create a critical alert when multiple servers are offline not just one

rgivens

We use Citrix machine creation services for some machine catalogs.  One machine catalog has 20 VDA's in it.  I would like to see a critical alert if there is a certain threshold of VDA's offline not just one.  Currently we have the environment configured so that we receive a critical when a production machine is offline.  That is reasonable except for the Citrix VDA's when I don't necessarily care if one of them is down in the middle of the night as long as the remainder of them are up.  So I'd like to somehow create a critical alarm for these specific machines that requires a certain number of them to be offline to have the critical alarm generated.  Otherwise, it'll just generate a medium severity that I can address in the morning.  Has anybody set something like this up and if so, do you have an example?  Thank you.

Seashore

Hi, you can solve this with a "Custom SWQL Alert".

Below example is for when more than 10 Nodes named "*-VDA-*" is down. You can change that part to something that matches your environment.  This alert WILL "assign" the triggered alert to one of the down VDA-nodes, but that's just how it has to be.

-- Part that SolarWinds adds automatically
SELECT Nodes.Uri, Nodes.DisplayName FROM Orion.Nodes AS Nodes


-- Part that you have to add to the alert
INNER JOIN
(
    SELECT
        COUNT(N.NodeID) AS QTY
        ,MAX(N.Uri) AS NodeURI
        ,N.Status
    FROM Orion.Nodes AS N
    WHERE
        N.Caption LIKE '%-VDA-%' -- The Node names to include
        AND N.Status = 2 -- 2=Down, 1=Up, 9=Unmnanaged
    GROUP BY N.Status    
    HAVING COUNT(N.NodeID)>10 -- Threshold for how many nodes has to be down to trigger alert
) AS T1 ON Nodes.Uri=T1.NodeURI

It looks like this then: