Out of the box, Orion offers a dozen default thresholds, and new ones are easily created. Each can be set with variable percentages or static values for both the threshold and reset values. Values are set to each interface by default, but each interface can be removed if need be.
Default alerts are also easily modified from a static number to a percentage. The list of metrics being monitored are grouped at the highest level by network nodes, interface and volume. Each group has subgroups, such as status, polling, errors, statistics and traffic. These groups are populated with more than 100 individual metrics, including "last boot for network nodes," "interface errors received today" and "volume percentage used." The layout keeps what can be an overwhelming number of knobs accessible and organized.
Fault management is one of Orion's weakest areas, but it does display events and alarms clearly, and you'll get value without heavy lifting. However, you won't get advanced fault features, such as the support for traps or log files found in CA's and HP's products; and there are no canned correlations, like those found in HP's OpenView NNM, to suppress downstream events or deduplicate recurring events.
The event console can be displayed as a summary or detailed list, and events can be linked to the devices to which they apply. The summary display groups similar events, and a single click will clear an entire group--a useful feature after a losing a router, as it makes getting rid of all the interface alerts fast and easy. Because the interface is completely configurable, you can move these lists and summaries into any configuration.
Getting rid of all the node's up or down events made it possible to quickly set things back to zero, but that's also a dangerous command: It could make shift turnover easy while hiding the true status of the network. Of course, if shift turnover means you leaving and coming back, then no big deal.
When an alert is displayed, all of the relevant interface utilization and error statistics are, by default, displayed as well. Settings can be customized with a simple point-and-click from within the Web interface as long as you're logged on as administrator. Events can't be assigned, acknowledged or cleared by operators, though they can be cleared from the Win32 admin GUI. So, the software doesn't provide a workflow process that would let the Web interface be used by operators; this is limiting if you've got to roll the management product out to a number of folks.
The process of creating an alert is as simple as checking the appropriate metric and setting the threshold value. By default, all alerts are applied to all appropriate devices. The devices, as we expected, can display status, but what was nice is that the status can be displayed in different ways; that's in keeping with the flexibility we found throughout the Network Performance Monitor.
For example, a display titled "overview" showed two groups of icons--one for each node and one for the interfaces. The icons actively display the status of each interface, which is a useful, quick update. We've found this feature in many network management applications, including Ipswitch's WhatsUp Gold. But what is unique to Orion is that the node and interface stats can be tied to different metrics, including percent utilization, errors, discards today or in the last hour, current signal-to-noise ratio, averages of collected data, and bits transferred on the interface. You can set these values or allow users to change them as needed.
Orion can't parse event streams or correlate events, as HP's and CA's products do, but a handy set of macros is provided wherein you can broadly categorize such variables as node name, time, interface, address, SNMP community, status, response time, speed and errors, and insert them into event text.
Take note that the paint is still wet on this utility. There's no Layer 2 discovery, no discovery or monitoring of trunked links, and no port scans of TCP/UDP services. But what's there works.
Discovery is ICMP- and SNMP-limited by subnet, or seed router. We like a "don't discover" or "not" list, so discovery can be limited to specific interfaces without looking at an entire ARP cache on a gateway router, but Orion does not offer this option. When you hit a heavily populated cache, all the devices get checked. If you're anything like us, you'll want to limit what you manage; in that case, Orion's discovery will be too much and you'll just add the devices manually. At least we felt that was easier than deleting devices one at a time.
During our testing SolarWinds sent us its new mapping tool. It was buggy initially but eventually provided basic bitmaps with links to underlying status.
The canned reports offer the works, including top-10 lists, tabular reports and graphs, all nicely linked to underlying data. Every "report resource" in the out-of-the-box reports is up for grabs, making it easy to combine gathered statistic into whatever look works for you.
The 18 canned reports run the gamut from response time, utilization, peak loads and CPU utilization to down interfaces and top disk space utilization. SolarWinds said it will release an "ad hoc report writer" in "early 2003."
We could modify reports by, for example, replacing charts with much sexier gauges and inserting stats like server CPU load, memory utilization and hard-disk usage. In addition, every item displayed within the Web GUI could be moved to any other Web display simply by copying the source. This meant if we had a performance gauge for an important router that we wanted to give to a network operator, it was a simple cut-and-paste.
Orion Network Performance Monitor 6.0, SolarWinds.Net, (918) 307-8100. www.solarwinds.net
RSS
We took an immediate shine to Orion. Even though it didn't have an overwhelming feature set, what it has works well, without a hassle. We like it so much we'd recommend it to our favorite aunt. Heck, even to our mom. 
SolarWinds has what it refers to as a "95th percentile calculation," meaning that when you're looking at a graph on which the value is set at 95 percent, you'll see the number of data points that fall below that line. This set point is movable to any percentage value; for example, if the 95 percent is changed to 70 percent, then the data points below 70 percent would be visible. This is a useful tool to help identify aberrant threshold violations or determine general usage. For example, if an interface has one big peak that causes the average utilization to rise above the threshold, but 95 percent of traffic is below the threshold, the problem may be transient. 
