Observability-Self-Hosted-Fundamentals SolarWinds Observability Self-Hosted Fundamentals Questions and Answers

In the SolarWinds Platform, transferring report definitions between different instances (such as Site A and Site B) requires a format that captures the underlying logic, SQL/SWQL queries, and layout metadata. According to theSolarWinds Platform Reporting Guide, while CSV, PDF, and DOC are formats used for exporting theresultsof a report (the data), they do not contain the instructions needed to recreate the report itself on a different server.

To share a report's structure, the administrator must use theExport/Import XMLfunctionality. By selecting the report in the Report Manager and choosing "Export," the system generates a specialized.xml file. This file contains the complete definition of the report, including the datasource filters, selected columns, chart configurations, and formatting rules. When this XML file is imported into the second SolarWinds instance, the platform parses the code and creates a new entry in the local database. This is the standard method for migrating custom reports from a test environment to production or sharing successful reporting templates across a geographically distributed organization with multiple independent polling installations.

AlertStackis a specialized AIOps feature within Hybrid Cloud Observability (HCO) designed to simplify incident response. According to theSolarWinds HCO Alertingdocumentation, anAlertStack clusteris anautogenerated grouping of related active alerts on related entities.

The primary goal of clustering is to reduce "alert fatigue." Instead of presenting a technician with twenty individual alerts (e.g., one for high CPU on a server, one for an application failure, and three for slow database response), AlertStack analyzes the relationships and dependencies between those entities. If the platform determines that the alerts are part of a single root-cause event—such as a storage array failure impacting multiple virtual machines and their applications—it automatically clusters them into a single visual timeline. This clustering isautogeneratedby the platform's machine learning engine based on the AppStack dependency map; it does not require a user to manually group the alerts. This allows the IT team to identify the "blast radius" of an incident and focus on the primary failure point rather than triaging dozens of symptoms individually.

SolarWinds agents support two communication modes: "Server-Initiated" (Passive) and "Agent-Initiated" (Active). According to theSolarWinds Platform Agent requirements and port information, the direction of communication determines which firewall ports must be open.

When an agent is configured forAgent-Initiated communication(where the agent on the managed node reaches out to the SolarWinds server), it usesTCP port 17778. This port must be open for inbound traffic on the SolarWinds Main Polling Engine or Additional Polling Engine. This mode is highly beneficial for monitoring servers in DMZs or remote sites where the SolarWinds server cannot initiate a connection through the firewall, but the remote node is allowed to communicate back to the primary management network. Port 17777 (Option B) is used for the legacy Orion Information Service, and 17790 (Option D) is used for specific client-to-server messaging in different contexts, but 17778 is the dedicated, encrypted port for agent-initiated data transmission.

SolarWinds Hybrid Cloud Observability provides robust reporting capabilities designed for both technical analysis and executive presentation. TheSolarWinds Platform Reporting Guidespecifies that reports generated through the Web Console can be delivered or manually exported in several standardized formats.

Excel (.xls/.xlsx): This format is primarily used for data-heavy reports where administrators need to perform further calculations, sorting, or external data manipulation. It allows the raw table data from the report to be easily ingested into other business intelligence tools.

PDF: This is the standard format for automated delivery and "executive-ready" documentation. It preserves the visual layout, including charts, logos, and specific formatting defined in the report builder.

While the platform usesJSON(Option B) for internal API communications and some dashboard configurations, andtxt(Option D) might be used for certain log exports, they are not standard selectable "export formats" within the primary Web-Based Report builder for end-user consumption. The primary focus of the reporting engine is providing human-readable (PDF) and spreadsheet-compatible (Excel) outputs.

AppStackis a specialized visualization tool designed to show the "stack" of dependencies between different layers of an IT environment. According to theSolarWinds Platform Administrator Guide, AppStack has two defining characteristics:

Automatic Relationship Gathering (A): The tool uses the data already collected by various modules (SAM, VMAN, SRM) toautomaticallymap how applications, database instances, servers, virtual hosts, and storage volumes are linked. This eliminates the need for manual manual line-drawing in most cases.

Customizable Visual Mapping (B): It provides aninteractive environment viewwhere users can filter by status, application name, or site to see a visual map of the infrastructure. This allows a user to click on a failing application and see exactly which virtual host or storage array might be causing the failure due to its relationship.

Options C and D describePerfStack(Performance Analysis), which is the tool used for time-series correlation and dragging metrics onto charts. AppStack focuses on thestructureof the environment, whereas PerfStack focuses on theperformance dataof the entities within that structure.

