SolarWinds KB: PowerShell

Showing posts with label PowerShell. Show all posts

Why Your SolarWinds Orion Web Server Drives are Filling Up Over Time & How to Fix It

If you've had your SolarWinds Orion install for any length of time, you'll probably notice that the C: drives on the primary polling engine and/or any additional web servers (AWS) keep growing over time. The more support tickets you create, the faster these drives will fill up. Well, there's a reason for this...

When you generate a diagnostics from the Orion web console, it drops all of those hefty zip files on the C: drive of the web server that you were logged into when you generated them. Furthermore, it never cleans these up on it's own. If you're web server has been up for several years, you've probably got a pretty good chunk of disk sucked up by these diagnostic files.

They are easy enough to clean up though, if you know where they are hidden. Yes, they are literally hidden. They exist under the hidden file path of %ProgramData%\SolarWinds\Diagnostics. Typically, that ProgramData environment variable will point to C:\ProgramData which is a hidden folder, but the path can vary based on your server's configuration.

In order to automatically clean these up, I wrote the PowerShell script below and I run it daily from Task Scheduler. This simple one-liner will check the directory for any zip files older that 14 days and delete them. Typically, after you submit that zip file to support, you'll never use it again. So, you're not going to be missing anything by removing these old files.

	Get-ChildItem -Path "$ENV:ProgramData\SolarWinds\Diagnostics" \| `
	Where-Object {$_.LastWriteTime -lt ((Get-Date).AddDays(-14)) -and $_.Extension -eq '.zip'} \| `
	Remove-Item -Force -Confirm $false

view raw Remove-OldOrionDiagnosticFiles.ps1 hosted with ❤ by GitHub

You will probably have to run this PowerShell snippet in an elevated PowerShell window for it to access these files if they have their default permissions.

I also have this script available on GitHub as Remove-OldOrionDiagnosticFiles.ps1 if you'd prefer to grab it from there.

How to Bulk Enable Application Dependency Mapping on Agents in SolarWinds Orion Using PowerShell

SolarWinds Server & Application Monitor (SAM) has a feature called Application Dependency Mapping. This feature analyzes the connections on servers running the Orion agent to determine which processes and servers are talking to each other. It then takes those connections and creates application dependencies for them.

Identifying and enabling application dependency mappings programmatically in SolarWinds Orion can get a little funky. Below is a PowerShell script which finds any agents that do not have application dependency mappings enabled and enabled it on them. I also have this script posted on GitHub if you'd prefer to grab it from there. Sometime copying code from a web page can morph characters.

# Verify that the OrionSDK is installed and available.

# This is a required prerequisite for this script.

# It can be downloaded from https://github.com/solarwinds/OrionSDK

if (!(Get-Command Get-SwisData)) {

if (!(Get-PSSnapin | Where-Object { $_.Name -eq "SwisSnapin" })) {

Try {

Add-PSSnapin "SwisSnapin"

} Catch {

if (Test-Path "C:\Program Files (x86)\SolarWinds\Orion SDK\SWQL Studio\SwisPowerShell.dll") {

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Program Files (x86)\SolarWinds\Orion SDK\SWQL Studio\SwisPowerShell.dll" | Out-Null

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe "C:\Program Files (x86)\SolarWinds\Orion SDK\SWQL Studio\SwisPowerShell.dll" | Out-Null

} else {

Write-Host "This script requires the OrionSDK to be installed." -ForegroundColor Red

Write-Host "https://github.com/solarwinds/OrionSDK" -ForegroundColor Red

}

# Checking to see if we already have stored credentials.

# If not, we'll prompt for credentials and securely

# store them with Export-CLIXML.

$ApiCredPath = $env:Userprofile + '\ApiCreds'

if (!(Test-Path -Path $ApiCredPath)) {

$ApiCred = Get-Credential -Message "Please enter your credentials for SolarWinds Orion"

if ($ApiCred) {

Export-Clixml -Path $ApiCredPath -InputObject $ApiCred

}

$SwCredential = Import-Clixml -Path $ApiCredPath -Verbose

# Checking to see if we have a cached an Orion server.

# If not, we'll prompt for hostname or IP address of the

# primary Orion server and cache it to the Orion environment variable.

if (!$Env:Orion) {

$OrionServer = Read-Host "Enter the hostname or IP of your primary Orion server."

