running the configuration wizard again or clicking, I've already manually configured this
server under Advanced should result in a successful configuration.
Error code 16004
Error: The deployment service executable was not found on the Orion server.
Cause: The Remote Installation Service.exe file was not found. This could be caused by an
incorrect SAM installation or the Remote Installation Service.exe was deleted or modified.
Resolution: Add the Remote Installation Service.exe file to the following directory: C:\Program
Files (x86)\SolarWinds\Orion\APM. For details, see the log on the Orion server located at:
Error code 16005
Error: The configuration executable was not found on the Orion server.
Cause: The SolarWinds.APM.RemoteIISConfigurator.exe file was not found. This can be caused
by an incorrect SAM installation or the SolarWinds.APM.RemoteIISConfigurator.exe file was
deleted or modified.
Resolution: Add the SolarWinds.APM.RemoteIISConfigurator.exe file to the following directory:

C:\Program Files (x86)\SolarWinds\Orion\APM. For details, see the log on the Orion server
located at: ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\RemoteExecutableStarter.log). When complete, rerun
1336
Error code 16006
Error: Access denied.
Cause: The provided user account does not have access to the Administrator share on the remote IIS
server.
Resolution: Ensure the provided user account has access to the Administrator share by trying to connect
to the Administrator share with the following: \\IISComputerName\<drive letter>$\ from the Orion
server. When complete, rerun the AppInsight for IIS Automatic Configuration Wizard.
Error code 16007
Error: The configuration executable has an invalid signature.
Cause: The configuration executable cannot be started on the remote IIS server due to one or more of the
following:
n The high level of User Account Control settings;

n The provided user account does not have privileges to run executable files;
n The SolarWinds.APM.RemoteIISConfigurator.exe file is not signed with a Solarwinds
certificate.
Resolution: Try to lower the User Account Control settings on remote IIS server. Also check that the user
account has privileges to run executable files. When complete, rerun the AppInsight for IIS Automatic
Error code 16008
Error: The network path was not found.
Cause: This is a general error message returned by Windows when a networking component is
malfunctioning. This may be caused by not having the appropriate root or intermediate certificate on the
remote IIS server.
Resolution: For details, see the log on the Orion server located at: ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\RemoteExecutableStarter.log). Following are some of
the more common reasons why this error message might be returned by Windows:
n Ensure you have access to the shared storage drive. When complete, rerun the AppInsight for IIS
Automatic Configuration Wizard.
n Firewalls can block traffic to the network which could generate this message. Try temporarily
disabling any software or hardware firewalls to isolate the problem. When complete, rerun the
AppInsight for IIS Automatic Configuration Wizard.
n Like firewalls, some anti-spyware tools have the same effect. Try temporarily disabling any anti-
spyware programs and restart the computer to isolate the problem. When complete, rerun the
AppInsight for IIS Automatic Configuration Wizard.
1337
Error code 16009
Error: The configuration file for the configuration executable was not found on the Orion server.
Cause: This is an internal error. This can be caused by either an incorrect SAM installation, or the
SolarWinds.APM.RemoteIISConfigurator.exe.config file was deleted or modified.
Resolution: Add the SolarWinds.APM.RemoteIISConfigurator.exe.config file to the following

directory: C:\Program Files (x86)\SolarWinds\Orion\APM. For details, see the log on the Orion
server located at:
Error code 16013
Error: Unable to access remote administrator share.
Cause: The remote administrator share cannot be accessed.
Resolution: Try enabling this feature manually by taking the following steps:
1. Ensure that both computers belong to the same Workgroup.

