Observability-Self-Hosted-Fundamentals SolarWinds Observability Self-Hosted Fundamentals Questions and Answers

AppStackrelies on the relationship data collected by theVirtualization Manager (VMAN)andServer & Application Monitor (SAM)modules. For an ESX host and its virtual machines (VMs) to appear and be correctly mapped in the stack, the platform must be able to "walk" the relationship from the hypervisor down to the guest OS.

The most common cause for missing virtualization data in AppStack is anincorrect polling method. To show the relationship between a physical host and its VMs, the node must be added to SolarWinds using the"Poll for VMware"or"Poll for Hyper-V"options. If the ESX host was added as a standard ICMP (Ping) or SNMP node without specifically enabling the virtualization polling credentials (linking it to the vCenter or the host's direct management API), the platform will see the host as a standalone server. Consequently, it will fail to discover the "parent-child" relationship between the host and its virtual machines. Without this verified architectural link in the database, AppStack cannot "build" the visual stack, leaving those entities out of the environment view.

When a new user account is created in the SolarWinds Platform, it is assigned a set of "Default" permissions designed to provide a "Read-Only" baseline of visibility. According to theSolarWinds Platform User Account Managementguide, the platform is configured to ensure that new users can immediately benefit from the monitoring data without having the power to accidentally modify the environment.

Specifically,view all active alerts (C)andview all existing reports (D)are enabled by default. This ensures that any team member with a login can see the current health of the infrastructure and access historical performance data. These are considered "Passive" rights that allow for operational awareness. Conversely,disable session time out (A)is a security-sensitive setting that is typically disabled by default to prevent abandoned sessions from remaining active on public or shared workstations.Self-manage dashboards (B), while a common feature, often requires explicit "Dashboards" or "View" management permissions to be toggled on by an administrator to prevent a proliferation of unmanaged or redundant dashboard pages within the database. By defaulting to alert and report visibility, SolarWinds follows the principle of providing immediate information for troubleshooting while reserving management and security-override functions for designated administrators.

Custom properties can be configured as "Mandatory" to ensure data integrity across the platform. According to theSolarWinds Platform Administrator Guide, changing a property like AssetTag to mandatory after nodes already exist creates an enforcement requirement.

The system does not retroactively block polling or delete nodes (Option B and D are incorrect), but it enforces the requirement during administrative interaction. Specifically:

Requirement after the action (A): Moving forward, any new node added to the system will require the AssetTag field to be populated before the node can be saved.

Requirement when edited (C): For existing nodes that do not yet have an AssetTag, the platform will permit them to exist and be polled normally. However, the next time an administrator attempts toeditthe properties of that node, the Web Console will block the "Save" action until a value is provided for the mandatory AssetTag field. This ensures that as the environment is managed over time, the metadata is gradually backfilled until all mandatory requirements are satisfied.

In Hybrid Cloud Observability (HCO), specifically within theAlertStackfeature, related alerts are grouped into clusters to reduce "alert fatigue" and provide a unified view of an incident. According to theSolarWinds HCO Alerting Guide, an alert cluster transitions through several states based on the status of the underlying trigger conditions.

When the primary issues that triggered the alerts within the cluster are addressed and the "Reset Conditions" for those alerts are satisfied, the cluster is automatically managed by the system. The term used to define a cluster that has met its end conditions isauto-closed. Unlike manual "acknowledgment" or "resolution," which are user-driven actions, "auto-closed" signifies that the platform's monitoring engine has verified the environment has returned to a healthy state and the cluster no longer requires active monitoring or intervention. This automated lifecycle management is central to the AIOps and machine-learning capabilities of the platform, ensuring that the dashboard only reflects currently active, actionable incidents rather than historical events that have already been naturally corrected.

In the SolarWinds Platform, "Administrator" rights in the Web Console grant extensive control over monitoring configurations, but they are distinct from "System Administrator" or "Security Administrator" roles. According to theSolarWinds Platform User Account Managementguide, a Web Console Administrator can manage nodes, create alerts , build reports , and customize dashboards.

