Observability-Self-Hosted-Fundamentals Sample Questions Answers

Anomaly-Based Alertingrepresents a shift from static thresholds to behavioral analysis in the HCO platform. According to theSolarWinds HCO Alerting Enginedocumentation, this feature uses machine learning to establish a "baseline" for specific metrics like CPU load or memory usage over a period of 7 to 30 days.

The primary benefit is that itanalyzes entity behaviorand triggers an alert only when a metric deviates significantly from its historical "normal" for that specific day and time. For example, if a server traditionally runs at 90% CPU during a Sunday night backup, a static 80% threshold alert would trigger a "false positive" every week. Anomaly-based alerting learns this behavior and will only fire an alert if the CPU hits 90% on a Tuesday morning when the normal load is only 20%.

This reduces alert noise by focusing ontrue anomaliesrather than simple threshold violations. It does not "remove the requirement for trigger conditions" (Options B and C); instead, it replaces a static numerical threshold with a dynamic, machine-learned threshold. The administrator still defineswhichentities to monitor andhowsensitive the anomaly detection should be.

In the SolarWinds Platform, groups are more than just static lists; they are logical containers that allow for the inheritance and management of settings across multiple entities. According to theSolarWinds Platform Administrator Guide, when configuring a group, you can define specific "Member Settings" that apply to the objects contained within that group.

The two primary settings that can be integrated as member settings within the group configuration arealerts (A)anduser accounts (D).

Alerts: This allows administrators to associate specific alerting logic directly with group membership. For example, you can configure group-specific alert thresholds or suppressions that apply only to the members of that group, ensuring that critical infrastructure groups have more sensitive alerting profiles than development or test groups.

User Accounts: This refers to the ability to link specific user or group account permissions to the group itself. This is often used in multi-tenant or departmentalized environments where a user account is granted a "Group Limitation." By adding user account settings as a member setting, you can define which users have the rights to view, manage, or edit the specific entities within that group.

While you can nest "groups" (Option B) within each other, they are considered members themselves rather than a "member setting". Similarly, "Intelligent Maps" (Option C) are visualization objects that cancontaingroups, but they are not a configurable setting appliedtothe members of a group within the standard group management wizard.

Custom properties can be configured as "Mandatory" to ensure data integrity across the platform. According to theSolarWinds Platform Administrator Guide, changing a property like AssetTag to mandatory after nodes already exist creates an enforcement requirement.

The system does not retroactively block polling or delete nodes (Option B and D are incorrect), but it enforces the requirement during administrative interaction. Specifically:

Requirement after the action (A): Moving forward, any new node added to the system will require the AssetTag field to be populated before the node can be saved.

Requirement when edited (C): For existing nodes that do not yet have an AssetTag, the platform will permit them to exist and be polled normally. However, the next time an administrator attempts toeditthe properties of that node, the Web Console will block the "Save" action until a value is provided for the mandatory AssetTag field. This ensures that as the environment is managed over time, the metadata is gradually backfilled until all mandatory requirements are satisfied.

In Hybrid Cloud Observability (HCO), reports are organized using specific metadata to make them searchable and manageable. According to theSolarWinds Platform Administrator Guide, every report created or provided out-of-the-box is associated with acategory.

Categories serve as the primary organizational structure in the Report Manager. Examples of standard categories include "Inventory," "Performance," "Historical," or "User Accounts". When creating a new report, the user is prompted to assign it to one of these categories or create a new one, which then dictates where the report appears in the navigation tree.

While the system may track who created a report, fields like "Owner" (Option D) or "Creator" (Option B) are not standard, visible metadata properties used for the primary sorting and management of web-based reports in the same way thecategoryis. "Format" (Option C) refers to the export type (PDF/Excel) and is a function of how the report is run or scheduled, rather than an inherent property of the report definition itself.

TheMy Deploymentpage is the centralized administrative hub for managing the health and scale of the SolarWinds Platform. According to theSolarWinds Platform Installation and Upgrade Guide, this page simplifies complex infrastructure tasks that previously required logging into the individual server consoles.

Centralized Upgrade (B): The "Updates & Evaluations" tab allows administrators to download and orchestrate the upgrade of the main polling engine and all additional polling engines from a single interface. This "Centralized Upgrade" feature ensures all components are updated in the correct order.

High Availability (HA) Pool Setup (D): The "High Availability" tab provides the wizard-driven interface to create and manage HA pools. This allows you to link a primary server with a standby server to ensure near-zero downtime in the event of a hardware or software failure.

While you canviewlicense status (Option A) or trigger diagnostics (Option C), license activation is typically handled via the License Manager, and diagnostic transmission is often a sub-function of the technical support workflow rather than the primary architectural focus of the "My Deployment" management page.

