Quantcast
Channel: THWACK: Document List - All Communities
Viewing all 9474 articles
Browse latest View live

How to create a report displaying the Last Time Data was Transmitted or Received on a Switch Port

$
0
0

First off, there's a great thread with XML language that creates a new Report for this that can be imported into your SW here:  How to find ports which have not been used for a long time ?

 

If that doesn't get you exactly what you want, older versions of NCM had this information as part of their Inventory solution.  It's been removed at version 7.4 and reportedly is moving to UDT.

 

Check this search out for other threads containing "Last  & Transmitted":  https://thwack.solarwinds.com/search.jspa?q=last+transmitted

 

 

The process below is what I built for my team's use, since the above XML report provided information for too many kinds of ports and systems.  The method I use allows you to focus on a specific switch, and it eliminates reporting on some ports that I know will always be out of scope for discovering patched copper ports for reuse (like fiber uplink ports and port-channels or local Fa0 ports).

 

Start off in Settings, Admin > Alerts & Reports, Create New Report

Click the small blue "Edit" just to the right of Datasource 1 and make it look like this:

Adjust the items above to match your specific needs and then click Add to Layout.

 

What the filtered options mean:

  • As you can see from the first entry (Caption contains "Insert Switch Name") this particular report will focus solely on a specific switch.  You don't have to include this if you don't want, and you could change it to identify a switch by whatever method you prefer--or drop it entirely.
  • Orion NPM may discover Cisco interfaces that are "Controlled" and "Uncontrolled" for security options (depending on IOS release and hardware platform); since these interfaces are duplicates to the physical interfaces, I don't want them included in the report, so I had it filter any interface with "ontrol" in its name.
  • I'm not interested in Port-channels, therefore that's filtered out.
  • I don't want any port whose status is "Up".
  • It must be a Physical Interface, not a virtual or logical one.
  • Don't report on Ten Gig interfaces ("Interface Name does not start with Te")
  • Don't report on interfaces ending in 49-52--those are uplink fiber links on my switches, and I'm not looking for information about those in this report.  I only want to know about copper ports that can be unpatched & reused.
  • Don't report on the Fa0 port if one is present

 

Click Edit Table

Adjust these items per your specific needs and click Submit

 

I put a note it to remind my Team to change the switch name inside the report:

Click Next

 

Put helpful information in the Report Description, Click Next.

 

 

Schedule if it needed:

Click Next

 

 

Review the setup and make any changes required:

Click Submit.

 

 

Now select the report, edit it to report on the specific switch, save it and run it. You'll get a report that sorts from the ports longest down to those most recently down, looking like this:

 

I export this to .PDF and send it to my Network Technicians for unpatching of ports on switches they're concerned with.

 

Enjoy!


STIG-JNPR-JNOS-PRTR - QoS and VPN.xml

STIG-JNPR-JNOS-PRTR - OOB.xml

STIG-JNPR-JNOS-PRTR - Logging and NTP.xml

STIG-JNPR-JNOS-PRTR - IPv6 and Multicast.xml

STIG-JNPR-JNOS-PRTR - ACL.xml

STIG-JNPR-JNOS-PRTR - Access Account.xml

HTTP/S Block Check


Powershell Monitor - Check for Multiple Instances of a Windows Process.apm-template

VLANs Used from IPAM

Unused IPAM VLANs

Table of Third Party Patches - Updated 06/16/2017

$
0
0

Simplify and automate these patches and more with SolarWinds Patch Manager.


Check out the attached spreadsheet for recent patches.

The Patch Manager catalog contains the following products:

 

 

VendorApplicationsLatest VersionLast Updated On
7-Zip7-Zip16.0410/04/16

Adobe

Air26.0.0.11806/14/17
Flash Player (ActiveX, Plugin & PPAPI)26.0.0.12606/14/17
Flash Player ESR (ActiveX & Plugin)18.0.0.38210/13/16
Shockwave12.2.9.19906/14/17
ApacheTomcat v77.0.7805/22/17
Tomcat v88.0.4405/18/17
Tomcat v8.58.5.1505/12/17

Apple

Apple Application Support5.506/02/17
Apple Mobile Device Support10.3.2.306/02/17
iTunes12.6.1.2505/17/17
QuickTime7.7.901/07/16
CitrixReceiver for Windows Enterprise4.703/20/17
FileZillaFileZilla Client3.26.206/16/17
FoxitFoxit Enterprise Reader8.3.0.1487804/19/17
GoogleChrome59.0.3071.10406/16/17
MalwarebytesMalwarebytes Anti-Malware3.1.2.173305/12/17
MicrosoftSkype7.37.0.10306/16/17

Mozilla

Firefox54.006/16/17
Firefox ESR45.904/24/17
Thunderbird52.2.006/16/17
SeaMonkey2.4612/28/16
Notepad++Notepad++7.4.105/18/17
OracleJava Runtime Environment8u13104/19/17
OperaOpera45.0.2552.89806/14/17
RealVNCVNC Server6.1.106/01/17

SolarWinds

Dameware MRC Standalone12.0.305/05/16
Dameware MRC Centralized12.0.305/05/16
Patch Manager WMI Providers2.1.2.303409/30/16
UltraVNCUltraVNC Server1.2.1.506/16/17
UltraVNC Viewer1.2.1.506/16/17
VLCVLC Media Player2.2.505/26/17
VMwareVMware Tools10.1.705/18/17
WinRARWinRAR5.408/29/16
WinZipWinZip21.5.1248005/17/17

 

Change History (current month + 1):

 

06/16

  • FileZilla Client 3.26.2 (06/12)
  • Google Chrome 59.0.3071.104 (06/15)
  • Mozilla Firefox 54.0 (06/13)
  • Mozilla Thunderbird 52.2.0 (06/14)
  • Skype 7.37.0.103 (06/08)
  • UltraVNC 1.2.1.5 (06/15)

 

06/14

  • Adobe Air 26.0.0.118 (06/13)
  • Adobe Flash 26.0.0.126 (06/13)
  • Adobe Shockwave 12.2.9.199 (06/13)
  • Opera 45.0.2552.898 (06/12)

