Solarwinds Npm

---
name: solarwinds-npm
description: "Expert coverage of SolarWinds Network Performance Monitor on the Orion platform: SNMP/WMI/ICMP polling, Orion architecture, polling engines, NetPath, PerfStack, NTA flow analysis, NCM config management, custom alerts, SWQL queries, and Orion SDK automation. Use for \"SolarWinds\", \"NPM\", \"Orion\", \"NetPath\", \"PerfStack\", \"SWQL\", \"NTA\", \"NCM\", \"SAM\", \"Orion SDK\", \"polling engine\". Do NOT use for cross-vendor comparison, platform selection, or category-wide architecture -- use the `network-monitoring` skill."
license: MIT
---

# SolarWinds NPM

This skill covers SolarWinds Network Performance Monitor (NPM) on the Orion platform, including all current versions through 2025.2. Areas of expertise include:

- Orion platform architecture (Web Console, SQL Server, polling engines)
- SNMP v1/v2c/v3 polling, WMI, ICMP monitoring
- Additional Polling Engines (APE) for distributed monitoring
- NetPath hop-by-hop path analysis
- PerfStack cross-domain performance correlation
- NTA (NetFlow Traffic Analyzer) for flow-based traffic analysis
- NCM (Network Configuration Manager) for config backup and compliance
- Custom alert engine with multi-condition logic
- SWQL (SolarWinds Query Language) for ad-hoc data queries
- Orion SDK (REST API) for automation and integration

## How to Approach Tasks

1. **Classify** the request:
   - **Troubleshooting** -- Identify specific NPM/Orion component, check polling status, alert configuration, node state
   - **Architecture** -- Load `references/architecture.md` for Orion internals, polling engine design, SQL schema
   - **Alerting** -- Multi-condition alert design, notification channels, escalation
   - **Reporting** -- PerfStack, custom reports, SWQL queries
   - **Automation** -- Orion SDK, REST API, SWQL

2. **Identify NPM version** -- Feature availability varies by version (2025.2 adds thin AP management, L2/L3 topology widgets, Aruba Central API).

3. **Load context** -- Read the reference file for deep knowledge.

4. **Analyze** -- Apply SolarWinds-specific reasoning. Understand the Orion module model (NPM, NTA, NCM, SAM are separate licenses on one platform).

5. **Recommend** -- Provide guidance with Web Console paths, SWQL queries, or SDK examples.

## Orion Platform Architecture

### Components
- **Orion Web Console** -- IIS-hosted HTTPS web application; role-based access control (RBAC)
- **SQL Server Backend** -- Microsoft SQL Server stores all configuration, polling data, events. Supports SQL Always On AG for HA.
- **Main Polling Engine** -- Primary service on the Orion Server; collects data from monitored nodes
- **Additional Polling Engines (APE)** -- Scale-out pollers for large environments or remote sites; communicate back to main Orion via HTTPS
- **Agent** -- Optional lightweight agent for Windows/Linux systems (WMI alternative, script execution, process monitoring)
- **Orion SDK** -- .NET/REST SDK for custom integrations

### Module Ecosystem
| Module | Function |
|---|---|
| NPM | Core device/interface monitoring; bandwidth, availability, latency |
| NCM | Configuration backup, compliance checking, change detection |
| NTA | Flow-based traffic analysis (NetFlow/IPFIX/J-Flow/sFlow) |
| SAM | Application and server monitoring (process, service, URL, script) |
| IPAM | IP address tracking, DHCP/DNS integration, subnet management |
| UDT | User Device Tracker (switch port mapping) |

### Polling Methods
- **SNMP v1/v2c/v3** -- Primary device polling; configurable interval (60s default); bulk OID walks
- **WMI** -- Windows monitoring (CPU, memory, processes, events) without agent
- **ICMP** -- Availability and response time (ping-based)
- **API** -- REST API integration for cloud-managed infrastructure (Aruba Central, Meraki)
- **Syslog** -- Inbound message collection and alerting
- **SNMP Trap** -- Trap collection; triggers alerts and logs

## NPM 2025.2 Features

- **Thin AP Management** -- Discover and manage individual thin APs as separate SNMP nodes (previously WLC-level only)
- **L2/L3 Metrics** -- IP assignment, STP topology, VLAN config, ARP mapping across multi-vendor switches
- **Interactive Topology Widgets** -- VLAN membership maps, STP root/blocked port visualization, MAC address drill-down
- **Aruba Central API** -- Monitor Aruba Central-managed switches and APs via API

## NetPath

Hop-by-hop TCP path analysis:

- Discovers and visualizes network path between probe and destination
- Works for TCP services (HTTP, HTTPS, custom TCP port)
- Detects path changes, latency anomalies, routing shifts over time
- Works across internet paths (not limited to internal network)
- Requires NetPath probe (agent or NPM server)
- Historical path data for trend analysis and correlation

## PerfStack

Cross-domain performance correlation dashboard:

- Drag-and-drop metrics from NPM, NTA, SAM, APM onto shared timeline
- Visually correlate network events with application performance
- Time-synchronized across all metric sources
- Save and share PerfStack layouts as reusable views
- Essential for cross-team troubleshooting (network + application + server)

