1.
Orion Advanced Alert Training For SolarWinds Customers

2.
Orion NPM Customer Training <ul><li>This presentation is a SolarWinds customer training on Orion Network Performance Monitor (NPM.) If you are not a SolarWinds customer, we recommend downloading & installing a 30-Day Trial evaluation of Orion NPM so you can follow along & understand the material being presented better. </li></ul><ul><li>SolarWinds Trials to Download: </li></ul><ul><li>Orion Network Performance Monit or – Download Now>> </li></ul>

3.
<ul><li>A big “Howdy” from SolarWinds </li></ul><ul><li>based in Austin, Texas </li></ul><ul><ul><li>Brandon Shopp– Sr. Product Manager </li></ul></ul><ul><ul><li>Chris LaPoint - Sr. Product Manager </li></ul></ul><ul><ul><li>Andy McBride – Technical Support Specialists </li></ul></ul><ul><ul><li>Kate Asaff – Field Application Engineer </li></ul></ul><ul><li>Today’s Topic: Training on Orion Advanced Alerts </li></ul><ul><li>Who is SolarWinds? </li></ul><ul><ul><li>Dude, if you don’t’ know this </li></ul></ul><ul><ul><li>you’re on the wrong webcast… </li></ul></ul>Introduction

4.
Housekeeping <ul><li>Can you hear me now? </li></ul><ul><ul><li>If not, use the GoToWebinar chat or Q&A panel to let us know. </li></ul></ul><ul><li>How do you win the free stuff? </li></ul><ul><li>How do you ask questions? </li></ul><ul><li>Will this thing be recorded? </li></ul><ul><li>Ask lots of questions </li></ul>

5.
Agenda <ul><li>Introduction to Orion Advanced Alerts </li></ul><ul><ul><li>How Alerts Work </li></ul></ul><ul><li>Advanced Alert Manager Interface </li></ul><ul><ul><li>Navigating the Interface </li></ul></ul><ul><ul><li>Condition Groups </li></ul></ul><ul><ul><li>Configuring a Simple Alert </li></ul></ul><ul><ul><li>Alert Actions and Escalations </li></ul></ul><ul><ul><li>Suppression </li></ul></ul><ul><ul><li>Using Custom Properties </li></ul></ul><ul><ul><li>Using Alert Variables </li></ul></ul><ul><li>Common Problems </li></ul><ul><ul><li>Troubleshooting </li></ul></ul><ul><li>Resources </li></ul><ul><ul><li>What’s Available Now </li></ul></ul><ul><ul><li>What’s New </li></ul></ul><ul><li>Q&A </li></ul>

6.
How Advanced Alerts Work How Alerts Work – A Look Under the Hood

7.
Advance Alert Manager <ul><li>Launching the Interface </li></ul><ul><li>Quick Tour </li></ul>Interface Demo

8.
<ul><li>Condition Group Types </li></ul><ul><ul><li>All = logical AND </li></ul></ul><ul><ul><li>Any = logical OR </li></ul></ul><ul><ul><li>Not all and None - Don’t use </li></ul></ul><ul><ul><ul><li>Trigger if not all of the following are true: </li></ul></ul></ul><ul><ul><ul><ul><li>Node is Up </li></ul></ul></ul></ul><ul><ul><ul><ul><li>Node Name is Chef </li></ul></ul></ul></ul><ul><ul><ul><li>This alert will now trigger any time a node is in any state other than up, but it will also trigger if the node name is anything other than Chef, which would make this alert pretty much useless. </li></ul></ul></ul><ul><li>Embedded condition groups </li></ul><ul><ul><li>Follow the left alignment </li></ul></ul>Condition Groups

9.
Question #1 <ul><li>Which alert feature allows sending an email when an alert condition exists? </li></ul><ul><li>A. Condition Groups </li></ul><ul><li>B. Alert Actions </li></ul><ul><li>C. Reset Actions </li></ul><ul><li>D. Suppression </li></ul>

10.
Question #1 <ul><li>Which alert feature allows sending an email when an alert condition exists? </li></ul><ul><li>A. Condition Groups </li></ul><ul><li>B. Alert Actions </li></ul><ul><li>C. Reset Actions </li></ul><ul><li>D. Suppression </li></ul>

11.
Alert Example #1 <ul><li>Launching and Configuring Simple Alerts </li></ul><ul><ul><li>WAN Peak Alert: Alert when a WAN interface utilization exceeds 95% </li></ul></ul><ul><ul><li>Add reset condition </li></ul></ul>