2. Specify which user(s) can access the Administrator Shares (Disk Volumes).
3. Enable File and Print Sharing through the Windows firewall.
4. Check to see if you can access the Administrator share from another computer.
Error code 16022
Error: An HTTPS listener currently exists on port 5986.
Cause: This error means that an HTTPS listener already exists on port 5986 and cannot be reused because
it is not configured to listen for the target IIS server IP address.
Resolution: For details, see the log on the target computer located at: ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\RemoteIISConfigurator.log &
RemoteIISConfiguratorPowerShell.log). For configuring WinRM using a different port, see
WinRM 2.0
Error code 16023
Error: Unable to create a self-signed certificate.
Cause: An unexpected error occurred during the certificate creation process.
Resolution: Check the configuration script log file located on target the IIS server, located at
[ALLUSERSPROFILE]\ProgramData\Solarwinds\Logs\APM\RemoteIISConfigurator.log.
1338
Error code 16024
Error: Unable to create wsMan listener.
Cause: This error means that an unexpected error occurred during wsMan listener creation.
Resolution: Check the configuration script log file located on the target IIS server at,
[ALLUSERSPROFILE]\ProgramData\Solarwinds\Logs\APM\RemoteIISConfigurator.log.
Error code 16029
Error: Failed to start Windows Remote Management.
Cause: This error means that the Windows Remote Management (WS-Management) service cannot be
started remotely.
Resolution: Ensure the Windows Remote Management service is running on the target IIS server.
Error Code 16049
Error: An unknown error occurred during IIS server configuration.
Resolution: For more information, see Other errors. Once the problem is isolated, rerun the AppInsight
for IIS Automatic Configuration Wizard.
Error code 16090
Error: PowerShell 2.0 or higher is required.
Cause: PowerShell 2.0 or higher is not installed on the target server.
Resolution: Ensure that PowerShell 2.0 or higher is installed on the target server. When complete, rerun
For Windows Server 2008, download the installation file for PowerShell 2.0 at
http://support.microsoft.com/kb/968929/en-us and install it on the target server.
PowerShell 2.0 is automatically installed on Windows Server 2008 R2 and therefore no additional
installation is required.
Other errors
Issue: PowerShell 2.0 is not Installed
Resolution: Install PowerShell.
For Server 2008, download the installation file for PowerShell 2.0 at
http://support.microsoft.com/kb/968929/en-us and install it on the server.
1339
PowerShell 2.0 is automatically installed on Server 2008 R2 and therefore no additional
installation is required.
Set the appropriate permissions for PowerShell on the target server

2. Execute the following PowerShell command: Set-PSSessionConfiguration
Microsoft.PowerShell -ShowSecurityDescriptorUI -force (The
permissions dialog should appear.)
3. Enable Full Control.
4. Ensure that the group to which the polling user belongs has access to Microsoft
PowerShell.
Issue: PowerShell WebAdministration snapin is not installed.
Information: For legacy systems with IIS 7.0 (Windows Vista, Windows 2008) PowerShell
WebAdministration snapins are not part of IIS.
Resolution: Download and install the PowerShell WebAdministration snapins found at the following link:
http://www.iis.net/downloads/microsoft/powershell
Issue: Polling IIS servers is unsuccessful.
Possible Errors: OutOfMemoryException, Not enough storage, WinRM, WinRM not functioning properly,
and so on.
Cause: IIS servers hosting many sites may cause polling to be unsuccessful.
Resolution: Increase the polling frequency and Memory per Shell Limit on the target node as needed.
Increase the polling frequency
The default value is set at 300 seconds (five minutes). If you see more than a five minute gap in a graphed
resource, this value can be increased, as in any other SAM application.
1. Click My Dashboards > SAM Summary, and then select an application to be taken to the Application
details page.
2. Click Edit Application Monitor > Override template (next to Polling Frequency).
3. Change to the desired value, and then click Submit.
Increase the memory per shell limit
1. Run PowerShell via Run as Administrator and execute the following command to get the actual value:
winrm get winrm/config/Winrs
1340
2. Examine MaxMemoryPerShellMB. If the value is less than 512, increase this value by executing
the following command:
Set-Item WsMan:\localhost\Shell\MaxMemoryPerShellMB NewValue -WarningAction
SilentlyContinue;
where the NewValue is the desired memory limit. If the error persists, the value should be
increased again.
Event IDs
The matrix below outlines and defines Microsoft event IDs to help aid in troubleshooting:
Event ID Source Log Severity Message
2281 Microsoft- Application Warning Worker process failed to initialize communication

Windows- with the World Wide Web Publishing Service and
IIS- therefore could not be started
WMSVC
2297 Microsoft- Application Warning Worker process for application pool encountered
Windows- an error while trying to read global module
IIS- configuration
W3SVC-
WP
5039 Microsoft- System Warning Worker process serving an application pool

