PowerShell - Disable alerting when specific server goes down

How can I get my if statement conditions to work properly using the Orion SDK with PowerShell?
For whatever reason, I can only get one of the conditions to match no matter what I do.

Is there something I may be missing for the if statements? I basically have the SWQL Queries as the conditions and then have it execute either disabling or enabling the alert.
If I change the queries or results, it doesn't seem to change either. Maybe there is a simpler way to do it?

# Setup Connection to SWIS

$SwisCreds = Get-Credential -Message "enter your Orion Creds"
$SwisConnection = Connect-Swis -Hostname "XXXXX" -Credential $SwisCreds
# SWQL Queries for servers up or down

$Down = "SELECT Caption AS NODE
FROM Orion.Nodes
WHERE Caption like 'XXX%' AND Status = '2'

$Up = "SELECT Caption AS NODE
FROM Orion.Nodes
WHERE Caption like 'XXX%' AND Status = '1'

# Check to see if alerting has been enabled or disabled
$Enabled = "SELECT AlertID, Name, Enabled
FROM Orion.AlertConfigurations
where AlertID = 'X' and Enabled = 'TRUE'

$Disabled= "SELECT AlertID, Name, Enabled
FROM Orion.AlertConfigurations
where AlertID = 'X' and Enabled != 'TRUE'

# Query SWIS with the states of the servers being either up or down

$ResultsDown = Get-SwisData -SwisConnection $SwisConnection -Query $Down
$ResultsUp = Get-SwisData -SwisConnection $SwisConnection -Query $Up
$Check_Alerts_Enabled = Get-SwisData -SwisConnection $SwisConnection -Query $Enabled
$Check_Alerts_Disabled = Get-SwisData -SwisConnection $SwisConnection -Query $Disabled
# Check to see if alerting has been enabled or disabled
# Disable or Enable Alerts due to matching conditions, if no results match write-host
if ($ResultsDown -and $Check_Alerts_Enabled) {
Get-SwisData $SwisConnection "SELECT uri FROM Orion.AlertConfigurations where AlertID = 'X' or AlertID = 'X'" | Set-SwisObject $SwisConnection -Properties @{Enabled=$false}
Write-Host "One or more polling Engine is down, disabling Alerts.";break
}
elseif ($ResultsUp -and $Check_Alerts_Disabled) {
Get-SwisData $SwisConnection "SELECT uri FROM Orion.AlertConfigurations where AlertID = 'X' or AlertID = 'X'" | Set-SwisObject $SwisConnection -Properties @{Enabled=$true}
write-host "All polling engines are back up, enabling alerts.";break
}
else {
Write-Host "No changes have been detected, nothing to do."
}

Find more posts tagged with

swql query

powershell scripting

PowerShell

API

orion sdk

Accepted answers

All comments

KMSigma.SWI

What exactly are you trying to accomplish? You mentioned in the code something about "Polling Engines," but I want to understand the framework for this script and its uses.

ThankfulEmerald

I'm trying to have 2 specific alerts disabled when any one of the polling engines go into a "down" state.
Eventually I also want to add the same condition if any of the Orion Application monitors go into a "down" state as well.
I also want to have these two alerts "enabled" again if all of the polling engines go back "up"

KMSigma.SWI

When the polling engines go down, doesn't the status change to "Unreachable" (ID 12) and not "Down" (ID: 2)? If that's the case, then you should just change your alert logic to ignore unreachable in the trigger or reset.

The problem with changing an alert configuration is that the alert doesn't care about the polling engine. If the Polling Engine with ID 3 is down and you disable the alert (on the main polling engine), anything on Engine ID 1, 2, 4, 5, etc. that should match won't fire an alert.

This reads very much like an "upgrading a polling engine" scenario. If I've misread it, please provide more details about the scenario you are hitting and the purpose of your script. More details are always better.

Disabling Alerts During Upgrades (Present Day)

I used to have to do something like this for upgrades when the upgrades didn't happen in parallel. Now that they do, I've gotten in the habit of turning off all alert notifications (still collecting the data) until the upgrade is complete.

Disabling Alerts During Upgrades (Olden Days)

In the old days (before the parallel upgrade of polling engines), I used to assign each node to a different poller when I was upgrading. Then I would use a script to assign them back.

So when Poller A was going to be upgraded, I'd move everything to Poller B. Then, after the upgrade of A was complete, I'd move everything to Poller A. Then, when the upgrade was complete, I'd use a script to balance them out (based on geographical region).

ThankfulEmerald

The alert was actually made by internal team members.
The alert creates an incident if specific nodes haven't polled via SNMP for over XX minutes.
I don't want to change their alert since they have their own specific use case for it.

However, I still need to disable their alerts when any one of the polling engines goes down or if any one of the Orion Observability application monitors goes into a down state.