 

06/06

  • Google Chrome 59.0.3071.86 (06/05)
  • FileZilla Client 3.26.1 (06/02)

 

06/02

  • Apple Application Support 5.5 (05/15)
  • Apple Mobile Device Support 10.3.2.3 (05/15)
  • FileZilla Client 3.26 (06/01)

 

06/01

  • RealVNC Server 6.1.1 (05/30)

 

05/31

  • Opera 45.0.2552.888 (05/31)

 

05/26

  • Opera 45.0.2552.881 (05/25)
  • VLC Media Player 2.2.5 (05/25)

 

05/23

  • VMware Tools 10.1.7 (05/18)

 

05/22

  • Apache Tomcat 7.0.78 (05/19)
  • Mozilla Firefox 53.0.3 (05/19)

 

05/18

  • Apache Tomcat 8.0.44 (05/16)
  • Notepad++ 7.4.1 (05/18)

 

05/17

  • iTunes 12.6.1.25 (05/15)
  • Mozilla Thunderbird 52.1.1 (05/15)
  • Opera 45.0.2552.812 (05/15)
  • VLC Media Player 2.2.5.1 (05/12)
  • VNC Server 6.1.0 (05/02)
  • WinZip 21.5.12480 (04/28)

 

05/15

  • Notepad++ 7.4 (05/13)

 

05/12

  • Apache Tomcat 8.5.15 (05/10)
  • Malwarebytes 3.1.2.1733 (05/10)

 

05/11

  • Flash Player 25.0.0.171 (05/09)
  • Google Chrome 58.0.3029.110 (05/09)
  • Opera 45.0.2552.635 (05/09)
  • Skype 7.36.0.101 (05/10)

 

05/08

  • Mozilla Firefox 53.0.2 (05/05)

 

05/04

  • Google Chrome 58.0.3029.96 (05/02)

 

05/02

  • FileZilla 3.25.2 (04/30)
  • Opera 44.0.2510.1457 (04/28)
  • Mozilla Thunderbird 52.1.0 (04/30)

Adding Live Weather to the "Worldwide Map" Resource

$
0
0

Adding Live Weather to the "Worldwide Map" Resource

 

Summary: This will allow you to add live weather to the worldwide map based on the OpenWeatherMap project (free).

Limitations: The map must be on a page where your can insert HTML/JavaScript. This will probably break during future releases.

Notes: If you want to change the height of your map you must do it within the HTML resource.

Preview:

Capture.PNG

 

Step 1: Get the id of your map element, to do this go to a page where you've inserted the map (don't go to the map page itself). Once there view the source of the page (Ctrl + U in most browsers) and search for the map element (Ctrl + F), search for 'id="worldmap' (without the single quotes but with the double quote). Make note of your map ID, in this case 753.

mapID.PNG

Step 2: Add a HTML resource to the page with the map on it that you would like to modify. To do this go to "Customize Page" >>> "Add Resource To Column X" >>> "Custom HTML".

Step 3: Paste the contents of the attached file into the Custom HTML resource you just added to the page. Make sure you update the file with your map ID you found in step 1 and change others settings you would like to.

NCM Beta 2 is here!

$
0
0

Hot on the heels of NCM 7.7 Beta 1, I'm excited to announce the availability of NCM 7.7 Beta 2.  This beta builds on Beta 1, and includes several exciting features that can be found on the WWWO for NCM; https://thwack.solarwinds.com/docs/DOC-176911.  Click the link below to sign up.

 

button_ncm-beta.png

 

To encourage beta participation we will continue to award THWACK points which can be used to buy SWAG from the THWACK store or just general bragging rights. We're really looking forward to getting some feedback on this feature-set!

Anti-Virus Connectors

$
0
0
Currently supported Anti-Virus connectors are:

 

 

AMaViS
AVG 7.5 Network
AVG DataCenter 7.5
AVG DataCenter 8.0
ClamAV
Command Antivirus for Windows
Command for Exchange Server
Cylance
Cylance Next Generation Anti-Virus
eEye Blink Professional Endpoint Protection
ESET NOD32 Syslog
ESET Remote Administrator
F-Secure Anti-Virus 7
F-Secure Policy Manager Server 10
F-Secure syslog
Forefront Endpoint Protection
Forefront Security Application Log (Client Security, Exchange and Sharepoint)
Forefront Security SQL Database
Forefront Security System Log (Client Security)
FreshClam
Group Shield/Outbreak for Exchange Server
InoculateIT 7.0+
InoculateIT v6
Kaspersky Administration Kit 8
Kaspersky Administration Kit 8 - Extended
Kaspersky Anti-Virus 10
Kaspersky Anti-Virus 6
Kaspersky events via Windows Event Log
Kaspersky Security Center
Kaspersky Security Center - Extended
McAfee Access Protection
McAfee Activity Log (4.5 DAT File update)
McAfee Mail Scan
McAfee NetShield
McAfee On Access Scan v7.0
McAfee Total Protection
McAfee Update v7.0
McAfee VSC
McAfee VSH 5.0/7.0
McAfee VSH 80i
McAfee VSH 85i
McAfee VSH Home
McAfee Web Email Scan
Microsoft Security Essentials
NOD Antivirus 4 Access Event
NOD Antivirus 4 Access Scan
NOD Antivirus 4 Access Threat
NOD Antivirus 4 SQL Event
NOD Antivirus 4 SQL Scan
NOD Antivirus 4 SQL Threat
NOD Antivirus 5 Access Event
NOD Antivirus 5 Access Scan
NOD Antivirus 5 SQL Event
NOD Antivirus 5 SQL Firewall
NOD Antivirus 5 SQL Scan
NOD Antivirus 5 SQL Threat
Panda Security for Desktops 4.02
Sophos Anti-Virus for Win2k
Sophos Anti-Virus SNMP
Sophos Enterprise 2.0 Database
Sophos Enterprise 3.0 Database
Sybari's Antigen 7.0 for Exchange Server 2000
Symantec Corp Antivirus
Symantec Endpoint Protection 11
Symantec Endpoint Protection Small Business Edition
Symantec Protection Engine

Trend Micro Control Manager
Trend IMSS
Trend IMSS Policy
Trend IMSS Virus
Trend InterScan
Trend Office Scan
Trend ScanMail
Trend Server Protect
VIPRE 5.0
VIPRE Business - System Events 4.0
VIPRE Business 4.0
VIPRE Enterprise 3.1
Webroot Antispyware Corporate Edition

 

 

RETURN TO FULL LIST

Using Compliance Reporting to Verify Juniper Alternate Slice Version

$
0
0

About a year ago I started a quest to figure out how to achieve this goal.  Since I've made some major headway I decided to share it out with the community in case it comes in handy.  There's probably better ways to do this so please comment if you have improvements!  Also, this only applies to EX (standalone and in VCs) and SRX devices; QFXes use virtual machines so it doesn't apply to them, and I don't have any other Juniper devices to verify whether or not this works there.

