How to set up an alert that compares two values from different components

Hello Everyone,

I have a SAM template with two components (A and . Each component returns a statistic value and I want the alert to be active if the value from component A is greater than the value of component B.

Is there a way to configure an alert in this manner?

Thank you and best regards

Find more posts tagged with

Alert

sam

trigger_condition

Accepted answers

All comments

yaquaholic

Hi noeltz,

have you tried the double block comparison, in the alert's trigger definition?

This allows you to test two variables against each other.

If this doesn't give you what you need, you can always use a custom SQL (or SWQL) trigger definition.

If you need to, just supply some more details, I am sure we can get it working for you.

I hope it helps!

noeltz

Hi yaquaholic,

I already tried the double value comparison but the problem is, that I cannot specify which statistic data from which component I want to compare.

2017-09-11 14_29_57.jpg

Even if I set the scope so that this only applies to the desired two components I can't choose which statistic value is the first and which is the second variable in the comparison.

What I need is a double value comparison like this: <Component A> [Statistic Data] is greater than <Component B> [Statistic Data]

Do you know a way to achieve this?

Best regards

yaquaholic

Okay, if the drop down boxes won;t cut it, SQL or SWQL is the way forward.

Firstly, lets work out what you are looking at.

Open your trigger definition and populate each of the variables into a single trigger condition, especially the two you want to compare, but add as many as you need.

Next from the top right of the definition you'll see a little yellow drop down arrow, click it and select show SWQL:

And as if by magic, we get a SWQL trigger pop-up.

Now although this won't be firing any alerts it does tell us where the data is in the database and will allow us to create the trigger for you.

Hopefully the trigger definition doesn't contain any sensitive data (if so hide it) and post up the SWQL that is outputted, the variables of interest and what you need to compare against what and I'll have a crack a writing an example for you.

noeltz

Okay,
so here is my SWQL output:

SELECT E0.[Uri], E0.[DisplayName]

FROM Orion.APM.Component AS E0

WHERE ( ( E0.[Application].[Node].[Vendor] = 'Windows' ) AND ( E0.[Application].[ApplicationAlert].[ApplicationName] = 'Windows Monitor' ) AND (( E0.[ComponentAlert].[ComponentName] = 'Win_Stat_A' ) OR ( E0.[ComponentAlert].[ComponentName] = 'Win_Stat_B' )) AND ( E0.[ComponentAlert].[StatisticData] > E0.[ComponentAlert].[StatisticData] ) )

The problem is this part: ( E0.[ComponentAlert].[StatisticData] > E0.[ComponentAlert].[StatisticData] )

I need to compare the StatisticData from Win_Stat_A against StatisticData from Win_Stat_B

Thank you very much for your help!

yaquaholic

Try this, it should work (it certainly passed SWQL syntax):

SELECT E0.[Uri], E0.[DisplayName]

FROM Orion.APM.Component AS E0

WHERE ( E0.[Application].[Node].[Vendor] = 'Windows' ) AND ( E0.[Application].[ApplicationAlert].[ApplicationName] = 'Windows Monitor')

AND ( SELECT E0.[ComponentAlert].[StatisticData] FROM Orion.APM.Component AS E0 WHERE E0.[ComponentAlert].[ComponentName] = 'Win_Stat_A')

( SELECT E0.[ComponentAlert].[StatisticData] FROM Orion.APM.Component AS E0 WHERE E0.[ComponentAlert].[ComponentName] = 'Win_Stat_B' )

Hopefully by isolating each metric first, then comparing them, you should get the result you are after.

If you have the Orion SDK installed (https://github.com/solarwinds/OrionSDK) you can test the SWQL in the SWQL studio, or you can use the native SWQL tools on your Orion server (http://<your Orion server>/Orion/admin/swis.aspx). The former is like a lightweight SQL studio, the later is not quite so dynamic.

Good luck!

HerrDoktor

I am working on a similar issue at the moment (with 2 Custom Pollers). I assume this will also end in a custom SQL or SWQL Alert.

If you are successful, let me know.

Cheers,

Holger

noeltz

I tried your solution but unfortunately it didn't work.

I tested the SWQL in the SWQL Studio and got the error message:

Subquery returned more than 1 value. This is not permitted when the subquery follows =,!=,<,<=,>,>= or when the subquery is used as an expression.

So I guessed the problem is that the subquerys output contains not only the statistic data for the components within the same application monitor.

I changed the entry object from component to application and modified the SWQL a little:

SELECT Application.Uri, Application.DisplayName FROM Orion.APM.Application AS Application

WHERE DisplayName = 'Windows Monitor'

AND ( SELECT StatisticData FROM Orion.APM.ComponentAlert AS CompA WHERE CompA.[Component].[Application].[Uri] = Application.Uri AND CompA.[ComponentName] = 'Win_Stat_A' )

( SELECT StatisticData FROM Orion.APM.ComponentAlert AS CompB WHERE CompB.[Component].[Application].[Uri] = Application.Uri AND CompB.[ComponentName] = 'Win_Stat_B' )

And that works like a charm.

So your idea to isolate the two metrics was leading me in the right direction.

Thank your for your help!

Best regards

noeltz

Hi HerrDoktor,

please read my post above to see how I got it working.

Mit freundlichen Grüßen aus Deutschland

Nils

HerrDoktor

Hi noeltz

thanks for the hint. Didn't read carefully.

More German in the "German forum" thwack EMEA -> German Content

Cheers,

Holger