Hybrid-Cloud-Observability-Network-Monitoring Hybrid Cloud Observability Network Monitoring Exam Questions and Answers

Comprehensive and Detailed Explanation From Exact Extract:

A node rediscovery updates all node and interface information, including names, IP addresses, captions, and interface aliases. Running a rediscovery on the node ensures all related interface details are refreshed in the SolarWinds database and web console.

Comprehensive and Detailed Explanation From Exact Extract:

If logs are not being sent from a Windows agent, you must confirm that the log forwarding feature is enabled. Even if the agent is installed, logs will not be transmitted unless this setting is turned on.

The documentation notes:

"Ensure the agent is configured to forward logs. Log forwarding must be enabled for the agent to transmit log data to the SolarWinds platform."

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds Hybrid Cloud Observability (HCO) supports capturing flow data and CBQoS data using:

A. IPFIX: (IP Flow Information Export) is the IETF standard for exporting flow information, supported for both flow data and CBQoS.

C. NetFlow: Developed by Cisco, widely used for flow and CBQoS data collection.

J-Flow is primarily for flow data (from Juniper devices), and SNMP is not a flow export protocol.

The documentation states:

"NetFlow (including NetFlow v9) and IPFIX are supported for flow and CBQoS data collection. These standards provide extensive network traffic and QoS visibility within HCO."

Comprehensive and Detailed Explanation From Exact Extract:

Incorrect hardware health data often results from polling the wrong MIB tree. By changing to the correct or preferred MIB tree for the device model, SolarWinds can accurately interpret and display hardware health metrics.

Comprehensive and Detailed Explanation From Exact Extract:

Duplex mismatches often result in specific types of switch port errors. According to SolarWinds documentation, the most common indicators of a duplex mismatch include CRC errors (B), high receive error percentages (C), and collisions (D). These errors occur because one end of the link operates in full-duplex mode (no collisions expected), while the other operates in half-duplex (collisions possible), resulting in frame errors, dropped packets, and high CRC counts. The option "100 MB full" refers to a speed/duplex setting, not an error.

Comprehensive and Detailed Explanation From Exact Extract:

Duplicate flow data typically results when both ingress and egress flow monitoring are applied simultaneously on interfaces. If both directions are enabled either globally (all interfaces) or locally (on a single interface), the same flow is counted twice—once entering and once leaving—resulting in duplicate statistics.

Comprehensive and Detailed Explanation From Exact Extract:

Unreadable fields in SNMP traps from a device typically indicate either the device is not monitored as a node (so SolarWinds cannot fully parse its SNMP data) or the MIB file for that device is not included in the SolarWinds MIB database, making it impossible to decode certain OIDs.

Comprehensive and Detailed Explanation From Exact Extract:

The Flow Navigator in SolarWinds NetFlow Traffic Analyzer (NTA) is a powerful custom filter and analysis tool. It enables users to apply multiple filters to NetFlow data, allowing the visualization of specific statistics about the entire network or selected subsets, such as all traffic from a certain IP range or application. This approach eliminates the need to manually click through device-by-device views, instead providing comprehensive traffic analysis across the whole monitored environment through a single, customizable interface.

Comprehensive and Detailed Explanation From Exact Extract:

Duplicate flows can occur if multiple interfaces export the same data or if NetFlow is configured on both ingress and egress interfaces. SolarWinds documentation recommends:

Enabling the “flow de-duplication” feature within NetFlow Traffic Analyzer to automatically filter duplicate data.

Ensuring NetFlow is enabled only on ingress interfaces (best practice), as enabling it on both directions can result in duplicate records.

Automatic addition of flow sources and enabling on sub-interfaces do not directly address duplication.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds Log Analyzer and Hybrid Cloud Observability support log collection from current, supported Windows operating systems, such as Windows 10 (workstation) and Windows Server 2019. Older or unsupported versions like Windows Vista or Server 2012 may not be supported.

Comprehensive and Detailed Explanation From Exact Extract:

To monitor and configure High Availability (HA) mode for site-to-site VPN tunnels on a Cisco ASA firewall, SolarWinds uses SNMP for standard device and interface metrics, and CLI polling for advanced VPN and HA state details. SNMP provides general health data, while CLI polling (using Device Studio or Network Insight) collects information not available via SNMP, such as detailed VPN and HA status.