 

The problem is that when you update firmware on a Juniper device the primary partition gets updated automatically but the backup partition does not.  You must run request system snapshot slice alternate to copy the active partition over so that if you have a failover of the primary the backup is running the same version.  This is particularly important in virtual-chassis setups where mismatched firmware can cause major problems.

 

The only way to see the versions of backup vs. primary is from operational mode; you run "show system snapshot media internal".  There's no way to pull this information from SNMP.  So we need a system whereby we can run that command, pull in the resulting output, and search the versions on primary and backup, then report when it's different than expected.

 

====================

 

 

Step one is to create a custom configuration type and then modify or create a new device template for NCM so that it knows what command to run.

 

Under Settings->NCM Settings->Config Settings, add a new config type and record the name exactly:

1.png

Under Settings->NCM Settings->Device Template Management, copy the Juniper device template and give it a name you can remember.  Add a command name with the config type you created previously, and for the value you want to put inside the quotes "system snapshot media internal".  This way, when it goes to download the config it will run the DownloadConfig command which is "show ${ConfigType}".  That will in turn run "show system snapshot media internal" on the device.  Save your template and assign it to your Juniper nodes.

     2.png

After you've confirmed you're able to download that config from a device, let's move on to step two.

     3.png4.png    

==============================

 

In step two we have to search and compare the configs that are generated.  Compliance reporting is best for this.  This part will be fairly difficult because depending on EX, EX in a VC, or SRX the output of the show command is different, and also because the order in which primary and backup are displayed varies randomly.  In addition, because compliance reports only search one line at a time, we have to make separate rules for backup and primary slices and then compare them to a known desired version, rather than just comparing them to themselves and verifying they're the same.  Add all that up and it equals many rules we need to specify.  I'll go through an SRX example and an EX / VC example and you can iterate based on whatever versions you want to look at.

 

     In Settings->NCM Settings->Manage Rules, create a new rule.  I've named mine with what type of device, what version I'm looking at, and whether I'm looking at backup or primary partition.

          5.png

You want advanced config search enabled, alerting when the string is NOT found, and searching in a config block using regex.  Here's a screenshot of the settings I'm using.  Note all you need to replace here is the version you're looking for, but make sure you include "ex-" because we're only looking for the jbase version.  All others should be the same as that.

          6.png

I've verified this search will work regardless of where the backup "stanza" falls in the config output.  It just checks to make sure the jbase version is whatever you set.  Again remember to include "ex-" because jbase is the only line that reports its version that way.  Here's an example config to show what I'm talking about (jbase bolded):

fpc0:
--------------------------------------------------------------------------
Information for snapshot on       internal (/dev/da0s1a) (primary)
Creation date: Sep 4 13:30:42 2015
JUNOS version on snapshot:  jbase  : ex-12.2R10.2  jkernel-ex-2200: 12.3R10.2  jcrypto-ex: 12.3R10.2  jdocs-ex: 12.3R10.2  jswitch-ex: 12.3R10.2  jpfe-ex22x: 12.3R10.2  jroute-ex: 12.3R10.2  jweb-ex: 12.3R10.2  fips-mode-arm: 12.3R10.2
 Information for snapshot on       internal (/dev/da0s2a) (backup)
Creation date: Sep 4 14:59:50 2015
JUNOS version on snapshot:  jbase  : ex-12.3R10.2  jkernel-ex-2200: 12.3R10.2  jcrypto-ex: 12.3R10.2  jdocs-ex: 12.3R10.2  jswitch-ex: 12.3R10.2  jpfe-ex22x: 12.3R10.2  jroute-ex: 12.3R10.2  jweb-ex: 12.3R10.2  fips-mode-arm: 12.3R10.2

 

Next, copy this rule and change the word primary in the config block start regex to search the primary config.  Ideally when you're searching for a version this rule should never trigger but it's nice to have, and if you apply the policy to every juniper device could help you find whether a device is not running the version of code you think it is.

 

The SRX rules vary a bit because again the output of the show command is different.  Use these settings for an SRX backup partition:

7.png

Copy and replace backup with primary for the primary partition.  Adjust version numbers as desired.

 

Now you just need to create policies and add in your rules as desired.  In my case I created different policies based on the version I wanted to look at, and then added the backup and primary rule for that given version to it.  I filtered my devices based on OS version because I specifically wanted to just check that the backup version was the same as the primary for a given JunOS version, but you can do whatever you'd like there.  Make sure your policies run against the Junipersnapshot config type only.

8.png

After you have your policies, create a report and add all of them in.  Almost done!

9.png

==================

 

Step three is testing.  Download a Junipersnapshot config for all devices you assigned that config and device type to.  Then, in compliance reports, highlight your report and run "Update selected".  Run it and you should get results:

10.png

 

============

Step four: Profit!  Let me know what you think!

