Muted Alerts - SWQL Custom Query Widget - Permissions Needed

chucksimalchik

We're using some SWQL that I've built off of to display Muted Alert objects on a custom dashboard which are very similar to the queries seen on Thwack. One, for example:

thwack.solarwinds.com/.../custom-dashboard-widget-to-display-muted-nodes

Some users are unable to see the results of the query, and I think it ultimately boils down to access to either Orion.AuditingEvents or Orion.AlertSuppression.

Does anyone know of a user right short of Admin that would allow the contents of the above query to be shown to users using the Custom Query widget?

weston.hood

yes, AuditingEvents requires admin rights to view other peoples audit actions. So non-admin accounts can only view their own actions. So you're doing an inner join on a null (and therefore get no return). What you can do is change these inner joins to left joins and have it print "unavailable" or something like that (you can change it to whatever you like in that last case statement). Here's a modified one that works for my non-admin account

SELECT
'Muted' as [Status]
,n.caption
,tostring(tolocal(SuppressFrom)) as [From]
,case when SuppressUntil is null or SuppressUntil = '9999-01-01 00:00:00' then 'Not set'
else tostring(tolocal(SuppressUntil )) end AS [Until]
,case when SuppressUntil is null or SuppressUntil = '9999-01-01 00:00:00' then '-'
else tostring(daydiff(getutcdate(), asup.SuppressUntil)) end as [Days Left]
,n.DetailsURL AS [_LinkFor_Node]
,'/Orion/images/StatusIcons/Small-' + n.StatusLED AS [_IconFor_Node]
,case when ae.AccountID is NULL then 'Unavailable' else ae.AccountID end AS [Account]

FROM Orion.AlertSuppression asup
join orion.nodes n on asup.entityuri=n.uri
left join (
SELECT ae.NetObjectID, max(ae.timeloggedutc) as recent
FROM Orion.AuditingEvents ae
WHERE ae.auditingactiontype.actiontype in ('Orion.AlertSuppressionChanged','Orion.AlertSuppressionAdded')
group BY ae.netobjectid) mostrecent ON mostrecent.NetObjectID = n.NodeID
left join (
SELECT ae.NetObjectID, ae.AccountID, ae.timeloggedutc
FROM Orion.AuditingEvents ae
WHERE ae.auditingactiontype.actiontype in ('Orion.AlertSuppressionChanged','Orion.AlertSuppressionAdded')
Order BY ae.TimeLoggedUtc desc) ae ON ae.NetObjectID = n.NodeID and ae.timeloggedutc=mostrecent.recent

order by n.caption