Hi,
I'm literally new to this, a user is asking me to provide a CPU alert report on a particular day and he asking me to fetch the timings of the alert? how do i do this?
First thing to say is welcome to THWACK and SolarWinds.Second is to pick on your words. A report is different to an alert which I am sure you are aware of - so my first query is do you want a report, or do you want an alert or do you want a report on the alerts? The three are very different.
But, on the presumption you just want to know what the CPU state was at a set time and when it (or if) it triggered, then there are two steps. The first would be to go to 'My Dashboards > Home > Performance Analysis' and then add the entity (in this case the node in question). Then add the metric you want - I'd suggest 'Peak CPU Load' and drag that across to the right.
Assuming it populates then adjust your timescale to suit (click the middle top where it will say 'Last hour' or similar). You could then export that as your report to a CSV.In terms of the alert you would need to interrogate either 'Events' or 'Message Center' both under Alerts & Activity. Again, narrow the search down to the time and/or node. Take screenshots of what you need, or you could print o a PDF for a hardcopy.If you need an actual report, then you'll have to go build that, but come back here if you need further advice. Good luck,
Hmm... It is possible to do a report on Alerts that happened during a given period, that were related to CPU, and to report on what time those alerts happened? Is that what you are looking for?
The problem is that Alert History isn't part of the standard reporting engine choices, so you'd have to craft a Custom SWQL query to look for the data you want. Or at least that's how I'd go about it.
From a quick look, the "Orion.AlertDefinitions" table has descriptions that relate to CPU. The AlertDefinitionID from this table is referenced in the "Orion.AlertActionExecuted" table, which is good because you have to do some action on an alert in order to track it. This table does reference the Orion.AlertObjectID, which that table has a link to the Orion.AlertHistory table.
So, with a few joins you should be able to relate this information together and produce the data you want and put it in to a report. Will take a bit of fudging around to get it right I'm sure.
SWQL Studio is great to help you do custom queries like this and figure this stuff out. A bit of a background in SQL would help.
Unfortunately I don't think I have any historical alerts on CPU to prototype this myself. But hopefully I put you on the right track?
Hi @stuartd ,
Thanks for the prompt reply. Ok, let me put it this way, a vendor is asking for a CPU report on 11th Jan, from i see when i export the report, there will be Node Name. IP address, Machine type, time stamp, average CPU load and Average percent Memory used, i belive in the timestamp, i can see only the date, so how do i add the time as well?
Ahh, right understood.
The timestamp does show date and time but you need to define your time period. So we have a report that shows average CPU use for a bunch of F5's from yesterday. In the 'Edit Table' section of your report you need to select the TimeStamp block and then pick the options in there you want. I'd leave the advanced section alone, but under 'Time-based settings' you might go with:
Be aware, the time shown will only ever (as I understand it) be on the full hour, every hour and our report comes out like this:
I hope that helps?FWIW, using the Perf Analysis approach it will also show date and time on the exported results. Here it will show you every X minutes where X = your polling cycle. So you can add multiple nodes, and multiple metrics or do them one at a time.
Yes, i did playing around with this you have suggested, i believe with Perf Analysis approach is better, only thing is to explained to user on how to read it especially on the value tab