Comprehensive and Detailed Explanation From Exact Extract:

The radial gauge display in the SolarWinds web console requires that the polled value from the OID is a numeric type that supports gauge visualizations (for example, a percentage or value with a defined minimum and maximum). If the OID returns data that does not fit these requirements—such as text, status, or a counter with no clear min/max—the gauge option will be grayed out and unavailable for selection. This behavior is explained in the Universal Device Poller documentation, which states that only compatible numeric OID types can be displayed using radial gauge resources.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds determines node status by polling using ICMP (ping) and SNMP. If ICMP is blocked by a firewall or network device between the polling engine and the monitored node, the node will appear “down” in the web console even though it is actually up. Likewise, if the SNMP credentials configured in SolarWinds are incorrect, the polling engine cannot successfully query the device, leading to a false “down” status.

From the documentation:

“If ICMP packets are blocked or dropped, SolarWinds cannot determine node status, resulting in false down events.”

“Incorrect SNMP community strings or credentials will prevent node polling, and these nodes may appear down in the console.”

Changing the polling interval or node management settings does not directly cause this issue.

Comprehensive and Detailed Explanation From Exact Extract:

To effectively diagnose a slow connection using NetPath, the following data points are essential:

Date, time, and duration of the performance issue: Helps correlate the problem with specific events or maintenance windows.

IP addresses of the nodes in question: Identifies the exact points in the network path where issues may arise.

Latency and packet loss information: These are core metrics provided by NetPath and are critical for pinpointing where delays and data loss occur.

The SolarWinds documentation states:

"When troubleshooting with NetPath, consider the time frame, the specific nodes (by IP address), and the latency/packet loss details between hops. Alert descriptions are not a primary diagnostic data point in NetPath's workflow."

Comprehensive and Detailed Explanation From Exact Extract:

A. MIB files define the available SNMP objects and metrics that can be polled from a device.

C. MIB files provide human-readable names and descriptions for OIDs, allowing SolarWinds to display metrics in a clear, user-friendly format instead of raw OID numbers.

Automatic device discovery is handled by network scanning, not by MIB files, and OIDs are created by device vendors, not by SolarWinds.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds Log Analyzer supports secure syslog forwarding using the TCP protocol. The industry standard and the default port used for secure syslog (Syslog over TLS/TCP) is port 6514. This is referenced in SolarWinds documentation where it specifies:

"For secure syslog forwarding, Log Analyzer uses TCP port 6514, which is the default for syslog over TLS, as defined by RFC 5425."

This ensures that log data is encrypted during transmission, enhancing security over the default UDP port 514 (which is used for non-secure syslog).

Comprehensive and Detailed Explanation From Exact Extract:

If the flow source view in SolarWinds NTA shows “never received” and firewall issues are ruled out, it is often because the device (node) is no longer monitored by SolarWinds. If a node is removed or its monitoring is disabled, the collector will not associate incoming flows from that node, resulting in "never received" status.

Comprehensive and Detailed Explanation From Exact Extract:

If interfaces on a node show an “unknown” status, the recommended solution is to delete and rediscover the node. This ensures all current interface information, OIDs, and properties are correctly detected and polled, resolving mismatch or missing data that can cause an “unknown” status.

Comprehensive and Detailed Explanation From Exact Extract:

For critical devices and connections, peak calculation is the recommended capacity planning method. This approach uses the highest observed utilization values within a time period, ensuring that planning accounts for maximum network demand and helps avoid bottlenecks during traffic spikes. SolarWinds documentation advises using peak calculations for important links to ensure network reliability and performance.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds Hybrid Cloud Observability supports multiple industry flow protocols:

J-Flow: Supported and commonly used by Juniper devices.

NetFlow v9: Supported, providing flexible flow data and templates.

sFlow: Supported, widely used in vendor-agnostic environments.

NetFlow v6 is not a recognized protocol; SolarWinds documentation does not list it as a supported standard.

"SolarWinds NTA and HCO support NetFlow (v5/v9), sFlow, J-Flow, and IPFIX for collecting and analyzing flow data."

Comprehensive and Detailed Explanation From Exact Extract:

Flow sampling reduces resource usage by analyzing a subset of traffic. The following protocols support sampling:

Cisco NetFlow (except v1): Most NetFlow versions support sampling.

IPFIX: Supports flow sampling as part of its standard.

NetFlow Lite: Designed to provide sampled flow data.

NetFlow V1 does not support flow sampling.

Exact Extract from Official Guide:

"NetFlow (except v1), IPFIX, and NetFlow Lite support flow sampling, enabling high-performance monitoring of large traffic volumes."

