Node View Alerts and Event History

sstark85

Below is a solution I created to view application or node events and alert history from the node view. This creates a very easy way to identify what is occurring and what has occurred by just looking at the node. The one thing I can't figure out yet is how to craft an SWQL query to show all application or node alerts that could be triggered. If you have any feedback or other cool ideas to make this better feel free to share.

Custom Query: Active Alerts

SELECT TriggeredDateTime AS [Active Time], TriggeredMessage, AlertActive.AlertObjects.EntityCaption as [TriggeringObject], Acknowledged AS Acked, AcknowledgedBy, AcknowledgedDateTime AS AckedTime,AlertActive.AlertObjects.EntityDetailsUrl As [_linkfor_TriggeringObject]FROM Orion.AlertActivewhere AlertActive.AlertObjects.RelatedNodeID=${NodeID}

Custom Query: Event History

SELECT DISTINCT Events.EventTime, Events.EventType AS Icon, EventTypes.Name, NetObjectTypes.Name AS Type, Events.Message, CONCAT('/Orion/ImageHandler.ashx?Server=1&Image=%2FNetPerfMon%2Fimages%2FEvent-',EventTypes.EventType,'.gif') as [_IconFor_Icon],CONCAT('/server/1/Orion/View.aspx?NetObject=',NetObjectTypes.Prefix,':',Events.NetObjectID) as [_linkfor_Message]FROM Orion.Events AS EventsINNER JOIN Orion.EventTypes AS EventTypes ON Events.EventType = EventTypes.EventTypeINNER JOIN (SELECT DISTINCT Name, Prefix FROM Orion.NetObjectTypes WHERE Name != 'Application') AS NetObjectTypes ON Events.NetObjectType = NetObjectTypes.Prefix+'        'WHERE NetworkNode = ${NodeID}order by EventTime desc

Custom Query: Event History Search

SELECT DISTINCT Events.EventTime, Events.EventType AS Icon, EventTypes.Name, NetObjectTypes.Name AS Type, Events.Message, CONCAT('/Orion/ImageHandler.ashx?Server=1&Image=%2FNetPerfMon%2Fimages%2FEvent-',EventTypes.EventType,'.gif') as [_IconFor_Icon],CONCAT('/server/1/Orion/View.aspx?NetObject=',NetObjectTypes.Prefix,':',Events.NetObjectID) as [_linkfor_Message]FROM Orion.Events AS EventsINNER JOIN Orion.EventTypes AS EventTypes ON Events.EventType = EventTypes.EventTypeINNER JOIN (SELECT DISTINCT Name, Prefix FROM Orion.NetObjectTypes WHERE Name != 'Application') AS NetObjectTypes ON Events.NetObjectType = NetObjectTypes.Prefix+'        'WHERE NetworkNode = ${NodeID}and Events.Message like '%${SEARCH_STRING}%'order by EventTime desc

Custom Query: Triggered Alert History Count

SELECT  LastTriggeredDateTime as [Time], EntityCaption as [Object],EntityDetailsUrL As [_linkfor_Object], TriggeredCountFROM Orion.AlertObjectswhere RelatedNodeID = ${NodeID}order by Time desc

Custom Query: Triggered Alert History Count Search

SELECT  LastTriggeredDateTime as [Time], EntityCaption as [Object],EntityDetailsUrL As [_linkfor_Object], TriggeredCountFROM Orion.AlertObjectswhere RelatedNodeID = ${NodeID}and (Object like '%${SEARCH_STRING}%'or Time like '%${SEARCH_STRING}%')order by Time desc

mesverrum

Looks pretty good, I use a similar variation of this idea for my node details pages as well.

You will want to edit the Custom Query: Event History Search line with WHERE NetworkNode = '2084' to WHERE NetworkNode = ${NodeID}

You also dont need to do the whole tostring thing for your details urls within the browser it sets those up as relative links, which is preferable to hard coded links because hard coding them can lead to strange results if you happen to access the page from the NPM server using localhost or by IP or anything beside exactly the same URL path as what you have hard coded. Detailsurl as [_linkfor_Object] will work fine.

My Alert History resource is like this

select ah.AlertObjects.AlertConfigurations.Name as [Alert Name],case when EventType=0 then concat('Triggered - ',ah.Message)when EventType=1 then concat('Alert Reset',ah.message)when EventType=2 then concat('Acknowledged - ',ah.Message)when EventType=3 then concat('Notes - ',ah.Message)end as [Message],ah.AlertObjects.EntityCaption as [Triggering Object],ToLocal(ah.Timestamp) as [Time],'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:'+ToString(ah.AlertObjectID) as [_linkfor_Message],'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:'+ToString(ah.AlertObjectID) as [_linkfor_Alert Name]from Orion.AlertHistory ahwhere EventType in (0,1,2,3)and ah.AlertObjects.RelatedNodeID='${NodeID}'and (Message like '%${SEARCH_STRING}%'or Timestamp like '%${SEARCH_STRING}%')order by TimeStamp desc

-Marc Netterfield

    Loop1 Systems: SolarWinds Training and Professional Services

•                 LinkedIN: Loop1 Systems
•                 Facebook: Loop1 Systems
•                 Twitter: @Loop1Systems