File Transfer and Sharing Connectors

$
0
0
Currently supported File Transfer and Sharing connectors are:

 

 

Cerberus FTP Server
CrushFTP
DFS Replication
EFT Server Enterprise Windows Application Log
GENE6 Secure FTP Server Security
GENE6 Secure FTP Server Transfer
Globalscape EFT Client
Globalscape Secure FTP (W3C Format)
GoAnywhere Services
LOGbinder for Sharepoint LOGbder SP log
LOGbinder for Sharepoint LOGbinder SP log
LOGbinder for Sharepoint Security log
MOVEit Log
MOVEit Windows Application Log
OpenBSD FTPd
Panzura Distributed File Services
ProFTPD Access
ProFTPD Auth
Pure-FTPd
SAMBA
Serv-U FTP Server

Serv-U MFT
VSFTPD
WS_FTP Server Corporate

 

 

RETURN TO FULL LIST

Full List of LEM Connectors

$
0
0
Currently supported connectors are:

   

Anti-VirusAMaViS
AVG 7.5 Network
AVG DataCenter 7.5
AVG DataCenter 8.0
ClamAV
Command Antivirus for Windows
Command for Exchange Server
Cylance
Cylance Next Generation Anti-Virus
eEye Blink Professional Endpoint Protection
ESET NOD32 Syslog
ESET Remote Administrator
F-Secure Anti-Virus 7
F-Secure Policy Manager Server 10
F-Secure syslog
Forefront Endpoint Protection
Forefront Security Application Log (Client Security, Exchange and Sharepoint)
Forefront Security SQL Database
Forefront Security System Log (Client Security)
FreshClam
Group Shield/Outbreak for Exchange Server
InoculateIT 7.0+
InoculateIT v6
Kaspersky Administration Kit 8
Kaspersky Administration Kit 8 - Extended
Kaspersky Anti-Virus 10
Kaspersky Anti-Virus 6
Kaspersky events via Windows Event Log
Kaspersky Security Center
Kaspersky Security Center - Extended
McAfee Access Protection
McAfee Activity Log (4.5 DAT File update)
McAfee Mail Scan
McAfee NetShield
McAfee On Access Scan v7.0
McAfee Total Protection
McAfee Update v7.0
McAfee VSC
McAfee VSH 5.0/7.0
McAfee VSH 80i
McAfee VSH 85i
McAfee VSH Home
McAfee Web Email Scan
Microsoft Security Essentials
NOD Antivirus 4 Access Event
NOD Antivirus 4 Access Scan
NOD Antivirus 4 Access Threat
NOD Antivirus 4 SQL Event
NOD Antivirus 4 SQL Scan
NOD Antivirus 4 SQL Threat
NOD Antivirus 5 Access Event
NOD Antivirus 5 Access Scan
NOD Antivirus 5 SQL Event
NOD Antivirus 5 SQL Firewall
NOD Antivirus 5 SQL Scan
NOD Antivirus 5 SQL Threat
Panda Security for Desktops 4.02
Sophos Anti-Virus for Win2k
Sophos Anti-Virus SNMP
Sophos Enterprise 2.0 Database
Sophos Enterprise 3.0 Database
Sybari's Antigen 7.0 for Exchange Server 2000
Symantec Corp Antivirus
Symantec Endpoint Protection 11
Symantec Endpoint Protection 11
Symantec Endpoint Protection Small Business Edition
Symantec Protection Engine
Trend IMSS
Trend IMSS Policy
Trend IMSS Virus
Trend InterScan
Trend Office Scan
Trend ScanMail
Trend Server Protect
VIPRE 5.0
VIPRE Business - System Events 4.0
VIPRE Business 4.0
VIPRE Enterprise 3.1
Webroot Antispyware Corporate Edition
Application.NET Sylog Client
Application and Services Logs - CertificateServicesClient-Lifecycle-System
Application and Services Logs - CertificateServicesClient-Lifecycle-User
Bomgar Appliance
BST Enterprises
Bunyan Admin/DS Logging
Cimcor CimTrak
Cron Service
Dameware Remote Administration
DAX Monitor - Demand AnalytX Monitor
DB2 Diag Local File - Non Syslog
Dell AppAssure
Directory Synchronization
FactoryTalk View
Flex Teller
GE PowerON Reliance/XA21
Honeyd Virtual Honeypot
IBM RACF and DB2 Syslog
IBM RACF Messages
Jboss Logging
Linux YUM
Log4j
Log4Net
Luminis Access
Luminis CP
Made2Manage ERP
Manage Engine Password Manager Pro
Meditech
Meditech EMR Access Log
Microsoft Windows AppLocker - EXE and DLL
Microsoft Windows AppLocker - MSI & Script
OracleFM Hyperion
Powershell
Print Services for Windows 7/2008 (Admin)
Print Services for Windows 7/2008 (Operational)
QCSI Application Log Data
QCSI Data Logs
QCSI System Logs
Salient Commerical Solutions
Salient Commerical Solutions
Savant Protection
Savant Protection
Sourceforge Denyhosts Log
Subnet Power System
Symantec Protection Engine
Wescom Resources Groups Host Gateway Windows Log
Windows Active Directory Federation Services
Windows DHCP Server 2000/2003/2008 event Log (Admin)
WindowsDHCP Server 2000/2003/2008 event Log (Operational)
Application SwitchCisco Content Services Switch
Citrix Secure Acess Gateway Enterprise Appliance/Netscaler
ConSentry Controller
Coyote Point Equalizer
F5 BigIP BSD Daemon Messages
F5 BigIP HTTPD specific
F5 BigIP Messages
F5 General BIG-IP Specific Messages
FireProof
LinkProof
Nortel Alteon
Radware AppDirector
CustomGE PowerOn Reliance/XA21
WRQ Reflection Console Capture
Data Loss PreventionBit9 Parity v5+ Syslog
CodeGreen Content Inspection
CodeGreen Content Inspection User
DeviceLock Audit
DeviceLock Events
EMC RecoverPoint
FileSure
Forcepoint Triton AP-Data
NuBridges Protect  Token Manager Engine
NuBridges Protect Key Manager
NuBridges Protect Resource Service
SecureSphere
SecureSphere Database Gateway 6.0
SecureSphere System and Firewall Events 6.0
SecureSphere v10
SecureSphere Web Application Firewall 6.0
Vericept Monitor
Websense Data Security
DatabaseIBM DB2 Messages
LOGbinder SQL
MSSQL 2000 Application Log
OpenEdge Audit
Oracle Alert Log
