I also highly recommend to upgrade. Older client versions had issues dealing with some tile servers, including default one. Best regards, Victor

If you are using Splunk (or similar, ElasticSearch) for collecting and searching logs at present and you're happy with it, moving to NetXMS just for syslog would be a step backwards. It's not purpose built for that. Searches in Splunk or ElasticSearch will be faster. 5GB per month means an average of 2kB/s. Just collecting the data shouldn't be an issue even with a desktop computer. Having said that, it will depend on what you do with it. Just collect it? Run syslog parsers over the top to generate events and alerts? Are you doing anything else inside NetXMS? How complex are your searches? Keeping in mind that there's no index on the actual message field so if you are searching based on text alone, well.... not ideal. If you're after searching through piles and piles of logs, a purpose built solution may be better. With that said, our Syslog DB inside NetXMS is 55GB and only holds 60 days worth of data. Works without issues for what we're doing with it. No, unfortunately not.  I'm assuming you're thinking of searches like "source-address:192.168.1.2 AND destination-address:8.8.8.8". NetXMS doesn't work like that. You are literally searching through the text string using SQL wildcards, e.g. "%source-address="192.168.1.2"%destination-address="8.8.8.8"%". But as that is a match against the message string itself, the order actually matters. You can add multiple conditions which can be either AND or OR. You can't mix and match those. So again, if you are looking for a solution for the sole purpose of searching through syslog data, it might make sense to stick with Splunk or switching to Elastic.

Web UI 3.0.2329

Thank you victor. I will check it. Best regards, Ravi

Hi Victor, Please find the attached captured file. Thank you Sushant netxmsd-threads.1390.20191121-115404

I could not manage to find a way to get source computer info from ForwardedEvents in Windows Event Collector Server. Desperately need help. https://docs.microsoft.com/windows/win32/wec/windows-event-collector?redirectedfrom=MSDN