12.
Alert Example #1 <ul><li>Configuring a Simple Alert </li></ul><ul><ul><li>WAN Peak Alert: Alert when a WAN interface utilization exceeds 95% </li></ul></ul><ul><ul><li>Add reset condition </li></ul></ul><ul><ul><li>Add time of day, day of week qualifiers </li></ul></ul><ul><ul><li>Add alert and reset actions with variables </li></ul></ul><ul><ul><li>Test the alert </li></ul></ul>

13.
Alert Example #2 <ul><li>Configuring a Simple Alert for an Extended Condition </li></ul><ul><ul><li>WAN Sustained High Usage Alert: Alert when a WAN interface utilization exceeds 75% for 2 polling periods </li></ul></ul><ul><ul><ul><li>Can be a symptom of an application or protocol request loop issue </li></ul></ul></ul>

14.
<ul><li>If Suppression Condition is True, the Alert is Suppressed Regardless of the Alert Condition. </li></ul><ul><ul><li>Example #1 – Direct Suppression </li></ul></ul><ul><ul><ul><li>Alert condition: Node down </li></ul></ul></ul><ul><ul><ul><li>Suppression condition: node name = Lab router </li></ul></ul></ul><ul><ul><ul><li>Result = if a node exists in SQL database with the name “Lab router”, then all node down alerts will be suppressed for this alert. </li></ul></ul></ul>Suppression Examples

15.
<ul><li>If Suppression Condition is True, the Alert is Suppressed Regardless of the Alert Condition. </li></ul><ul><ul><li>Example #1 - </li></ul></ul><ul><ul><ul><li>Alert condition: Node down </li></ul></ul></ul><ul><ul><ul><li>Suppression condition: node name = Lab router </li></ul></ul></ul><ul><ul><ul><li>Result = if a node exists in SQL database with the name “Lab router”, then all node down alerts will be suppressed for this alert. </li></ul></ul></ul><ul><ul><li>Example #2 – Embedded Suppression </li></ul></ul><ul><ul><ul><li>Alert condition: Simple condition group </li></ul></ul></ul><ul><ul><ul><ul><li>Trigger Alert when All of the following apply </li></ul></ul></ul></ul><ul><ul><ul><ul><ul><li>Alert Status is equal to Down </li></ul></ul></ul></ul></ul><ul><ul><ul><ul><ul><li>Node Name not equal Lab router (Suppression condition) </li></ul></ul></ul></ul></ul><ul><ul><ul><li>Result: Alert will only fire when device other than lab router is down </li></ul></ul></ul>Suppression Examples

16.
Complex Alert with Suppression <ul><li>Create an Alert for a Gateway Device Failure </li></ul><ul><li>Suppress Device Down Alerts for Devices Behind Gateway </li></ul>

17.
Complex Alert with Suppression <ul><li>Configuring a Complex Alert </li></ul><ul><ul><li>Create a Custom Property for and assign to all devices in the remote site </li></ul></ul><ul><ul><li>Create an alert for custom property is true AND node is status is not equal to up </li></ul></ul><ul><ul><li>Suppress if IP Address = Address is Gateway Address AND node status is not equal to up </li></ul></ul><ul><li>Create a second, separate alert </li></ul><ul><ul><li>Alert if IP Address = Address of Gateway AND Node Status is not equal to up </li></ul></ul>

18.
<ul><li>Allows for Alert Notifications </li></ul><ul><ul><li>Send Email </li></ul></ul><ul><ul><ul><li>Ticket system integration </li></ul></ul></ul><ul><ul><li>Send syslog message or SNMP trap </li></ul></ul><ul><ul><li>Play a sound </li></ul></ul><ul><ul><li>Execute a script of program </li></ul></ul><ul><ul><li>Send a Windows Net message </li></ul></ul><ul><ul><li>Lots more – see Orion Admin Guide </li></ul></ul><ul><li>Variables Allow for Specific Alert Messages </li></ul><ul><ul><li>What exactly triggered </li></ul></ul><ul><ul><li>What was affected </li></ul></ul><ul><ul><li>Lots of others </li></ul></ul>Adding Alert Actions and Variables

19.
Other Orion Alert Types <ul><li>Basic Alerts </li></ul><ul><ul><li>Most all functionality exists in Advanced Alerts </li></ul></ul><ul><li>Syslog Alerts </li></ul><ul><ul><li>Defined in Syslog Alerts/Rules UI. reset conditions, actions and ability to filter by host, message string, etc </li></ul></ul><ul><li>Trap Alerts </li></ul><ul><ul><li>Defined in Trap Alerts/Rules UI. Allows for filtering, parsing, thresholds and alert actions. </li></ul></ul>

20.
Question #2 <ul><li>What are Alert Variables used for? (Choose two.) </li></ul><ul><li>A. To play a sound </li></ul><ul><li>B. To indicate the alert trigger </li></ul><ul><li>C. To indicate the affected devices </li></ul><ul><li>D. Suppression </li></ul>

