EOC custom property filters

I am running the EOC 1.3 to connect to a pair of NPM/SAM Orion instances. I am primarily using it so an eyes-on-glass team can track open advanced alerts. When i use the default "Global XX Active Alert' view, it shows all of the active alerts just fine. However, since different servers have different owners, I created a Node Custom Property on each Orion instance called "Platform_Team" and populated it with the relevant data.

When I attempted to separate out the Active Alerts view to just those for the Windows Team and those for the UNIX Team, for example, most of the alerts disappeared. The missing alerts mostly appear to be volume or SAM application alerts. My filter is just Node.CustomProperty.Platform_Team = 'TEAM NAME HERE' and it works for a few alerts such as Node Down.

Is this because the network object for a volume alert has its own set of Custom Properties? If so, how would I be able to override that and pull the node.CustomProperty for a volume alert? This goes double for application alerts which do not have any custom properties that I am aware of.

Find more posts tagged with

eoc_1

eoc_custom_filter_sql

Accepted answers

Detroiter

Using Node.MachineType LIKE '%Windows%' still does not present any volume alerts. That workaround would not work for me anyway since we have more than 1 UNIX platform team.

I tried the second option and that is a good workaround. Since all my advanced alerts are labeled with the platform team that owns the system in question, I can use that as a filter. Thanks!

I do still think that EOC objects should be able to be related back to the full list of custom properties for the Orion node they exist on. But i do thank you again for getting me a workable solution!

All comments

phil3

Hi, there.

The reason your filter is working that way is because that resource cannot be filtered by Volume or SAM properties. You can only filter that resource by the following entities:

EOC.Alert2
EOC.Node
EOC.Node.CustomProperty (what you're currently using)
EOC.Orion

Source: http://www.solarwinds.com/documentation/eoc/docs/EOCAdministratorGuide.pdf (see Appendix

I asked our Dev team about a workaround, and they recommended you change your filters to include the MachineType property in the EOC.Node entity. For example:

Node.MachineType like 'machineType'

Note: This only works if that property is populated by SNMP for the nodes you're monitoring.

I hope this helps. Let us know if you have any questions.

Thanks.

Phil

phil3

Another option:

Change your alerts so that they include some sort of prefix for the alert name. For example, use "UNIX" and "Windows" as the prefixes, and use a filter similar to this:

Alert.AlertName like 'UNIX%'

Let us know which option ends up working out.

Thanks again.

Phil

Detroiter

Using Node.MachineType LIKE '%Windows%' still does not present any volume alerts. That workaround would not work for me anyway since we have more than 1 UNIX platform team.

I tried the second option and that is a good workaround. Since all my advanced alerts are labeled with the platform team that owns the system in question, I can use that as a filter. Thanks!