Hybrid-Cloud-Observability-Network-Monitoring Questions and Answers

The best practices for creating a Universal Device Poller (UDP) in SolarWinds are:

Consult vendor documentation for OID: Always check the device/vendor documentation for the correct OID to monitor the desired metric.

Perform SNMPwalk to determine if OID exists: Use SNMPwalk to verify the OID’s existence and see if it is supported and returns the correct values from the device.

Calling SolarWinds support is not a standard step for obtaining OIDs, and WBemtest is a Windows tool for WMI, not SNMP/OID polling.

Exact Extract from Official Guide:

“Consult device vendor documentation for correct OIDs and perform SNMPwalk to ensure the OID exists and is supported by the device before creating a UDP.”

— (Network Performance Monitor Administrator Guide, “Best Practices for Universal Device Pollers” section)

Comprehensive and Detailed Explanation From Exact Extract:

With Network Insight features (including for Palo Alto and F5 BIG-IP devices) installed alongside Network Configuration Manager and Performance Monitoring, you can monitor:

High availability details: Provides information on device redundancy, failover status, and clustering.

Policy details: Enables insight into firewall, security, and NAT policies for managed devices.

Access lists and VPNs may be monitored in other modules, but the primary, advanced insight is for high availability and policy configurations.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds NTA processes flow data via a dedicated collector component. Devices are configured to export flow records to the NTA collector, which ingests, stores, and analyzes the data.

"NetFlow Traffic Analyzer receives flow data from network devices using the NetFlow Collector service, which processes and stores traffic information for analysis."

No agent is required on target devices, and the collector is the key processing method.

Comprehensive and Detailed Explanation From Exact Extract:

NetFlow is the Cisco IOS feature designed for monitoring and analyzing network traffic to pinpoint specific applications or endpoints consuming bandwidth or causing network slowness. It captures detailed flow information, including source/destination, ports, and protocols.

Comprehensive and Detailed Explanation From Exact Extract:

Duplicate flows can occur if multiple interfaces export the same data or if NetFlow is configured on both ingress and egress interfaces. SolarWinds documentation recommends:

Enabling the “flow de-duplication” feature within NetFlow Traffic Analyzer to automatically filter duplicate data.

Ensuring NetFlow is enabled only on ingress interfaces (best practice), as enabling it on both directions can result in duplicate records.

Automatic addition of flow sources and enabling on sub-interfaces do not directly address duplication.

Comprehensive and Detailed Explanation From Exact Extract:

The flow navigator in SolarWinds NetFlow Traffic Analyzer allows users to filter and analyze flow data. For future access, you can save your custom view to the menu bar from the flow navigator, providing one-click access to your saved configurations.

The documentation states:

“To save a custom NetFlow analysis for future use, configure your view in the flow navigator, then select the option to save the view to the menu bar for easy retrieval.”

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds provides the flow alert wizard as the tool to configure and manage flow alerts. This wizard guides administrators through selecting the relevant flow metrics and alert thresholds.

The documentation states:

"Use the Flow Alert Wizard to define and manage alerts on flow-based data, allowing for rapid detection and notification of anomalous network activity."

Comprehensive and Detailed Explanation From Exact Extract:

According to theSolarWinds Log Analyzer Administrator Guide (Version 2024.1), Log Analyzer provides several built-in or native log entry actions as part of its log-processing rules. The key native log entry actions include:

Add a tag to the log entry: This action allows you to tag event logs for easier searching and filtering later.

Continue rule processing but do not save: With this action, the log entry is not saved but rule processing continues.

Halt further rule processing for the log entry: Selecting this action will immediately stop the processing of any more rules for the current log entry.

Sending an email notification is an alert action and not considered a native log entry action in the context of log processing rules.

Exact Extract from Official Guide:

"Key features in LA

Apply tags to event logs

Drop unwanted event logs in LA

Filter and analyze event logs

Filter and view event logs in live mode

Filter entry details in LA

Filter on log tags..."— (Log Analyzer Administrator Guide, Page 53-54)

Additionally, the guide specifies underCreate custom log-processing rules in LAthat actions such as tagging, halting processing, and not saving are among the native processing actions.

The “Device View” feature allows users to view the physical layout of device interfaces on graphical stencils, providing an intuitive graphical representation of port locations and status.

Exact Extract from Official Guide:

“Device View displays the physical layout of device interfaces using graphical stencils for supported devices.”