However, for security reasons, the ability to managepasswords—specifically the credentials used for polling (SNMP strings, WMI service accounts, or external integration secrets)—is often restricted. While an admin canassignan existing credential to a node, the ability to add, edit, or view the clear-text/obfuscated passwords within the centralizedCredential Libraryis a separate, higher-level security permission. This prevents a standard Web Administrator from potentially harvesting sensitive service account passwords from the database. This "separation of duties" ensures that while a user can manage the monitoring environment, they cannot necessarily compromise the security of the underlying infrastructure accounts.

The SolarWinds Hybrid Cloud Observability (HCO) Platform is designed for maximum deployment flexibility to accommodate diverse enterprise security and infrastructure requirements. According to theSolarWinds Platform Installation and Upgrade Guide, the platform's architecture is fundamentally self-contained.

Operation without an internet connection (A): This is a critical requirement for many government, military, and high-security financial environments. The platform is capable of "air-gapped" operation, where all polling, data processing, and visualization occur within a private network. While features like "Platform Connect" (for cloud-based AI) may require a connection, the core monitoring, alerting, and reporting functions remain fully operational without any external internet access.

Deployment on-premises or in the cloud (B): HCO is truly hybrid. It can be installed on physical hardware or virtual machines within a local data center, or it can be deployed within a Virtual Private Cloud (VPC) on platforms like AWS or Azure. This allows organizations to maintain their monitoring infrastructure alongside their managed assets, regardless of where those assets reside.

While HCOprovidesAIOps and machine learning (Option C), this is a feature of specific licensing tiers and configuration states rather than a fundamental "platform" characteristic that defines its deployment capability in the same way its offline and hybrid nature does.

The "Add Node" wizard in the SolarWinds Platform is a multi-step process designed to fully integrate a new device into the monitoring ecosystem. According to theSolarWinds Platform Node Managementdocumentation, once the IP address and credentials (SNMP/WMI) are verified, the administrator is presented with several configuration panels.

Select Statistics and Resources (D): This is the critical step where the admin chooseswhatto monitor on the node. This includes selecting specific interfaces, volumes, or hardware health sensors. It also allows for the selection of the polling frequency for "Statistics" (how often to collect performance data) and "Status" (how often to check if the node is up).

Create/Assign Custom Properties (C): During the "Add Node" process, there is a dedicated tab for metadata. Here, the admin can fill in values for existing custom properties (such as Site, Owner, or Asset Tag). If a property does not exist, the wizard often provides a shortcut to the Custom Property manager tocreateor modify the fields so that the node is correctly categorized from the moment it is added to the database.

Device Studio Pollers(Option A) are typically assignedaftera node is added if the default pollers are insufficient.Rediscovery Interval(Option B) is a global setting or found deep in the advanced node properties, rather than a primary configuration step in the standard "Add Node" wizard.

The SolarWinds Agent is a versatile polling tool, but it must be compatible with the underlying Operating System (OS) to function correctly. According to theSolarWinds Platform Agent requirements, the agent software is designed to run on a wide variety of modern Windows and Linux distributions.

For the Windows ecosystem, the agent supports both server-grade and enterprise-grade workstation operating systems.Windows Server 2022 (D)is fully supported, allowing for deep monitoring of the latest Microsoft server environments, including support for AppInsight applications. Similarly,Windows 11 Enterprise (C)is a supported platform, which is particularly useful for monitoring high-end workstations, jump boxes, or remote endpoints that act as critical nodes in the network.

While SolarWinds does support various Linux distributions (such as RHEL, CentOS, and Ubuntu),Debian 11andFedora(Options A and B) are often not listed as "officially primary supported" in the same tier as the Windows or main enterprise Linux distributions in current HCO documentation. The Windows agent remains the most feature-complete version of the software, supporting a broader range of monitoring types (like Quality of Experience and deep application analysis) compared to its Linux counterparts. Therefore, for an HCO deployment focusing on the latest infrastructure, Windows Server 2022 and Windows 11 are the verified answers.

