SolarWinds Observability-Self-Hosted-Fundamentals Exam Questions

AlertStack is a specialized AIOps feature within Hybrid Cloud Observability (HCO) designed to simplify incident response. According to the SolarWinds HCO Alerting documentation, an AlertStack cluster is an autogenerated grouping of related active alerts on related entities.

The primary goal of clustering is to reduce 'alert fatigue.' Instead of presenting a technician with twenty individual alerts (e.g., one for high CPU on a server, one for an application failure, and three for slow database response), AlertStack analyzes the relationships and dependencies between those entities. If the platform determines that the alerts are part of a single root-cause event---such as a storage array failure impacting multiple virtual machines and their applications---it automatically clusters them into a single visual timeline. This clustering is autogenerated by the platform's machine learning engine based on the AppStack dependency map; it does not require a user to manually group the alerts. This allows the IT team to identify the 'blast radius' of an incident and focus on the primary failure point rather than triaging dozens of symptoms individually.

The modern web-based report builder in SolarWinds is highly integrated with the rest of the platform's visualization tools. According to the SolarWinds Platform Reporting Guide, reports are no longer limited to simple data tables; they can incorporate rich, interactive content already created elsewhere in the console.

Two key configurations available as content are existing intelligent maps (A) and existing widgets (D).

Existing Intelligent Maps: This allows an administrator to take a visually mapped dependency or network topology and embed it directly into a scheduled report. This provides a geographical or logical context to the data that static tables cannot provide.

Existing Widgets: Most widgets (resources) found on Summary or Node Details pages---such as 'Top 10 Nodes by Response Time' or 'Active Alerts'---can be added to a report as a component. This ensures consistency between what users see in real-time on their dashboards and what they receive in their weekly PDF summaries.

While you can embed performance data, the report builder is designed to consume these pre-configured UI elements (Maps and Widgets) to simplify report creation and maintain a unified look and feel across the observability suite.

In the SolarWinds Platform, the method used to poll a node (SNMP, WMI, or Agent) is a specific property assigned to the node record in the database. According to the SolarWinds Platform Agent Management guide, simply installing the agent software on a remote server does not automatically convert the existing node record to use that agent for data collection.

If a node was originally added to the system via WMI, the platform will continue to attempt to poll it via WMI over the network using RPC/DCOM, even if the SolarWinds Agent is successfully installed and running on the target machine. To fix this 'irregularity' and take advantage of the agent's encrypted, single-port communication, an administrator must edit the node and change the polling method (D).

By going to Manage Nodes, selecting the domain controller, and clicking 'Edit Properties,' the admin must find the 'Polling Method' section and select 'Agent'. Once saved, the Polling Engine will stop using WMI network calls and will instead wait for the agent to provide the data (if in Agent-Initiated mode) or reach out to the agent via the agent's port (if in Server-Initiated mode). This change ensures that the monitoring load is shifted to the agent and that the communication adheres to the desired security profile.

Platform Connect is a foundational technology in Hybrid Cloud Observability (HCO) that bridges the gap between the on-premises (self-hosted) installation and SolarWinds' cloud-based AIOps and machine learning services. According to the SolarWinds HCO Administrator Guide, the primary function enabled by this connection is anomaly-based alerting.

Anomaly detection requires significant computational resources to process months of historical performance data and build sophisticated behavioral baselines for thousands of metrics. To prevent this heavy processing from impacting the performance of the local monitoring server, SolarWinds offloads the analysis to a cloud-based machine learning engine. Platform Connect provides the secure, encrypted tunnel required to transmit relevant performance metadata to the cloud for analysis and receive dynamic threshold updates in return.

Without Platform Connect, the local instance is restricted to traditional static thresholds (e.g., 'Alert if CPU > 90%'). With it, the system can identify 'unusual' behavior (e.g., 'Alert if CPU is 70% at 2:00 AM on a Tuesday, when it is normally 10%'). While HCO handles infrastructure monitoring and mapping locally, the specific 'intelligence' layer that drives anomaly detection is the standout benefit provided by the Platform Connect architecture.

According to the SolarWinds Platform Administrator Guide regarding Modern Dashboards, the platform introduces several new widget types designed for high-performance data visualization. The widget shown in the image, which displays a single, large numerical value (the number '1') representing a specific count of 'DOWN Nodes' against a distinct colored background, is officially categorized as a KPI (Key Performance Indicator) widget.

KPI widgets are specifically engineered to provide an immediate 'at-a-glance' understanding of critical metrics. Unlike the legacy 'Classic' dashboards which relied on multi-row tables or fixed gauges, the Modern Dashboard KPI widget allows for a highly streamlined presentation of data derived from SWQL (SolarWinds Query Language). In this instance, the widget is likely running a query such as SELECT count(NodeID) FROM Orion.Nodes WHERE Status = 2, which returns a single scalar value. This value is then rendered prominently in the center of the widget.

One of the defining features of the KPI widget in HCO is its ability to use Conditional Formatting. This allows the background color of the widget to change dynamically based on the value returned by the query; for example, the background may turn red if the count of down nodes is greater than zero, providing a visual alert to the NOC staff. This type of widget is distinct from a 'table' (D), which displays multiple rows of data, or a 'counter' (A), which is typically a legacy term for simple incremental statistics. It is also not a 'custom HTML' (B) widget, as those are used for embedding external content or custom code rather than native data point visualization. The KPI widget remains the primary tool for displaying high-level summary statistics, such as active alert counts, total interface errors, or, as seen here, the availability status of nodes across the environment.