Unable to select Interfaces on Anomaly-Based Alert in SolarWinds Platform 2026.2.2

10/26/2026 4:40 PM

10/26/2026 5:06 PM

When creating an Anomaly-Based Alert, Interface may be missing from the entity-type dropdown even though anomaly-based alerts are enabled in Platform Connect.

Interface alerting was introduced in SolarWinds Observability Self-Hosted 2025.4. Availability in the alert wizard depends on the feature prerequisites and the Interface capability setting. This article explains how to verify those requirements, inspect the setting, and apply a targeted workaround when it is incorrectly disabled. It also describes the checks to perform if Interface remains unavailable after the setting is enabled.

See the 2025.4 release notes for the introduction of Interface-level Anomaly-Based Alerts.

Orion Platform

For the disabled-setting condition, AnomalyBasedAlerts-PlatformGateway-Enabled has CurrentValue = 0, preventing Interface selection. The reason the setting became disabled was not confirmed.

A connected UAMS client alone does not establish that the anomaly-detection plugin is active. Token validation failures, malformed setting metadata, plugin activation problems, and interface-query timeouts must be investigated separately when present. Do not assume every missing Interface selector has the same root cause.

This procedure restores Interface targeting when the feature prerequisites are met and the Interface capability flag is incorrectly disabled. It also identifies conditions that require additional investigation instead of a database change.

1. Verify feature and license requirements

• Confirm the deployment is on a version that supports Interface-level Anomaly-Based Alerts: 2025.4 or later.

• Confirm an active, non-evaluation SolarWinds Observability Self-Hosted Advanced license. A separate SolarWinds Observability SaaS license is not required after Platform Connect is configured. See Anomaly-Based Alerting requirements.

• Open Settings > All Settings > Add/Edit Platform Connector and confirm Platform Connect is connected and Anomaly-Based Alerts is enabled.

• Confirm Platform Connect uses a valid API Access token rather than an ingestion-only token. Confirm the token has the access required by registration; investigate any token-permission validation failure before changing the database setting.

For general setup guidance, see Platform Connect configuration. Use the guide corresponding to your installed release when wizard labels differ; the linked page describes the current release.

2. Verify UAMS and anomaly-detection health

• Confirm the UAMS client is installed and connected.

• Confirm the anomaly-detection plugin is active, not merely downloaded.

• Review token-sufficiency validation and authentication results in:

C:\ProgramData\SolarWinds\UAMSClient\log\plugins\anomaly-detection\AIIM-AnomalyDetectionPlugin-YYYYMMDD.log

If token validation fails, correct the token or Platform Connect configuration before considering the workaround. Successful registration or a successful Public API request does not, by itself, prove that the anomaly-detection plugin is active.

3. Inspect the database setting

Run this read-only query against the SolarWinds Platform database:

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

SELECT TOP 1000 * FROM [dbo].[Settings]
where SettingID='AnomalyBasedAlerts-PlatformGateway-Enabled'

Review CurrentValue, Minimum, Maximum, and DefaultValue.

• CurrentValue = 0: The Interface capability is disabled. Verify the prerequisites and token state before proceeding.

• CurrentValue = 1: The capability is enabled. Do not repeat the update; continue with plugin and query troubleshooting if Interface remains unavailable.

• Missing row or NULL in Minimum, Maximum, or DefaultValue: Have SolarWinds Support review the setting metadata. Do not invent replacement values. Malformed metadata can prevent the setting from being read correctly.

The product normally manages this setting automatically. Manual changes should be limited to a validated workaround with SolarWinds Support guidance.

4. Apply the targeted workaround when appropriate

If the requirements are met, the token is valid, and the setting remains incorrectly disabled:

1. Take a backup of the SolarWinds Platform database before making changes.

2. Coordinate the change with SolarWinds Support.

3. Run the following update against the correct SolarWinds Platform database:

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

UPDATE dbo.Settings
SET CurrentValue = '1'
WHERE SettingID = 'AnomalyBasedAlerts-PlatformGateway-Enabled';

4. Rerun the read-only query to verify that CurrentValue is 1.

5. Reopen the Anomaly-Based Alert wizard and verify that Interface is selectable.

6. Monitor the setting to confirm that it remains 1. If it returns to 0, collect the related token-sufficiency and plugin logs rather than repeatedly applying the update.

This workaround restores the disabled capability flag. It does not repair an invalid token, malformed setting metadata, inactive plugin, or interface-query timeout.

5. Select the target interfaces

1. Open Alerts & Activity > Anomaly-Based Alerts and select Add New Alert.

2. In entity selection, choose Interface.

3. Select the nodes hosting the target interfaces, then select the individual interfaces.

4. If a node or interface is absent, review the trunk-interface filter. By default, only nodes with trunk interfaces are shown; clear that filter to show all nodes.

5. Configure conditions using supported Interface metrics: received/transmit errors, received/transmit discards, or average receive/transmit traffic in bps.

6. Investigate if Interface remains unavailable

If the setting is 1 but Interface is still missing, verify plugin activation and investigate interface-query failures. Review:

C:\ProgramData\SolarWinds\Logs\Orion\AIIM\SolarWinds.AIIM.BusinessLayer.log
C:\ProgramData\SolarWinds\Logs\Orion\OrionWeb.log
C:\ProgramData\SolarWinds\Logs\Orion\ApolloWebApi.log
C:\ProgramData\SolarWinds\Logs\Orion\FusionWebHost.log
C:\ProgramData\SolarWinds\InformationService\v3.0\Orion.InformationService.log

Collect entries corresponding to the failed attempt, particularly those involving Orion.NPM.Interfaces, Orion.NPM.InterfaceTraffic, and Orion.NPM.InterfaceErrors. Review local messaging health if relevant connection failures are present. Escalate plugin-activation or query-timeout problems to SolarWinds Support rather than treating the flag update as their resolution.