Hybrid-Cloud-Observability-Network-Monitoring Sample Questions Answers

Comprehensive and Detailed Explanation From Exact Extract:

When configuring database log collection (e.g., from SQL Server), SolarWinds supports:

Mixed mode authentication (SQL Server and Windows authentication)

Windows authentication

Kerberos and oAUTH are not supported directly as authentication methods for log collection from SQL Server databases in the SolarWinds platform.

Comprehensive and Detailed Explanation From Exact Extract:

For effective network capacity planning:

Enough historical data (at least 7 days) must be available: This ensures meaningful trend and forecast analysis.

Relevant objects (nodes, interfaces, volumes) must be managed: Only managed entities are included in capacity planning calculations.

Polling every OID or updating the MIB database (A, D) is not a direct requirement for capacity planning.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds provides several statistics for network capacity planning, most notably:

Memory usage data on nodes: Useful for forecasting resource exhaustion on network devices.

Receive utilization on interfaces: Essential for predicting bandwidth saturation and planning upgrades.

The documentation states:

"Key statistics for network capacity planning include interface utilization trends (receive and transmit) and memory utilization, which allow for forecasting and proactive infrastructure management."

Comprehensive and Detailed Explanation From Exact Extract:

List resources is the menu where you can select or deselect which interfaces (including operationally down and administratively shutdown ones) are monitored for a node. This allows you to uncheck unnecessary or down interfaces and prevent them from impacting the node status.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds capacity forecasting accuracy improves when:

More historical data is used: The more historical data points included in calculations, the better the forecasting model will perform.

Using average daily values for calculations: This smooths out anomalies and provides a more accurate trend, as recommended in the documentation:

“To improve the precision of capacity forecasting, use as much historical data as possible and set calculations to use average daily values.”

Monitoring with platform agents or adjusting thresholds affects alerting, not trend accuracy.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds Hybrid Cloud Observability supports multiple industry flow protocols:

J-Flow: Supported and commonly used by Juniper devices.

NetFlow v9: Supported, providing flexible flow data and templates.

sFlow: Supported, widely used in vendor-agnostic environments.

NetFlow v6 is not a recognized protocol; SolarWinds documentation does not list it as a supported standard.

"SolarWinds NTA and HCO support NetFlow (v5/v9), sFlow, J-Flow, and IPFIX for collecting and analyzing flow data."

Comprehensive and Detailed Explanation From Exact Extract:

To detect duplex mismatches:

The node must be monitored (i.e., managed in SolarWinds).

The node must be in "up" status, so SNMP data about interface status, speed, and errors can be polled and compared.

Description in MIB (A) is not necessary if the device is already SNMP-capable, and "warning" status (C) is a result, not a requirement.

Comprehensive and Detailed Explanation From Exact Extract:

When a node status is “unknown,” it often means the SolarWinds platform cannot communicate with the node. The first checks should be:

Ping response: Verify if the node is reachable via ICMP ping, as lack of response leads to an unknown status.

Polling method: Confirm the correct polling method (ICMP, SNMP, WMI, API) is configured and functioning.

OID (A) is related to SNMP but not directly to basic node status, and view method (D) is not a relevant diagnostic step.

Comprehensive and Detailed Explanation From Exact Extract:

Device Studio pollers are used to build custom pollers for advanced device-specific metrics and widgets. The technologies explicitly supported for Device Studio pollers include:

Machine type for node details widget: Device Studio can create custom pollers to display specific node details, such as machine type, chassis ID, or serial number, within a node details widget.

Power supply status for vital statistics view: Device Studio also allows polling and visualizing metrics such as power supply status, fan status, and other vital statistics that are not natively included in basic SNMP polling.

While Device Studio can poll for advanced or composite data such as VLAN, VRF, and device health, certain interface statistics or single CPU/memory metrics are typically managed by standard SNMP pollers or Universal Device Pollers rather than Device Studio.

The best practices for creating a Universal Device Poller (UDP) in SolarWinds are:

Consult vendor documentation for OID: Always check the device/vendor documentation for the correct OID to monitor the desired metric.

Perform SNMPwalk to determine if OID exists: Use SNMPwalk to verify the OID’s existence and see if it is supported and returns the correct values from the device.

Calling SolarWinds support is not a standard step for obtaining OIDs, and WBemtest is a Windows tool for WMI, not SNMP/OID polling.

Exact Extract from Official Guide:

“Consult device vendor documentation for correct OIDs and perform SNMPwalk to ensure the OID exists and is supported by the device before creating a UDP.”

— (Network Performance Monitor Administrator Guide, “Best Practices for Universal Device Pollers” section)

Comprehensive and Detailed Explanation From Exact Extract:

Unknown flow traffic often occurs when SolarWinds receives flow data from sources not defined in its database, or when flow-enabled devices are not sending data to the expected port.