According to theSolarWinds Platformconfiguration documentation, the option toEncrypt connections with SSLduring the database configuration wizard specifically dictates the security level of the communication channel between the application server and the database backend. When this box is checked, the platform ensures thatthe network data between SolarWinds' Hybrid Cloud Observability Platform server and the SQL server will be encrypted. This security measure is critical for protecting the integrity and confidentiality of the performance metrics, configuration data, and credentials as they traverse the internal network between these two primary architectural components.

This encryption utilizesTransport Layer Security (TLS)to wrap theTDS (Tabular Data Stream)protocol used by Microsoft SQL Server. By enabling this feature, the platform prevents potential "man-in-the-middle" attacks where an adversary could sniff network traffic to intercept sensitive monitoring data or administrative information stored within the SQL database. It is important to note that for this setting to function correctly, theSQL Servermust be configured with a valid SSL/TLS certificate that is trusted by the SolarWinds application server.

This setting differs from simple credential encryption (Option C) or secure storage (Option B) because it applies toall datatransmitted during the session, not just the initial login exchange. Furthermore, while the configuration wizard does require a login account (Option A), that account's specific permissions are a separate functional requirement from the underlying encryption of the transport layer. Enabling SSL encryption is a standard best practice for organizations following strict compliance frameworks likeHIPAA,PCI-DSS, orSOC2, where protecting data-in-transit is a mandatory requirement even on internal, "trusted" network segments. This centralized encryption toggle simplifies the deployment of high-security observability environments by orchestrating the secure connection parameters through the standard SolarWinds Configuration Wizard interface.

When new users are added to the SolarWinds Platform, they are typically granted a "Standard User" baseline of permissions to ensure they have immediate visibility without administrative risk. According to theSolarWinds Platform User Account Managementguides, the two primary default rights arelog into web console (B)andview existing reports (D).

The ability to log into the web console is the fundamental prerequisite for any user interaction with the platform. Once logged in, the "View Existing Reports" permission allows the user to navigate the report manager, search for historical data, and run or export reports that have been shared with them. These permissions are considered "safe" or "read-only" baseline rights. In contrast,Edit Views (A)andManage Reports (C)are administrative-level permissions that are disabled by default. "Edit Views" allows a user to change the dashboard layout for everyone, and "Manage Reports" allows for the creation, deletion, and scheduling of reports. By restricting these to an "opt-in" basis, SolarWinds protects the integrity of the monitoring configuration while ensuring that every team member can access the information they need to perform their daily duties.

Anomaly-Based Alertingis a premier feature of Hybrid Cloud Observability that moves beyond static thresholds to identify performance deviations based on historical behavior. According to theSolarWinds HCO Administrator Guide, this feature relies on cloud-assisted analytics to process complex datasets. To enable this, two specific components are required:

Advanced Machine-Learning Feature: This is the functional logic within the HCO platform that identifies patterns and establishes "normal" baselines for metrics like CPU load or interface utilization.

Platform Connect: This is the essential bridge that links the self-hosted HCO instance to the SolarWinds cloud-based AIOps engine. Because anomaly detection requires significant computational power to analyze long-term historical trends, the heavy processing is often offloaded. Platform Connect ensures that the necessary metadata can be analyzed securely to generate the dynamic thresholds used for these alerts.

WithoutPlatform Connect, the local server cannot access the machine-learning models required to calculate what constitutes an "anomaly" versus standard operational variance. This architecture allows HCO to provide high-level AIOps capabilities without requiring massive localized hardware for every installation.

