Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Need to create an alert from a failed policy rule

I need some advanced help my friends. I am trying to create an alert based off a failed NCM compliance policy rule.

The goal is basically this - run a compliance report and then trigger an alert for each node that fails a specific rule. The alert action would then change the value of a certain node custom property.

The following SWQL query gives me the error, "Cannot implicitly convert from data type Guid to data type Int32":

SELECT n.NodeID

FROM Cirrus.PolicyCacheResults r

JOIN Orion.Nodes n ON r.NodeID = n.NodeID

WHERE r.IsViolation = True AND r.RuleName = 'rule name here'

Can anyone help me with the query and how to get it into a custom SWQL trigger query?

Thanks.

Find more posts tagged with

Comments

Lofstrand

Hi @patriot

"NCM NodeID" is NOT EQUAL to "NPM/Core NodeID" (for some reason….)

The table Cirrus.Nodes holds both values, joining in that table let you "move" between the two nodeid-types.

SELECT

  n.NodeID

FROM Cirrus.PolicyCacheResults AS r

INNER JOIN Cirrus.Nodes AS CN ON R.NodeID=CN.NodeID

INNER JOIN Orion.Nodes AS n ON CN.CoreNodeID = N.NodeID

WHERE

  r.IsViolation = True

  AND r.RuleName = 'rule name here'

Lofstrand

To get the above inte a Custom SWQL Alert Trigger Condition, you have to form a query that uses both the mandatory part and the customizable part. Usually, I create the lower part first and then just join in the result with the mandatory part. Like this:

-- Trigger Condition Manadatory part

SELECT Nodes.Uri, Nodes.DisplayName FROM Orion.Nodes AS Nodes
-- Customizable part

INNER JOIN

(

SELECT

CN.CoreNodeID

FROM Cirrus.PolicyCacheResults AS r

INNER JOIN Cirrus.Nodes AS CN ON R.NodeID=CN.NodeID

WHERE

r.IsViolation = True

AND r.RuleName = 'rule name here'

) AS T ON Nodes.Nodeid=T.CoreNodeID

You can see I skippet one join from the original query as we don't need it.

When you create the alert, it can look likt this:

dnakkala

Hello Lofstrand,

Thanks for sharing the above to trigger an alert for NCM policy violation and I am also working on the same to setup in my org. Require assistance to get some more clarity to better understand on how frequently this "Cirrus.PolicyCacheResults" get data refreshed? I am trying to setup alerts based multiple policies each policy contain several rules covering different technologies in our enterprise. I would like to trigger alert whenever a device go non-compliance for any of the defined policies/rules. If I setup evaluation trigger condition every 1 minute will it read Cirrus.PolicyCacheResults every minute and trigger too many alerts per rule violation? Also want to clear the alert if the device is back in compliance. To setup one alert per device if the non compliance/violation is true then how to do this share some insights.

dnakkala

Hello Lofstrand /All,

Lofstrand

Hi, if I'm not mistaking, the policy is checked each night at 23.55 (default) and upon manual och triggered updates. See more here:

Find and remediate policy violations