Oracle Auditor - Buffer - Extended Edition
Oracle Auditor - Database
Oracle Auditor - Database - Extended
Oracle Auditor - Syslog
Oracle Auditor - Syslog - Extended
Oracle Auditor - Windows - Extended
Postgres Log File
SolarWinds LEM MSSQL Auditor
MySQL Database Log
E-MailIBM Domino AIX
LOGbinder for Exchange
Lotus Notes and Domino Server 8
Lotus Notes Webmail
Microsoft Exchange Application Log
Microsoft Exchange Event Log
Microsoft Exchange Management Log
File Transfer & SharingCerberus FTP Server
GoAnywhere Services
OpenBSD FTPd
SAMBA
VSFTPD
WS_FTP Server Corporate
CrushFTP
DFS Replication
EFT Server Enterprise Windows Application Log
GENE6 Secure FTP Server Security
GENE6 Secure FTP Server Transfer
Globalscape EFT Client
Globalscape Secure FTP (W3C Format)
LOGbinder for Sharepoint LOGbder SP log
LOGbinder for Sharepoint LOGbinder SP log
LOGbinder for Sharepoint Security log
MOVEit Log
MOVEit Windows Application Log
Panzura Distributed File Services
ProFTPD Access
ProFTPD Auth
Pure-FTPd
Serv-U FTP Server
Serv-U MFT
WS_FTP Server Corporate
FirewallsA10 Load Balancer and Web Application Firewall
Applicure dotDefender
Barracuda NG Firewall (Phion Netfence)
Barracuda NG Firewall (Phion Netfence) Extended
Barracuda Web Application Firewall
Borderware Firewall
Checkpoint Edge X Firewall
Checkpoint OPSEC NG LEA Client
Checkpoint Safe@Office Firewall
Cisco PIX and IOS
Cisco SA500 Series Security Applicances
Cyberguard
D-Link DFL Firewall
eSoft
Fortigate 5.0+
GNAT Box System Software
Hirschmann EAGLE System Industrial Firewall
HP Firewall
Ingate Firewall
IP Filter
IPFire OpenSource Firewall Distribution
IPTables/NetFilter
Juniper NetScreen 5
Juniper Virtual Gateway
Kerio Controll Firewall
McAfee Firewall v5.8 CEF
McAfee ForcePoint Firewall
Microsoft Forefront Theat Management Gateway
Microsoft ISA
Netgear FV Series
Netscreen (Juniper SRX Firewall)
Network Box RM300 and ITPE 1000
Novell BorderManager
OSSEC Active Response Log
Palo Alto Networks PA-2000 and PA-4000
PF Sense Firewall/Router
Sidewinder 6.1+ Firewall
Sidewinder Firewall
Sonicwall
Sonicwall GMS
Sophos (Astaro) Security Gateway
StoneGate Firewall v5.3 CEF
Storm Shield Netasq
Symantec Velociraptor 1.5
Symantec Velociraptor 2.0
Symantec Velociraptor 3.0
TippingPoint X505
Titanium Mirror Firewall
Tofino Firewall LSM for Industrial Networks
Trend Deep Security
Vmware vShield Edge Firewall
WatchGuard Firewalls
Windows Firewall
Identity and Access ManagementBioPassword
Cisco (NAC) Network Access Control Appliance with Clean Access Manager (CAM) or Server (CAS) Software
Cisco ACS
Cisco ClearBox Enterprise RADIUS Server
Cisco Customer Voice Portal
Cisco Identity Services Engine (ISE)
Cisco Secure ACS 4.1 Syslog
Cisco Secure ACS 5+ Syslog
Cyber-Ark Vault
DigitalPersona Pro
e-DMZ Password Auto Repository
Entrust
Extreme Sentriant
FutureX Excrypt
IAS RADIUS
IBM Tivoli Access Manager
Juniper SBR
Manage Engine Password Manager Pro SNMP
Microsoft RRAS
Net Access
NetIQ Directory
Novell Identity Audit DB
PointSec PC
RSA Authentication Manager 7.1
Safenet Authentication Service
SanDisk CMC
SecureAuth IDP
SecureID Syslog
Thycotic Secret Server
TriCipher
Vormetric
Windows IAS and NPS System Log
IDS and IPSActiveScout
Cisco FirePower Modeul (Sourcefire 3D System)
Cisco IDS/IPS v4/5.x
Cisco IPS 5+ (SDEE)
Dragon IDS
FortiSnort
GFI LANguard System Integrity Monitor
IBM XGS
ISS Proventia IPS
ISS RealSecure IDS
Juniper IDP 250 v5.0
Juniper IDP 3.x
Juniper IDP 4.0+
McAfee Network Security Manager
NitroGuard IPS - Snort Format
NitroSecurity IPS
Osiris Host Integrity Monitoring System
Radware Defense Pro
Reflex IMC
SecureAuth Error Logs
SecureAuth Logging Audit Logs
SecureNet IDS
Snort
Symantec Gateway IDS
Syslog Snort
Tipping Point IPS 2.1
TippingPoint Audit and System
TippingPoint IPS 1.4
TippingPoint SMS
TopLayer Attack Mitigator
Trend Micro Interscan Gateway Security Appliance
Tripwire Enterprise
Network Access ControlAruba ClearPass Policy Manager
Cisco Prime Security Manager
Network ManagementAirwatch
Arbor Pravail APS 2104
Axcient Unified Management Console (UMC)
Barracuda Load Balancer ADC
Blue Coat Packet Shaper
Cimcor CimTrak
Cisco Wireless Access Point
Cisco Wireless Control System
Cisco Wireless LAN Controller SNMP Trap Logs
ePolicy Orchestrator (ePO)
ePolicy Orchestrator (ePO) 4.5+
Juniper NSM
Lancope Stealth Watch
Microsoft Forefront Endpoint Protection
Nagios
SecureLink Device
Solarwinds Orion and Virtualization Manager
Titus Enterprise Information Protection
Network ServicesBarracuda
Barracuda Admin
Barracuda Mail Archiver
Barracuda Spam Firewall
BIND
CA BrightStor
Calix Telecommunications
Cisco Network Registrar
DHCPd
DNS Bind
Eaton Cooper Power Systems
KEMP User Log
Linux LDAP Access
Linux LDAP Error
Linux Sendmail
Locum Real Time Monitor
Microsoft Windows Activation Services
Named BIND
NetIQ eDirectory
OpenLDAP
Postfix
Quest Vmware vRanger
Riverbed/Brocade Stingray
SafeNet DataSecure Certificate Server
Semafone
SNMPD Daemon Messages
Solarwinds Web Help Desk
Symantec BackupExec System Recovery
Symmetricom SyncServer