According to the SolarWinds Platform Administrator Guide for Hybrid Cloud Observability, theAppStack Environment Viewprovides an interactive, visual mapping of relationships between monitored entities such as applications, servers, and storage. In the provided image, it is evident thata filter is applied to show entities related to an application (A)because the left-hand navigation pane shows specific filters selected under the "Applications" category, and the main view displays a subset of the environment's total objects that correspond specifically to those application relationships. This filtering capability allows users to narrow down the environment to focus on the specific dependencies of a critical business service, such as Microsoft Active Directory or a SQL Server instance, which are shown as filtered groups in the sidebar.

Furthermore, it can be concluded thatthe option to hide categories with no objects is selected (B). A standard, unfiltered AppStack view typically displays every possible layer of the IT stack—including Transactions, LUNs, Pools, and Arrays—regardless of whether they contain active entities. However, in the provided view, only categories containing entities relevant to the current filter (such as Applications, Database Instances, Servers, and Volumes) are visible. This indicates that the "Hide categories with no objects" setting is active, which is a standard customization used to clean up the interface and highlight only the active parts of the dependency map.

While the view shows storage-related entities like "Volumes," this does not confirm whether theStorage Resource Monitor (SRM) is not installed (C), as basic volume data can often be collected via standard node polling. Additionally, the AppStack interface itself does not provide enough diagnostic data to verify if theuser account is given administrator access rights (D), as these visual elements are accessible to non-admin users with appropriate view permissions. Therefore, A and B are the only verified conclusions based on the visual evidence of the filtered environment.

The transition from the legacy Orion Platform toHybrid Cloud Observability (HCO)introduced stricter hardware and software prerequisites to support modern features like AIOps, advanced mapping, and high-performance data processing. According to theSolarWinds Hybrid Cloud Observability System Requirements, the platform requires modern SQL features for optimal performance.

While legacy versions of the Orion Platform may have supported SQL Server 2016 or even 2012 in older iterations,MS SQL Server 2019is identified as theminimum supported versionfor new HCO installations. This requirement ensures compatibility with the latest database indexing and query optimization techniques used by the SolarWinds Platform to handle the high volume of time-series data generated by observability nodes. Additionally, using SQL 2019 or later (including SQL 2022) is necessary to ensure the platform can utilize specific security protocols and memory management improvements that are not available in the end-of-life SQL 2012 or SP1 versions of 2016.

Managing user permissions through Active Directory (AD) groups in SolarWinds requires an understanding of how the platform resolves conflicting rights. When a user belongs to multiple groups, the platform must determine which set of permissions takes precedence. According to theSolarWinds Platform User Account Managementguide, there are two primary ways to ensure the "correct" (often the most restrictive or most specific) permissions are applied.

Add users as individual users (A): Individual user account settings always take precedence over group settings in the SolarWinds Platform. If a user needs specific rights that differ from their assigned AD groups, creating a local or AD-linked individual account for them allows the administrator to "override" group-level permissions with 100% certainty.

Re-order groups (D): The SolarWinds Web Console allows administrators to change thesearch orderof groups. When a user logs in, the platform checks the groups in the order they are listed in the "Manage Accounts" screen. The first group match it finds is the one that defines the user's session permissions. By re-ordering the groups, an admin can ensure that the group with the "correct" intended permissions is processed first.

Options B and C are inefficient and unnecessary "nuclear" options that disrupt the benefits of using centralized AD management for the rest of the organization.

The ability to create or modify reports is a high-level administrative function in the SolarWinds Platform, distinct from the ability to simply view them. According to theSolarWinds Platform User Account Managementguide, this is controlled by theReport Managementright.

To restrict a specific group of users from creating or editing reports while still allowing them to view existing ones, the administrator mustremove the "Manage Reports" permissionfrom their user accounts. When this right is set to "No," the"Manage Reports" buttonis hidden from the "All Reports" view for that user. They can still click on and run any report they have access to, but they will lack the interface options to enter the "Report Builder," change schedules, or delete entries. This provides a secure way to delegate report consumption to the wider team while centralizing report creation within a smaller group of "power users" or administrators. Option D is incorrect as it refers toAlerts, which is a separate permission set entirely.