The SolarWinds Agent is a versatile polling tool, but it must be compatible with the underlying Operating System (OS) to function correctly. According to theSolarWinds Platform Agent requirements, the agent software is designed to run on a wide variety of modern Windows and Linux distributions.

For the Windows ecosystem, the agent supports both server-grade and enterprise-grade workstation operating systems.Windows Server 2022 (D)is fully supported, allowing for deep monitoring of the latest Microsoft server environments, including support for AppInsight applications. Similarly,Windows 11 Enterprise (C)is a supported platform, which is particularly useful for monitoring high-end workstations, jump boxes, or remote endpoints that act as critical nodes in the network.

While SolarWinds does support various Linux distributions (such as RHEL, CentOS, and Ubuntu),Debian 11andFedora(Options A and B) are often not listed as "officially primary supported" in the same tier as the Windows or main enterprise Linux distributions in current HCO documentation. The Windows agent remains the most feature-complete version of the software, supporting a broader range of monitoring types (like Quality of Experience and deep application analysis) compared to its Linux counterparts. Therefore, for an HCO deployment focusing on the latest infrastructure, Windows Server 2022 and Windows 11 are the verified answers.

Custom Views(Summary Views and Detail Views) are the primary way administrators control the layout and focus of the SolarWinds Web Console. According to theSolarWinds Platform Administrator Guide, views are used to tailor the platform to different user roles.

The two primary reasons for creating them are:

Limit user access to specific elements (A): Views can be restricted to specific users or groups. By creating a custom view that only contains "Storage" widgets and assigning it to the Storage Team, an administrator can effectively limit what those users see when they log in. This prevents users from being overwhelmed by irrelevant data and acts as a functional layer of access control.

Personalize user experience and focus on specific elements (D): Different roles require different data. A CXO might need a high-level "Map" and "SLA Trend" view, while a technician needs a "Top 10 Nodes by CPU" and "Active Alerts" view. Custom views allow the administrator to curate exactly which widgets are visible, ensuring that each user has the most relevant information for their job front-and-center.

SQL customizations(Option C) are a method of building widgets, but not thereasonfor the view itself. Monitoring new elements (Option B) is handled through theAdd NodeandPollerssettings; a view onlydisplayswhat is already being monitored.

The reporting engine in the SolarWinds Platform is designed to provide historical documentation and summary data for management and technical analysis. According to theSolarWinds Platform Reporting Guide, reports are distinct from alerts; while alerts focus on real-time "critical incidents needing immediate attention" (Option B), reports focus on aggregated data over time.

Specifically, the two primary purposes shown in the options are:

Availability and Response Time Reports (A): These provide a summary of how infrastructure has performed over a specific period (daily, weekly, monthly). This is used for Service Level Agreement (SLA) reporting to show that devices at a particular location maintained required uptime and performance metrics.

Status Summaries (D): Reports can be generated to show the current or historical distribution of node health. A report on the "number of nodes in warning or critical states" provides an executive-level view of environmental stability, identifying which areas of the network are experiencing the most frequent issues.

Option C is incorrect as database dependencies are typically visualized live inAppStackorIntelligent Mapsrather than in a static report. Option B describes the function of theAlerting Engine, which is intended for immediate operational response rather than the post-hoc analysis provided by reports.

The transition from the legacy Orion Platform toHybrid Cloud Observability (HCO)introduced stricter hardware and software prerequisites to support modern features like AIOps, advanced mapping, and high-performance data processing. According to theSolarWinds Hybrid Cloud Observability System Requirements, the platform requires modern SQL features for optimal performance.

While legacy versions of the Orion Platform may have supported SQL Server 2016 or even 2012 in older iterations,MS SQL Server 2019is identified as theminimum supported versionfor new HCO installations. This requirement ensures compatibility with the latest database indexing and query optimization techniques used by the SolarWinds Platform to handle the high volume of time-series data generated by observability nodes. Additionally, using SQL 2019 or later (including SQL 2022) is necessary to ensure the platform can utilize specific security protocols and memory management improvements that are not available in the end-of-life SQL 2012 or SP1 versions of 2016.

Visibility of the reporting module is a configurable security setting within each SolarWinds user account. According to theSolarWinds Platform User Account Managementguide, if a user logs into the Web Console and finds the Reports section empty or inaccessible, it is likely due to anAccount Limitation.