— (Network Performance Monitor Administrator Guide, “Flow Protocols and Sampling” section)

Comprehensive and Detailed Explanation From Exact Extract:

The most common cause of mismatch between bandwidth (SNMP) numbers and flow (NetFlow, sFlow, etc.) numbers is that not all network traffic is included in the flow export. SNMP bandwidth counters include all traffic traversing the interface, but NetFlow or other flow records may only represent sampled or filtered subsets, or may miss certain traffic due to export or device configuration limitations. This is a well-documented and expected difference in the SolarWinds platform.

Comprehensive and Detailed Explanation From Exact Extract:

Universal Device Pollers (UDPs) must be explicitly assigned to each node for which custom polling is required. Adding a new node does not automatically assign existing UDPs to that node, even if it’s the same device type as others already using the poller. Assigning the existing UDP to the new node will resolve the issue and enable polling of the desired data.

Comprehensive and Detailed Explanation From Exact Extract:

Device Studio supports the following data sources:

Calculated result from transformation of polled values: You can apply calculations (such as average, sum, transformation) to the raw polled data.

Polled value by a device on an object ID: Device Studio can directly poll an OID from a device and use its value for monitoring.

Night/day standard deviation and predicted/baseline values are not direct data sources in Device Studio.

Comprehensive and Detailed Explanation From Exact Extract:

NetPath is specifically designed to trace and troubleshoot connectivity paths between nodes.

Network Insight provides in-depth analysis and diagnostics for specific vendors/devices, including health, connectivity, and configuration.

Asset inventory and MIB browser are not direct troubleshooting tools for connectivity.

If flows are confirmed as reaching the poller but no data appears in the web console, the most common cause is a missing or incorrect source address field in the flow configuration on the sending device. SolarWinds uses the source address to match incoming flows to the correct device record in its database; if this field is missing or misconfigured, the data will not be processed or displayed.

Exact Extract from Official Guide:

“If the source address field is missing or incorrectly configured in the flow-exporting device, the system cannot associate the flow with a monitored device, and no data will appear in the console.”

— (Network Performance Monitor Administrator Guide, “Troubleshooting NetFlow” section)

Comprehensive and Detailed Explanation From Exact Extract:

For a node-specific log view, navigate to the node’s details summary and choose “Analyze Logs” under the Management section. This provides a filtered view of log messages for the selected node, allowing you to drill into relevant log events and details.

From the documentation:

“To view logs for a specific node, open Node Details > Management > Analyze Logs for node-level log analysis and troubleshooting.”

Comprehensive and Detailed Explanation From Exact Extract:

To collect and analyze Windows event logs in SolarWinds Hybrid Cloud Observability, you must:

Deploy and configure the platform agent on the Windows server: The agent is responsible for collecting logs locally, including event logs, and sending them to the SolarWinds platform for analysis.

Configure the Windows server to send logs to the SolarWinds platform: This can be achieved by forwarding event logs from the Windows server to the server running the SolarWinds platform (e.g., via Windows Event Forwarding or syslog if using third-party tools).

Simply configuring rules within the platform does not automatically grant access to Windows event logs; deployment of the agent or configuration of log forwarding is required for collection. This requirement is outlined in the Log Analyzer Administrator Guide and the Hybrid Cloud Observability documentation for Windows log collection.

Comprehensive and Detailed Explanation From Exact Extract:

When you observe an "unknown traffic event" in the SolarWinds web console, it usually means the collector is receiving NetFlow or other flow data from a device that is not currently managed or monitored in the SolarWinds database. The collector can receive flows from any device, but if the device is not added or properly monitored, the traffic will show up as "unknown" because SolarWinds cannot associate the flows with a known interface or device.

Comprehensive and Detailed Explanation From Exact Extract:

False positives in hardware health alerts often occur when the polled MIB on the device is not the preferred or correct MIB for that particular hardware platform. This can result in SolarWinds interpreting SNMP data incorrectly, causing inaccurate alerts. Ensuring that the device is using the recommended MIB for hardware health resolves these false alert issues.

Comprehensive and Detailed Explanation From Exact Extract:

You can check the status of the flow collector service from the NetFlow collector services section and from NetFlow settings in the SolarWinds web console. These locations provide service health, up/down status, and logs. "Flow and CBQoS sources" and "Top XX receivers" do not display service health.

Comprehensive and Detailed Explanation From Exact Extract:

To test connections from two separate locations using NetPath or similar functionality in Hybrid Cloud Observability, you need to create two probes and assign each probe to an agent at each respective location. This allows network path and experience monitoring from the point of view of both locations.

