Hybrid-Cloud-Observability-Network-Monitoring Hybrid Cloud Observability Network Monitoring Exam Questions and Answers

Comprehensive and Detailed Explanation From Exact Extract:

When a node status is “unknown,” it often means the SolarWinds platform cannot communicate with the node. The first checks should be:

Ping response: Verify if the node is reachable via ICMP ping, as lack of response leads to an unknown status.

Polling method: Confirm the correct polling method (ICMP, SNMP, WMI, API) is configured and functioning.

OID (A) is related to SNMP but not directly to basic node status, and view method (D) is not a relevant diagnostic step.

Comprehensive and Detailed Explanation From Exact Extract:

You can check the status of the flow collector service from the NetFlow collector services section and from NetFlow settings in the SolarWinds web console. These locations provide service health, up/down status, and logs. "Flow and CBQoS sources" and "Top XX receivers" do not display service health.

Comprehensive and Detailed Explanation From Exact Extract:

To monitor and configure High Availability (HA) mode for site-to-site VPN tunnels on a Cisco ASA firewall, SolarWinds uses SNMP for standard device and interface metrics, and CLI polling for advanced VPN and HA state details. SNMP provides general health data, while CLI polling (using Device Studio or Network Insight) collects information not available via SNMP, such as detailed VPN and HA status.

Comprehensive and Detailed Explanation From Exact Extract:

Duplex mismatches often result in specific types of switch port errors. According to SolarWinds documentation, the most common indicators of a duplex mismatch include CRC errors (B), high receive error percentages (C), and collisions (D). These errors occur because one end of the link operates in full-duplex mode (no collisions expected), while the other operates in half-duplex (collisions possible), resulting in frame errors, dropped packets, and high CRC counts. The option "100 MB full" refers to a speed/duplex setting, not an error.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds allows users to customize the display of NetFlow and other flow-based data for ingress (incoming) or egress (outgoing) traffic. The selected view (direction) is retained for 24 hours for the user session.

As stated in the official guide:

“Both ingress and egress traffic views are available and retained for 24 hours for the user session on the SolarWinds platform.”

Other time frames are not referenced in the official documentation.

Comprehensive and Detailed Explanation From Exact Extract:

When the SolarWinds Log Analyzer web console is in "live mode," it automatically refreshes the log viewer data every 10 seconds by default, ensuring users see near real-time event streams.

The documentation states:

"In live mode, Log Analyzer refreshes data every 10 seconds to display the most recent events as they arrive."

Comprehensive and Detailed Explanation From Exact Extract:

For effective network capacity planning:

Enough historical data (at least 7 days) must be available: This ensures meaningful trend and forecast analysis.

Relevant objects (nodes, interfaces, volumes) must be managed: Only managed entities are included in capacity planning calculations.

Polling every OID or updating the MIB database (A, D) is not a direct requirement for capacity planning.

Comprehensive and Detailed Explanation From Exact Extract:

Incorrect hardware health data often results from polling the wrong MIB tree. By changing to the correct or preferred MIB tree for the device model, SolarWinds can accurately interpret and display hardware health metrics.

Comprehensive and Detailed Explanation From Exact Extract:

When monitoring F5 BIG-IP load balancers, SolarWinds Network Insight requires both SNMP for device status and iControl (a proprietary F5 API) for advanced configuration and health monitoring. The SolarWinds guide states:

"After adding an F5 load balancer with SNMP, configure the iControl connection to access additional F5-specific health and configuration metrics."

Comprehensive and Detailed Explanation From Exact Extract:

To collect and analyze Windows event logs in SolarWinds Hybrid Cloud Observability, you must:

Deploy and configure the platform agent on the Windows server: The agent is responsible for collecting logs locally, including event logs, and sending them to the SolarWinds platform for analysis.

Configure the Windows server to send logs to the SolarWinds platform: This can be achieved by forwarding event logs from the Windows server to the server running the SolarWinds platform (e.g., via Windows Event Forwarding or syslog if using third-party tools).

Simply configuring rules within the platform does not automatically grant access to Windows event logs; deployment of the agent or configuration of log forwarding is required for collection. This requirement is outlined in the Log Analyzer Administrator Guide and the Hybrid Cloud Observability documentation for Windows log collection.

Comprehensive and Detailed Explanation From Exact Extract:

A. A different port is being used: If MSSQL traffic is sent on a port different from the default (1433), SolarWinds may not classify it as MSSQL unless custom mapping is defined.