## Alerting

### Alert Engine
- **Condition types**: Threshold, baseline deviation, state change, complex condition
- **Multi-condition**: AND/OR logic combining multiple metrics and states
- **Dampening**: Require condition to persist for N polling intervals (prevents flapping alerts)
- **Reset conditions**: Define when alert clears (automatic or manual)
- **Scope**: Per-node, per-group, per-custom-property

### Notification Methods
- Email, SMS, Slack, Microsoft Teams, PagerDuty, OpsGenie
- Webhook (generic HTTP POST)
- Script execution (PowerShell, Python)
- SNMP trap forwarding
- Log to Orion event log

### Alert Best Practices
- Use multi-condition alerts to reduce noise (e.g., interface down AND parent node up = real issue; parent down = expected)
- Leverage custom properties for alert routing (site, team, priority)
- Set appropriate dampening (2-3 polling cycles minimum)
- Create escalation alerts (if not acknowledged in 30 min, notify manager)
- Review zero-trigger alerts quarterly; disable or tune

## SWQL (SolarWinds Query Language)

SQL-like query language for all Orion data:

```sql
-- Top 10 interfaces by utilization
SELECT TOP 10 n.Caption, i.Caption, i.InPercentUtil, i.OutPercentUtil
FROM Orion.NPM.Interfaces i
JOIN Orion.Nodes n ON i.NodeID = n.NodeID
WHERE i.InPercentUtil > 50
ORDER BY i.InPercentUtil DESC

-- Nodes with high CPU
SELECT Caption, CPULoad, PercentMemoryUsed
FROM Orion.Nodes
WHERE CPULoad > 80
ORDER BY CPULoad DESC

-- Recent alerts
SELECT AlertName, ObjectName, TriggeredDateTime, Severity
FROM Orion.AlertStatus
WHERE TriggeredDateTime > ADDDAY(-1, GETUTCDATE())
ORDER BY TriggeredDateTime DESC

-- Custom property filter
SELECT Caption, IP_Address, CustomProperties.Site
FROM Orion.Nodes
WHERE CustomProperties.Site = 'New York'
```

### SWQL Access
- **SWQL Studio** -- Desktop application for interactive queries (part of Orion SDK)
- **REST API** -- `GET /SolarWinds/InformationService/v3/Json/Query?query=<SWQL>`
- **Web Console** -- Custom report builder uses SWQL under the hood

## Orion SDK / REST API

### Authentication
- Windows authentication or Orion account credentials
- Base URL: `https://<orion-server>:17778/SolarWinds/InformationService/v3/Json/`

### Common Operations
```
# Query
GET /Query?query=SELECT+Caption,+IP_Address+FROM+Orion.Nodes

# Add node
POST /Create/Orion.Nodes
Body: {"Caption": "switch01", "IPAddress": "10.1.1.1", ...}

# Update node
POST /Orion.Nodes/NodeID=123/CustomProperties
Body: {"Site": "New York"}

# Invoke action (unmanage node)
POST /Invoke/Orion.Nodes/Unmanage
Body: ["N:123", "2026-04-08T12:00:00", "2026-04-08T14:00:00", false]
```

### Use Cases
- Automated node onboarding from CMDB
- Custom dashboards pulling Orion data
- Alert-triggered automation (auto-remediation scripts)
- ITSM integration (create ServiceNow tickets from alerts)

## Capacity Planning

### Polling Engine Sizing
- Single polling engine: ~500-1,200 nodes with standard polling
- Additional Polling Engines for: >1,200 nodes, remote sites, WAN-separated networks
- SQL Server: size based on data retention and module count
- Disk I/O is the most common bottleneck (SQL writes during polling)

### Data Retention
- Default: 365 days detailed, hourly/daily summaries retained longer
- Adjust per module in Settings > All Settings > Database Settings
- Larger retention = larger SQL database = more disk/memory

## Common Pitfalls

1. **SQL Server undersized** -- NPM is SQL-intensive. Underpowered SQL causes slow Web Console, delayed alerts, and polling failures. Size SQL Server generously (SSD storage, adequate RAM).

2. **SNMP v2c in production** -- Community strings are cleartext. Use SNMPv3 with authPriv for production environments.

3. **Too many custom pollers** -- Each custom SNMP poller adds load. Consolidate OIDs into bulk polls where possible.

4. **Alert noise from flapping** -- Interfaces that flap generate rapid alerts. Add dampening (minimum 3 polling cycles) and deduplication.

5. **NetPath agent placement** -- NetPath measures path from the probe location. Place agents at the source of user traffic, not at the data center.

6. **Module licensing confusion** -- NPM, NTA, NCM, SAM are separate licenses. NTA requires flow-exporting devices. NCM requires SSH/Telnet access to devices.

7. **Ignoring PerfStack** -- PerfStack is the most powerful Orion feature for cross-domain troubleshooting. Train teams to use it.

## Reference Files

Load these when you need deep knowledge:

- `references/architecture.md` -- Orion platform, polling engines, modules, NetPath, PerfStack, SQL schema. Read for "how does X work" questions.