Disabled component alert

Hi all,

There was an issue recently that someone disabled a SAM component that was important an we didn't get the alert when it went down, so I wanted to know:

Is it possible to trigger an alert when a SAM component is disabled? If so, how can it be setup?

Thank you.

Find more posts tagged with

sam

component monitor

sam templates

Alerting

sam monitoring

application monitors

Accepted answers

All comments

mark.gover

Disabled as in unmanaged or muted?

gombosi

I think you would probably want this as a report instead of an alert unless you are going to try to focus the alert on a specific component. A good test would be to create an alert that goes off when that component status is not up, disable it and see if the trigger condition works.

drevollo

No, I mean disabled in the assigned application template

drevollo

I already created a report, and I'll try with the test alert. Thank you.

mark.gover

ahh right, got you.

weston.hood

I would think you could create a SQL Server User Experience Monitor against the SolarwindsOrion database. Have it count statistic as difference. Set critical threshold > 1 (means some new component was disabled). Setup an alert when this component goes critical status. Doesn't look like an auditing event exists for this so I'm thinking this is the only way.

Not sure how you could identify the component name/ID though, possibly either with scheduled and daily report exports. Or, possibly if you have SCM.

Using SCM, you can perform a diff on database query results. Something like

SELECT Name, ID, IsDisabled FROM APM_Component

WHERE IsDisabled='True'

And that would highlight what new component names appear in the disabled list.

SteveK

That could get very noisy. I don't even want to think about how many disabled components are floating around in our environment (especially on the appinsight front).

I took a quick look and setup a component alert, and tried looking at component events, but unfortunatly that is empty. I was hoping to see if there was some kind of status event you could go off of.

I'm sure there is some kind of SWQL that could be written to retrieve recent events and find component status changed, but I don't have time to go down that route at the moment.

If you want to do a quick/dirty route, then:

This would be exteremly noisy though. My environment would have triggered over 1k times. So to try and reduce the noise, you should be able to scope the alert. If you have a small list of monitors that you would like to do, then I would scope that to Application Name:

The other route would be to create a "DisabledComponent" custom property or something, and then flag the scope to a True/False value on that one. Then you would just need to update the custom props. on the app monitors you want.

drevollo

This is the solution I'm using so far, and I'm still trying to figure out how to get the component name that was disabled.

drevollo

Good idea about the custom property, I'll try to implement that. Thanks.