Windows- reported a failure
WAS
5015 Microsoft- System Warning Worker process serving application pool was
Windows- orphaned
WAS
5127 Microsoft- System Warning Worker process serving the application pool is no
Windows- longer trusted by Windows Process Activation
WAS Service (WAS)
1173 Microsoft- System Error World Wide Web Publishing Service did not
Windows- initialize the HTTP driver and was unable start
IIS-W3SVC
1026 Microsoft- System Warning World Wide Web Publishing Service encountered
Windows- an error when it tried to secure the handle of the
IIS-W3SVC application pool
1341
1135, 1134 Microsoft- System Warning World Wide Web Publishing Service failed to
Windows- configure the centralized World Wide Web
IIS- Consortium (W3C) logging properties
WMSVC
1020 Microsoft- System Warning World Wide Web Publishing Service failed to
Windows- configure the HTTP.SYS control channel property
IIS-
WMSVC
1062 Microsoft- System Warning World Wide Web Publishing service failed to
Windows- configure the logging properties for the HTTP
IIS- control channel
WMSVC
1126 Microsoft- System Warning World Wide Web Publishing Service failed to copy
Windows- a change notification for processing
IIS-W3SVC
Windows- enable end point sharing for the HTTP control
IIS-W3SVC channel
1071, 1073 Microsoft- System Warning World Wide Web Publishing Service failed to
Windows- enable global bandwidth throttling
IIS-W3SVC
Windows- properly configure the application pool queue
IIS-W3SVC length
Windows- properly configure the load balancer capabilities
IIS-W3SVC on application pool
5067 Microsoft- System Warning World Wide Web Publishing Service property
Windows- failed range validation
WAS
1037 Microsoft- System Warning HTTP control channel for the World Wide Web
Windows- Publishing Service did not open
IIS-W3SVC
1342
2208 Microsoft- Application Warning HTTP Server could not create a client connection
Windows- object for user
IIS-
WMSVC
2206 Microsoft- Application Warning HTTP Server could not create the main connection
Windows- socket
IIS-
WMSVC
2201 Microsoft- Application Warning HTTP Server could not initialize its security
Windows-
IIS-
WMSVC
2203 Microsoft- Application Warning HTTP Server could not initialize the socket library
Windows-
IIS-
WMSVC
2204 Microsoft- Application Warning HTTP Server was unable to initialize because of a
Windows- shortage of available memory
IIS-
WMSVC
2274, 2268, Microsoft- Application Warning ISAPI application error detected

2220, 2219, Windows-
2214 IIS-
WMSVC
5088, 5061, Microsoft- System Warning Job object associated with the application pool
5060 Windows- encountered an error
WAS
2227 Microsoft- Application Warning The server was unable to acquire a license for an
Windows- SSL connection
IIS-
WMSVC
2233 Microsoft- Application Warning The server was unable to allocate a buffer to read
Windows- a file
IIS-
WMSVC
1343
2226, 2230, Microsoft- Application Warning The server was unable to read a file
2231, 2232 Windows-
IIS-
WMSVC
5174, 5179, Microsoft- System Warning Windows Process Activation Service (WAS)
5180 Windows- detected invalid configuration data
WAS
5085 Microsoft- System Warning Windows Process Activation Service (WAS) did not
Windows- apply configuration changes to application pool
WAS
5054, 5091 Microsoft- System Error Windows Process Activation Service (WAS) did not
Windows- run the automatic shutdown executable for
WAS application pool
5063 Microsoft- System Warning Windows Process Activation Service (WAS)

Windows- encountered a failure requesting IIS configuration
WAS store change notifications

Windows- encountered a failure while setting the affinity
WAS mask of an application pool
5066 Microsoft- System Error Windows Process Activation Service (WAS)

Windows- encountered an error attempting to configure
WAS centralized logging

Windows- encountered an error attempting to look up the
WAS built-in IIS_IUSRS group
5172, 5173 Microsoft- System Warning Windows Process Activation Service (WAS)
Windows- encountered an error trying to read configuration
WAS

