Comprehensive and Detailed Explanation From Exact Extract:

Applications and NBAR2 applications in top applications are sorted by bytes: The default sorting for the “Top Applications” view, including NBAR2 apps, is by bytes.

It is possible to combine applications and NBAR2 applications: SolarWinds allows combining standard and NBAR2-classified apps for alerting and reporting purposes.

Exact Extract from Official Guide:

"Top Applications, including NBAR2, are sorted by bytes and you can combine standard and NBAR2 application data in alerts and reports."

— (Network Performance Monitor Administrator Guide, “NBAR2 Applications” section)

Comprehensive and Detailed Explanation From Exact Extract:

If an OID is not present in the SolarWinds MIB database, you can still poll it by manually defining the OID in Device Studio. The platform allows you to input the object identifier and specify SNMP as the method to query the device.

From the documentation:

"If a required OID is missing from the MIB database, use the Device Studio's 'Manually Define Object Identifier' feature to specify the OID and configure SNMP polling for the device."

Comprehensive and Detailed Explanation From Exact Extract:

Custom pollers are typically created when you need to monitor metrics or OIDs that are not supported by default in SolarWinds:

Monitor specific metric that is not out-of-the-box: If a device exposes a metric not natively monitored by SolarWinds, you must create a custom poller for that metric.

Monitor unsupported object ID: For any OID that is not included in default templates, a custom poller is necessary.

Monitoring special equipment or devices without WMI might also need custom pollers, but the requirement specifically applies when you need to access non-standard metrics or OIDs.

Comprehensive and Detailed Explanation From Exact Extract:

If a device studio poller is configured with a static textual value (rather than a dynamic OID), any change in the actual value on the node will not be detected automatically; the poller’s configuration must be manually updated to reflect the new value. OID-based pollers update automatically as values change on the device.

Comprehensive and Detailed Explanation From Exact Extract:

Device Studio is designed to enable support for complex devices and can poll multiple OIDs as part of a single custom poller definition. While Universal Device Poller (UDP) is also used for custom SNMP polling, it is generally limited to a single OID per poller. Device Studio is intended for use cases that require combining and correlating multiple OIDs for richer, template-based device monitoring.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds allows you to confirm which metrics (contributors) are used to determine node status. In the node status contributors configuration, you can check if CPU load is included for status calculation. This ensures that CPU thresholds are considered when evaluating overall node health.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds Hybrid Cloud Observability (HCO) supports capturing flow data and CBQoS data using:

A. IPFIX: (IP Flow Information Export) is the IETF standard for exporting flow information, supported for both flow data and CBQoS.

C. NetFlow: Developed by Cisco, widely used for flow and CBQoS data collection.

J-Flow is primarily for flow data (from Juniper devices), and SNMP is not a flow export protocol.

The documentation states:

"NetFlow (including NetFlow v9) and IPFIX are supported for flow and CBQoS data collection. These standards provide extensive network traffic and QoS visibility within HCO."

Comprehensive and Detailed Explanation From Exact Extract:

The correct process for creating a poller in Device Studio is:

Select the technology

Specify the data source

Assign the poller to a node

Save the poller

Comprehensive and Detailed Explanation From Exact Extract:

When the SNMP community string is changed on a device, SolarWinds recommends:

Edit the node properties and save the changes.

Update the community string in node properties to match the new value on the device.

"To restore polling, edit the node in SolarWinds, update the SNMP community string in the properties, and save the changes. This ensures that SolarWinds can authenticate and resume polling. Deleting and re-adding the node is not necessary, nor is restarting the SNMP service on the device in most cases."

Comprehensive and Detailed Explanation From Exact Extract:

In NetFlow (especially Flexible NetFlow on Cisco devices), a flow monitor is applied to an interface to track and collect information about IPv4 (or IPv6) traffic. The flow monitor references a flow record and a flow exporter. The monitor itself is the entity configured on an interface to start the flow tracking process.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds determines node status by polling using ICMP (ping) and SNMP. If ICMP is blocked by a firewall or network device between the polling engine and the monitored node, the node will appear “down” in the web console even though it is actually up. Likewise, if the SNMP credentials configured in SolarWinds are incorrect, the polling engine cannot successfully query the device, leading to a false “down” status.

From the documentation:

“If ICMP packets are blocked or dropped, SolarWinds cannot determine node status, resulting in false down events.”

“Incorrect SNMP community strings or credentials will prevent node polling, and these nodes may appear down in the console.”

Changing the polling interval or node management settings does not directly cause this issue.

Comprehensive and Detailed Explanation From Exact Extract:

Enabling DNS resolution but not storing hostnames immediately results in:

Reduced database memory/storage used for DNS info, as hostnames aren’t stored with each flow record.

