SWSQL query where alert does not exist

Hi, I am looking to create a sort of failsafe SAM alert.

We have SAM monitors setup for various items. We have alerts set to match the SAM name and do alert stuff.

I noticed we were sometimes having the SAM monitor added, but no alert so it was basically useless. I created a new alert (catch all) to monitor with to monitor all SAM monitors, but we then get double alerts for monitors setup to alert.

I then started to exclude in the catch all monitor those alerts we did have setup, but it is growing big.

I was wondering if there was a SQL query to identify when a SAM monitor is not in an active alert?

Find more posts tagged with

sam

swsql

Alerts

Accepted answers

All comments

adam.beedell

This query kinda exists in the "all alers this object could trigger" widget

It's not very easy to parse, but it's basically pulling all the alerts against the (in this case) Application table (maybe +components etc), then looping through the SCOPE section for each of those, and if matched then covered else not covered.

I've pitched solarwinds on a "Coverage" UI thing to help this problem, there's been people in solarwinds talking about it before, but it's not currently on build

You can get by with a fairly limited amount of application alerts by using variables in your alerts that pull from content on the objects you're alerting on, like calling the support_team variable against the node as an email address.

casperinmd

Thanks for the reply. I'll look into this.

We early on got in the habit (good or bad) of putting "steps to resolve" right in the alert, so we have 1 alert for each SAM monitor. It grew a lot, hence my predicament.

Maybe I'll dive into variables and custom variables a bit more and look into that to cleanup and streamline what we have.

Regarding the widget you mentioned, I don't have that, is it from Thwack?

adam.beedell

Nah it's out of the box, classic dashboards only though. If you cant see it then check for typos if you still cant see it maybe config wizard.
I've typoed on my end "All Alerts*..." oops.

You could potentially put the "how to fix" in stuff like the application or component description, but there's a limit for how generic you can get without getting more complicated than the original problem. 1 per SAM monitor is probably way too many though.

You could maybe JOIN the alert ID or Component ID to some sort of KB-Like-Table...

A note: The All Alerts This Object Could Trigger widget and the logic I mentioned in my first reply both require a SCOPE, so if there's no scope (think, a custom SWQL/SQL alert) it doesnt operate right. Also if you've got a busted alert in your environment somewhere that'll show up as a problem.