Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Interface down alerts

rkalidh

Hi,

Pleaese help me to get list of interface down alerts through swis query.

Find more posts tagged with

Accepted answers

mrxinu

Try this:

SELECT
    Nodes.Caption AS NodeName
    ,Interfaces.Caption AS InterfaceName
    ,Alerts.Acknowledged
    ,Alerts.AcknowledgedDateTime
    ,Alerts.TriggeredDateTime
FROM Orion.Nodes AS Nodes
JOIN Orion.NPM.Interfaces AS Interfaces ON Nodes.NodeID = Interfaces.NodeID
JOIN Orion.AlertObjects AS Objects ON Objects.RelatedNodeID = Nodes.NodeID AND Objects.EntityURI = Interfaces.URI
JOIN Orion.AlertActive AS Alerts ON Alerts.AlertObjectID = Objects.AlertObjectID
WHERE Interfaces.Status = 2

All comments

mrxinu

Hey there,

You're looking for the Orion.NPM.Interfaces entity and the query would be the following:

SELECT
     Nodes.Caption AS NodeName
     ,Interfaces.Caption AS InterfaceName
FROM Orion.Nodes AS Nodes
JOIN Orion.NPM.Interfaces AS Interfaces ON Nodes.NodeID = Interfaces.NodeID
WHERE Interfaces.Status = 2

rkalidh

Hi,

Thanks. It is working fine . Could you help me to get alertobject I'd and

triggered datetime for interface down alerts. Pls help.

mrxinu

Ah I see what you were asking. Sorry about that. Give this a try. You should have access to both the active alert information if you want additional fields and the alert object information so just add to the SELECT clause as needed:

SELECT
    Alerts.AlertActiveID
    ,Alerts.AlertObjectID
    ,Alerts.TriggeredDateTime
    ,Objects.RealEntityType
FROM Orion.AlertActive AS Alerts
JOIN Orion.AlertObjects AS Objects ON Alerts.AlertObjectID = Objects.AlertObjectID
WHERE Objects.RealEntityType = 'Orion.NPM.Interfaces'

rkalidh

Hi,

Am using below query to get interface down alerts, but somewhat am getting duplicate value in results, instead of 2 interface down, it is showing as same interface down twice. please hele me to fix this.

results3=swis.query("SELECT ao.AlertObjectID,I.InterfaceName,ac.AlertMessage as Message,ao.RelatedNodeCaption as Node,ao.AlertID as AlertID

from Orion.NPM.Interfaces I inner join Orion.AlertObjects ao on ao.Node.NodeID=I.Node.NodeID

inner join Orion.AlertActive aa on aa.AlertObjectID=ao.AlertObjectID

inner join Orion.AlertConfigurations ac on ac.AlertID=ao.AlertID

inner join Orion.AlertStatus als on ao.AlertObjectID=als.AlertObjectID

WHERE ac.Severity=2 and als.Acknowledged = 0 and ac.Severity=2 and I.Status=2 and ac.AlertMessage like '%Alert me when an interface goes down%'

and I.InterfaceID in (13961,13962,13963,3246,9060,3522,9088,3445,15372,12437,12438,7100,3404,9470,6741,9123,3362,10986,15282,4738,9119,3528,4289,9939,10142,7176,9118,3499,16236,3439,11797,3453,9823,9824,3545,3546,7005,9491,9492,10741,10742,11849,11852,14605,5133,8800,5274,5549,5584,5585,6725,10122,8710,7159,7762,9161,7974,8763,10551,9323,9399,12185,14549,15846,14588,16378,15847,16375,13956,13957,13959,14715,15754,9934,9996) order by aa.TriggeredDatetime desc")