SolarWinds SCP-NPM - SolarWinds Network Performance Monitor (NPM) Exam

Network Discovery is a feature of SolarWinds NPM that allows you to automatically discover and add network devices to the Orion Platform for monitoring. You can use Network Discovery to query Domain Controllers in your company domain and then select the Organizational Units (OUs) with the registered devices you want to scan. This way, you can add entities from NPM to monitor for all registered devices in your company domain in a single discovery. The other options are not as efficient or accurate as Network Discovery, as they either require manual addition of each device, or rely on the Domain Controllers to provide the list of registered devices, which may not be up-to-date or complete. References:

Discover your network devices and add them to the Orion Platform

Discover devices on your network using Active Directory

NPM polls static properties, such as interface speed and duplex mode, from the firewall devices using SNMP. NPM also collects traffic statistics, such as bytes in and bytes out, from the firewall interfaces using SNMP or NetFlow. NPM then calculates bandwidth consumption based on the total amount of bytes coming through the firewall over a given time interval. Bandwidth consumption is expressed as a percentage of the interface speed. For example, if a firewall interface has a speed of 100 Mbps and NPM polls 10 MB of bytes in and 10 MB of bytes out in one minute, the bandwidth consumption is 20% [(10 MB + 10 MB) / 100 Mbps * 100%]1. References: Monitor firewalls with NPM, Calculate bandwidth utilization on an interface

 The Universal Device Poller (UnDP) is a feature that allows users to create custom monitors for almost any statistic provided by SNMP based on its Management Information Base (MIB) and object identifier (OID). However, sometimes the OID that the user wants to monitor may not be available in the MIB tree, either because it is not supported by the device or because the MIB database is outdated. In this case, the user needs to update the MIB database to get the latest MIBs from the SolarWinds website or from the device vendor. This will ensure that the UnDP canfind the OID in the MIB tree and poll it successfully12. References: 1: Update the SolarWinds MIB Database for the SolarWinds Platform3, 2: Monitor custom statistics based on OIDs with Universal Device Pollers in the SolarWinds Platformhttps://documentation.solarwinds.com/en/success_center/orionplatform/content/core-downloading-the-solarwinds-mib-database-sw3581.htm

According to the SolarWinds NPM Administrator Guide, you can assign different permissions to user accounts to control their access and actions in the Orion Platform. One of the permissions is “Allow Account to Clear Events and Acknowledge Alerts and Syslogs”, which enables the userto acknowledge alerts, clear events, and mark syslogs as read. This permission is required for a user to be able to acknowledge alerts, as acknowledging an alert stops the escalation process and provides an audit trail. The other permissions listed are not related to alert acknowledgment. “Allow Account to Unmanage Objects” allows the user to temporarily stop monitoring selected network objects. “Allow Node Management Rights” allows the user to add, edit, and delete nodes and interfaces. “Allow Administrator Rights” grants the user full access to all Orion Platform features and settings. References: SolarWinds NPM Administrator Guide, page 69-70; Add or remove an alert acknowledgment.

High Traffic Utilization alerts are triggered when the interface’s received or transmitted percent utilization exceeds a specified threshold. However, this may not reflect the actual network congestion, as traffic spikes can occur momentarily and then subside. To avoid false alerts, you can configure the alert to trigger only when the traffic utilization remains high for a sustained period, such as 5 minutes or more. This way, you can filter out the transient traffic peaks and focus on the persistent issues that affect the network performance. References:

How do I create a high transmit percent utilization alert to monitor interface bandwidth

Trouble with High receive percent utilization alert

How alerts work

 SNMP traps are unsolicited messages sent by network devices to report events or issues. If NPM receives too many traps from devices that are not managed by NPM, or traps that are not relevant for monitoring, the performance of the Orion Web Console can be affected. To resolve this issue, you can point the devices to a trap manager, such as Kiwi Syslog Server, and configure it to filter out unwanted traps before forwarding the remaining ones to the Orion Platform. This way, NPM will only process the traps that are important for monitoring and alerting, and reduce the load on the database and web server. References: Configure SNMP traps in NPM, Filter traps in Kiwi Syslog Server, [Forward traps to another host in Kiwi Syslog Server]

 If you do not want to be notified when an interface is down, you can specify that the interface is unpluggable. The interface status is not reflected in the status of the parent node and in alerts. On the Node Management view, select the interface, and click Edit Properties. Select Display Interface as Unplugged Rather Than Down, and click Submit. The interface status does not influence the status of the parent node1. References:

Suspend collecting data for interfaces in NPM - SolarWinds (see the Set the interface status as Unpluggable section)

https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-configuring-trap-viewer-filters-and-alerts-sw272.htm https://documentation.solarwinds.com/en/success_center/orionplatform/content/lm/la-orion-log-viewer.htm

https://support.solarwinds.com/SuccessCenter/s/article/VMAN-and-IVIM-feature-comparison?language=en_US