if ($OrionServer) {

New-Item -Path Env:\Orion -Value $OrionServer

}

$Swis = Connect-Swis -Hostname $env:Orion -Credential $SwCredential

# Get agent nodes that don't yet have application dependencies enabled

$NodesQuery = @"

SELECT NodeID, ObjectSubType, IPAddress, Caption, n.CustomProperties.Environment, n.Inventory.NodeID AS [InventoryNodeID]

FROM Orion.Nodes n

WHERE n.ObjectSubType='Agent' AND

n.Inventory.NodeID IS NULL AND

$Nodes = Get-SwisData -SwisConnection $Swis -Query $NodesQuery

# Loop through each of the nodes and enable application dependencies

foreach ($Node in $Nodes) {

Invoke-SwisVerb -SwisConnection $Swis -EntityName Orion.ADM.NodeInventory -Verb Enable -Arguments @( ,@( $($Node.NodeID) ) )

}

Enable-ApplicationDependencyPolling.ps1

How to Set Node Captions to Lower Case Host Name in SolarWinds Orion Using PowerShell

By default, SolarWinds Orion will use either the sysname it gets from the device via SNMP, WMI, or the agent, etc. when it sets the nodes name in the "caption" field. If it can't get the sysname, it will try to get a name from reverse DNS and use that if it is available. Unfortunately, this can leave the node names inconsistent where some will have be using a fully qualified domain name (FQDN) and other won't. Some will use capital letters, while others will be lower case.

I wrote a PowerShell script which will truncate the name down to the hostname and convert all of the letters to lower case. This makes viewing a list of nodes much easier on the eyes when they are all consistent, especially if you have a touch of OCD. I have the full script available on GitHub here, if you'd like to download it.

I tried to dummy-proof the script a little bit. So, you'll notice that the first section will check that the OrionSDK is installed and that the snap-in has been loaded, which is a prerequisite requirement.

The second section will prompt you for credentials to log into the SolarWinds SWIS API. I use the export-clixml and import-clixml cmdlets to store and retrieve the credentials. These cmdlets use the "Windows Data Protection API" to securely encrypt/decrypt the credentials.

The next section creates a connection to the SolarWinds SWIS API. It will check to see if there's already an "Orion" environment variable. If not, it will prompt you for the hostname or IP address of the primary Orion server and cache it in the "Orion" environment variable. That way it doesn't have to ask you for the Orion server again the next time you run the script.

I also use the "ScriptLogPath" environment variable to cache the directory where you want to store the script logs. If this hasn't been set yet, it will prompt you for a file path. The next section roll these logs if they are over 10 MB.

Finally we are getting to the guts of the script. First, we'll query the Orion API for nodes in the private IP space which have alphabetic characters, a period, and no spaces in it's name. I limited it to the private IP space because if it's an external node, the domain is probably more useful and probably wants to be preserved. If it has a period, it obviously isn't just a hostname. Finally, if it has a space, it's probably a custom caption of sort, so we won't mess with it.

The script takes all of the results from the query above, splits them at all of the periods and takes the first section for the new caption. It then converts that new caption, converts it to lower case and writes it back to the Orion API.

The final section of the script uses the ExecuteSQL verb in the Orion.Reporting path of the Orion API to get any remaining nodes that has a capital letter in it's name. We do it this way because the Orion API isn't able to use case sensitive regex to find the nodes. The Orion database typically uses SQL_Latin1_General_CP1_CI_AS for collation, which is case insensitive. By piping the SQL query into SQL through the ExecuteSQL verb, we can force it to use the Latin1_General_BIN collation for this query. We then manually build a URI for that node, convert the caption to lower case, and update the node via the Orion API.

I hope this is useful for you. As always, test any scripts before using them in production. Feel free to catabolize the parts that are important to you, and drop what isn't.