Hi, little step forward. I manually pull configuration (full) on switch with full interfaces list and get this: [20.11.2019 12:34:58] **** Poll request sent to server **** [20.11.2019 12:34:58] Poll request accepted [20.11.2019 12:34:58] Starting configuration poll for node 10.6.1.224 [20.11.2019 12:34:58] Capability reset [20.11.2019 12:34:58] Checking node's capabilities... [20.11.2019 12:34:58] Checking SNMP... [20.11.2019 12:34:58] SNMP agent is active (version 3) [20.11.2019 12:34:59] System description changed to NETGEAR 24-Port Gigabit PoE+ Smart Managed Pro Switch with 4 SFP Ports (GS728TPv2), Software Version 6.0.1.14, Boot Version 1.0.0.5 [20.11.2019 12:34:59] System name changed to SSD-Sosnowiec1 [20.11.2019 12:34:59] System contact changed to [20.11.2019 12:34:59] System location changed to [20.11.2019 12:35:41] Capability check finished [20.11.2019 12:35:41] Checking interface configuration... [20.11.2019 12:35:50] Unable to get interface list from node [20.11.2019 12:35:50] Interface "testcc (GigabitEthernet1)" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet2" is no longer exist [20.11.2019 12:35:50] Interface "test3cc (GigabitEthernet3)" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet4" is no longer exist [20.11.2019 12:35:50] Interface "test5cc8 (GigabitEthernet5)" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet6" is no longer exist [20.11.2019 12:35:50] Interface "test7c (GigabitEthernet7)" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet8" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet9" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet10" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet11" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet12" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet13" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet14" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet15" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet16" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet17" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet18" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet19" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet20" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet21" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet22" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet23" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet24" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet25" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet26" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet27" is no longer exist [20.11.2019 12:35:50] Interface "GigabitEthernet28" is no longer exist [20.11.2019 12:35:50] Interface "LAG1" is no longer exist [20.11.2019 12:35:50] Interface "LAG2" is no longer exist [20.11.2019 12:35:50] Interface "LAG3" is no longer exist [20.11.2019 12:35:50] Interface "LAG4" is no longer exist [20.11.2019 12:35:50] Interface "LAG5" is no longer exist [20.11.2019 12:35:50] Interface "LAG6" is no longer exist [20.11.2019 12:35:50] Interface "LAG7" is no longer exist [20.11.2019 12:35:50] Interface "LAG8" is no longer exist [20.11.2019 12:35:50] Interface "LAG9" is no longer exist [20.11.2019 12:35:50] Interface "LAG10" is no longer exist [20.11.2019 12:35:50] Interface "LAG11" is no longer exist [20.11.2019 12:35:50] Interface "LAG12" is no longer exist [20.11.2019 12:35:50] Interface "LAG13" is no longer exist [20.11.2019 12:35:50] Interface "LAG14" is no longer exist [20.11.2019 12:35:50] Interface "LAG15" is no longer exist [20.11.2019 12:35:50] Interface "LAG16" is no longer exist [20.11.2019 12:35:50] Interface configuration check finished [20.11.2019 12:35:50] Checking node name [20.11.2019 12:35:50] Node name is an IP address and need to be resolved [20.11.2019 12:35:54] Node name cannot be resolved [20.11.2019 12:35:55] Finished configuration poll for node 10.6.1.224 [20.11.2019 12:35:55] Node configuration was changed after poll [20.11.2019 12:35:55] **** Poll completed successfully **** So I losted all interfaces. After few hours of manually polling status/configuration and trying everythink I know how to get interface from this switch. I have to do: Configuration poll -> set again SNMP password/community on switch -> Configuration poll. Please notice that in second poll there is not a 'Checking SNMP': [20.11.2019 14:22:21] **** Poll request sent to server **** [20.11.2019 14:22:22] Poll request accepted [20.11.2019 14:22:22] Starting configuration poll for node 10.6.1.224 [20.11.2019 14:22:22] Checking node's