Need help building an alert - NPM.

I am trying to define the trigger conditions for an alert. If a node with a system name containing 'PUB' and an IP range of 192.168.xx.2 to 192.168.xx.126 is discovered, then I would like to be notified.

Part of the issue is that it does not appear that I have the ability to analyze the 3rd and/or 4th node of the IP address.

Find more posts tagged with

Alert

npm

system name

Accepted answers

All comments

smttysmth02gt

Have you tried this?

All child conditions must be satisfied (AND)

Node - System Name - contains - PUB

All child conditions must be satisfied (AND)

Node - IP_Address - is greater than - 192.168.*.2

All child conditions must be satisfied (AND)

Node - IP_Address - is less than - 192.168.*.126

wickedoz

I have.

The problem is that 192.168.31.2 is only including address where the last node of the IP begins with a 2. Therefore these examples: 192.168.31.7 or 192.168.31.62 or 192.168.31.11 are not in the range.

It would be helpful if Node in IP Range was one of the conditions that could be set.

image001.png

jm_sysadmin

The SWQL below might help:

SELECT NodeID, IPAddress, SysName

FROM Orion.Nodes

Where SysName like 'PUB%' and (IPAddress like '192.168.%.2' or IPAddress like '192.168.%.126')

smttysmth02gt

That was my next step lol. I thought he was trying to use the GUI so that was my starting point.

jm_sysadmin

He might be, but when I struggle in the GUI SWQL is my go to

wickedoz

I am trying to use the GUI and am trying to accomplish something like this:

Where SysName contains 'PUB%'

AND

(

(IPAddress greater than '192.168.31.2' AND IPAddress less than '192.168.31.126')

(IPAddress greater than '192.168.32.2' AND IPAddress less than '192.168.32.126')

(IPAddress greater than '192.168.33.2' AND IPAddress less than '192.168.33.126')

)

However this does not actually get the range of 124 IP addresses for each subnet.

smttysmth02gt

Use jm_sysadmin's query. It works.

wickedoz

I do I build an alert using SWQL?