Specifically, the "Report Limitation" field in the user's profile can be set to"No Reports". This setting acts as a total block, preventing the user from viewing any report definitions, whether they are predefined (out-of-the-box) or custom-made. This is a common configuration for restricted user roles, such as basic operators or external contractors, who need to see real-time status in dashboards but should not have access to the historical, inventory, or security data contained in the platform's reporting engine. While a user could also be restricted from seeing specific entities (Option B), this would typically just result in empty datainsidea report rather than the total inability to view the reports module itself. Setting the account to "No Reports" ensures the user isprevented from viewing all reportsglobally across the platform.

In Hybrid Cloud Observability (HCO), report visibility is controlled byReport Limitation Categories. While standard users are typically restricted to specific categories (e.g., "Finance Reports" or "Network Reports"), administrators often require a global view of all reporting assets.

According to theSolarWinds Platform Documentation on Restricting Report Access, the setting"No Limitation"is the specific value used to bypass all category-based filters. When an account is configured with the "No Limitation" report category, the platform security layer allows that user to see every report stored in the database, including reports marked as "private" or those assigned to specific siloed departments.

It is important to distinguish this from the"Default"setting (Option A), which typically only allows users to see reports that have not been assigned to any specific limitation category. To ensure a Platform Administrator has a truly comprehensive view for auditing or management purposes, the "No Limitation" setting must be explicitly selected in their User Account settings underSettings > All Settings > Manage Accounts > Edit User.

AppStackis designed to provide a "top-to-bottom" visual representation of the IT infrastructure layers that support an application. According to theSolarWinds Platform Administrator Guide, the AppStack Environment view automatically maps relationships between specific monitored entities.

The two primary categories that appear in this view aredatabase instances (A)andservers (C). In a typical application stack, the "Server" represents the physical or virtual hardware, while the "Database Instance" (monitored via AppInsight for SQL, Oracle, etc.) represents the software layer running on that server. AppStack visually links these so that if a database instance shows a critical status, an administrator can instantly see which server it is hosted on and if there are underlying infrastructure issues. Other common categories include Applications, Transactions, Virtual Hosts, Clusters, and Volumes.

NetFlow(Option B) is a traffic analysis technology used in the NetFlow Traffic Analyzer (NTA) and is generally not a primary "entity" category in the standard AppStack environment map.SNMP Pollers(Option D) are the backend mechanisms used to collect data; they are a configuration component rather than a logical infrastructure entity that would be represented as a layer in an application dependency stack.

In the SolarWinds Platform, data visibility is controlled at the account level through a security feature known as Account Limitations. According to theSolarWinds Platform User Account Managementdocumentation, when a single user has restricted visibility while others do not, it points to a specificAccount Limitationapplied to that user's profile.

Account limitations act as a persistent filter on the database queries performed by the Web Console during that user's session. If an administrator has configured a limitation based on a custom property like "Location" or "Region," the user will only see entities that match that specific criteria. For example, if the user's account is limited to Location = New York, they will be unable to see nodes, alerts, or reports associated with Location = London, even if those nodes are active and being monitored by the system.

This is a fundamental tool for multi-tenant environments or large enterprises where different teams are responsible for different geographic or logical segments of the network. It is more effective than "View Limitations" (Option D) because an account limitation follows the user across the entire platform, including search results, alerts, and reports, whereas a view limitation only affects a specific dashboard page. Options B and C are unlikely because they would typically affect multiple users or indicate a major monitoring gap rather than a user-specific visibility issue.

The ability to create and manageIntelligent Mapsin the SolarWinds Platform is tied to a specific set of granular user permissions. While a user may have general rights to view the console, creating a map involves placing entities onto a canvas and, frequently, utilizing background images or custom icons. According to theSolarWinds Platform documentation on Map Management, a critical prerequisite for full map creation functionality is thepermission to add images (D).

In the user account settings underSettings > All Settings > Manage Accounts, there is a specific toggle for "Allow Map Management" or "Allow Editing." However, if the underlying platform permission for "Add Images" is not enabled, the user will find the map creation wizard restricted or non-functional. This is because Intelligent Maps rely on the platform's shared image library to store the metadata and visual components of the map. Without the right to write to this library (Add Images), the user is blocked from saving new map definitions to the database. This permission is often disabled by default for standard users to prevent the web server's storage from being filled with unauthorized or non-work-related image files.

SolarWindsIntelligent Mapsare highly interactive, but their functionality is strictly gated by user permissions. According to theSolarWinds Platform documentation on Map Management, if a user can see nodes but cannot see their real-time status (the colored status ring) or perform advanced functions like nesting one map inside another, it points to a lack ofMap Editing Rights.

