Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

SQL alert for flapping nodes

HI.

I got the following SQL query to use in my alert to trigger when a node has flapped 3 times in 1hour. This is working 100% but I need to filter the nodes by certain criteria which is a custom node property named "Technology".

This custom property must be one of the following... "Telkom ME" or "Vodacom ME" or "Vodacom MW".

Can someone help me to edit this query to also filter on the custom property?

SELECT Nodes.Caption, Nodes.NodeID FROM Nodes

In the SQL condition please paste

JOIN Events ON Nodes.NodeID = Events.NetObjectID

where eventtime >dateadd(hour,-1,getdate()) AND EventType = '1'

group by EventType, NodeID, Caption, Message

having count(*)>=3

Thank You

Find more posts tagged with

flapping nodes

Accepted answers

dgsmith80

Hi rouxd@ampath.co.za try this, hopefully, it should work:

SELECT Nodes.Caption, Nodes.NodeID FROM Nodes--In the SQL condition please pasteJOIN Events ON Nodes.NodeID = Events.NetObjectIDWHERE (Technology = 'Telekom ME' OR Technology = 'Vodacom ME' OR Technology = 'Vodacom MW') AND EventTime > DATEADD(HOUR,-1,GETDATE()) AND EventType = '1'GROUP BY EventType, NodeID, Caption, MessageHAVING COUNT(*)>=3

Because your query is using the Nodes(View) then the custom property is merged into. Therefore you don't need to do another JOIN for them.

All comments

dgsmith80

Hi rouxd@ampath.co.za try this, hopefully, it should work:

SELECT Nodes.Caption, Nodes.NodeID FROM Nodes--In the SQL condition please pasteJOIN Events ON Nodes.NodeID = Events.NetObjectIDWHERE (Technology = 'Telekom ME' OR Technology = 'Vodacom ME' OR Technology = 'Vodacom MW') AND EventTime > DATEADD(HOUR,-1,GETDATE()) AND EventType = '1'GROUP BY EventType, NodeID, Caption, MessageHAVING COUNT(*)>=3

Because your query is using the Nodes(View) then the custom property is merged into. Therefore you don't need to do another JOIN for them.

rouxd

HI David,

Firstly thank you for the reply and help. I have been struggling for more than a year to get this alert to work correctly.

I have edited my alert with your edit and will monitor and test for a few days.

Thanx again.

rouxd

Hi David,

I have tested and is working like s charm. This is great!!!!!

But now I have a new issue. My reset trigger is not working as it should. Once a node has flapped it is sending me a mail....which is correct.....but then the reset trigger is triggering way too soon. This is then checking the trigger condition and is triggered again and is creating a looping alert of sorts.

This is my reset trigger to reset when the node has been up for 1 hour. Please correct me on this query as I got this from a tech from solarwinds but obviously is not working.

SELECT Nodes.Caption, Nodes.NodeID FROM Nodes

where LastSystemUpTimePollUtc < dateadd(hour,-1,getdate()) AND Status = '1'

Your help is much appreciated.

Thanx

dgsmith80

Hmm not sure about the logic of that reset condition. Let me check the logic you want:

ALERT IF: Node goes down more than 3 times in the last 1 hour period AND has Node CP of either: Telekom ME / Vodacom ME / Vodacom MW.

RESET IF: Node Status is Up for more than 1 Hour.

Is that correct?

If so I would suspect you could just a normal Alert Logic rather than Advanced SQL.

Hope that helps.