According to theSolarWinds Platform Administrator GuideregardingModern Dashboards, the platform introduces several new widget types designed for high-performance data visualization. The widget shown in the image, which displays a single, large numerical value (the number "1") representing a specific count of "DOWN Nodes" against a distinct colored background, is officially categorized as aKPI (Key Performance Indicator)widget.

KPI widgets are specifically engineered to provide an immediate "at-a-glance" understanding of critical metrics. Unlike the legacy "Classic" dashboards which relied on multi-row tables or fixed gauges, the Modern Dashboard KPI widget allows for a highly streamlined presentation of data derived fromSWQL (SolarWinds Query Language). In this instance, the widget is likely running a query such as SELECT count(NodeID) FROM Orion.Nodes WHERE Status = 2, which returns a single scalar value. This value is then rendered prominently in the center of the widget.

One of the defining features of the KPI widget in HCO is its ability to useConditional Formatting. This allows the background color of the widget to change dynamically based on the value returned by the query; for example, the background may turn red if the count of down nodes is greater than zero, providing a visual alert to the NOC staff. This type of widget is distinct from a "table" (D), which displays multiple rows of data, or a "counter" (A), which is typically a legacy term for simple incremental statistics. It is also not a "custom HTML" (B) widget, as those are used for embedding external content or custom code rather than native data point visualization. The KPI widget remains the primary tool for displaying high-level summary statistics, such as active alert counts, total interface errors, or, as seen here, the availability status of nodes across the environment.

Network Discovery in the SolarWinds Platform is designed to identify as much infrastructure as possible, even if that infrastructure is "locked down." According to theSolarWinds Platform Administrator Guide, the discovery wizard follows a specific hierarchy of identification.

If a device hasSNMPorWMIdisabled (often the case for security-hardened servers, basic switches, or simple IP-enabled appliances), the platform cannot gather deep performance metrics like CPU or memory. However, the device can still be discovered and monitored for "Up/Down" availability using a simple Ping (ICMP). To ensure these devices are added to the database during a scan, the administrator must check the box to "Include devices that only respond to ICMP" during the discovery configuration. If this is not selected, the discovery engine will skip any IP address that does not provide a valid SNMP or WMI credential response, potentially leaving gaps in the network inventory. This is the standard method for monitoring "Ping-only" nodes.

Anomaly-Based Alertingin HCO is currently focused on high-cardinality performance metrics that exhibit clear cyclical patterns (daily or weekly cycles). According to theSolarWinds Platform Alerting Guide, the machine learning engine is optimized for metrics where "normal" behavior varies significantly based on time of day.

The two primary supported metrics for this feature are:

Average CPU Load (A): CPU utilization is highly variable; a server might be idle at night but busy during business hours. Anomaly detection learns these patterns to prevent false positives during scheduled peak times.

Percent Packet Loss (D): Network stability is a critical indicator of environmental health. By establishing a baseline for packet loss, the system can distinguish between a minor, expected "blip" in a high-traffic environment and a true anomaly that indicates a failing circuit or network congestion.

While metrics like "Disk Space Usage" (Option B) are critical, they are generally "linear" or "incremental" rather than cyclical; a disk filling up is a trend that is usually better handled by standard predictive or static threshold alerts. Similarly, while interface utilization is important, the initial release of anomaly-based features prioritizedNode-levelperformance metrics like CPU and Packet Loss to provide the most immediate value for identifying server and core network health deviations.

Anomaly-Based Alertingis a premier feature of Hybrid Cloud Observability that moves beyond static thresholds to identify performance deviations based on historical behavior. According to theSolarWinds HCO Administrator Guide, this feature relies on cloud-assisted analytics to process complex datasets. To enable this, two specific components are required:

Advanced Machine-Learning Feature: This is the functional logic within the HCO platform that identifies patterns and establishes "normal" baselines for metrics like CPU load or interface utilization.

Platform Connect: This is the essential bridge that links the self-hosted HCO instance to the SolarWinds cloud-based AIOps engine. Because anomaly detection requires significant computational power to analyze long-term historical trends, the heavy processing is often offloaded. Platform Connect ensures that the necessary metadata can be analyzed securely to generate the dynamic thresholds used for these alerts.

WithoutPlatform Connect, the local server cannot access the machine-learning models required to calculate what constitutes an "anomaly" versus standard operational variance. This architecture allows HCO to provide high-level AIOps capabilities without requiring massive localized hardware for every installation.

SolarWinds distinguishes between "viewing" reports and "managing" them through account permissions. According to theSolarWinds Platform User Account Managementguides, standard users can typically view, run, and export reports that they have access to.

