Refining the Alert Scope.

Question

I have a situation where I need to populate various interface metrics for 16 devices (paired in HA solution). Only when the device is primary, the interfaces appear on the device. In secondary only the management interfaces are operational.

I have solved monitoring the interfaces when failover occurs by using a Discovery job and importing the interfaces when found.

I then to produce a weekly report on certain interfaces on the (current) primary devices. I have done this by assigning a custom property to each interface required.

When the pair failover and the discovery job runs. The operational interfaces are imported and monitored with no custom property assigned (wouldn't be nice to have a function in the discovery job to assign CP's :-)  ).

I have set up an Alert to automatically assign the CP on any of the interfaces where the CP value is blank. But as there are a large number of interfaces. The Scope of the alert is vast and I would like to refine it. Having the ability to use a 'pull from list' option would be great. But I don't know if a way or that Solarwinds provides this function. Using Groups is no good as te interfaces are imported with no CP's and trying to refine using naming covers too many other interfaces not needed in the report.

1 option was to list the Interface full names using SWQL. But before I do that. I wondered if anyone had discovered a way of using a file list?

Thanks

rocco_2016 · Answer

Thanks for the ideas. I'll try them today

sum_giais · Answer

Possibly throw a simple script action to run a SwisPowerShell command that does it all in one alert, or scheduled task and could end up with just 1 alert that does the action. That's a bit complex though and probably not the easiest way to go about it.

Could perhaps make an attempt to slim down your scope with a custom SWQL alert looking at an interface. The query below joins in the Orion.Events data of interfaces being added to the SolarWinds Platform within the last 24 hours.

Would need to replace "MyCustomPropertyName" with the name of your custom property, and perhaps change up the logic of the query a bit to fit your needs. Then setup the alert to run on the desired cadence of your choosing.

SELECT Interfaces.Uri, Interfaces.DisplayName FROM Orion.NPM.Interfaces AS Interfaces
INNER JOIN ( SELECT
     e.NetObjectID
FROM Orion.Events AS e
WHERE e.EventType = 16 -- EventType 16 is 'Interface Added'
AND e.NetObjectType = 'I'
AND HOURDIFF(e.EventTime, GETUTCDATE()) < 24 ) AS j ON j.NetObjectID = Interfaces.InterfaceID
WHERE ( Interfaces.CustomProperties.MyCustomPropertyName IS NULL
OR Interfaces.CustomProperties.MyCustomPropertyName = '' )

adam.beedell · Answer

If the list exists in SWQL/SQL (pref to the former) you can JOIN to it. Like:

Update stuff alert:

Select i.name, i.uri from Orion.interfaces i
right join orion.list l on i.uri = l.uri

where X

Note in that example you cant make a custom table swql accessible so that's assuming you've got data somewhere. You can do this straight up in SQL but use with caution.

if you're taking about taking an action based off list.xls then you'd want to look at the Orion SDK github page. fine in theory I suppose.

Havnt throught about the particular's of your problem mind