Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

How get access to component script output #2 in my alert actions? SWQL magic?

I have a monitoring template with a powershell component monitor. The component monitor is outputting valuable information to two script outputs.

The first script output is human readable, the second script output is similar information, but in JSON format.

I've created a component alert that will fire when this component has a problem on any server (component status is Critical, which is easy to setup).

Once the alert fires, I'm trying to POST the second script output to a URL and I can't quite figure out how to get access to the second script output (the Unique ID is "AlertsJson" (without quotes).

I'm not super sure how to figure out the SWQL. I did find this, but I'm not sure if this is right nor am I sure if the WHERE clause is correct

${N=SWQL;M=SELECT c.MultipleStatisticData.StringData 
FROM Orion.APM.Component c 
where componentid = ${N=SwisEntity;M=ComponentAlert.ComponentID} 
and c.MultipleStatisticData.Name like '%AlertsJson%'}

The reason I'm not sure the WHERE clause is correct is because of the "ComponentID". What is ComponentAlert.ComponentID? (Since my alert is a component alert, perhaps ComponentAlert.ComponentID is the exact ID of the component monitor that has been applied to the node? And Orion.APM.Component has a list of all components that have been applied to nodes (via monitoring templates)?

And perhaps the above SWQL is the right query?

Where would I run a SWQL query to verify? (I have direct solarwinds database access (read only), but I don't know where I can validate a SWQL query?)

Thank you~!

Find more posts tagged with

Accepted answers

All comments

yaquaholic

Good morning ctech291,

Firstly get yourself over to: https://github.com/solarwinds/OrionSDK
There you'll find the SDK, along with the SWQL Studio - the perfect place for SWQL
And all the docs for SWQL and the SDK.

Though as the SWQL your using has a variable built in, but by replacing ${N=SwisEntity;M=ComponentAlert.ComponentID} with a valid ComponentID it'll run.

If you need any help don't be afraid to ask, as we have SWQL gods here in Thwack.

yaquaholic

adam.beedell

This is fairly simple if it's a single alert for a single extra metric (you make a custom macro for multicomponentstatistics where id 2 or whateever)
This can be fairly painful for a generic alert that needs to operate with different objects and data structures

ctech291

@yaquaholic - thank you. I was able to get SWQL Studio and validate that the above SWQL statement is valid:

But it appears that when I try to place the "StringData" variable reference into my alert trigger, solarwinds is trying to escape the double quotes for me:

Alert trigger POST body:

Error message in c:\ProgramData\SolarWinds\Logs\Orion\ActionsExecutionAlert.log:

2023-12-05 17:41:56,696 [62] ERROR AlertingLogger - (null)  Failed to execute an HTTP request. Method: POST, Url: https://REDACTED, Body: {
    "fullscanbit": 0,
    "servers": [{\"Module\":\"this is the module\",\"Environment\":\"TEST\",\"EnvironmentType\":\"dev\"}]
}
System.Net.WebException: The remote server returned an error: (400) Bad Request.
   at System.Net.HttpWebRequest.GetResponse()
   at SolarWinds.Orion.Core.Actions.Impl.SendHttpRequest.SendHttpRequestExecutor.ExecuteInternal()

Notice that my data in the database seems to get escaped:

What is stored in the database:

[{"Module":"this is the module","Environment":"IHOK","EnvironmentType":"dev"}]

What gets put into the body of my POST:

[{\"Module\":\"this is the module\",\"Environment\":\"IHOK\",\"EnvironmentType\":\"dev\"}]

I'll see what I can do, however, does anyone know how to remove the backslashes or tell solarwinds to put the RAW database value into my POST body and not try to escape it for me?

adam.beedell

I'm suspicious that it's the action that's placing escapes rather than the macro. It if were the macro you should see it in your first SS. If not you could hit it with a REPLACE

If so, you could try placing a Post.exe doing curl or invoke-restmethod on the server that accepts arguments, then trigger it with a Execute an external program action

ctech291

I ended up changing my payload and I'm converting the string to a JSON in my own code. My payload now looks like this:

{
    "fullscanbit": 0,
    "server_text": "${N=SWQL;M=SELECT c.MultipleStatisticData.StringData FROM Orion.APM.Component c where componentid = ${N=SwisEntity;M=ComponentAlert.ComponentID} and c.MultipleStatisticData.Name like '%AlertsJson%'}"
}

. On the receiving end, "server_text" is just a bunch of text, but when I convert it to JSON it properly reads it as an array.

And it's working!

Thanks for the help! Posting here helped me get through this.