However, administrative actions that affect the system's resource usage or global configurations require theManage Reportspermission:

Modify report schedule (C): Only users with management rights can create, edit, or delete the schedules that automatically email reports to recipients. This is a security measure to prevent unauthorized users from flooding mail servers or accessing sensitive data via automated delivery.

Change report timing (A): This refers to editing the "Time Period" or "Schedule" settings within a report's core definition. Altering these parameters changes the report for all users, so it is restricted to those with "Manage" rights.

Exporting a report(Option B) andrunning an existing report(Option D) are fundamental "read-only" actions available to any user who has been granted report viewing rights.

The SolarWinds Agent provides a robust alternative to agentless polling (SNMP/WMI), particularly in restricted environments. According to theSolarWinds Platform Agent requirements and port information, the primary architectural benefit is its communication security and firewall-friendly nature.

When using an agent, communication is consolidated. Instead of requiring a wide range of dynamic ports for RPC (as with WMI) or multiple ports for various SNMP checks, the agentcommunicates through a single fixed port(typically TCP 17778 for agent-initiated or 17790 for server-initiated communication). Furthermore, all traffic between the agent and the polling engine isencryptedusing 256-bit AES encryption. This makes agents the ideal choice for monitoring:

DMZ Servers: Where opening numerous ports back to the management network is a security violation.

Cloud Instances (AWS/Azure): Where data must travel over public or semi-public links and requires encryption in transit.

Remote Sites: Where NAT or strict firewall rules make traditional SNMP/WMI polling impossible.

Option B is incorrect because agents still report back to the Polling Engine (Orion Information Service), which then handles the database writes. Option C is incorrect as the agent actually increases the granularity of data collection, which may slightly increase database volume rather than reduce load.

The Custom Property Import tool is designed to help administrators bulk-update metadata for hundreds or thousands of nodes simultaneously. According to theSolarWinds Platform Administrator Guide, maintaining data integrity is a priority during this process.

A critical feature supported during the import is thatincoming values are validated before being written (D). When an administrator uploads a CSV or Excel file containing custom property values, the platform performs a validation check against the defined "Type" of each property in the database. For example, if a custom property InstallDate is defined as a "Date" type, and the import file contains a text string like "Last Tuesday," the validation engine will flag an error and prevent the import from corrupting the database. This validation also checks for character limits and ensures that values for restricted "Drop-down" properties match the predefined allowed list. This safeguard is essential for ensuring that automated alerts and reports, which rely on this metadata, function correctly without being disrupted by malformed data entries.

The SolarWinds Platform utilizes a centralizedAction Managerto handle alert notifications and remediations efficiently. According to theSolarWinds Platform Alerting Guide, alert actions (such as sending an email, executing a script, or posting to a Slack channel) are often treated as reusable objects. When multiple alerts (Alert A and Alert B) share the same action from the Action Manager, they are essentially pointing to a single configuration entry in the database.

If an administrator edits Alert A and modifies the parameters of that shared trigger action, the change is not isolated to just that alert's workflow. Instead, thetrigger action is updated in the manager. Because Alert B is linked to that same action ID, it will immediately reflect the updated configuration the next time it triggers. This behavior is designed to simplify administration; for example, if a primary on-call email address changes, an admin only needs to update the action once rather than editing every individual alert. However, it requires caution: if a user intended to change the action for Alert A only, they should instead "Copy" the action or create a new one to avoid inadvertently altering the behavior of Alert B and all other alerts sharing that centralized action.

The SolarWinds Platform provides distinct tools for visualizing different aspects of environmental health and performance.AppStackis primarily an entity-relationship mapping tool. According to theSolarWinds SAM Administrator Guide, "The AppStack Environment view provides a powerful layer of troubleshooting visibility by exposing all participating objects in your environment, as well as their relationships to one another". It allows administrators to customize whichentities(nodes, applications, volumes, etc.) are visible and how they are grouped to show dependencies.

Conversely,PerfStack(Performance Analysis) is the engine used for metric correlation. As stated in theSolarWinds Platform Administrator Guide, PerfStack allows users to "drag and drop performance metrics from multiple entities onto a single chart to correlate data over time". While AppStack excels at showingwhatis connected, PerfStack excels at showinghowspecific metrics (CPU, Latency, IOPS) across those connected entities interact. Therefore, a combination is required where AppStack handles theentitiesand PerfStack handles themetrics. Specifically, you use AppStack to identify the scope of entities involved in a performance bottleneck and then transition those entities into a PerfStack project to perform a deep-dive analysis of the metrics. This modular approach ensures that troubleshooting is both contextually aware (via AppStack) and data-driven (via PerfStack).

The SolarWinds Platform web-based report builder provides specific layout options to ensure reports are professional and readable. According to theSolarWinds Platform Reporting Guide, customization of a report's visual structure is handled through the Layout tab.