— (Network Performance Monitor Administrator Guide, “Device View” section)

Comprehensive and Detailed Explanation From Exact Extract:

Duplex mismatches often result in specific types of switch port errors. According to SolarWinds documentation, the most common indicators of a duplex mismatch include CRC errors (B), high receive error percentages (C), and collisions (D). These errors occur because one end of the link operates in full-duplex mode (no collisions expected), while the other operates in half-duplex (collisions possible), resulting in frame errors, dropped packets, and high CRC counts. The option "100 MB full" refers to a speed/duplex setting, not an error.

Comprehensive and Detailed Explanation From Exact Extract:

The most common cause of mismatch between bandwidth (SNMP) numbers and flow (NetFlow, sFlow, etc.) numbers is that not all network traffic is included in the flow export. SNMP bandwidth counters include all traffic traversing the interface, but NetFlow or other flow records may only represent sampled or filtered subsets, or may miss certain traffic due to export or device configuration limitations. This is a well-documented and expected difference in the SolarWinds platform.

Comprehensive and Detailed Explanation From Exact Extract:

UDP port 2055 is the default port for NetFlow data (flow analysis), while SNMP (port 161) is required for CBQoS monitoring. SolarWinds NTA receives flow traffic on UDP 2055, and SNMP is used for polling CBQoS statistics from devices.

Comprehensive and Detailed Explanation From Exact Extract:

A. Ensuring that firewall rules allow SNMP traffic is essential, especially when monitoring remote site nodes.

C. Basic connectivity should be checked by pinging the node from the SolarWinds application server.

D. If the SNMP community string is changed, the SNMP service on the device must be restarted for the new configuration to take effect.

Option B is not required unless SNMPv3 is specifically being used, and even then, SNMPv2c and SNMPv1 are still widely supported and commonly used.

Comprehensive and Detailed Explanation From Exact Extract:

When the NetFlow collector service is showing a "down" status, the SolarWinds documentation recommends the following troubleshooting steps:

Confirm the database connection is up and server has free resources.

Explanation:The NetFlow collector service relies on connectivity to the SolarWinds database. If the database connection is lost or the server is out of resources (such as CPU or RAM), the service may go down or fail to start. Ensuring that the database is reachable and that the server has enough resources is a primary troubleshooting step.

Start or restart SolarWinds’ NetFlow service from Orion Service Manager.

Explanation:The official troubleshooting guidance instructs administrators to use the Orion Service Manager to start or restart the NetFlow service. This is a direct method to recover the NetFlow collector from a "down" state and is one of the first actions recommended by SolarWinds support.

Options B and C arenotrecommended in the official documentation:

Deleting and re-adding the NetFlow collector service is not a documented troubleshooting step and may cause loss of configuration.

Starting or restarting the generic "collector service" is not specific to NetFlow; the correct service is the NetFlow service.

Exact Extract from Official Guide:

"If NetFlow collector service status is down:

Ensure the SolarWinds database is online and the server is not experiencing resource issues.

Use the Orion Service Manager to start or restart the NetFlow service.

If the issue persists, review the NetFlow logs for errors and consult the SolarWinds Success Center for advanced troubleshooting."— (Network Performance Monitor Administrator Guide, Troubleshooting NetFlow and Service Issues)

Comprehensive and Detailed Explanation From Exact Extract:

Device Studio pollers are used to build custom pollers for advanced device-specific metrics and widgets. The technologies explicitly supported for Device Studio pollers include:

Machine type for node details widget: Device Studio can create custom pollers to display specific node details, such as machine type, chassis ID, or serial number, within a node details widget.

Power supply status for vital statistics view: Device Studio also allows polling and visualizing metrics such as power supply status, fan status, and other vital statistics that are not natively included in basic SNMP polling.

While Device Studio can poll for advanced or composite data such as VLAN, VRF, and device health, certain interface statistics or single CPU/memory metrics are typically managed by standard SNMP pollers or Universal Device Pollers rather than Device Studio.

Comprehensive and Detailed Explanation From Exact Extract:

The MIB browser tool in the SolarWinds web console is designed to browse, query, and verify OIDs on monitored nodes. It allows you to test if an OID returns valid data for a specific device before assigning it in a custom poller. This ensures compatibility and accuracy of your custom monitoring setup.

Comprehensive and Detailed Explanation From Exact Extract:

For secure syslog (Syslog over TLS), the standard port used is TCP 6514. SolarWinds Log Analyzer and Platform listen on TCP port 6514 for secure syslog messages.

Exact Extract from Official Guide:

"Log Analyzer supports receiving secure syslog messages over TCP port 6514, in accordance with the RFC 5425 standard."

