Group Trigger Action Variable - SWQL Help

Hello,

I have set Web Console Settings > STATUS ROLLUP MODE to "Show Worst Status" to show when a Node has any component, application, interface or volume in a status other than up.

This was for the dashboard we setup by use of Groups. All Nodes do have a co-responding custom field set for the associated group name.

The issue I am having is when the Alert is setup, i cannot access the variable that I really want to report on (Group trigger cannot access Application/Component variables. The reason I'm a bit hamstrung on using Group as the trigger is because of the rollup alert capability it has for when a node/app/comp/int/volume has an issue.

The one I am really after is this one - the Group Root Cause drill down status.

For example, if Citrix has ANY issue, the email below shows everything except the Group Root Cause sub item that shows the actual component/app/int/volume that is in 'not up'.

Trigger Email:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

${N=SwisEntity;M=Name} - ${N=SwisEntity;M=StatusDescription}

${N=Alerting;M=AlertMessage}

${N=OrionGroup;M=GroupStatusRootCause}

Details on component or application can be seen here:

Monitoring Group: ${N=SwisEntity;M=DetailsUrl}.

Alert Name: ${N=Alerting;M=AlertName}

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Citrix - Warning

Citrix Error
Pxxxxx01 is Warning

Details on component or application can be seen here:
Monitoring Group: https://xxxxxxx/Orion/NetPerfMon/ContainerDetails.aspx?NetObject=C:7.

Alert Name: Citrix

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I understand I may need to make joins from the below but, can i just use the variable that shows on the widget above?

[APM_CurrentComponentStatus]
[APM_Component]
[APM_Application]
[NodesData]
[Containers]
[ContainerMemberDefinitions]

I hope I have explained this well and really appreciate any help I could receive.

Regards,

MTZ

Find more posts tagged with

trigger

SWQL

root cause

Group

variable

Accepted answers

All comments

dark235

Im having a similar issue.

I have hundreds of "sites" that are all set up as groups dynamically assigned by their custom property site. Each of my groups is set to show BEST status (as opposed to yours). The idea behind the alert being, when the Group is Up but a Group Member is anything other than Up, throw an alert. I am using the ${N=OrionGroup;M=GroupStatusRootCause} field because the widget on the Group dashboard shows which item is a problem. Unfortunately for me, the ${N=OrionGroup;M=GroupStatusRootCause} field always returns "Group has no problems"

I have a ticket open because I believe this to be a bug and not something I have misconfigured.

While I wait for the response, I've been trying to figure out how to extract the correct data using a SQL query for the alert.

So, in theory, yes, you can use the GroupStatusRootCause and it should return that info but I'm having some issues with it so you should be aware that you might as well. I'm running 2019.4.

monitoringlife

What is your use case for groups?

I would avoid trying to avoid alerting on groups directly. The main use case for groups (that I use) is for setting up dependencies and 'down stream suppression'. Example: remote site group, with a dependency on the WAN routers. If WAN router goes down, so will everything behind it. Setting the dependency generates only the one alert (for the WAN router), all down stream devices show as impacted by their parent dependency.

If you have a standard SAM template you populate for Citrix server you can alert on that.

You can include in the trigger action the 'Root Cause' or 'node status' or my favorite 'ComponentsWithProblems'.

Trigger action ends up looking something like:

dark235

Not OP but, for us, the reason we don't use dependencies is because of the number of devices/locations/changes within our network. Dependencies are set up in a counter-intuitive manner from my perspective. Instead of being able to Dynamically create a group and pick which item is the parent and which are the children, you have to manually pick one item as a parent and then manually pick the subsequent items as the children. If literally anything changes with that environment, you have to remember to fix it. Add a new switch to that location? Gotta update the dependency. Replace a WAP on site? Gotta update the dependency. With Groups, if I add a new device, as long as I've tagged it properly, it gets added to the group. There's nothing else I need to do. I tried creating two groups for each site a "Site A" group that included all of the devices at that site and then a "Site A LAN" that included all of the devices except the parent device and then build dependencies off that. It was better but it was three times the amount of work and with almost 1000 locations, it isn't a very scalable solution. It is already a ton of work to just build groups which, considering the simple sql logic that already exists for that sort of grouping, is a bit perplexing.

All that being said, I'll look at ComponentsWithProblems and see if it kicks back the results I am expecting.

monitoringlife

Groups can have other groups be the parent dependency. Groups membership can be dynamic (query, custom property, etc.).

With 1,000 locations I agree there is no easy solution. The only thing that comes to mind is using the API and leveraging your CMDB. We use our CMDB to populate custom properties, those properties are used in groups/alerts/etc.

dark235

Groups can have other groups but they can't have a group of which the parent is a member - that's where my problem is. The need to make a group of child devices (which is then hanging off a parent dependency) and another group of all the site devices (so that all the devices in one location are under one place) is convoluted and confusing.

Thanks though.