Logo on the report (B): Administrators can upload a custom company logo to appear in the header of the report. This ensures that exported PDFs and web views align with corporate branding standards.

Width of the report (D): The layout editor allows users to define the report width, typically choosing between a fixed pixel width (often used to ensure a consistent look on printed paper or PDF) or a percentage-based fluid width that adjusts to the browser window.

While the platform allows for some styling, granular control over thefont of the report content(Option A) is generally limited to global CSS or predefined themes rather than individual report layout settings. Similarly, theposition of the page number(Option C) is usually a fixed element of the report's footer template and is not a standard customizable field within the primary web-based report layout wizard.

PerfStack(Performance Analysis) projects are highly versatile troubleshooting assets that can be shared and integrated across the SolarWinds Platform. According to theSolarWinds Platform Administrator Guide, once a correlation project is built—linking metrics like CPU, Latency, and IOPS—it can be utilized in several ways.

Add as a menu bar item (A): A specific PerfStack project that is used frequently (such as "Core Switch Health") can be saved and added directly to the main navigation menu. This allows users to access the troubleshooting dashboard with a single click from anywhere in the console.

Share to non-web console users (B): PerfStack projects can be shared via a unique URL. This "Public Link" feature allows stakeholders who do not have a SolarWinds account (such as third-party vendors or executives) to view the real-time correlation data in a read-only browser view.

Show as a widget in a view (D): PerfStack projects can be embedded into Summary Views or Node Details pages as awidget. This provides context-sensitive performance data right alongside the standard node information, allowing for "at-a-glance" correlation without leaving the main dashboard.

While PerfStack provides visual data, it is typically treated as a dynamic, interactive "Project" or "Widget" rather than a static "dashboard graphic" (Option C) in the classic sense of a standalone image or icon.

Visibility of the reporting module is a configurable security setting within each SolarWinds user account. According to theSolarWinds Platform User Account Managementguide, if a user logs into the Web Console and finds the Reports section empty or inaccessible, it is likely due to anAccount Limitation.

Specifically, the "Report Limitation" field in the user's profile can be set to"No Reports". This setting acts as a total block, preventing the user from viewing any report definitions, whether they are predefined (out-of-the-box) or custom-made. This is a common configuration for restricted user roles, such as basic operators or external contractors, who need to see real-time status in dashboards but should not have access to the historical, inventory, or security data contained in the platform's reporting engine. While a user could also be restricted from seeing specific entities (Option B), this would typically just result in empty datainsidea report rather than the total inability to view the reports module itself. Setting the account to "No Reports" ensures the user isprevented from viewing all reportsglobally across the platform.

Groups in the SolarWinds Platform are logical containers used to organize monitored entities for easier management, alerting, and reporting. According to theSolarWinds Platform Administrator Guide, one of the most powerful features of the grouping engine is the ability to automate membership. Specifically,groups can be created based on custom properties.

When defining a group, administrators can choose between "Static Selection" (manual) or "Dynamic Query." By using dynamic queries, a group can be configured to automatically include any node, interface, or volume that matches specific criteria, such as a custom property value (e.g., Department = Engineering or Site = London). This ensures that as new infrastructure is added to the environment and tagged with the appropriate metadata, the groups update themselves without human intervention.

Regarding the other options: groupscanbe members of other groups (nested groups), which is a common practice for creating complex hierarchical views of an organization. The default status rollup mode is typically set to "Mixed" or "Show Worst Status" rather than "Best Status," to ensure that any single failure within the group is visible to the administrator. Finally, rollup options absolutely apply to all members within the group, as they define how the collective health of those members is calculated and displayed on the dashboard.

Predefined alerts(out-of-the-box alerts) come built into Hybrid Cloud Observability to provide immediate value. According to theSolarWinds Platform Alerting Guide, these alerts have specific behaviors regarding modification.

Default Email Recipients (A): Many predefined alerts include a "Send an Email" action by default. However, for these to work, an administrator must first configure the global SMTP settings and ensure that "Default Recipients" are defined, or the alert will have no destination for its notifications.

Conditions cannot be directly edited (D): To protect the integrity of the built-in logic, the platform often prevents users from directly overwriting thetrigger and reset conditionsof a predefined alert. Instead, the recommended workflow is to "Duplicate and Edit," allowing the user to create a customizable copy of the alert while keeping the original out-of-the-box version intact for reference.

Option B is incorrect as SolarWinds does not automatically use the registration email for monitoring notifications. Option C is generally incorrect because while conditions are often locked, administrators are usually allowed to add or modifyactions(like adding a specific email address) to a predefined alert to make it functional for their specific environment.