Less database space used for flows, since flow records will reference IPs rather than resolved DNS names.

Reduced SQL server reads/writes since the platform does not immediately resolve and store hostnames with every received flow, decreasing load.

DNS names will still appear in reports where resolved dynamically, so option C is incorrect.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds platform allows for customizing threshold behavior to reduce false positives and tune alerting sensitivity. The three primary customizable threshold settings are:

Single poll: A threshold is triggered immediately if the value breaches the limit in a single polling cycle.

X consecutive polls: The threshold must be exceeded in X consecutive polling intervals before being considered breached.

X of Y polls: The threshold is triggered if the value exceeds the limit in X out of Y most recent polls.

"X concurrent polls" is not an available threshold customization in the SolarWinds platform.

Comprehensive and Detailed Explanation From Exact Extract:

A. Communication issue exists in new device: If there is an SNMP or network issue, the poller cannot retrieve data.

D. Object IDs (OIDs) are not supported: The new device may not support the same OIDs as the test device, resulting in no data returned.

SolarWinds documentation notes:

"When extending a poller to other devices, ensure network/SNMP communication is successful and that the target devices support the required OIDs. Differences in support or access may cause data collection to fail on some nodes."

Comprehensive and Detailed Explanation From Exact Extract:

NetFlow is the Cisco IOS feature designed for monitoring and analyzing network traffic to pinpoint specific applications or endpoints consuming bandwidth or causing network slowness. It captures detailed flow information, including source/destination, ports, and protocols.

Comprehensive and Detailed Explanation From Exact Extract:

In SolarWinds Universal Device Poller (UDP), the column get type is used to retrieve values from a particular column of an SNMP table, meaning you get all the values for that column across multiple rows.

Comprehensive and Detailed Explanation From Exact Extract:

Hardware health monitoring can be enabled during node discovery or after a node is added via the "List Resources" option. Additionally, hardware health can be enabled or viewed in the Asset Inventory page for nodes that support it.

From the documentation:

“You can enable hardware health sensors by selecting the option during resource discovery (List Resources) or later via Asset Inventory for individual nodes.”

Comprehensive and Detailed Explanation From Exact Extract:

B. NetFlow data is commonly used to diagnose network performance issues, such as identifying sources of congestion or bottlenecks.

C. NetFlow analysis provides visibility into which applications and endpoints are consuming bandwidth and causing congestion.

User authorization and link status events are not functions of NetFlow; those are handled by other monitoring tools or features.

Comprehensive and Detailed Explanation From Exact Extract:

According to the SolarWinds documentation:

"The maximum number of resources that can be displayed in any flow chart or view is 50. Attempting to display more may impact performance and will not be rendered in the UI."

This ensures optimal performance and usability of the charts within the platform.

The “Device View” feature allows users to view the physical layout of device interfaces on graphical stencils, providing an intuitive graphical representation of port locations and status.

Exact Extract from Official Guide:

“Device View displays the physical layout of device interfaces using graphical stencils for supported devices.”

— (Network Performance Monitor Administrator Guide, “Device View” section)

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds Log Analyzer supports secure syslog forwarding using the TCP protocol. The industry standard and the default port used for secure syslog (Syslog over TLS/TCP) is port 6514. This is referenced in SolarWinds documentation where it specifies:

"For secure syslog forwarding, Log Analyzer uses TCP port 6514, which is the default for syslog over TLS, as defined by RFC 5425."

This ensures that log data is encrypted during transmission, enhancing security over the default UDP port 514 (which is used for non-secure syslog).

Comprehensive and Detailed Explanation From Exact Extract:

For secure syslog (Syslog over TLS), the standard port used is TCP 6514. SolarWinds Log Analyzer and Platform listen on TCP port 6514 for secure syslog messages.

Exact Extract from Official Guide:

"Log Analyzer supports receiving secure syslog messages over TCP port 6514, in accordance with the RFC 5425 standard."

— (Log Analyzer Administrator Guide, “Syslog Configuration” section)

Comprehensive and Detailed Explanation From Exact Extract:

To monitor a custom application using flow monitoring in SolarWinds Hybrid Cloud Observability, you must define the application by specifying its port or port range (and optionally protocol). After this, the application can be assigned to flows involving specific machines, but the primary step is to define application ports first.

Comprehensive and Detailed Explanation From Exact Extract:

The Universal Device Poller (UDP) in SolarWinds NPM allows users to monitor any SNMP-exposed value, including interface traffic, UPS battery status, and CPU temperature, provided the device's MIB exposes the relevant OIDs. Users configure the UDP to poll these custom OIDs, making it a flexible option for monitoring a wide range of metrics across diverse devices.

