Get history of alerts for a node

I wanted a resource that would show me the history of all alerts on a node, including inactive alerts. To do this, I created a custom query resource with the following custom SWQL. The node name and message texts are clickable links to the alert detail page.

select AlertHistory.AlertObjects.AlertConfigurations.Name as [Alert Name], Message, AlertHistory.AlertObjects.EntityCaption as [Triggering Object],ToLocal(Timestamp) as [Time],AlertHistory.AlertObjects.RelatedNodeCaption as [Related Node],'solarwinds.ci.northwestern.edu/.../ActiveAlertDetails.aspx as [_linkfor_Message],'solarwinds.ci.northwestern.edu/.../ActiveAlertDetails.aspx as [_linkfor_Alert Name]from Orion.AlertHistory where AlertHistory.AlertObjects.RelatedNodeID='${NodeID}'and EventType = 0order by TimeStamp desc

To enable searching by alert message content or date, put this SWQL in the "Search SWQL Query" box:

select AlertHistory.AlertObjects.AlertConfigurations.Name as [Alert Name], Message, AlertHistory.AlertObjects.EntityCaption as [Triggering Object],ToLocal(Timestamp) as [Time],AlertHistory.AlertObjects.RelatedNodeCaption as [Related Node],'solarwinds.ci.northwestern.edu/.../ActiveAlertDetails.aspx as [_linkfor_Message],'solarwinds.ci.northwestern.edu/.../ActiveAlertDetails.aspx as [_linkfor_Alert Name]from Orion.AlertHistory where AlertHistory.AlertObjects.RelatedNodeID='${NodeID}'and (Message like '%${SEARCH_STRING}%'or Timestamp like '%${SEARCH_STRING}%')and EventType = 0order by TimeStamp desc

The resulting resource looks like this:

Find more posts tagged with

History

resource

Alerts

Accepted answers

All comments

darcydressell44

Thanks for adding this! Works awesome.

My only question - Is there any way to get this to work on a "group" of nodes? That way it displays the history of "group" alerts?

I think this line will need to be edited:

where AlertHistory.AlertObjects.RelatedNodeID='${NodeID}'

I'll be looking into this, but if anyone has some tips I'd appreciate it.

Thanks!

m-milligan

You can do this by creating a group with the nodes you want in it. Then, use this query in a custom query resource for the group:

select AH.AlertObjects.AlertConfigurations.Name as [Alert Name],

Message,

AH.AlertObjects.EntityCaption as [Triggering Object],

ToLocal(Timestamp) as [Time],

'https://solarwinds.ci.northwestern.edu/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:'+ToString(AH.AlertObjectID) as [_linkfor_Message],

'https://solarwinds.ci.northwestern.edu/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:'+ToString(AH.AlertObjectID) as [_linkfor_Alert Name]

from Orion.AlertHistory AH

where AH.AlertObjects.RelatedNodeId in

( select C.Members.MemberPrimaryID

from Orion.Container C

where C.Members.MemberEntityType = 'Orion.Nodes'

and C.Name = '${Caption}'

)

and AH.EventType = 0

order by AH.TimeStamp desc

This will give you all of the alerts for each of the individual Nodes in the group.

darcydressell44

Woohoo! Thank you Sir.

Works beautifully.