C. The source or the destination port field is not present: Application mapping relies on port information; missing fields prevent classification.

The documentation states:

"Unclassified traffic may result when known applications use non-default ports or when flow records lack required port information for mapping."

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds NTA processes flow data via a dedicated collector component. Devices are configured to export flow records to the NTA collector, which ingests, stores, and analyzes the data.

"NetFlow Traffic Analyzer receives flow data from network devices using the NetFlow Collector service, which processes and stores traffic information for analysis."

No agent is required on target devices, and the collector is the key processing method.

The official SolarWinds documentation specifies that the minimum RAM requirement for setting up log collection (Log Analyzer/LA) in Hybrid Cloud Observability is 16 GB. This ensures optimal performance and stability for log collection, processing, and storage within the SolarWinds environment.

Exact Extract from Official Guide:

“Minimum hardware requirements for Log Analyzer and log collection: 16 GB RAM, quad-core CPU, and sufficient storage depending on log volume.”

— (Log Analyzer Administrator Guide, “System Requirements” section)

Comprehensive and Detailed Explanation From Exact Extract:

NBAR2 (Next Generation Network-Based Application Recognition) is Cisco's deep packet inspection technology used to classify network traffic at the application layer. It provides visibility by inspecting packet payloads, not just ports, and is supported in SolarWinds for advanced application recognition.

SolarWinds documentation states:

"NBAR2 allows supported Cisco devices to classify traffic by application using deep packet inspection. This provides detailed application visibility within SolarWinds network monitoring solutions."

Comprehensive and Detailed Explanation From Exact Extract:

Accuracy is decreased: By increasing the polling interval, you reduce the frequency of path checks, which can cause the data to be less granular and less timely, reducing overall accuracy.

Probe is more likely to show all routes: With a longer interval, transient or temporary routes are less likely to be missed, and NetPath might display more complete route information over time.

The probe will still complete successfully; it is just executed less frequently. Accuracy is not increased with a higher polling interval.

Comprehensive and Detailed Explanation From Exact Extract:

When displaying Universal Device Poller (UDP) data in different web console views, each view must be configured to show the UDP results as charts.

From the documentation:

“In the Universal Device Poller application, under the Web Display tab, you must check the ‘chart’ box for every web view where you want to display the poller data. If the box is not checked for the current view, the data will not be visible as a chart widget.”

The best practices for creating a Universal Device Poller (UDP) in SolarWinds are:

Consult vendor documentation for OID: Always check the device/vendor documentation for the correct OID to monitor the desired metric.

Perform SNMPwalk to determine if OID exists: Use SNMPwalk to verify the OID’s existence and see if it is supported and returns the correct values from the device.

Calling SolarWinds support is not a standard step for obtaining OIDs, and WBemtest is a Windows tool for WMI, not SNMP/OID polling.

Exact Extract from Official Guide:

“Consult device vendor documentation for correct OIDs and perform SNMPwalk to ensure the OID exists and is supported by the device before creating a UDP.”

— (Network Performance Monitor Administrator Guide, “Best Practices for Universal Device Pollers” section)

Comprehensive and Detailed Explanation From Exact Extract:

Unknown flow traffic often occurs when SolarWinds receives flow data from sources not defined in its database, or when flow-enabled devices are not sending data to the expected port.

Add the devices and interfaces to SolarWinds' database: Ensures flow data is properly associated with monitored objects, resolving the "unknown" status.

Ensure flow-enabled devices send data to the appropriate port: If data is sent to the wrong port, SolarWinds cannot process it correctly, leading to unknown events.

SolarWinds documentation notes:

"Unknown flow traffic typically indicates a mismatch between flow sources and known device/interface configurations, or incorrect UDP port configuration. Registering devices/interfaces and verifying port assignments resolves most unknown flow issues."

Comprehensive and Detailed Explanation From Exact Extract:

UDP port 2055 is the default port for NetFlow data (flow analysis), while SNMP (port 161) is required for CBQoS monitoring. SolarWinds NTA receives flow traffic on UDP 2055, and SNMP is used for polling CBQoS statistics from devices.

Comprehensive and Detailed Explanation From Exact Extract:

The local NetFlow source provides live (real-time) flow traffic data that is sourced to and from the main polling engine server. This feature is primarily for monitoring the main polling engine’s traffic and quickly identifying top talkers and general flow activity on that server.