capabilities... [20.11.2019 14:22:22] Checking SNMP... [20.11.2019 14:22:22] SNMP agent is active (version 2c) [20.11.2019 14:23:04] Capability check finished [20.11.2019 14:23:05] Checking interface configuration... [20.11.2019 14:23:14] Unable to get interface list from node [20.11.2019 14:23:14] Interface configuration check finished [20.11.2019 14:23:14] Checking node name [20.11.2019 14:23:14] Node name is an IP address and need to be resolved [20.11.2019 14:23:18] Node name cannot be resolved [20.11.2019 14:23:18] Finished configuration poll for node 10.6.1.224 [20.11.2019 14:23:18] Node configuration was not changed after poll [20.11.2019 14:23:18] **** Poll completed successfully **** [20.11.2019 14:24:25] **** Poll request sent to server **** [20.11.2019 14:24:25] Poll request accepted [20.11.2019 14:24:25] Starting configuration poll for node 10.6.1.224 [20.11.2019 14:24:25] Checking node's capabilities... [20.11.2019 14:24:25] Capability check finished [20.11.2019 14:24:25] Checking interface configuration... [20.11.2019 14:24:42] IP address 10.6.1.224 removed from interface "testcc (GigabitEthernet1)" [20.11.2019 14:24:42] IP address 127.0.0.1 added to interface "testcc (GigabitEthernet1)" [20.11.2019 14:24:42] Found new interface "GigabitEthernet2" [20.11.2019 14:24:42] Found new interface "aa23 (GigabitEthernet3)" [20.11.2019 14:24:42] Found new interface "aa24 (GigabitEthernet4)" [20.11.2019 14:24:42] Found new interface "aa25 (GigabitEthernet5)" [20.11.2019 14:24:42] Found new interface "aa26 (GigabitEthernet6)" [20.11.2019 14:24:42] Found new interface "test7c (GigabitEthernet7)" [20.11.2019 14:24:42] Found new interface "GigabitEthernet8" [20.11.2019 14:24:42] Found new interface "GigabitEthernet9" [20.11.2019 14:24:42] Found new interface "GigabitEthernet10" [20.11.2019 14:24:42] Found new interface "GigabitEthernet11" [20.11.2019 14:24:42] Found new interface "GigabitEthernet12" [20.11.2019 14:24:42] Found new interface "GigabitEthernet13" [20.11.2019 14:24:42] Found new interface "GigabitEthernet14" [20.11.2019 14:24:42] Found new interface "GigabitEthernet15" [20.11.2019 14:24:42] Found new interface "GigabitEthernet16" [20.11.2019 14:24:42] Found new interface "GigabitEthernet17" [20.11.2019 14:24:42] Found new interface "GigabitEthernet18" [20.11.2019 14:24:42] Found new interface "GigabitEthernet19" [20.11.2019 14:24:42] Found new interface "GigabitEthernet20" [20.11.2019 14:24:43] Found new interface "GigabitEthernet21" [20.11.2019 14:24:43] Found new interface "GigabitEthernet22" [20.11.2019 14:24:43] Found new interface "GigabitEthernet23" [20.11.2019 14:24:43] Found new interface "GigabitEthernet24" [20.11.2019 14:24:43] Found new interface "GigabitEthernet25" [20.11.2019 14:24:43] Found new interface "GigabitEthernet26" [20.11.2019 14:24:43] Found new interface "GigabitEthernet27" [20.11.2019 14:24:43] Found new interface "GigabitEthernet28" [20.11.2019 14:24:43] Found new interface "LAG1" [20.11.2019 14:24:43] Found new interface "LAG2" [20.11.2019 14:24:43] Found new interface "LAG3" [20.11.2019 14:24:43] Found new interface "LAG4" [20.11.2019 14:24:43] Found new interface "LAG5" [20.11.2019 14:24:43] Found new interface "LAG6" [20.11.2019 14:24:43] Found new interface "LAG7" [20.11.2019 14:24:43] Found new interface "LAG8" [20.11.2019 14:24:43] Found new interface "LAG9" [20.11.2019 14:24:43] Found new interface "LAG10" [20.11.2019 14:24:43] Found new interface "LAG11" [20.11.2019 14:24:43] Found new interface "LAG12" [20.11.2019 14:24:43] Found new interface "LAG13" [20.11.2019 14:24:43] Found new interface "LAG14" [20.11.2019 14:24:44] Found new interface "LAG15" [20.11.2019 14:24:44] Found new interface "LAG16" [20.11.2019 14:24:44] Interface configuration check finished [20.11.2019 14:24:44] Checking node name [20.11.2019 14:24:44] Node name is an IP address and need to be resolved [20.11.2019 14:24:44] Node name cannot be resolved [20.11.2019 14:24:44] Finished configuration poll for node 10.6.1.224 [20.11.2019 14:24:44] Node configuration was changed after poll [20.11.2019 14:24:44] **** Poll completed successfully **** After this second poll the SNMP communication works without reset password. One more Configuration poll and SNMP is gone. What's more. If I do: Configuration poll -> set again SNMP password/community on switch -> Status poll (this work OK) -> Configuration poll, it wouldn't works and SNMP will be lost. For now I can't see any difference between check or uncheck 'Prevent automatic SNMP configuration change' box. Please let me know if I can provide more test to find a solution.