21.
Question #2 <ul><li>What are Alert Variables used for? (Choose two.) </li></ul><ul><li>A. To play a sound </li></ul><ul><li>B . To indicate the alert trigger </li></ul><ul><li>C. To indicate the affected devices </li></ul><ul><li>D. Suppression </li></ul>

22.
<ul><li>Issue will be in one of three areas </li></ul><ul><ul><li>1 - Alert Condition </li></ul></ul><ul><ul><ul><li>Errors in condition logic </li></ul></ul></ul><ul><ul><ul><ul><li>Conditions impossible to meet </li></ul></ul></ul></ul><ul><ul><ul><li>Suppression killing all triggers </li></ul></ul></ul><ul><ul><li>2 - Alert Action </li></ul></ul><ul><ul><ul><li>Error in external program or script </li></ul></ul></ul><ul><ul><ul><li>Email issues </li></ul></ul></ul><ul><ul><li>3 - Alert is OK but test is invalid </li></ul></ul><ul><ul><ul><li>Check test logic and alert criteria </li></ul></ul></ul><ul><ul><li>What to do if you get hopelessly stumped? </li></ul></ul><ul><ul><ul><li>Announcing the …….. </li></ul></ul></ul>Troubleshooting Alerts

23.
Thwack Alert Lab! <ul><li>A cross product forum dedicated to helping user quickly solve issues with alerts </li></ul><ul><ul><li>Orion and modules (IP SLAM, APM, IPAM) </li></ul></ul><ul><ul><ul><li>Basic and advanced alerts, trap alerts, syslog alerts </li></ul></ul></ul><ul><ul><li>IP Monitor </li></ul></ul><ul><ul><li>Designated Alert Gurus </li></ul></ul><ul><ul><ul><li>Both from SW and the thwack community </li></ul></ul></ul><ul><ul><ul><li>Help other users and become an Alert Guru! </li></ul></ul></ul><ul><ul><li>Paste screen shot of problem your alert or export alert and share </li></ul></ul>

24.
Question #3 <ul><li>Advanced Alerts function by: </li></ul><ul><li>A. Sending SNMP queries for each alert type </li></ul><ul><li>B. Performing SQL queries of the Orion database for the alert trigger </li></ul><ul><li>C. Listening for traps or syslog messages </li></ul><ul><li>D. Keeping all alert conditions in memory comparing live SNMP </li></ul>

25.
Question #3 <ul><li>Advanced Alerts function by: </li></ul><ul><li>A. Sending SNMP queries for each alert type </li></ul><ul><li>B. Performing SQL queries of the Orion database for the alert trigger </li></ul><ul><li>C. Listening for traps or syslog messages </li></ul><ul><li>D. Keeping all alert conditions in memory comparing live SNMP </li></ul>

26.
Orion NPM Customer Training <ul><li>This presentation is a SolarWinds customer training on Orion Network Performance Monitor (NPM.) If you are not a SolarWinds customer, we recommend downloading & installing a 30-Day Trial evaluation of Orion NPM so you can follow along & understand the material being presented better. </li></ul><ul><li>SolarWinds Trials to Download: </li></ul><ul><li>Orion Network Performance Monit or – Download Now>> </li></ul>

27.
Where to learn more… <ul><li>Documentation </li></ul><ul><ul><li>http://www.solarwinds.com/support/Orion/docs/OrionAdministratorGuide.pdf </li></ul></ul><ul><li>Videos </li></ul><ul><ul><li>http://www.solarwinds.com/geek </li></ul></ul><ul><li>Community </li></ul><ul><ul><li>http://www.thwack.com </li></ul></ul><ul><ul><li>The New Alert Lab thwack forum! </li></ul></ul><ul><ul><ul><li>Dedicated forum to solving alerting issues </li></ul></ul></ul><ul><li>Technical Reference </li></ul><ul><ul><li>Thwack Content Exchange - Understanding Orion Advanced Alerts </li></ul></ul><ul><li>Technical Support </li></ul><ul><ul><li>http://www.solarwinds.com/support/ </li></ul></ul>

28.
<ul><li>Thank you for attending! </li></ul><ul><li>To learn more or to download free 30-day trials of </li></ul><ul><li>SolarWinds products visit: www.SolarWinds.com </li></ul><ul><li>Contact information </li></ul><ul><li>Josh Stephens, Head Geek </li></ul><ul><li>[email_address] </li></ul><ul><li>twitter: sw_headgeek </li></ul><ul><li>Blog: http://thwack.com/blogs/geekspeak/ </li></ul><ul><li>p.s. Remember to renew your maintenance!!! </li></ul>Summary and Q&A