— (Log Analyzer Administrator Guide, “Syslog Configuration” section)

Comprehensive and Detailed Explanation From Exact Extract:

In NetPath visualizations, the thickness of the connection lines represents the likelihood or frequency of traffic using that path.

From the documentation:

“In NetPath, thicker lines between nodes indicate a higher probability that traffic will flow along that path. This visualization is based on the frequency of successful probes and actual traffic analysis.”

Comprehensive and Detailed Explanation From Exact Extract:

The correct process for creating a poller in Device Studio is:

Select the technology

Specify the data source

Assign the poller to a node

Save the poller

Comprehensive and Detailed Explanation From Exact Extract:

By default, SolarWinds Log Analyzer retains log data for 7 days. This means log messages are searchable and available in the web console for one week unless the retention settings are adjusted.

The documentation states:

"Log Analyzer's default retention period for storage and search is 7 days. Administrators can adjust this period as required to meet compliance or storage needs."

Comprehensive and Detailed Explanation From Exact Extract:

For organizations with very large environments and strict requirements for data freshness and availability, SolarWinds documentation prescribes several specific steps:

A. Deploy multiple additional polling engines (APEs) in each regional datacenter and configure load balancing."For environments exceeding 20,000 monitored interfaces, deploy multiple Additional Polling Engines (APEs) to distribute load and maintain polling intervals. Place APEs close to monitored devices to reduce latency."

B. Implement SolarWinds High Availability (HA) pools for both the main and polling engine servers, with active-passive failover."SolarWinds HA pools provide automatic failover for platform and polling engines, ensuring service continuity in case of hardware or network failures."

C. Configure the SolarWinds database server in a Microsoft SQL Server Always On Availability Group."To protect against database outages, deploy the SolarWinds database in a SQL Server Always On Availability Group or Failover Cluster Instance (FCI)."

Option D is incorrect; overlapping node groups are not a requirement and, in fact, the documentation suggests using dynamic assignment to balance load, not strictly static node groups.

Comprehensive and Detailed Explanation From Exact Extract:

When you observe an "unknown traffic event" in the SolarWinds web console, it usually means the collector is receiving NetFlow or other flow data from a device that is not currently managed or monitored in the SolarWinds database. The collector can receive flows from any device, but if the device is not added or properly monitored, the traffic will show up as "unknown" because SolarWinds cannot associate the flows with a known interface or device.

Comprehensive and Detailed Explanation From Exact Extract:

Disabling NetFlow/CBQoS stops flow data collection, resulting in gaps in graphs during the disabled period (A). However, historical data collected prior to disabling is retained in the database (C), so you can still view past flow information.

Comprehensive and Detailed Explanation From Exact Extract:

Hardware health monitoring can be enabled during node discovery or after a node is added via the "List Resources" option. Additionally, hardware health can be enabled or viewed in the Asset Inventory page for nodes that support it.

From the documentation:

“You can enable hardware health sensors by selecting the option during resource discovery (List Resources) or later via Asset Inventory for individual nodes.”

Universal Device Pollers (UDPs) are tied to the polling engine on which they are created. This means if a UDP is created on the main polling engine, it will only collect data for devices polled by that engine. To collect data from devices polled by an additional polling engine, you must create or assign the UDP on that engine as well.

Exact Extract from Official Guide:

“Universal Device Pollers are tied to the polling engine on which they are created. To monitor devices assigned to an Additional Polling Engine, the UDP must be created or assigned on that engine.”

— (Network Performance Monitor Administrator Guide, “Universal Device Pollers” section)

Comprehensive and Detailed Explanation From Exact Extract:

A. When you probe less frequently, updates are slower but generally more accurate since there's less overhead and less chance of missing network changes due to polling overlaps.

C. Probing more frequently results in faster updates but may slightly decrease accuracy due to increased network noise and overlapping probes.

The documentation states:

"A higher probing frequency provides faster updates in NetPath views but can reduce accuracy due to more frequent sampling. Lower frequency means slower updates but typically results in higher accuracy and less system load."

Comprehensive and Detailed Explanation From Exact Extract:

Device Studio in SolarWinds allows you to build custom pollers for several device-level metrics. According to the SolarWinds Administrator Guide:

Device Studio can be used to create pollers for multi-CPU/memory, single CPU/memory, and VLAN details. These templates allow you to monitor resource usage and VLAN assignments.

"You can build templates for node details, but those are standard node properties, not supported by Device Studio pollers."

Comprehensive and Detailed Explanation From Exact Extract:

For effective network capacity planning:

Enough historical data (at least 7 days) must be available: This ensures meaningful trend and forecast analysis.

Relevant objects (nodes, interfaces, volumes) must be managed: Only managed entities are included in capacity planning calculations.