Full Script: Set-OrionCaptionToLowerCaseHostName.ps1

Custom SWQL Query to Identify the Top 10 SolarWinds Orion Nodes by Their Number of NPM Elements

Below is a SWQL query which can be used to determine which nodes in your SolarWinds Orion environment have the most elements. What is an element? In NPM, every node, volume and interface counts as an element. Which leads to, why is this important? For one, SolarWinds Network Performance Monitor (NPM) is typically licensed by the number of elements, unless you are one of the newer nodes based licensing options. If you have a large environment, this also comes in helpful when trying to balance the load across your polling engines. Typically, a polling engine is limited to ~12,000 elements before your polling frequencies start to automatically slow down (unless you're stacking polling engine licenses and have the computer resources to support it).

SELECT TOP 10 i.Interfaces + v.Volumes + 1 AS [Elements] , n.Caption AS [Node] , n.NodeID , n.IP_Address AS [IP] , n.Vendor , n.MachineType FROM Orion.Nodes n INNER JOIN (SELECT COUNT(InterfaceID) AS [Interfaces], NodeID FROM Orion.NPM.Interfaces GROUP BY NodeID) AS i ON i.NodeID=n.NodeID INNER JOIN (SELECT COUNT(VolumeID) AS [Volumes], NodeID FROM Orion.Volumes GROUP BY NodeID) AS v ON v.NodeID=n.NodeID GROUP BY n.NodeID , n.Caption , n.IP_Address , n.Vendor , n.MachineType , i.Interfaces , v.Volumes ORDER BY [Elements] DESC

If you're unfamiliar with SWQL and how to run it, I'll list a few ways below.

You can go to https://<OrionURL>/orion/Admin/swis.aspx in your environment, past the code in the box, and execute it. You'll have to replace "https://<OrionUrl>" with the URL for your environment, of course.
If you have the OrionSDK installed, you can run it in SWQL Studio.
If you have the OrionSDK installed, you can run the query with the "Get-SwisData" PowerShell cmdlet.
You can use the query above as a data source for a report or custom dashboard widget.

Get-Top10NodesByElements.swql on GitHub

Custom SWQL Query to Identify the Top 10 SolarWinds Orion Nodes by Their Number of Enabled SAM Components

Since SolarWinds Server & Application Monitor (SAM) went to node based licensing, it isn't super easy to determine which nodes have the most SAM components assigned to them. Below is a SWQL query which can be used to display the top 10 nodes with the most enabled SAM components in your environment.

SELECT TOP 10 Count(c.ComponentID) AS [Components] , c.Application.Node.NodeID , c.Application.Node.Caption AS [Node] , c.Application.Node.IP_Address AS [IP] , c.Application.Node.Vendor , c.Application.Node.MachineType FROM Orion.APM.Component c WHERE c.Disabled = 'False' GROUP BY c.Application.Node.NodeID , c.Application.Node.Caption , c.Application.Node.IP_Address , c.Application.Node.Vendor , c.Application.Node.MachineType ORDER BY [Components] DESC

If you're unfamiliar with SWQL and how to run it, I'll list a few ways below.

You can go to https://<OrionURL>/orion/Admin/swis.aspx in your environment, past the code in the box, and execute it. You'll have to replace "https://<OrionUrl>" with the URL for your environment, of course.
If you have the OrionSDK installed, you can run it in SWQL Studio.
If you have the OrionSDK installed, you can run the query with the "Get-SwisData" PowerShell cmdlet.
You can use the query above as a data source for a report or custom dashboard widget.

Get-Top10NodesByElements.swql on GitHub

Prelude

I have been working with SolarWinds products for many years now. I've done everything from professional services across the SolarWinds portfolio of products to systems engineering and administration jobs. I've even earned five SolarWinds SCP certifications. Over the years, I've learned a lot of tips and tricks, as well as developed an extensive archive of PowerShell scripts, pollers, SWQL and SQL queries, etc. As I have time, I'll be cleaning up my code, posting the details here, and building out a related GitHub repository. Bookmark the site, subscribe to the RSS feed, etc... there's a lot of good things coming down the pipe!

Feel free to follow me on GitHub, Thwack and/or LinkedIn