Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Advanced Alert via SQL

mivy00

I currently have the following SQL setup as a report.

select TOP 5 cast(message as varchar(200)) as EventMsg, COUNT(*) as Occurances

from Events

where eventtime >dateadd(hour,-24,getdate())AND Message like '%accel UP%'

group by cast(message as varchar(200)),EventType

having count(*)>=2

order by Occurances DESC

I have this report as viewable from Orion Web console on one of hte views. We have a need to be able to configure an alert based on this data. The alert would be something like If more than 5 occurances then fire an email.....etc. Can this be done

Find more posts tagged with

Accepted answers

mivy00

Questionaro thanks for your help I got it working. For others that may need a flapping alert some modification to this SQL will have to be done but this should get you started.

Create a new alert

Under Trigger Condition choose Custom SQL Alert

I setup my trigger query on Node

My custom SQL

INNER JOIN Events ON Nodes.NodeID = Events.NetObjectID

where eventtime >dateadd(hour,-24,getdate())AND Message like '%accel UP%'

group by NodeID, Caption, EventType

having count(*)>=3

Under Reset Condition choose Reset this alert when the following conditions are met

My custom SQL

INNER JOIN Events ON Nodes.NodeID = Events.NetObjectID

where eventtime >dateadd(hour,-24,getdate())AND Message like '%accel UP%'

group by NodeID, Caption, EventType

having count(*)<3

Setup any other suppresion or trigger action etc...

All comments

Questionario

well, there is the advanced sql alert in the advanced alert manager.

you can try to create one there, unfortunately i dont think you can just paste it in there...

you will probably need to edit the sql-database to edit the advanced sql alert to change the top of the alert query. only do this if you are very familiar with sql.

mivy00

I read that in some other posts, but I dont see it. I am on the latest versions of everything

mivy00

Never mind I found it. Under Type of Property to Monitor

mivy00

After more thought I decided against using the advanced SQL alert. The issue being if I was looking for there to be 5 events in the event log then I would get an alert when the event count reached 5. But if the event count reached 6 and then the one of those events fell off of the 24hr time frame then the alert would fire again on the way back down.

Also there is some question about how the rule would evaluate. If I said look for 5 events that matched x criteria in the event table and then there were 5 events in the event table and it remained that way for most of the 24hr period I'm afraid I would get one alert per sample ......So for every sample, once every 2 minutes the rule would evauluate and if the condition was still true it would send another alert.

The last one is speculation on my part if anyone at solarwinds knows the true answer it would be appreciated