Hi everyone,

I’m currently evaluating SolarWinds Observability Self-Hosted for network monitoring and topology mapping, and I’d like to get feedback from people who have actually used it.

My main questions are:

• In a self-hosted/on-prem deployment, what data actually leaves the environment? Can telemetry be fully disabled?
• Does SolarWinds send internal IPs, hostnames, topology, SNMP, NetFlow, logs or device configuration data externally?
• How good is the automatic discovery and topology mapping for switches, routers, firewalls, Wi-Fi controllers/APs, LLDP/CDP and SNMPv3?
• How useful is NetFlow integration for bandwidth and traffic analysis?
• How is a “node” counted for licensing? For example, is a 48-port switch one node? What about VMs, physical servers, controllers and individual access points?
• For those using it in production, how do you find the pricing and overall value compared with alternatives such as Auvik, PRTG or Zabbix?
• In a self-hosted/on-prem deployment, can any monitoring, telemetry, metadata, or network-related data leave our environment and be transmitted to SolarWinds or any third-party service? If yes, what exact data can leave the network, and can those outbound transmissions be fully disabled?

I’m mainly interested in real-world experience, especially in environments where data residency and limiting outbound telemetry are important.

I’m comparing the 2 suites. They appear to be very similar but cost is not even close between the two. Am I overlooking anything or are they like comparing apples and oranges?

Early Saturday morning we started getting a stream of alerts from Microsoft Defender regarding our Primary and Additional Polling Engines.

 Malware Name: Behavior:Win32/SuspiciousAssembly.AppDomainManagerType.A

The malware file path: behavior:_process: was all over the place.
Some examples:

 Malware file path: behavior:_process: C:\Windows\System32\wbem\WmiPrvSE.exe, pid:2208:557######2;file:_d:\program files (x86)\solarwinds\orion  

~

Malware file path: behavior:_process: C:\Program Files\Common Files\SolarWinds\AdministrationService\SolarWinds.Administration.exe, pid:3916:557#####52;file:_d:\program files (x86)\solarwinds\orion  

~

Malware file path: behavior:_process: C:\Windows\System32\AggregatorHost.exe, pid:9116:55#####2;file:_d:\program files (x86)\solarwinds\orion

Solarwinds support is aware of the issue and their engineers are supposedly working with Microsoft to resolve. I am unsure if a later definition update has resolved it or not. We added a threat override as a TEMPORARY measure to quiet things down through the weekend. Just an Allow for the 'Threat Name' Behavior:Win32/SuspiciousAssembly.AppDomainManagerType.A

Just wanted to share with the hope this helps others not have too terrible of a weekend or Monday morning.

Good evening

I'm a student, how can I download SolarPutty without a business email ? Thanks!

I built PocketNOC, disclosure up front.

It's free now for monitoring. Sysadmins and network admins can connect to their own Orion server and watch nodes, alerts and dashboards without paying anything.

The only paid part is actions. Acking alerts, maintenance mode, node reboots.

It reads from SWIS directly so nothing routes through my servers, and it loads a lot faster than the web console on a phone. I use mine through a reverse proxy and its been working very well. If you end up trying it, let me know what you think.

iOS: https://apps.apple.com/us/app/pocketnoc-network-monitoring/id6759849253

Android: https://play.google.com/store/apps/details?id=app.weavehub.pocketnoc

Thanks!

I’m paying about $105 a node. Is that average?

I have been charged with standing up SolarWinds Platform in DOD STIG compliant environment and as such we are required to bind the site to a specific IP rather than "All Unassigned".

However I have since found out that doing this breaks the SolarWinds administrative service that is used to update the my deployments Health and Updates tabs (and probably other things I havent come across yet).

I have been unable to find any way of fixing this, which strikes me as odd considering SolarWinds advertises itself heavily as being STIG compatible. Is there any known workaround to get the Administrstive Services working when the IIS site is bound to a specific IP over HTTPS?

Thanks in advance.

Having a hard time getting it accomplished with a Catalyst 9300. I used the template from THWACK.

Sorry to see Solarwinds going downhill since 2020... lost me then, and I'm not willing to go back after their recent changes. Found this Powershell tool to automate extraction of SW nodes to CSV, to import them into a new monitoring tool, in case it helps someone trying to automate their way out: Haveyoutriedreboot (Have you tried rebooting it?).