Comprehensive and Detailed Explanation From Exact Extract:

The local NetFlow source provides live (real-time) flow traffic data that is sourced to and from the main polling engine server. This feature is primarily for monitoring the main polling engine’s traffic and quickly identifying top talkers and general flow activity on that server.

Comprehensive and Detailed Explanation From Exact Extract:

A. Ensuring that firewall rules allow SNMP traffic is essential, especially when monitoring remote site nodes.

C. Basic connectivity should be checked by pinging the node from the SolarWinds application server.

D. If the SNMP community string is changed, the SNMP service on the device must be restarted for the new configuration to take effect.

Option B is not required unless SNMPv3 is specifically being used, and even then, SNMPv2c and SNMPv1 are still widely supported and commonly used.

Comprehensive and Detailed Explanation From Exact Extract:

According to theSolarWinds Log Analyzer Administrator Guide (Version 2024.1), Log Analyzer provides several built-in or native log entry actions as part of its log-processing rules. The key native log entry actions include:

Add a tag to the log entry: This action allows you to tag event logs for easier searching and filtering later.

Continue rule processing but do not save: With this action, the log entry is not saved but rule processing continues.

Halt further rule processing for the log entry: Selecting this action will immediately stop the processing of any more rules for the current log entry.

Sending an email notification is an alert action and not considered a native log entry action in the context of log processing rules.

Exact Extract from Official Guide:

"Key features in LA

Apply tags to event logs

Drop unwanted event logs in LA

Filter and analyze event logs

Filter and view event logs in live mode

Filter entry details in LA

Filter on log tags..."— (Log Analyzer Administrator Guide, Page 53-54)

Additionally, the guide specifies underCreate custom log-processing rules in LAthat actions such as tagging, halting processing, and not saving are among the native processing actions.

Universal Device Pollers (UDPs) are tied to the polling engine on which they are created. This means if a UDP is created on the main polling engine, it will only collect data for devices polled by that engine. To collect data from devices polled by an additional polling engine, you must create or assign the UDP on that engine as well.

Exact Extract from Official Guide:

“Universal Device Pollers are tied to the polling engine on which they are created. To monitor devices assigned to an Additional Polling Engine, the UDP must be created or assigned on that engine.”

— (Network Performance Monitor Administrator Guide, “Universal Device Pollers” section)

Comprehensive and Detailed Explanation From Exact Extract:

The flow navigator in SolarWinds NetFlow Traffic Analyzer allows users to filter and analyze flow data. For future access, you can save your custom view to the menu bar from the flow navigator, providing one-click access to your saved configurations.

The documentation states:

“To save a custom NetFlow analysis for future use, configure your view in the flow navigator, then select the option to save the view to the menu bar for easy retrieval.”

Comprehensive and Detailed Explanation From Exact Extract:

Network Insight in SolarWinds supports in-depth monitoring for certain advanced switch platforms. According to the latest SolarWinds Network Performance Monitor Administrator Guide:

"Network Insight for Cisco Nexus provides advanced visibility into the health, configuration, and performance of Nexus switches. This includes inventory, configuration changes, interface health, VDCs, and more."

Other switch families such as Brocade, Juniper, and Meraki are not currently supported by Network Insight.

The official SolarWinds documentation specifies that the minimum RAM requirement for setting up log collection (Log Analyzer/LA) in Hybrid Cloud Observability is 16 GB. This ensures optimal performance and stability for log collection, processing, and storage within the SolarWinds environment.

Exact Extract from Official Guide:

“Minimum hardware requirements for Log Analyzer and log collection: 16 GB RAM, quad-core CPU, and sufficient storage depending on log volume.”

— (Log Analyzer Administrator Guide, “System Requirements” section)

Comprehensive and Detailed Explanation From Exact Extract:

Resource is showing outdated information: If polling intervals are too long or if there is a communication problem, the hardware health resource may not update promptly, resulting in inaccurate status display.

Wrong MIB being used for polling: If SolarWinds is using an incorrect or generic MIB, it may not retrieve accurate hardware health data for the specific fan sensor, causing the status to incorrectly display as “up” even when failed.

While disabled sensors and forced thresholds may impact alerting or monitoring, they are less likely to cause this direct display inconsistency.

Comprehensive and Detailed Explanation From Exact Extract:

When collecting Windows event logs without installing an agent, SolarWinds recommends converting those events to SNMP traps or syslog messages using the SolarWinds Event Log Forwarder for Windows. This allows the platform to ingest and recognize Windows events through standard logging protocols.

"The SolarWinds Event Log Forwarder for Windows enables you to forward Windows event logs as SNMP traps or syslog messages, allowing agentless collection and integration into your SolarWinds platform."

