SolarWinds NPM Technology Expert

Orion Platform Architecture

Components

• Orion Web Console -- IIS-hosted HTTPS web application; role-based access control (RBAC)
• SQL Server Backend -- Microsoft SQL Server stores all configuration, polling data, events. Supports SQL Always On AG for HA.
• Main Polling Engine -- Primary service on the Orion Server; collects data from monitored nodes
• Additional Polling Engines (APE) -- Scale-out pollers for large environments or remote sites; communicate back to main Orion via HTTPS
• Agent -- Optional lightweight agent for Windows/Linux systems (WMI alternative, script execution, process monitoring)
• Orion SDK -- .NET/REST SDK for custom integrations

Module Ecosystem

Polling Methods

• SNMP v1/v2c/v3 -- Primary device polling; configurable interval (60s default); bulk OID walks
• WMI -- Windows monitoring (CPU, memory, processes, events) without agent
• ICMP -- Availability and response time (ping-based)
• API -- REST API integration for cloud-managed infrastructure (Aruba Central, Meraki)
• Syslog -- Inbound message collection and alerting
• SNMP Trap -- Trap collection; triggers alerts and logs

NPM 2025.2 Features

• Thin AP Management -- Discover and manage individual thin APs as separate SNMP nodes (previously WLC-level only)
• L2/L3 Metrics -- IP assignment, STP topology, VLAN config, ARP mapping across multi-vendor switches
• Interactive Topology Widgets -- VLAN membership maps, STP root/blocked port visualization, MAC address drill-down
• Aruba Central API -- Monitor Aruba Central-managed switches and APs via API

NetPath

Hop-by-hop TCP path analysis:

• Discovers and visualizes network path between probe and destination
• Works for TCP services (HTTP, HTTPS, custom TCP port)
• Detects path changes, latency anomalies, routing shifts over time
• Works across internet paths (not limited to internal network)
• Requires NetPath probe (agent or NPM server)
• Historical path data for trend analysis and correlation

PerfStack

Cross-domain performance correlation dashboard:

• Drag-and-drop metrics from NPM, NTA, SAM, APM onto shared timeline
• Visually correlate network events with application performance
• Time-synchronized across all metric sources
• Save and share PerfStack layouts as reusable views
• Essential for cross-team troubleshooting (network + application + server)

Alerting

Alert Engine

• Condition types: Threshold, baseline deviation, state change, complex condition
• Multi-condition: AND/OR logic combining multiple metrics and states
• Dampening: Require condition to persist for N polling intervals (prevents flapping alerts)
• Reset conditions: Define when alert clears (automatic or manual)
• Scope: Per-node, per-group, per-custom-property

Notification Methods

• Email, SMS, Slack, Microsoft Teams, PagerDuty, OpsGenie
• Webhook (generic HTTP POST)
• Script execution (PowerShell, Python)
• SNMP trap forwarding
• Log to Orion event log

Alert Best Practices

• Use multi-condition alerts to reduce noise (e.g., interface down AND parent node up = real issue; parent down = expected)
• Leverage custom properties for alert routing (site, team, priority)
• Set appropriate dampening (2-3 polling cycles minimum)
• Create escalation alerts (if not acknowledged in 30 min, notify manager)
• Review zero-trigger alerts quarterly; disable or tune

SWQL (SolarWinds Query Language)

SQL-like query language for all Orion data:

-- Top 10 interfaces by utilization
SELECT TOP 10 n.Caption, i.Caption, i.InPercentUtil, i.OutPercentUtil
FROM Orion.NPM.Interfaces i
JOIN Orion.Nodes n ON i.NodeID = n.NodeID
WHERE i.InPercentUtil > 50
ORDER BY i.InPercentUtil DESC

-- Nodes with high CPU
SELECT Caption, CPULoad, PercentMemoryUsed
FROM Orion.Nodes
WHERE CPULoad > 80
ORDER BY CPULoad DESC

-- Recent alerts
SELECT AlertName, ObjectName, TriggeredDateTime, Severity
FROM Orion.AlertStatus
WHERE TriggeredDateTime > ADDDAY(-1, GETUTCDATE())
ORDER BY TriggeredDateTime DESC

-- Custom property filter
SELECT Caption, IP_Address, CustomProperties.Site
FROM Orion.Nodes
WHERE CustomProperties.Site = 'New York'

SWQL Access

• SWQL Studio -- Desktop application for interactive queries (part of Orion SDK)
• REST API -- GET /SolarWinds/InformationService/v3/Json/Query?query=<SWQL>
• Web Console -- Custom report builder uses SWQL under the hood

Orion SDK / REST API

Authentication

• Windows authentication or Orion account credentials
• Base URL: https://<orion-server>:17778/SolarWinds/InformationService/v3/Json/

Common Operations

# Query
GET /Query?query=SELECT+Caption,+IP_Address+FROM+Orion.Nodes

# Add node
POST /Create/Orion.Nodes
Body: {"Caption": "switch01", "IPAddress": "10.1.1.1", ...}

# Update node
POST /Orion.Nodes/NodeID=123/CustomProperties
Body: {"Site": "New York"}

# Invoke action (unmanage node)
POST /Invoke/Orion.Nodes/Unmanage
Body: ["N:123", "2026-04-08T12:00:00", "2026-04-08T14:00:00", false]

Use Cases

• Automated node onboarding from CMDB
• Custom dashboards pulling Orion data
• Alert-triggered automation (auto-remediation scripts)
• ITSM integration (create ServiceNow tickets from alerts)

Capacity Planning

Polling Engine Sizing

• Single polling engine: ~500-1,200 nodes with standard polling
• Additional Polling Engines for: >1,200 nodes, remote sites, WAN-separated networks
• SQL Server: size based on data retention and module count
• Disk I/O is the most common bottleneck (SQL writes during polling)

Data Retention

• Default: 365 days detailed, hourly/daily summaries retained longer
• Adjust per module in Settings > All Settings > Database Settings
• Larger retention = larger SQL database = more disk/memory

Common Pitfalls

1. SQL Server undersized -- NPM is SQL-intensive. Underpowered SQL causes slow Web Console, delayed alerts, and polling failures. Size SQL Server generously (SSD storage, adequate RAM).

2. SNMP v2c in production -- Community strings are cleartext. Use SNMPv3 with authPriv for production environments.

3. Too many custom pollers -- Each custom SNMP poller adds load. Consolidate OIDs into bulk polls where possible.

4. Alert noise from flapping -- Interfaces that flap generate rapid alerts. Add dampening (minimum 3 polling cycles) and deduplication.

5. NetPath agent placement -- NetPath measures path from the probe location. Place agents at the source of user traffic, not at the data center.

6. Module licensing confusion -- NPM, NTA, NCM, SAM are separate licenses. NTA requires flow-exporting devices. NCM requires SSH/Telnet access to devices.

7. Ignoring PerfStack -- PerfStack is the most powerful Orion feature for cross-domain troubleshooting. Train teams to use it.

Reference Files

Load these when you need deep knowledge:

• references/architecture.md -- Orion platform, polling engines, modules, NetPath, PerfStack, SQL schema. Read for "how does X work" questions.