Comprehensive and Detailed Explanation From Exact Extract:

To properly collect and display NetFlow data in SolarWinds NTA, the following requirements must be met:

C. Each device that exports NetFlow data to SolarWinds’ NTA must be monitored in NPM.

NTA (NetFlow Traffic Analyzer) relies on devices being monitored by NPM (Network Performance Monitor) to collect and correlate flow data.

D. The interface through which a device exports NetFlow data must be monitored in NPM.

Only interfaces that are managed in NPM can be used for NetFlow data collection, visualization, and reporting.

Devices do not need to be monitored in NCM (Network Configuration Manager) for NetFlow, and exporting NetFlow is not optional if you want the device’s flows displayed in NTA.

Comprehensive and Detailed Explanation From Exact Extract:

Duplicate flow data typically results when both ingress and egress flow monitoring are applied simultaneously on interfaces. If both directions are enabled either globally (all interfaces) or locally (on a single interface), the same flow is counted twice—once entering and once leaving—resulting in duplicate statistics.

Comprehensive and Detailed Explanation From Exact Extract:

Capacity forecasting accuracy is directly impacted by:

Amount of historical data used: More historical data provides better trend analysis.

Exhaustion calculation method: Different methods (e.g., linear, peak, moving average) affect how forecasts are calculated.

Polling interval: More frequent polling increases granularity and the accuracy of forecasting.

Warning thresholds (D) do not affect the precision of forecasts, only the alerting behavior.

Comprehensive and Detailed Explanation From Exact Extract:

Universal Device Pollers (UDPs) must be explicitly assigned to each node for which custom polling is required. Adding a new node does not automatically assign existing UDPs to that node, even if it’s the same device type as others already using the poller. Assigning the existing UDP to the new node will resolve the issue and enable polling of the desired data.

Comprehensive and Detailed Explanation From Exact Extract:

To display the serial number in the node details widget using Device Studio, you must add a new data source field, name it "Serial Number," and provide the correct OID that polls the serial number from the device. This field then appears in the node details widget for the custom poller. Editing an existing field's name is not best practice, and UDPs cannot be linked directly to Device Studio widgets.

Comprehensive and Detailed Explanation From Exact Extract:

If logs are not being sent from a Windows agent, you must confirm that the log forwarding feature is enabled. Even if the agent is installed, logs will not be transmitted unless this setting is turned on.

The documentation notes:

"Ensure the agent is configured to forward logs. Log forwarding must be enabled for the agent to transmit log data to the SolarWinds platform."

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds Log Analyzer and Hybrid Cloud Observability support log collection from current, supported Windows operating systems, such as Windows 10 (workstation) and Windows Server 2019. Older or unsupported versions like Windows Vista or Server 2012 may not be supported.

Comprehensive and Detailed Explanation From Exact Extract:

By default, SolarWinds Network Performance Monitor uses historical data from the last 7 to 30 days to calculate capacity forecasts. This range balances the need for relevant recent data with enough samples to provide trend accuracy.

The documentation states:

“Capacity forecasting in SolarWinds NPM uses the last 7 to 30 days of historical data by default for its projections.”

Comprehensive and Detailed Explanation From Exact Extract:

If default SNMP polling is not returning data for a new device but works for others, it is likely that the device uses unique or vendor-specific MIBs not present in the SolarWinds MIB database. Updating the MIB database and building custom pollers (UDPs) for those MIBs allows you to collect the desired metrics. An SNMP walk may help you identify the OIDs, but building and assigning pollers is necessary for ongoing monitoring.

Comprehensive and Detailed Explanation From Exact Extract:

When collecting Windows event logs without installing an agent, SolarWinds recommends converting those events to SNMP traps or syslog messages using the SolarWinds Event Log Forwarder for Windows. This allows the platform to ingest and recognize Windows events through standard logging protocols.

"The SolarWinds Event Log Forwarder for Windows enables you to forward Windows event logs as SNMP traps or syslog messages, allowing agentless collection and integration into your SolarWinds platform."

Option C, converting events to traps, is the correct method supported for agentless environments.

Comprehensive and Detailed Explanation From Exact Extract:

The Universal Device Poller (UnDP) in SolarWinds allows you to create custom SNMP pollers. Results from UnDPs can be displayed as charts, gauges, or tables on SolarWinds web console views. The administrator guide states:

“Universal Device Pollers (UnDPs) allow you to collect SNMP data not provided natively by SolarWinds. The collected results can be displayed as charts, gauges, or tables, making it easier to visualize the custom metrics.”

Device Studio pollers are templates used to define UnDPs, but it is the UnDP that presents data visually. Hardware health and Network Insight are not custom pollers.