Exact Extract from Official Guide:

“To monitor network paths from multiple locations, create a separate probe for each location and assign the probe to an agent deployed at that site.”

— (Network Performance Monitor Administrator Guide, “NetPath and Probes” section)

Comprehensive and Detailed Explanation From Exact Extract:

By default, SolarWinds Network Performance Monitor uses historical data from the last 7 to 30 days to calculate capacity forecasts. This range balances the need for relevant recent data with enough samples to provide trend accuracy.

The documentation states:

“Capacity forecasting in SolarWinds NPM uses the last 7 to 30 days of historical data by default for its projections.”

Comprehensive and Detailed Explanation From Exact Extract:

With Network Insight features (including for Palo Alto and F5 BIG-IP devices) installed alongside Network Configuration Manager and Performance Monitoring, you can monitor:

High availability details: Provides information on device redundancy, failover status, and clustering.

Policy details: Enables insight into firewall, security, and NAT policies for managed devices.

Access lists and VPNs may be monitored in other modules, but the primary, advanced insight is for high availability and policy configurations.

Comprehensive and Detailed Explanation From Exact Extract:

To create a NetPath probe in SolarWinds, you need to specify a source (which requires a Windows-based agent or node) and a destination port. The documentation states:

“To deploy a NetPath probe, select a Windows node or agent as the source and specify the connection port for the service to be monitored. Linux nodes and agents are not supported for NetPath probes.”

Comprehensive and Detailed Explanation From Exact Extract:

Hardware health monitoring can be enabled during node discovery or after a node is added via the "List Resources" option. Additionally, hardware health can be enabled or viewed in the Asset Inventory page for nodes that support it.

From the documentation:

“You can enable hardware health sensors by selecting the option during resource discovery (List Resources) or later via Asset Inventory for individual nodes.”

Comprehensive and Detailed Explanation From Exact Extract:

The Universal Device Poller (UnDP) in SolarWinds allows you to create custom SNMP pollers. Results from UnDPs can be displayed as charts, gauges, or tables on SolarWinds web console views. The administrator guide states:

“Universal Device Pollers (UnDPs) allow you to collect SNMP data not provided natively by SolarWinds. The collected results can be displayed as charts, gauges, or tables, making it easier to visualize the custom metrics.”

Device Studio pollers are templates used to define UnDPs, but it is the UnDP that presents data visually. Hardware health and Network Insight are not custom pollers.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds allows users to customize the display of NetFlow and other flow-based data for ingress (incoming) or egress (outgoing) traffic. The selected view (direction) is retained for 24 hours for the user session.

As stated in the official guide:

“Both ingress and egress traffic views are available and retained for 24 hours for the user session on the SolarWinds platform.”

Other time frames are not referenced in the official documentation.

Comprehensive and Detailed Explanation From Exact Extract:

To monitor an application on a server with SolarWinds, you must first find the application in the list of available (supported or discovered) applications and enable monitoring for it. The platform also provides a “monitor recommended applications” button to automatically suggest and enable monitoring for best-practice applications on a given server.

From the documentation:

“To monitor an application, select it from the list of available applications and enable it for the target server. The ‘Monitor Recommended Applications’ option helps you quickly enable commonly used application monitors.”

Grouping IP addresses or configuring specific source/destination pairs is not required for standard application monitoring.

Comprehensive and Detailed Explanation From Exact Extract:

The standard unit for flow-based alerts in SolarWinds (e.g., NetFlow Traffic Analyzer) is megabits per second (mbps). Alerts regarding traffic rates, bandwidth utilization, and similar flow metrics are configured and displayed in mbps for consistency with network monitoring best practices.

Comprehensive and Detailed Explanation From Exact Extract:

For secure syslog (Syslog over TLS), the standard port used is TCP 6514. SolarWinds Log Analyzer and Platform listen on TCP port 6514 for secure syslog messages.

Exact Extract from Official Guide:

"Log Analyzer supports receiving secure syslog messages over TCP port 6514, in accordance with the RFC 5425 standard."

— (Log Analyzer Administrator Guide, “Syslog Configuration” section)

Comprehensive and Detailed Explanation From Exact Extract:

When a device returns multi-core CPU statistics as a table, SolarWinds Device Studio allows you to use the "Add Calculated Value" option and select the average function. This enables the web console widget to display the computed average CPU utilization automatically.

The documentation explains:

"For devices with multi-core CPUs, you can use the Add Calculated Value feature in the Device Studio to compute the average (or other statistical functions) of returned table values, which can then be visualized directly in widgets."