Add the devices and interfaces to SolarWinds' database: Ensures flow data is properly associated with monitored objects, resolving the "unknown" status.

Ensure flow-enabled devices send data to the appropriate port: If data is sent to the wrong port, SolarWinds cannot process it correctly, leading to unknown events.

SolarWinds documentation notes:

"Unknown flow traffic typically indicates a mismatch between flow sources and known device/interface configurations, or incorrect UDP port configuration. Registering devices/interfaces and verifying port assignments resolves most unknown flow issues."

The “Device View” feature allows users to view the physical layout of device interfaces on graphical stencils, providing an intuitive graphical representation of port locations and status.

Exact Extract from Official Guide:

“Device View displays the physical layout of device interfaces using graphical stencils for supported devices.”

— (Network Performance Monitor Administrator Guide, “Device View” section)

Comprehensive and Detailed Explanation From Exact Extract:

The Universal Device Poller (UnDP) in SolarWinds allows you to create custom SNMP pollers. Results from UnDPs can be displayed as charts, gauges, or tables on SolarWinds web console views. The administrator guide states:

“Universal Device Pollers (UnDPs) allow you to collect SNMP data not provided natively by SolarWinds. The collected results can be displayed as charts, gauges, or tables, making it easier to visualize the custom metrics.”

Device Studio pollers are templates used to define UnDPs, but it is the UnDP that presents data visually. Hardware health and Network Insight are not custom pollers.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds NTA maps flow sources to nodes by matching the IP address. If a device exports flows using a secondary IP (not the one defined as "primary" in SolarWinds), and the setting "Allow matching by other IPs" is not enabled, the flow will not map to a known node. The documentation explains:

"If flow packets are received from an IP address not designated as primary in SolarWinds, and matching by other IPs is disabled, the flow source is not linked to a node. Enable the setting to match by any device IP to resolve this issue."

Comprehensive and Detailed Explanation From Exact Extract:

The MIB browser tool in the SolarWinds web console is designed to browse, query, and verify OIDs on monitored nodes. It allows you to test if an OID returns valid data for a specific device before assigning it in a custom poller. This ensures compatibility and accuracy of your custom monitoring setup.

Comprehensive and Detailed Explanation From Exact Extract:

Disabling NetFlow/CBQoS stops flow data collection, resulting in gaps in graphs during the disabled period (A). However, historical data collected prior to disabling is retained in the database (C), so you can still view past flow information.

Comprehensive and Detailed Explanation From Exact Extract:

Only SNMP version 3 supports advanced authentication methods such as MD5, SHA1, SHA256, and SHA512 in SolarWinds and other SNMP-compliant platforms.

The documentation specifies:

"SNMP v3 provides secure authentication and encryption options, including MD5, SHA1, SHA256, and SHA512. Versions 1 and 2c only support community string authentication."

Comprehensive and Detailed Explanation From Exact Extract:

To effectively diagnose a slow connection using NetPath, the following data points are essential:

Date, time, and duration of the performance issue: Helps correlate the problem with specific events or maintenance windows.

IP addresses of the nodes in question: Identifies the exact points in the network path where issues may arise.

Latency and packet loss information: These are core metrics provided by NetPath and are critical for pinpointing where delays and data loss occur.

The SolarWinds documentation states:

"When troubleshooting with NetPath, consider the time frame, the specific nodes (by IP address), and the latency/packet loss details between hops. Alert descriptions are not a primary diagnostic data point in NetPath's workflow."

Comprehensive and Detailed Explanation From Exact Extract:

Device Studio allows you to define calculated values based on multiple polled results. To aggregate per-core CPU usage into a single metric, you can create a calculated value (such as the average) using the outputs from all cores.

From the documentation:

“Device Studio enables you to define calculated values (such as sum or average) when multiple SNMP values are returned, allowing you to represent a total or average CPU usage.”

Comprehensive and Detailed Explanation From Exact Extract:

Hiding an IP address group in IPAM management means that group will not appear in dashboards, charts, or reports, but the underlying data and group definition remain intact and are not deleted.

Comprehensive and Detailed Explanation From Exact Extract:

Capacity forecasting accuracy is directly impacted by:

Amount of historical data used: More historical data provides better trend analysis.

Exhaustion calculation method: Different methods (e.g., linear, peak, moving average) affect how forecasts are calculated.

Polling interval: More frequent polling increases granularity and the accuracy of forecasting.

Warning thresholds (D) do not affect the precision of forecasts, only the alerting behavior.