Option C, converting events to traps, is the correct method supported for agentless environments.

Comprehensive and Detailed Explanation From Exact Extract:

When the NetFlow collector service is showing a "down" status, the SolarWinds documentation recommends the following troubleshooting steps:

Confirm the database connection is up and server has free resources.

Explanation:The NetFlow collector service relies on connectivity to the SolarWinds database. If the database connection is lost or the server is out of resources (such as CPU or RAM), the service may go down or fail to start. Ensuring that the database is reachable and that the server has enough resources is a primary troubleshooting step.

Start or restart SolarWinds’ NetFlow service from Orion Service Manager.

Explanation:The official troubleshooting guidance instructs administrators to use the Orion Service Manager to start or restart the NetFlow service. This is a direct method to recover the NetFlow collector from a "down" state and is one of the first actions recommended by SolarWinds support.

Options B and C arenotrecommended in the official documentation:

Deleting and re-adding the NetFlow collector service is not a documented troubleshooting step and may cause loss of configuration.

Starting or restarting the generic "collector service" is not specific to NetFlow; the correct service is the NetFlow service.

Exact Extract from Official Guide:

"If NetFlow collector service status is down:

Ensure the SolarWinds database is online and the server is not experiencing resource issues.

Use the Orion Service Manager to start or restart the NetFlow service.

If the issue persists, review the NetFlow logs for errors and consult the SolarWinds Success Center for advanced troubleshooting."— (Network Performance Monitor Administrator Guide, Troubleshooting NetFlow and Service Issues)

Comprehensive and Detailed Explanation From Exact Extract:

Device Studio supports advanced custom polling, allowing you to build pollers for technologies such as multi-CPU/memory, node details (e.g., chassis, serial number), and single CPU/memory. While interface traffic polling is best accomplished through standard interface resources, Device Studio is designed for more advanced or complex device metrics that are not available via built-in polling.

Comprehensive and Detailed Explanation From Exact Extract:

Hiding an IP address group in IPAM management means that group will not appear in dashboards, charts, or reports, but the underlying data and group definition remain intact and are not deleted.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds capacity forecasting accuracy improves when:

More historical data is used: The more historical data points included in calculations, the better the forecasting model will perform.

Using average daily values for calculations: This smooths out anomalies and provides a more accurate trend, as recommended in the documentation:

“To improve the precision of capacity forecasting, use as much historical data as possible and set calculations to use average daily values.”

Monitoring with platform agents or adjusting thresholds affects alerting, not trend accuracy.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds Hybrid Cloud Observability supports multiple industry flow protocols:

J-Flow: Supported and commonly used by Juniper devices.

NetFlow v9: Supported, providing flexible flow data and templates.

sFlow: Supported, widely used in vendor-agnostic environments.

NetFlow v6 is not a recognized protocol; SolarWinds documentation does not list it as a supported standard.

"SolarWinds NTA and HCO support NetFlow (v5/v9), sFlow, J-Flow, and IPFIX for collecting and analyzing flow data."

Comprehensive and Detailed Explanation From Exact Extract:

To request an update to the SolarWinds MIB database, you must provide a complete SNMP walk or MIB walk from the device in question. This allows SolarWinds to identify and incorporate new OIDs and their definitions into the database.

From the documentation:

"Submit a request with a full SNMP walk or MIB walk output from your device. This provides the necessary OID and device structure for the SolarWinds team to update the MIB database."

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds provides a MIB Browser utility that lets you search and verify whether a specific object ID (OID) exists in the SolarWinds MIB database. By entering the OID in the MIB Browser, you can confirm its presence and also test polling against the device.

The documentation states:

"Use the MIB Browser to search for and verify OIDs in the SolarWinds MIB database. The tool also allows you to test poll the device to ensure the OID is being returned."

Comprehensive and Detailed Explanation From Exact Extract:

Duplex mismatches often result in specific types of switch port errors. According to SolarWinds documentation, the most common indicators of a duplex mismatch include CRC errors (B), high receive error percentages (C), and collisions (D). These errors occur because one end of the link operates in full-duplex mode (no collisions expected), while the other operates in half-duplex (collisions possible), resulting in frame errors, dropped packets, and high CRC counts. The option "100 MB full" refers to a speed/duplex setting, not an error.

Comprehensive and Detailed Explanation From Exact Extract:

A. MIB files define the available SNMP objects and metrics that can be polled from a device.

C. MIB files provide human-readable names and descriptions for OIDs, allowing SolarWinds to display metrics in a clear, user-friendly format instead of raw OID numbers.

Automatic device discovery is handled by network scanning, not by MIB files, and OIDs are created by device vendors, not by SolarWinds.