WatchGuard Extensible Content Security (XCS) Auth Log
WatchGuard Extensible Content Security (XCS) Syslog
Windows DHCP Server
Operating SystemsAIX Audit
AIX Syslog
FireEye Operating System
FreeBSD Authentication
HP OpenVMS 8+
HP UX
iSecurity for OS400 (Raz-Lee)
Legacy TriGeo Agent AS400 Tool
LEM FIM File and Directory
LEM FIM Registry
Linux Auditd
Linux PAM
Linux PAM Command
LogAgent for OS400 (Patrick Townsend Security Solutions)
Mac OS X
Microsoft Cluster Services
Microsoft Windows NTML
MobileIron Assemble
MobileIron VSP
Novell Netware 6.5
Novell Netware 6.5 (Database)
OpenSSH
PowerTech Interact
SELinux
Solaris 10 BSM Auditing
Solaris 10 Snare Auditing
SUDO
SUDO Syslog
vmWare ESX esxcfg-firewall log
vmWare ESX messages log
vmWare ESX secure log
vmWare ESX vmkernel log
vmWare ESX vmkwarning log
vmWare ESXi Hostd log
vmWare ESXi messages log
vmWare ESXi vmkernel log
Windows Directory Service Audit Log
Windows DNS Server Audit Log
Windows DNS Server Log
Windows DNS Traffic Log
Windows File Replication Service
Windows Filtering Platform Events
Windows Security Log
Windows Security Log
Windows System Log
Windows Task Scheduler
Physical InfrastructureAPC InfraStruXure
Hitachi AMS
HP BladeSystem Enclosure Auth Log
HP BladeSystem Enclosure Local Log
JACO CartCare
Proxy Server and Content FiltersForcepoint Triton AP-Web
Squid Access Log
Squid Guard Access Block Log
Symantec Web Security for Windows
Actiance Unified Security Gateway
Barracuda Web Filter
Blue Coat Proxy SH Web Access
Blue Coat ProxySG
Cisco Content Security and Control Security Services Module 6.1-6.2
Cisco Content Security and Control Security Services Module 6.3+
Clearswift Secure Email Gateway
eSafe
Fortiweb Web Application Firewall
Ironport Email Security Appliance
Ironport Web Security
McAfee Email Gateway
McAfee Web Gateway v6.x
McAfee Web Gateway v7.x
Sonicwall Email Security
Sophos ES Appliance
Sophos ES Appliance Auth
Sophos WS Appliance
St.Bernard iPrism
Trend Micro IWSVA
Websense Security Gateway Anywhere
Websense Web Filter and Websense Security Database
Websense Web Filter and Websense Web Security
Router/Switches3Com Switch
Adtran Atlas Switch
Adtran NetVanta Router
Alcatel Lucent OmniSwitch
Allied Telesis Routers and Switches
Arista Switches
Aruba Wireless Access Point 3.x
Aruba Wirless Access Point
Avaya/Nortel VSP 7000 Ethernet Routing Switch
Blade RackSwitch
Brocade Iron Series
Brocade VDX Switches
Brocade Vyatta Router
Cisco CatOS
Cisco Nexus NX-OS
Cisco Small Business 30 Series Managed Switch
Cisco Wireless LAN Controller & IOS-XE Software
Dell Force10 Switch
Dell PowerConnector Switches
Enterasys C-Series & N-Series Switches
Enterasys IdentiFi Wireless Controller
Extreme Switch
Foundry
FreeWave
Hirschmann OpenRail System Compact Switch
HP MSM700 Series Controller
HP ProCurve 1910-24G-PoE Switch
HP ProCurve Switches Firmware F.05.65+ ZI Series
Huawei Switches
Juniper JUNOS
Mikrotik Routers
Motorola WLAN Controller
Motorola WS2000 SNMP
Netgear Switch
Nortal Ethernet Routing Switch 4500 Series
Nortel Baystack
Nortel Contivity 200 Series
Nortel WLAN Security Switch
Proxim Orinoco WAP
Qlogic Fibre Channel Switch
Raritan Dominion Switch
Ruckus ZoneDirector WLAN Controller
RuggedCom Switch
Telco Switch
Xirrus WiFi Array
Zyxel P-660-HW-T
ZyXel XGS4528F
Security and UTMCyberoam UTM
Cyphort Threat Protection
Enforcive Enterprise Security
FireEye HX
FireEye Malware Protection System
FortiGate 2.5
Fortigate 2.8+
Fortigate 300C
FortiMail Email Security Appliances
McAfee Network and Security Platform (IntruShield)
Meraki MX
Proofpoint Enterprise Protection
SmoothWall Unified Threat Manager
Sophos UTM
WatchGuard Firebox
WatchGuard Firebox X Edge E-Series
WatchGuard SOHO
WatchGuard Xcore
Zscaler Web Security\Advanced Security
StorageDell Equallogic SAN Systems
HP StorageWorks Modular Smart Array
IBM NetApp ONTAP
NetApp
QNAP NAS/File Server
SwitchesAXIA Ethernet Switch
System Scan ReportersForeScout CounterACT NAC
Nessus Security Scanner
Patchlink Vulnerability Scanner
QualysGuard Scan Report
Rapid7 NeXpose Vulnerability Scanner
Retina
VPN and Remote AccessArray Networks SPX
Barracuda SSL VPN Connector
Cisco VPN
Citrix Secure Access Gateway
Citrix XenDesktop
Citrix XenServer Auth log
Citrix XenServer Daemon log
Corente AWB
FirePass SSL VPN
LogMeIn
Neo Accel SSL VPN
Neoteris VPN/Juniper SA Series
Netgear SSL VPN Concentrator SSL312
Netilla VPN
Nortel Contivity
OpenVPN
pcAnywhere
Permeo VPN
Pulse Secure
Riverbed Steelhead WAN Optimization
Sonicwall Aventail SSL VPN E-Class
SonicWall E-Class SRA
Sonicwall SSL VPN
UltraVPN
WatchGuard vClass
WatchGuard vClass (Alarm)
WatchGuard vClass (VPN)
Web ServerAnyEvent
Apache Tomcat
ASC Config
Cluster
Common Daemon
Incapsula Web Application Firewall
Microsoft Forefront Threat Management Gateway 2010
Microsoft Forefront TMG 2010 Web Proxy (W3C Server file format)
Microsoft IIS FTP Server 5+
Microsoft IIS FTP Server 7.0
Microsoft IIS Web Server 5 - 8.5
Milestone Xprotect
NetMotion Mobility Server
NetMotion Mobility Warehouse
Tomcat Escalation Assignement Aborted Event
Trustwave Web Defend
Websphere 7
RETURN TO FULL LIST