Hi, you can create internal DCI for parameter "Dummy" and use transformation script like return $node->ipAddr; Best regards, Victor

Hi all! I'm trying to compile and run EPP report definition from attached samples in https://www.netxms.org/forum/installation/install-report-server/msg16296/#msg16296. I got it to compile with maven (had to make some changes to pom.xml), but it can't run. The first error was that it couldn't find the report.DataSource's constructer with (net.sf.jasperreports.engine.JRDataset, java.util.Map) parameters, so I changed the existing one to: public DataSource(JRDataset dataset, Map<String, ? extends JRValueParameter> parameters){ super(dataset, parameters); } in EPP's DataSource.java. After this, for a few time I got null pointer exception (unfortunately I don't have the log for that), but now I'm getting: 12:36:06.760 [quartzScheduler_Worker-1] ERROR c.r.r.s.impl.FileSystemReportManager - Can't load compiled report net.sf.jasperreports.engine.JRException: java.io.FileNotFoundException: main.jasper at net.sf.jasperreports.engine.util.JRLoader.loadObject(JRLoader.java:127) ~[jasperreports-6.3.1.jar:6.3.1] at net.sf.jasperreports.engine.util.JRLoader.loadObject(JRLoader.java:116) ~[jasperreports-6.3.1.jar:6.3.1] at com.radensolutions.reporting.service.impl.FileSystemReportManager.loadReport(FileSystemReportManager.java:129) [reporting-server-2.2.16.jar:na] at com.radensolutions.reporting.service.impl.FileSystemReportManager.execute(FileSystemReportManager.java:282) [reporting-server-2.2.16.jar:na] at com.radensolutions.reporting.job.GeneratorJob.execute(GeneratorJob.java:33) [reporting-server-2.2.16.jar:na] at org.quartz.core.JobRunShell.run(JobRunShell.java:202) [quartz-2.2.1.jar:na] at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573) [quartz-2.2.1.jar:na] Caused by: java.io.FileNotFoundException: main.jasper ... 7 common frames omitted I don't know what causes the problem, I guess there were some changes in reporting server. So my question is: Should I just use SQL data source, or is it possible to use java data source and if so, where can I find some sample that works, to examine it? I'm using NetXMS version 2.2.16 (both server and reporting server). Attached is the pom.xml p.s.: The Data Collection Configuration definition seems to work just fine. Edit: I forgot to mention that I also had to modify processAlarms method, because EventProcessingPolicyRule.getActions() return a List<ActionExecutionConfiguration> not a List<Long>. Best regards, Sch.Donat pom.xml

This looks like a bug in configure script - it is made with assumption that library files always installed under PCRE prefix /lib. Seems to not be the case on SUSE. I'll update configure script. Best regards, Victor

Ah, found the issue The DCI is not actually missing. It's just obscured by the bottom half of the 'Filter' header. If you look very closely at the photo on the right you can see a little bit of black text. If I click on that pixel or use the up arrow, it will select that DCI entry So this is a bug with the UI not organising itself correctly. I imagine its placing the list assuming a single-entry header row like the first photo, but the filter one is 2 rows tall hence obscures the first entry

My bad, I never noticed "Automatic Apply Rules" option on the template. Solved, thanks for answering!

Timer cancellations are related to server actions that are launched when an event happens. In event processing policy you can configure an action that is executed and set execution delay (in seconds). When event happens, the action will be scheduled. To be able to cancel this particular action we need to mark it somehow. This is done with timer key. This field can have macro fields in it, so e.g. for every node or node-dci combination, etc this field can be unique. Then we can have another record in event processing policy that can have timer cancellation action. It has the same timer key. If that happens before the timeout goes out, the scheduled action will be cancelled. If not, the action will happen.

There is no standard way of getting this information. If device supports entity MIB then most likely you can get P/N and S/N from there. If not you should looks at vendor specific MIBs - many vendors do provide that information in their custom MIBs. Best regards, Victor

i solved thanks.

Hi, problem is that name of those nodes does not starts with "cab", it is in the middle. If you want to match any node that contains cab it will be different: return $node->name imatch ".*cab.*"; This will match any name with letter combination cab at any position using regular expression. If you want something more complex you can use more complex regular expression. Site https://regex101.com/ is a good resource for testing your expressions. Best regards, Victor

Thank you so much for all the info. I look forward for the 3.1 version. Thanks and best regards, Ravi.

Sorry, I miss that first part with file names. Will check static builds, looks like this is issue specific to either static linking or non-UNICODE build. Usually you do not need static agents though - generic Linux agent (nxagent-3.0.2357-linux-x86_64.tar.gz) should work as well. Best regards, Victor

You can mark interfaces em0.0 as "exclude from topology" if they does not have any valid addresses. I believe those are for stacking/clustering and not visible from outside anyway. Best regards, Victor

Currently it is not possible. If you don't mind please create feature request in our bug tracker for that. Best regards, Victor