SWQL help for custom alerting

Hello All,

I am are trying to build a custom alert that will allow us to consolidate windows alerts for nodes. When there is a critical even, I would like to have the alert include all the nodes components that are in warning or critical. And maybe even include a like back to Orion or and RDP link to FQDN hostname or IP address.

Find more posts tagged with

Accepted answers

All comments

bobmarley

When you create the alert and are on the Trigger Actions page there is an option to Insert Variable. If you click on that you will be able to select any variable you wish to add to the alert message there.

adam.beedell

Hi Boricua,

This is doable, and ultimately will include one of two things:

A custom macro using FOR XML PATH to grab all the components. (There is a feature in the works for STRING_AGG in SWQL but it's a way off)
The OOTB components-with-issues macro

You should use the 2nd until you get the first working. The 2nd is fine, but could be formatted better and includes the UNKNOWN status which is ok but annoying for appinsight packages particularly

The FOR XML PATH bit you can search for here for some examples, I'm a couple days away from getting back into SWQL studio so I've not wrote it for you

The link back to orion should be there as default, else it's a macro like detailsurl, the RDP link i'd be surprised if it worked via an alert for security, but presumably it's a macro with RDP://${IP_Address} in there somewhere.

The first line of your post around Windows alerts for Nodes is a little confusing, but is important. If you alert on the Node Level it's different from alerting at the Application level, you need to be sure about this bit