Integrate Google Charts with Solarwinds reports/view, A Pie chart example

$
0
0

When built reports with Solarwinds report builder we only have plain data tables. It would be very informative if we could add some customised charts, such pie charts in the reports. It is possible to use MSSQL report builder to create more richly reports but this involves installing additional components on MSSQL server and you need access the Solarwinds Database directly.

 

I start to use Google Chart recently for my “Raspberry  Pi “ projects and suddenly realize I could Integrating the Google Chart into the Solarwinds reports/views. Here is an example:

 

pie01.jpg

Prerequisite: 
You need an IIS web server supporting ASP and can access both your Solarwinds Website and Internet. You can use Solarwinds web server if it can access Internet.

 

Step 1: Build a report using Solarwinds Report Builder


Report Title:  “Solarwinds Statistic - Node Polling Method”
In my example I am using “Advanced SQL”, the query is:

 

Query
SELECT
(SELECT COUNT(Nodes.NodeID) FROM Nodes)  AS Total_Nodes,
(SELECT COUNT(Nodes.NodeID) FROM Nodes where ObjectSubType = 'ICMP')  AS ICMP,
(SELECT COUNT(Nodes.NodeID) FROM Nodes where ObjectSubType = 'SNMP' and SNMPVersion = 1)  AS SNMPv1,
(SELECT COUNT(Nodes.NodeID) FROM Nodes where ObjectSubType = 'SNMP' and SNMPVersion = 2)  AS SNMPv2,
(SELECT COUNT(Nodes.NodeID) FROM Nodes where ObjectSubType = 'SNMP' and SNMPVersion = 3)  AS SNMPv3,
(SELECT COUNT(Nodes.NodeID) FROM Nodes where ObjectSubType = 'WMI' )  AS WMI


In the “Field Formatting” you need add “Web URL” for each data you want to send to Google chart.  This is for parsing data out from the report later in the asp page. Here I am using dummy URL, you can using real links to link your table/chart to another Solarwinds page.

 

pie02.jpg

 

Step 2: open your report from Solarwinds web console:


The URL should looks like: "http://solarwinds-web-server-IP-or-FQDN/Orion/Report.aspx?Report=Solarwinds_Statistic_-_Node_Polling_Method&Printable=TRUE&accountid=userID&password=userPwd"

 

Added the following parameter to the end of the URL link:
&Printable=TRUE&accountid=userID&password=userPwd
userID is Solarwinds user account ID, userPwd is the account password. The account should be read only.

 

From your browser: open view page source, you should find the dummy links you created in the report, we will use these information to parse the data in the ASP page below.

 

pie04.jpg

Step 3:  Create an ASP page


Create an asp page and save it to a web server which can assess Solarwinds web pages and Internet. The asp page has three parts: VBscript, JavaScript and HTML codes.

 

The VBScript will get the report page and save the return to a string. I use the regular expression to  parse the data from the string and pass them to JavaScript. The JavaScript will call Google Chart API to draw the Pie chart in the HTML <div></div>

 

The asp code is:

==================================================================

<html><head><%
' URL link to the Solarwinds Report
' http://solarwinds-web-server-IP-or-FQDN/Orion/Report.aspx?Report=Solarwinds_Statistic_-_Node_Polling_Method
' add the following parameter to the end of the URL link: &Printable=TRUE&accountid=userID&password=userPwd"
' userID is Solarwinds user account ID, userPwd is the account password. The account should be read only.
strURL = "http://your-url/Orion/Report.aspx?Report=Solarwinds_Statistic_-_Node_Polling_Method&Printable=TRUE&accountid=user&password=userpwd"

' get the URL return text
strHttpText = GetTextFromUrl(strURL)

' using vbs regular expression to parse the data

' get total number of nodes polling by Ping
Set rexp01 = New RegExp
With rexp01
      .Pattern    = "polling-ping" & Chr(34) & ">\d+</a"      .IgnoreCase = False      .Global    = False
End With
set matchs01 = rexp01.Execute(strHttpText)
If matchs01.Count > 0 Then    set match01 = matchs01(0)    match01 = Replace(match01, "polling-ping" & Chr(34) & ">", "")    match01 = Replace(match01, "</a", "")    match01 = cInt(match01)    'response.write match01 - debug
Else    match01 = 0
End If

' get total number of nodes polling by SNMP1
Set rexp02 = New RegExp
With rexp02
      .Pattern    = "polling-snmp1" & Chr(34) & ">\d+</a"      .IgnoreCase = False      .Global    = False
End With
set matchs02 = rexp02.Execute(strHttpText)
If matchs02.Count > 0 Then    set match02 = matchs02(0)    match02 = Replace(match02, "polling-snmp1" & Chr(34) & ">", "")    match02 = Replace(match02, "</a", "")    match02 = cInt(match02)    'response.write match02 - debug
Else    match02 = 0
End If