Windows- encountered an internal error while managing a
WAS worker process
5101 Microsoft- System Error Windows Process Activation Service (WAS) failed
Windows- to create application pool
WAS
1344
5070, 5093 Microsoft- System Warning Windows Process Activation Service (WAS) failed
Windows- to issue recycle request to application pool
WAS
5005 Microsoft- System Error Windows Process Activation Service (WAS) is

Windows- stopping because it encountered an error
WAS

Windows- received a change notification but was unable to
WAS process it correctly
2296 Microsoft- Application Warning Module has an invalid precondition

Windows-
IIS-
W3SVC-
WP
2295 Microsoft- Application Warning Module registration error detected (failed to find
Windows- RegisterModule entry point)
IIS-
W3SVC-
WP
2293 Microsoft- Application Warning Module registration error detected (module

Windows- returned an error during registration)
IIS-
WMSVC
1133 Microsoft- System Warning Only one type of logging can be enabled at a time
Windows-
IIS-W3SVC
2261 Microsoft- Application Warning SF_NOTIFY_READ_RAW_DATA filter notification is

Windows- not supported in IIS
IIS-
WMSVC
5036 Microsoft- System Error The configuration manager for Windows Process
Windows- Activation Service (WAS) did not initialize
WAS
1345
2264 Microsoft- Application Warning The directory specified for caching compressed
Windows- content is invalid
IIS-
WMSVC
2298 Microsoft- Application Warning The Global Modules list is empty

Windows-
IIS-
W3SVC-
WP
2218 Microsoft- Application Warning The HTTP server encountered an error processing
Windows- the server-side include file
IIS-
WMSVC
2258 Microsoft- Application Warning The server failed to close client connections to
Windows- URLs during shutdown
IIS-
WMSVC
5152 Microsoft- System Warning Application pool has an IdleTimeout equal to or

Windows- greater than the PeriodicRestart time
WAS
5010, 5011, Microsoft- System Warning Application pool worker process is unresponsive
5012, 5013 Windows-
WAS
5009 Microsoft- System Warning Application pool worker process terminated

Windows- unexpectedly
WAS
2216 Microsoft- Application Warning A script has not responded within the configured
Windows- time-out period
IIS-
WMSVC
2221 Microsoft- Application Warning A server-side-include file has included itself, or

Windows- the maximum depth of server-side include files
IIS- has been exceeded
WMSVC
1346
2222 Microsoft- Application Warning An attempt was made to load an ISAPI filter on a
Windows- server instance, but because it requires the SF_
IIS- NOTIFY_READ_RAW_DATA filter notification, it
W3SVC- must be loaded as a global filter
WP
500, 499, 23, Active Application Warning ASP application error occurred
22, 21, 20, 19, Server
18, 17, 16, 9, 8, Pages
7, 6, 5
5030 Microsoft- System Error Windows Process Activation Service (WAS)

Windows- terminated unexpectedly, and the system was not
WAS configured to restart it.
2279, 2278, Microsoft- Application Warning Worker process encountered an error during
2277 Windows- initialization
IIS-
W3SVC-
WP
1005 Microsoft- The World Wide Web Publishing Service (WWW

Windows- Service) is stopping because it encountered an
IIS-W3SVC error. The data field contains the error number
8001 Microsoft- The Web Management Service was stopped

Windows- because it did not respond
IIS-
WMSVC
WinRM 2.0
An HTTPS listener currently exists on port 5986
Important: If you received the following error: An HTTPS listener currently exists on port 5986, use
the following steps to configure the listener on an available port by changing 5986 to an available
port number throughout these steps.
1347
1. To configure WinRM on a server, open a command prompt in the Run as Administrator context.
certificate>";Hostname="<IP Address of Server>_Solarwinds_IIS_Zero_