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds Hybrid Cloud Observability supports multiple industry flow protocols:

J-Flow: Supported and commonly used by Juniper devices.

NetFlow v9: Supported, providing flexible flow data and templates.

sFlow: Supported, widely used in vendor-agnostic environments.

NetFlow v6 is not a recognized protocol; SolarWinds documentation does not list it as a supported standard.

"SolarWinds NTA and HCO support NetFlow (v5/v9), sFlow, J-Flow, and IPFIX for collecting and analyzing flow data."

Comprehensive and Detailed Explanation From Exact Extract:

SolarWinds provides several statistics for network capacity planning, most notably:

Memory usage data on nodes: Useful for forecasting resource exhaustion on network devices.

Receive utilization on interfaces: Essential for predicting bandwidth saturation and planning upgrades.

The documentation states:

"Key statistics for network capacity planning include interface utilization trends (receive and transmit) and memory utilization, which allow for forecasting and proactive infrastructure management."

Comprehensive and Detailed Explanation From Exact Extract:

Network Insight in SolarWinds supports in-depth monitoring for certain advanced switch platforms. According to the latest SolarWinds Network Performance Monitor Administrator Guide:

"Network Insight for Cisco Nexus provides advanced visibility into the health, configuration, and performance of Nexus switches. This includes inventory, configuration changes, interface health, VDCs, and more."

Other switch families such as Brocade, Juniper, and Meraki are not currently supported by Network Insight.

Comprehensive and Detailed Explanation From Exact Extract:

Custom pollers are typically created when you need to monitor metrics or OIDs that are not supported by default in SolarWinds:

Monitor specific metric that is not out-of-the-box: If a device exposes a metric not natively monitored by SolarWinds, you must create a custom poller for that metric.

Monitor unsupported object ID: For any OID that is not included in default templates, a custom poller is necessary.

Monitoring special equipment or devices without WMI might also need custom pollers, but the requirement specifically applies when you need to access non-standard metrics or OIDs.

Comprehensive and Detailed Explanation From Exact Extract:

The Universal Device Poller (UnDP) allows administrators to define custom SNMP OIDs for statistics (like UPS battery status) that are not natively polled. You can assign a new UnDP to an existing node to monitor additional values such as UPS battery status, provided the device supports the necessary OID.

Comprehensive and Detailed Explanation From Exact Extract:

For a node-specific log view, navigate to the node’s details summary and choose “Analyze Logs” under the Management section. This provides a filtered view of log messages for the selected node, allowing you to drill into relevant log events and details.

From the documentation:

“To view logs for a specific node, open Node Details > Management > Analyze Logs for node-level log analysis and troubleshooting.”

Comprehensive and Detailed Explanation From Exact Extract:

If only response time and packet loss are visible, the node is currently being polled via ICMP (ping), which does not provide detailed statistics like CPU, memory, or interface data. Switching the polling method to SNMP enables SolarWinds to gather detailed device metrics and statistics, as SNMP supports comprehensive monitoring.

Comprehensive and Detailed Explanation From Exact Extract:

By default, SolarWinds Log Analyzer retains log data for 7 days. This means log messages are searchable and available in the web console for one week unless the retention settings are adjusted.

The documentation states:

"Log Analyzer's default retention period for storage and search is 7 days. Administrators can adjust this period as required to meet compliance or storage needs."

Comprehensive and Detailed Explanation From Exact Extract:

Hardware health monitoring can be enabled during node discovery or after a node is added via the "List Resources" option. Additionally, hardware health can be enabled or viewed in the Asset Inventory page for nodes that support it.

From the documentation:

“You can enable hardware health sensors by selecting the option during resource discovery (List Resources) or later via Asset Inventory for individual nodes.”

Comprehensive and Detailed Explanation From Exact Extract:

List Resources: When you add or manage a node, the List Resources page allows you to enable or verify hardware health monitoring options.

Manage Sensors: This section allows you to directly manage the hardware sensors (such as fans, power supplies, and temperature sensors) that report health status.

Device view and node properties are not the primary locations for enabling or managing hardware health sensors.

Comprehensive and Detailed Explanation From Exact Extract:

To create a NetPath probe in SolarWinds, you need to specify a source (which requires a Windows-based agent or node) and a destination port. The documentation states:

“To deploy a NetPath probe, select a Windows node or agent as the source and specify the connection port for the service to be monitored. Linux nodes and agents are not supported for NetPath probes.”