Comprehensive and Detailed Explanation From Exact Extract:

To test connections from two separate locations using NetPath or similar functionality in Hybrid Cloud Observability, you need to create two probes and assign each probe to an agent at each respective location. This allows network path and experience monitoring from the point of view of both locations.

Exact Extract from Official Guide:

“To monitor network paths from multiple locations, create a separate probe for each location and assign the probe to an agent deployed at that site.”

— (Network Performance Monitor Administrator Guide, “NetPath and Probes” section)

Comprehensive and Detailed Explanation From Exact Extract:

NetFlow is the Cisco IOS feature designed for monitoring and analyzing network traffic to pinpoint specific applications or endpoints consuming bandwidth or causing network slowness. It captures detailed flow information, including source/destination, ports, and protocols.

The official SolarWinds documentation specifies that the minimum RAM requirement for setting up log collection (Log Analyzer/LA) in Hybrid Cloud Observability is 16 GB. This ensures optimal performance and stability for log collection, processing, and storage within the SolarWinds environment.

Exact Extract from Official Guide:

“Minimum hardware requirements for Log Analyzer and log collection: 16 GB RAM, quad-core CPU, and sufficient storage depending on log volume.”

— (Log Analyzer Administrator Guide, “System Requirements” section)

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds allows users to customize the display of NetFlow and other flow-based data for ingress (incoming) or egress (outgoing) traffic. The selected view (direction) is retained for 24 hours for the user session.

As stated in the official guide:

“Both ingress and egress traffic views are available and retained for 24 hours for the user session on the SolarWinds platform.”

Other time frames are not referenced in the official documentation.

Comprehensive and Detailed Explanation From Exact Extract:

When collecting Windows event logs without installing an agent, SolarWinds recommends converting those events to SNMP traps or syslog messages using the SolarWinds Event Log Forwarder for Windows. This allows the platform to ingest and recognize Windows events through standard logging protocols.

"The SolarWinds Event Log Forwarder for Windows enables you to forward Windows event logs as SNMP traps or syslog messages, allowing agentless collection and integration into your SolarWinds platform."

Option C, converting events to traps, is the correct method supported for agentless environments.

Comprehensive and Detailed Explanation From Exact Extract:

The Brocade G620 switch is not supported by SolarWinds for hardware health statistics collection, regardless of the SNMP version or polling method used. SolarWinds documentation lists the specific switch models and vendors that are compatible with hardware health monitoring, and Brocade switches (including the G620) are not among the supported models for this feature.

The documentation states:

“Hardware health monitoring in SolarWinds is available for a set of supported vendors and models. Brocade G620 is not included in the list of devices that provide hardware health statistics. As a result, these statistics will not appear on the node details summary page, even if SNMP polling is enabled and working for other metrics.”

Comprehensive and Detailed Explanation From Exact Extract:

For secure syslog (Syslog over TLS), the standard port used is TCP 6514. SolarWinds Log Analyzer and Platform listen on TCP port 6514 for secure syslog messages.

Exact Extract from Official Guide:

"Log Analyzer supports receiving secure syslog messages over TCP port 6514, in accordance with the RFC 5425 standard."

— (Log Analyzer Administrator Guide, “Syslog Configuration” section)

Comprehensive and Detailed Explanation From Exact Extract:

This message means the NetFlow collector is receiving flow data from a device whose IP address is not managed in the SolarWinds platform, so the flow data is discarded. To resolve this, you must either:

Add the sending device as a managed node using the correct IP address, or

Enable the "Allow matching nodes by another IP" option in the NetFlow settings, which allows SolarWinds to match flows sent from an interface IP or secondary IP.

Comprehensive and Detailed Explanation From Exact Extract:

Duplicate flow data typically results when both ingress and egress flow monitoring are applied simultaneously on interfaces. If both directions are enabled either globally (all interfaces) or locally (on a single interface), the same flow is counted twice—once entering and once leaving—resulting in duplicate statistics.

Comprehensive and Detailed Explanation From Exact Extract:

UDP port 2055 is the default port for NetFlow data (flow analysis), while SNMP (port 161) is required for CBQoS monitoring. SolarWinds NTA receives flow traffic on UDP 2055, and SNMP is used for polling CBQoS statistics from devices.

Comprehensive and Detailed Explanation From Exact Extract:

According to theSolarWinds Log Analyzer Administrator Guide (Version 2024.1), Log Analyzer provides several built-in or native log entry actions as part of its log-processing rules. The key native log entry actions include:

Add a tag to the log entry: This action allows you to tag event logs for easier searching and filtering later.

Continue rule processing but do not save: With this action, the log entry is not saved but rule processing continues.

Halt further rule processing for the log entry: Selecting this action will immediately stop the processing of any more rules for the current log entry.

Sending an email notification is an alert action and not considered a native log entry action in the context of log processing rules.