1. Open PowerShell in the Run as Administrator context.

2. Create a function for adding firewall rules using the following code:
function Add-FirewallRule {
param(
$name,
$tcpPorts,
$appName = $null,
$serviceName = $null
)
$fw = New-Object -ComObject hnetcfg.fwpolicy2
$rule = New-Object -ComObject HNetCfg.FWRule
$rule.Name = $name
if ($appName -ne $null) { $rule.ApplicationName = $appName }
if ($serviceName -ne $null) { $rule.serviceName = $serviceName }
$rule.Protocol = 6 #NET_FW_IP_PROTOCOL_TCP
$rule.LocalPorts = $tcpPorts
$rule.Enabled = $true
$rule.Grouping = "@firewallapi.dll,-23255"
$rule.Profiles = 7 # all
$rule.Action = 1 # NET_FW_ACTION_ALLOW
$rule.EdgeTraversal = $false
$fw.Rules.Add($rule)
}
1348
3. Run the function to create the firewall exception for WSMAN using the following command:
Add-FirewallRule "Windows Remote Management" "5986" $null $null
4. Verify the rule was created by navigating to Control Panel > Windows Firewall > Advanced Settings.
Troubleshoot ESX hardware monitoring

Error message: Unable to connect to remote server, check the following:
n Ensure CIM is enabled on the ESX server.

n Ensure port 5989 is opened on the firewall
Error message: If the ESX server returns the message, Unable to establish session with all provided
credentials, check the following:
n Verify the VMware credentials in the VIM are correct

n Verify the account belongs to the root user group
Troubleshoot baseline thresholds

Thresholds could not be calculated, standard deviation is zero
There has been no statistically significant deviation of the collected metric during the baseline
period. Without some variance in the polled value, it is not possible to determine a valid warning or
critical threshold. For example if you poll Disk I/O statistics on an inactive volume, the value is always
zero and there is no way to statistically know whether 1 is bad, or if 1.000.000 is still good.
1349
The recommended warning or critical thresholds are less then minimum value for the statistic
This occurs when the Less Than, Greater Than operators are changed, but the values are not
updated. For example, when you have a Greater Than operator, the warning threshold cannot be
greater than the critical threshold. The inverse is true for the Less Than operator.
1350

SAMAdminGuide PDF

Transféré par

Informations du document

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

SAMAdminGuide PDF

Transféré par

Droits d'auteur :

Formats disponibles

SolarWinds

Server & Application Monitor

Last Updated: Friday, June 10, 2016

SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS

Server & Application Monitor Administrator Guide, Version 6.2.4, 5/3/2016

How Does SolarWinds Server & Application Monitor Work? 40

Requirements and Installation 44

Prepare a SolarWinds Orion Platform installation 44

SAM software requirements 45

Server port requirements 47

SolarWinds SAM database server (SQL server) requirements 47

SAM requirements for virtual machines and servers 49

Additional monitoring requirements 50

Quality of Experience requirements 52

Configure the SolarWinds Orion server to use the correct syslog port 54

SQL server configuration best practices 55

Maximizing SQL server performance 55

Hardware settings for SQL servers 56

Database file setting recommendations 58

Memory setting recommendations 58

CPU setting recommendations 58

Security enhancements and exceptions for SolarWinds Orion Platform products 58

Enable secure channels with SSL 58

Antivirus directory exclusions 61

SolarWinds Orion Platform products licensing 61

Activate your SolarWinds license 62

License Manager requirements 63

Additional SAM technology requirements 67

SNMP requirements for monitored devices 68

Additional SolarWinds SAM requirements 68

Asset inventory and hardware health monitoring requirements 68

AppInsight for SQL requirements and permissions 69

AppInsight for Exchange requirements and permissions 71

AppInsight for IIS requirements and permissions 72

Requirements for the Windows Scheduled Task Monitor 73

SNMP requirements for monitored devices 73

Scale SAM for larger environments 74

SAM licensing model detailed 75

See the available component monitors remaining in your license 77

Install and configure Server & Application Monitor 77

Configure Server & Application Monitor 78

Run SolarWinds SAM 78

Perform common tasks 78

Install, upgrade, and move SolarWinds Server & Application Monitor 79

Uninstall SAM from your server 79

Administer and implement SAM technologies 81

Manage Orion Web Console 81

Log in to the Orion Web Console 81

Customize the Orion Web Console 82

Orion Web Console and chart settings 107

Administrative functions 110

Manage Users 113

Manage Orion Web Console user accounts 113

Create users 113

Change account passwords 116

Enable users to authenticate through LDAP 117

Define what users can access and do 117

Set default menu bars and views for users 120

Limit users to specific network areas 121

Configure automatic login 123

Enable LogonFallback 125

Discover and add network devices 128

Discover your network with the Discovery Wizard 129