SolarWindsIntelligent Mapsare highly interactive, but their functionality is strictly gated by user permissions. According to theSolarWinds Platform documentation on Map Management, if a user can see nodes but cannot see their real-time status (the colored status ring) or perform advanced functions like nesting one map inside another, it points to a lack ofMap Editing Rights.

Without "Map Edit" permissions, the user is essentially in a "restricted view" mode. They can see the physical entities that have been placed on a map, but the dynamic overlays—such as the status of the node or the ability to modify the hierarchy of the map—are disabled to prevent unauthorized changes to the global map configuration. To resolve this, a Platform Administrator must navigate toSettings > All Settings > Manage Accounts, edit the specific user account, and change the "Map Management" or "Allow Map Editing" permission to "Yes". This grants the user the ability to interact with the map's metadata and organizational structure, including nesting and status visualization.

The reporting engine in the SolarWinds Platform is designed to provide historical documentation and summary data for management and technical analysis. According to theSolarWinds Platform Reporting Guide, reports are distinct from alerts; while alerts focus on real-time "critical incidents needing immediate attention" (Option B), reports focus on aggregated data over time.

Specifically, the two primary purposes shown in the options are:

Availability and Response Time Reports (A): These provide a summary of how infrastructure has performed over a specific period (daily, weekly, monthly). This is used for Service Level Agreement (SLA) reporting to show that devices at a particular location maintained required uptime and performance metrics.

Status Summaries (D): Reports can be generated to show the current or historical distribution of node health. A report on the "number of nodes in warning or critical states" provides an executive-level view of environmental stability, identifying which areas of the network are experiencing the most frequent issues.

Option C is incorrect as database dependencies are typically visualized live inAppStackorIntelligent Mapsrather than in a static report. Option B describes the function of theAlerting Engine, which is intended for immediate operational response rather than the post-hoc analysis provided by reports.

PerfStack(Performance Analysis) projects are highly versatile troubleshooting assets that can be shared and integrated across the SolarWinds Platform. According to theSolarWinds Platform Administrator Guide, once a correlation project is built—linking metrics like CPU, Latency, and IOPS—it can be utilized in several ways.

Add as a menu bar item (A): A specific PerfStack project that is used frequently (such as "Core Switch Health") can be saved and added directly to the main navigation menu. This allows users to access the troubleshooting dashboard with a single click from anywhere in the console.

Share to non-web console users (B): PerfStack projects can be shared via a unique URL. This "Public Link" feature allows stakeholders who do not have a SolarWinds account (such as third-party vendors or executives) to view the real-time correlation data in a read-only browser view.

Show as a widget in a view (D): PerfStack projects can be embedded into Summary Views or Node Details pages as awidget. This provides context-sensitive performance data right alongside the standard node information, allowing for "at-a-glance" correlation without leaving the main dashboard.

While PerfStack provides visual data, it is typically treated as a dynamic, interactive "Project" or "Widget" rather than a static "dashboard graphic" (Option C) in the classic sense of a standalone image or icon.

In Hybrid Cloud Observability (HCO), report visibility is controlled byReport Limitation Categories. While standard users are typically restricted to specific categories (e.g., "Finance Reports" or "Network Reports"), administrators often require a global view of all reporting assets.

According to theSolarWinds Platform Documentation on Restricting Report Access, the setting"No Limitation"is the specific value used to bypass all category-based filters. When an account is configured with the "No Limitation" report category, the platform security layer allows that user to see every report stored in the database, including reports marked as "private" or those assigned to specific siloed departments.

It is important to distinguish this from the"Default"setting (Option A), which typically only allows users to see reports that have not been assigned to any specific limitation category. To ensure a Platform Administrator has a truly comprehensive view for auditing or management purposes, the "No Limitation" setting must be explicitly selected in their User Account settings underSettings > All Settings > Manage Accounts > Edit User.