Without "Map Edit" permissions, the user is essentially in a "restricted view" mode. They can see the physical entities that have been placed on a map, but the dynamic overlays—such as the status of the node or the ability to modify the hierarchy of the map—are disabled to prevent unauthorized changes to the global map configuration. To resolve this, a Platform Administrator must navigate toSettings > All Settings > Manage Accounts, edit the specific user account, and change the "Map Management" or "Allow Map Editing" permission to "Yes". This grants the user the ability to interact with the map's metadata and organizational structure, including nesting and status visualization.

In the SolarWinds Platform, the "Node" acts as the primary parent object for all other monitored elements related to that IP address or hostname. According to theSolarWinds Platform Node Managementguide, the deletion process follows a strict parent-child relationship hierarchy.

When an administrator selects a node and chooses to delete it, thenode and all its associated objects are immediately removed (B)from the active monitoring database. Associated objects include interfaces, volumes, hardware health sensors, and application monitors (such as those assigned via SAM). This is an irreversible action. Unlike "Unmanaging" or "Muting," which keep the node record intact, "Delete" purges the entity and its historical data pointers from the current view.

It is important to understand that while the records are removed from the web console immediately, the actual data rows in the SQL database may be marked for deletion and cleared during the next scheduled "Database Maintenance" (Option C). However, from the perspective of the user and the monitoring engine, theresultis immediate: the node stops being polled, its alerts are cancelled, and it no longer appears in any dashboards or reports. The platform does not allow "orphaned" objects; you cannot have a monitored interface in the database if its parent node has been deleted (Option D).

Anomaly-Based Alertingis a premier feature of Hybrid Cloud Observability that moves beyond static thresholds to identify performance deviations based on historical behavior. According to theSolarWinds HCO Administrator Guide, this feature relies on cloud-assisted analytics to process complex datasets. To enable this, two specific components are required:

Advanced Machine-Learning Feature: This is the functional logic within the HCO platform that identifies patterns and establishes "normal" baselines for metrics like CPU load or interface utilization.

Platform Connect: This is the essential bridge that links the self-hosted HCO instance to the SolarWinds cloud-based AIOps engine. Because anomaly detection requires significant computational power to analyze long-term historical trends, the heavy processing is often offloaded. Platform Connect ensures that the necessary metadata can be analyzed securely to generate the dynamic thresholds used for these alerts.

WithoutPlatform Connect, the local server cannot access the machine-learning models required to calculate what constitutes an "anomaly" versus standard operational variance. This architecture allows HCO to provide high-level AIOps capabilities without requiring massive localized hardware for every installation.

In Hybrid Cloud Observability (HCO), specifically within theAlertStackfeature, related alerts are grouped into clusters to reduce "alert fatigue" and provide a unified view of an incident. According to theSolarWinds HCO Alerting Guide, an alert cluster transitions through several states based on the status of the underlying trigger conditions.

When the primary issues that triggered the alerts within the cluster are addressed and the "Reset Conditions" for those alerts are satisfied, the cluster is automatically managed by the system. The term used to define a cluster that has met its end conditions isauto-closed. Unlike manual "acknowledgment" or "resolution," which are user-driven actions, "auto-closed" signifies that the platform's monitoring engine has verified the environment has returned to a healthy state and the cluster no longer requires active monitoring or intervention. This automated lifecycle management is central to the AIOps and machine-learning capabilities of the platform, ensuring that the dashboard only reflects currently active, actionable incidents rather than historical events that have already been naturally corrected.

Modern Dashboardsrepresent a significant evolution over the legacy "Classic" summary views in the SolarWinds Platform. According to theSolarWinds Platform Administrator Guide, there are several architectural differences designed to improve performance and flexibility.

Define visible data using SWQL (D): Unlike classic dashboards that rely on a fixed "Data Selection" wizard or pre-built resources, modern dashboards allow administrators tohand-edit SWQL (SolarWinds Query Language) queriesdirectly within the widget configuration. This provides near-infinite flexibility to filter and display data in ways that were previously impossible without custom coding.

Configure refresh rates (C): Classic dashboards typically rely on the global web console refresh interval (often 5 minutes) or a full page reload. Modern dashboards introduce the ability toset individual refresh intervalsfor each widget (from 1 second to 24 hours), or configure a "Modern Widget Refresh" default for the entire dashboard. This ensures that critical real-time data is updated more frequently than static inventory data on the same page.

While "NOC mode" (Option B) and "Account Limitations" (Option A) are compatible with the broader SolarWinds environment, they are standard platform features that have existed in classic views for years and are not "unique" new settings specific only to the modern dashboarding engine.