' get total number of nodes polling by SNMP2
Set rexp03 = New RegExp
With rexp03
      .Pattern    = "polling-snmp2" & Chr(34) & ">\d+</a"      .IgnoreCase = False      .Global    = False
End With
set matchs03 = rexp03.Execute(strHttpText)
If matchs03.Count > 0 Then    set match03 = matchs03(0)    match03 = Replace(match03, "polling-snmp2" & Chr(34) & ">", "")    match03 = Replace(match03, "</a", "")    match03 = cInt(match03)    'response.write match03 - debug
Else    match03 = 0
End If

' get total number of nodes polling by SNMP3
Set rexp04 = New RegExp
With rexp04
      .Pattern    = "polling-snmp3" & Chr(34) & ">\d+</a"      .IgnoreCase = False      .Global    = False
End With
set matchs04 = rexp04.Execute(strHttpText)
If matchs04.Count > 0 Then    set match04 = matchs04(0)    match04 = Replace(match04, "polling-snmp3" & Chr(34) & ">", "")    match04 = Replace(match04, "</a", "")    match04 = cInt(match04)    'response.write match04 - debug
Else    match04 = 0
End If

' get total number of nodes polling by WMI
Set rexp05 = New RegExp
With rexp05
      .Pattern    = "polling-wmi" & Chr(34) & ">\d+</a"      .IgnoreCase = False      .Global    = False
End With
set matchs05 = rexp05.Execute(strHttpText)
If matchs05.Count > 0 Then    set match05 = matchs05(0)    match05 = Replace(match05, "polling-wmi" & Chr(34) & ">", "")    match05 = Replace(match05, "</a", "")    match05 = cInt(match05)    'response.write match05 - debug
Else    match05 = 0
End If

iTotalNodesCount = match01 + match02 + match03 + match04 + match05

' Sub Function: get a URL return text
Function GetTextFromUrl(url)
  Set oXMLHTTP = CreateObject("MSXML2.ServerXMLHTTP.3.0")  oXMLHTTP.Open "GET", url, False  oXMLHTTP.Send  If oXMLHTTP.Status = 200 Then    GetTextFromUrl = oXMLHTTP.responseText  End If
End Function


%><!--Google Chart: Load the AJAX API--><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">

// Load the Visualization API and the piechart package.
google.load('visualization', '1.0', {'packages':['corechart']});

// Set a callback to run when the Google Visualization API is loaded.
google.setOnLoadCallback(drawChart);

// Callback that creates and populates a data table,
// instantiates the pie chart, passes in the data and
// draws it.
function drawChart() {
    // Create the data table.    var data = new google.visualization.DataTable();    data.addColumn('string', 'NodeStatus');    data.addColumn('number', 'Slices');    data.addRows([        ['PING <%= match01 %>', <%= match01 %>],        ['SNMP1 <%= match02 %>', <%= match02 %>],        ['SNMP2 <%= match03 %>', <%= match03 %>],        ['SNMP3 <%= match04 %>', <%= match04 %>],        ['WMI <%= match05 %>', <%= match05 %>]    ]);    // Set chart options    var options = {title: 'Total Nodes: <%= iTotalNodesCount %>',                width: 550,                height: 250,                is3D: true,                pieSliceText: 'percentage',                  sliceVisibilityThreshold: 0,                pieStartAngle: -100,                slices: {0:{offset: 0.2, color: 'Magenta'},                        1: {offset: 0.1, color: 'orange'},                        2: {color: '#0099C6'},                        3: {offset: 0.1, color: 'yellow'},                        4: {offset: 0.2, color: 'blue'},                        },    };    // Instantiate and draw our chart, passing in some options.    var chart = new google.visualization.PieChart(document.getElementById('chart_div'));    chart.draw(data, options);
}</script></head><body>  <!--Div that will hold the pie chart-->  <div id="chart_div"></div></body></html>

==================================================================

 

Step 4: In Solarwinds, create a view page and add two resources: “Report from Orion Report Writer” and “Custom HTML”

 

Edit “Report from Orion Report Writer”, Link the report to the report you just created
Edit “Custon HTML”, add the following code:  (replace with your asp page link)

 

====================================================

<iframe src="http://link-to-your-asp-page/solarsta.asp" width=550 height=250 frameborder=0 scrolling="no"></iframe>

====================================================

 

View your chart in the view page. Done!

 

You can use the similar method to create different chats, such as  Node status pie chart. Also you can make the chart click-able to link to other pages.  Just add the following code in asp page after JavaScript function “chart.draw(data, options);”  An example for Node status pie chart:

 

* Below is an image, not text. Cannot paste as text

pie06.jpg

 

pie05.jpg

Hope this is helpful. Thanks

 

Update: 01

==================

As designerfx suggested, the code is  attached as a text file

Custom Report - Top SQL by O/S User

$
0
0

DESCRIPTION

This custom report will list the Top N SQL statements in your instance for a specified O/S user name. To use this report, run it from SQL*Plus while connected to the Ignite repository database.

 

SQL*PLUS SCRIPT

select id, name from cond order by name;

prompt Which Database ID

accept DBID

prompt Enter Start Date (mm/dd/yy hh24:mi)

accept BeginDate

prompt Enter End Date (mm/dd/yy hh24:mi)

accept EndDate

prompt How many SQLs should be displayed

accept HowMany

prompt Enter the OS username

accept OSUser

 

set pagesize 999

set linesize 132

column hash_or_name format a22

 

select hash_or_name, timesecs from (

  select nvl(n.name, sw.izho) hash_or_name, sum(sw.qp/100) timesecs

  FROM consw_&DBID sw, cono_&DBID o, con_sql_name n

  where sw.d between to_date('&BeginDate','mm/dd/yy hh24:mi') and to_date('&EndDate','mm/dd/yy hh24:mi')

  and sw.ixoy = o.id

  and sw.izho = n.hash

  and upper(o.name) = upper('&OSUser')

  group by nvl(n.name, sw.izho)

  order by sum(sw.qp/100) desc)

where rownum <= &HowMany

order by timesecs desc

/

Viewing all 9474 articles
Browse latest View live


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>