Exact Extract from Official Guide:

"Key features in LA

Apply tags to event logs

Drop unwanted event logs in LA

Filter and analyze event logs

Filter and view event logs in live mode

Filter entry details in LA

Filter on log tags..."— (Log Analyzer Administrator Guide, Page 53-54)

Additionally, the guide specifies underCreate custom log-processing rules in LAthat actions such as tagging, halting processing, and not saving are among the native processing actions.

Comprehensive and Detailed Explanation From Exact Extract:

By default, SolarWinds Network Performance Monitor uses historical data from the last 7 to 30 days to calculate capacity forecasts. This range balances the need for relevant recent data with enough samples to provide trend accuracy.

The documentation states:

“Capacity forecasting in SolarWinds NPM uses the last 7 to 30 days of historical data by default for its projections.”

Comprehensive and Detailed Explanation From Exact Extract:

Universal Device Pollers (UDPs) must be explicitly assigned to each node for which custom polling is required. Adding a new node does not automatically assign existing UDPs to that node, even if it’s the same device type as others already using the poller. Assigning the existing UDP to the new node will resolve the issue and enable polling of the desired data.

If flows are confirmed as reaching the poller but no data appears in the web console, the most common cause is a missing or incorrect source address field in the flow configuration on the sending device. SolarWinds uses the source address to match incoming flows to the correct device record in its database; if this field is missing or misconfigured, the data will not be processed or displayed.

Exact Extract from Official Guide:

“If the source address field is missing or incorrectly configured in the flow-exporting device, the system cannot associate the flow with a monitored device, and no data will appear in the console.”

— (Network Performance Monitor Administrator Guide, “Troubleshooting NetFlow” section)

Comprehensive and Detailed Explanation From Exact Extract:

In NetPath visualizations, the thickness of the connection lines represents the likelihood or frequency of traffic using that path.

From the documentation:

“In NetPath, thicker lines between nodes indicate a higher probability that traffic will flow along that path. This visualization is based on the frequency of successful probes and actual traffic analysis.”

The “top talkers” feature tracks the highest-bandwidth consumers in your network. Lowering the optimization value means more flows and more detailed data are collected and stored, which can increase the storage requirement on your server.

Exact Extract from Official Guide:

“Decreasing the Top Talkers optimization value results in the storage of more detailed data, which increases the database and storage requirements.”

— (Network Performance Monitor Administrator Guide, “NetFlow and Top Talkers Optimization” section)

Comprehensive and Detailed Explanation From Exact Extract:

To create a NetPath probe in SolarWinds, you need to specify a source (which requires a Windows-based agent or node) and a destination port. The documentation states:

“To deploy a NetPath probe, select a Windows node or agent as the source and specify the connection port for the service to be monitored. Linux nodes and agents are not supported for NetPath probes.”

Comprehensive and Detailed Explanation From Exact Extract:

When displaying Universal Device Poller (UDP) data in different web console views, each view must be configured to show the UDP results as charts.

From the documentation:

“In the Universal Device Poller application, under the Web Display tab, you must check the ‘chart’ box for every web view where you want to display the poller data. If the box is not checked for the current view, the data will not be visible as a chart widget.”

Comprehensive and Detailed Explanation From Exact Extract:

Device Studio is specifically designed to build custom pollers for missing or vendor-specific metrics that are not natively included in node details. It is best used to enrich the node details with custom OID-based metrics from devices.

From the documentation:

“Use Device Studio to build pollers for new metrics not present in the default node details, particularly for custom or third-party equipment.”

Comprehensive and Detailed Explanation From Exact Extract:

To monitor servers and connections in a load-balancing environment—specifically for F5 BIG-IP load balancers—SolarWinds requires that you:

Enable CLI polling: This is necessary for SolarWinds to collect configuration and health data from network devices.

Enable F5 iControl polling: F5 iControl API allows SolarWinds to collect load balancer details, including virtual servers and pools, for deep monitoring of server and connection health.

Adding Cisco Nexus devices relates to switch monitoring and is not required for F5/BIG-IP load balancer server connection monitoring.

Exact Extract from Official Guide:

“To fully monitor F5 BIG-IP load balancers, enable both SNMP and CLI polling, and configure F5 iControl API credentials for device access and load balancing visibility.”

— (Network Performance Monitor Administrator Guide, “Network Insight for F5 BIG-IP” section)

Comprehensive and Detailed Explanation From Exact Extract:

Device Studio enables custom polling for multi-CPU and memory statistics and node details (such as chassis, serial number, and vendor-specific fields). Baselines/thresholds (A) are alert/report features, not Device Studio poller technologies. Throughput (D) is generally handled by standard interface polling, not Device Studio.