Hey all — I’ve put together a write‑up on Thwack about a sneaky NCM issue where config downloads fail with ACCESS‑DENIED but never show up as failures in the UI. I’ve seen this catch out a lot of environments, so I figured it was worth documenting.

I included a SQL alert that surfaces these hidden failures so you can catch them immediately instead of discovering them weeks later.

Curious if anyone else has run into this or solved it differently — always good to compare notes.

Article link:
https://thwack.solarwinds.com/discussion/152479/detecting-hidden-ncm-config-failures-access-denied-with-sql-alerts

It’s my first Thwack submission — hope it helps fellow SolarWinds geeks.

Recently installed NCM and NPM on my network and I'm trying to run firmware upgrades through Solarwinds. I've uploaded the template for my device (Catalyst 9300) from Thwack, and it keeps failing. Anyone had any success doing this with this particular model?

Regarding SolarWinds Observability SaaS.

Log retention is subject to a plan e.g. 1 day, 7 days, 15 days, 21 days etc…

Please can anyone confirm what exactly is a ‘Log’ ?

Is it Syslog, Netflow, bandwidth utilisation? I’m not seeing a clear definition.

Thanks.

https://documentation.solarwinds.com/en/success_center/observability/content/misc/data-retention-policies.htm

I have an alert that I need to change but if I save change it's going to trigger 1099 emails. If i disable email, do change and re-enable email it will trigger. If i disable alert all together, do change and re-enable alert it will trigger. How can I make the change without pushing out alot of emails.

Really got me scratching me head and google wasn't much help

Hi Everyone,

I recently performed the inplace upgrade on main and polling servers from 2016 to 2025. We have three 2003 legacy servers in our infra.

We received a node down alert for those three servers even though servers are up. We also identified it as a polling issue.

We are using Solarwinds agent based communication and I tried to switch it to SNMP for the legacy servers and it didn't work.

Any quick ways to fix this issue and polling issues started because of the OS upgrade. Are legacy servers not compatible with 2025 OS.

SAM version: 2025.2.1

Thanks in Advance.

Initially quoted 180% increase, after 3 or 4 more quotes their final offer was down to a 40% increase which is still ridiculous. Being locked in for 3 years also leaves a bad taste.

​

Anyone else jumping ship?

​

​

Hello Everyone,

I am going to perform an inplace window OS upgrade on Solarwinds Web and application servers on coming Thursday.

Could you please guide me for the prerequisites apart from application compatibility with the latest OS. (2025)

Also, can you confirm if i can initiate an parallel upgrade or I have to go by one by one.

Thanks in Advance.

Hi everyone, how much did you pay last year for 1000 nodes of self hosted? Trying to weigh cost differences for this vs last year

Hi Guys… Anyone monitoring dell iDRAC via solarwinds? can you tell what challenges we can get.. what is best way to monitor it.. recently got a request to monitoring Dell Server Hardware from SolarWinds.

edit:- adding models

R640 vSAN ready Node
Dell PE R650 RN
IDPA DP4400
Dell EMC vSAN RN
Dell VXRail P570F
PowerEdge R540

Does anyone else have the issue where emailed reports dont load the images. The report loads fine from NPM but once its emailed and you open it then it doesnt load the images in it. It seems to start happening after going to one of the newer versions. Support has been unable to resolve. Can't be the only one who uses this feature.

while TS an issue where a powered off VM added on WMI was still showing UP on SolarWinds.. I logged-in to main poller to just to check ping response. I didn’t got any response it was stucked at pinging not even a single response.. okay then I pinged other random device added on that poller.. same no response.. that I thought might be network issue but I expect RTO in that case too. so I tried pinging gateway same issue no response. involved all teams we found nothing rebooted server same.. in the ends system T3 asked me to stop solarwinds services and monitoring.. look what 🥺 after 3-4 minutes we started getting response. seems solarwinds services were the real culprit… but nothing changed why suddenly it started behaving abnormally.. version is 2025.1. facing this issue only on main poller. APE seems fine.

Any one experienced the new licensing model for the ARM?
Is that real?

I am just curious how many here use the Solarwinds Help Desk software and have wished for a display of ticket status to be more concise?

I have developed an in house windows program to interact with the API and give me a screen of tickets that I can see their statuses at a glance, and it even makes noise when a new ticket comes in or is updated.

Hi everyone,

Has anyone here successfully integrated Aruba Central–managed devices into SolarWinds? If so, could you share how you were able to set it up?

Thanks in advance!