Report on triggered alerts over the past weekend

Hello,

I'm interested in setting up a regular report that runs on a Monday morning and outputs a list of alerts that were triggered over the previous weekend. This is so we can have a consolidated list of things that occurred on the network over the weekend that may have since cleared, and we can follow up on.

I've attempted to do this by modifying the out-of-the-box report "Triggered and reset alerts - last 30 days" but I am not getting all of the alerts to appear in this list, only some of them. The report seems to query the events log which doesn't contain all the triggered alerts.

Has anyone tried doing something similar? Is there any way to query the alerts separately over a given time period?

Thanks in advance,

James

Find more posts tagged with

Reports

orion

npm

Alerts

Accepted answers

All comments

mesverrum

This thread might help, it mentions a few queries and links to other threads with similar goals. thwack.solarwinds.com/.../alert-history---cleared-time

- Marc Netterfield

Loop1: SolarWinds Training and Professional Services
My GitHub: Mesverrum

sguido

Here is the SWQL I use to get alerts for the last 12 hours. Instead of MinuteDiff use DayDiff and change 720 to 8 (I use <) and I think you should be in business.

SELECT ToLocal(Alert.TimeStamp) as Time, Nodes.Caption AS Name, SubString(Alert.Message, 1, 100) AS Alert_Description,Nodes.DetailsUrl AS DetailsUrl, Nodes.IP AS IP
FROM Orion.AlertHistory Alert
INNER JOIN Orion.Nodes AS Nodes ON Alert.AlertObjects.RelatedNodeId = Nodes.NodeID
WHERE (MinuteDiff(Alert.TimeStamp,ToUtc(GetDate())) < 720)
AND Alert.EventType = 0 AND Alert.Message NOT LIKE '%OpenDuty%'
ORDER BY Alert.TimeStamp ASC

sguido

Sorry, you need to also remove the WHERE condition for OpenDuty.

james.christley

Thank you. This looks to pull the data I need, so I'll give this a test over the next week and see what happens.