Polling every OID or updating the MIB database (A, D) is not a direct requirement for capacity planning.

Comprehensive and Detailed Explanation From Exact Extract:

Log Analyzer listens for syslog messages by default on:

TCP port 514 (the standard syslog port)

TCP port 6514 (the default port for syslog over TLS/SSL, i.e., secure syslog)

Port 162 is for SNMP traps, and 1463 is not standard for syslog in SolarWinds.

Comprehensive and Detailed Explanation From Exact Extract:

Incorrect hardware health data often results from polling the wrong MIB tree. By changing to the correct or preferred MIB tree for the device model, SolarWinds can accurately interpret and display hardware health metrics.

Comprehensive and Detailed Explanation From Exact Extract:

According to the SolarWinds documentation:

"The maximum number of resources that can be displayed in any flow chart or view is 50. Attempting to display more may impact performance and will not be rendered in the UI."

This ensures optimal performance and usability of the charts within the platform.

Comprehensive and Detailed Explanation From Exact Extract:

The Universal Device Poller (UnDP) allows administrators to define custom SNMP OIDs for statistics (like UPS battery status) that are not natively polled. You can assign a new UnDP to an existing node to monitor additional values such as UPS battery status, provided the device supports the necessary OID.

Comprehensive and Detailed Explanation From Exact Extract:

If logs are not being sent from a Windows agent, you must confirm that the log forwarding feature is enabled. Even if the agent is installed, logs will not be transmitted unless this setting is turned on.

The documentation notes:

"Ensure the agent is configured to forward logs. Log forwarding must be enabled for the agent to transmit log data to the SolarWinds platform."

Comprehensive and Detailed Explanation From Exact Extract:

To monitor servers and connections in a load-balancing environment—specifically for F5 BIG-IP load balancers—SolarWinds requires that you:

Enable CLI polling: This is necessary for SolarWinds to collect configuration and health data from network devices.

Enable F5 iControl polling: F5 iControl API allows SolarWinds to collect load balancer details, including virtual servers and pools, for deep monitoring of server and connection health.

Adding Cisco Nexus devices relates to switch monitoring and is not required for F5/BIG-IP load balancer server connection monitoring.

Exact Extract from Official Guide:

“To fully monitor F5 BIG-IP load balancers, enable both SNMP and CLI polling, and configure F5 iControl API credentials for device access and load balancing visibility.”

— (Network Performance Monitor Administrator Guide, “Network Insight for F5 BIG-IP” section)

Comprehensive and Detailed Explanation From Exact Extract:

The radial gauge display in the SolarWinds web console requires that the polled value from the OID is a numeric type that supports gauge visualizations (for example, a percentage or value with a defined minimum and maximum). If the OID returns data that does not fit these requirements—such as text, status, or a counter with no clear min/max—the gauge option will be grayed out and unavailable for selection. This behavior is explained in the Universal Device Poller documentation, which states that only compatible numeric OID types can be displayed using radial gauge resources.

Comprehensive and Detailed Explanation From Exact Extract:

If an OID is not present in the SolarWinds MIB database, you can still poll it by manually defining the OID in Device Studio. The platform allows you to input the object identifier and specify SNMP as the method to query the device.

From the documentation:

"If a required OID is missing from the MIB database, use the Device Studio's 'Manually Define Object Identifier' feature to specify the OID and configure SNMP polling for the device."

Comprehensive and Detailed Explanation From Exact Extract:

In SolarWinds Universal Device Poller (UDP), the column get type is used to retrieve values from a particular column of an SNMP table, meaning you get all the values for that column across multiple rows.

Comprehensive and Detailed Explanation From Exact Extract:

NetPath is specifically designed to trace and troubleshoot connectivity paths between nodes.

Network Insight provides in-depth analysis and diagnostics for specific vendors/devices, including health, connectivity, and configuration.

Asset inventory and MIB browser are not direct troubleshooting tools for connectivity.

Comprehensive and Detailed Explanation From Exact Extract:

NetPath probes require a supported Windows environment for deployment. According to the SolarWinds documentation, probes can be run from the Hybrid Cloud Observability (HCO) server itself, which must be a Windows server, or from any Windows client computer, including Windows 10. NetPath agents are not available for Linux or for network devices such as routers; the agent cannot be installed on Red Hat Linux or routers.

Comprehensive and Detailed Explanation From Exact Extract:

Show best is the status rollup mode designed for groups of redundant or backup devices. It displays the "best" (most available/least severe) status within the group, which is most useful when any one device in the group being up means the group is healthy.