Automatic Node Population & Application Assignment (Part 2)

Welcome to the second of my two-part article showing you how to configure your SolarWinds® platform to completely automate the process of monitoring your server farm. If you missed the first part, you can catch-up here Automatic Node Population & Application Assignment (Part 1).

Let’s pick up from where we left off last time.

Application Discovery Based-on Alerts & Custom Properties

There are different ways to know if an application is installed on a server. For example, our company could use a name convention that helps us identify the role of our devices. It is quite common to find name conventions that tell us the location of the device, the role of the device or even the owner/team of the device. Names like GBLONEXCH01 is telling us: 

• The device is in Great Britain (GBxxxxxxxxx)
• The device is in London (xxLONxxxxxx)
• The device is an exchange server (xxxxxEXCHxx)

Now, how can we tell SolarWinds that if a device contains SHARE in its name, it is a SharePoint server? There are several ways to achieve this, but our preference is to use custom properties and alerts (just to keep things consistent).

A not-so-well-known feature exists within the SolarWinds alerts that allow us to modify the value of a custom property based on a triggered action. It means that when an alert is triggered, SolarWinds will modify the value of a particular custom property of that node. So for example, we can create this alert:

• Trigger conditions: nodename contains SHARE
• Trigger action: include sharepoint in custom property applications

>> How to create an Alert <<

Now, there are a couple of caveats here. First of all, in the above screenshot, you have probably noticed that the trigger conditions also contain node applications that do not contain SharePoint. We need to add this extra condition because we don’t want to fire this alert for the servers that already have SharePoint on their applications custom property.

Secondly, when we modify the value of the custom property Applications, we can’t just add ‘sharepoint’ as the value for the custom property, as this would replace the entire value that was there previously (maybe other applications are being monitored on that server). We want to keep any other application-defined on that custom property, that’s why we add “Sharepoint, ${N=SwisEntity;M=CustomProperties.applications}”. This variable will save the previous content of the custom property so that the new value is appended to it. For example, if the value of the custom property applications was “Windows, Mcafee”, now it will be “Sharepoint, Windows, Mcafee”. As you can see, this process allows us to automate the process of application monitoring for more than one application.

And a further consideration, one of the first configurations you need to take into account when creating an alert is the alert frequency. By default, this is set to 1 minute, which means that SolarWinds will check if there is any node matching the trigger conditions every minute! Probably we don’t need to be that aggressive, so that’s why I normally recommend changing this value to 4 hours. This will keep your SolarWinds server (and our SQL server) more relaxed.

But what can we do if we don’t use a name convention? Or worse still, what if we cannot trust it……?

….and now is when the magic happens.

If you are familiar with SolarWinds, you probably know that when a Windows server is monitored using WMI or via an agent (SNMP will do as well, but won’t give us such granular data), we get something called Asset Inventory information. This information is polled from the server and contains details such as the hardware installed (or virtual hardware installed), domain information, serial number, operating system, and software installed.

Yep, you heard it right, we can get a list of software installed on that server, including OS patches, antivirus, backup tools, and any other software. This means that somehow SolarWinds is aware of the software installed on the servers. Wouldn’t it be nice if you could tell SolarWinds to monitor a specific application if it is reported by the asset inventory info? Well, it is also possible, using the same alerting feature to modify the value of a custom property we used before.

At this point things get a little bit tricky and the below requires some SQL query knowledge (not too much though).

In theory, we could create the same type of alert that we created before, just changing the trigger condition from ‘node name’ to ‘software inventory’, unfortunately, this option is not available now in the alert configuration. By default, there is no ‘software inventory’ field ?. Nonetheless, SolarWinds allows us to create SQL based alerts (thank you SolarWinds!), and a trigger condition like the one below would do the same job:

Please bear in mind that in your environment it might be different: the SharePoint version, the name of the application etc…may vary… although the way to recreate it would be similar to the above.

Job Done

So, as you have seen, we have automated our SolarWinds installation to automatically detect new servers on our network, include and monitor them, discover applications that we may need to be aware of, and start monitoring those applications as well. Once this has been implemented, I can go down to the pub to enjoy a delicious pineapple juice while SolarWinds does my job.