Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

NCM/NPM alert schedule based on custom table?

Our company owns several facilities that host events. During these times we turn everything on and watch it, and "when the carnival leaves town" we shut it all down. I know I can just click these things and unmanage them until the next event, but it's inelegant. I'd like something to handle this automatically.

I was thinking I could add a table to the database with 3 columns, something like:

SITE | Event start | Event End

abc | Dec 1 | Dec 8

abc | Dec 12 | Dec 17

bcd | Nov 7 | Nov 15

cde | Mar 1 | Mar 8

Any site could have any number of events, I just need to query for the site in question and see if any events are "ON" at the moment and if so I need to alert the designated devices, and if there is nothing going on I need to ignore or unmanage these devices.

I've played with custom fields and we use them quite a bit but they don't lend themselves well to a multi-event type of setup. I'd like to just put the whole schedule in one spot for the year and have the system handle everything else automatically.

Any suggestions?

Find more posts tagged with

Accepted answers

miteethor

Well, I've worked out a way to accomplish this. It's a little clunky but it works. Here's what I did:

1. Create a new boolean custom property called "ActiveEvent" on all nodes

2. Create a new custom property called "Site" and apply a site tag to all nodes

3. Create 2 alerts

3a. First alert says "For site #1, if ActiveEvent is "No" change to "yes" and log. This uses the calendar to only be enabled during the event window.

3b. Second alert says "for site #1, if ActiveEvent is "Yes" change to "No" and log. This uses the exact same calendar, only it's set to be DISABLED during the same time window and enabled all other times.

4. Now create a custom property called "Monitoring" on all nodes. Possible values are "24x7", "8-8", "EventOnly","NoAlerts"

5. Create an alert that checks for ActiveEvent="yes" and Monitoring<>"NoAlerts" which will cover you for alarms during an event

6. Create an alert that checks for ActiveEvent="no" and Monitoring="24x7" which kicks off 24x7x365

7. Create an alert that checks for ActiveEvent="no" and Monitoring="8-8" which kicks off 8am to 8pm

8. For each site, you will need to repeat steps 3a and 3b to include the schedule. We have 12 sites so that's 24 total alerts to handle the calendar. Make sure that the calendars are set identically on each set with the 2nd one inverted (i.e disable only during the event)

9. Congratulations, you've made an event calendar for each location that will automatically set your alerting.

All comments

d09h

Schedule an unmanage job? Set the re-manage date to be the date you identified as Event start...

Configure Orion to unmanage items on a scheduled basis - SolarWinds Worldwide, LLC. Help and Support

Would this work for you? I realize your use case may be the inverse of the typical one for unmanage functionality (scheduled outages).

miteethor

I tried to work with that, the utility is very unwieldy. It doesn't help that it's outside of the Orion platform. In addition, many of these devices will be online - we just "don't care" if anything happens to them until the next event starts. Some locations will shut down buildings for the winter, while others will leave everything powered up. Some buildings do get used regularly but an alert can wait until business hours. Really the crux if the issue comes down to using a very complex criteria to decide if an alarm is worth sounding - checking multiple date ranges and custom fields. From everything I'm reading a custom field has to be attached to a node, group, alarm, or report, and juggling schedules for multiple locations is just more complex than a single field can handle.

I'm not sure if AlertCentral can handle this, I just found the product yesterday and I'm going to play around with it.

d09h

The unmanage utility is definitely there for this purpose, so anything you invent without will likely have layers of workarounds. What specifically was the issue with it? May need to compare level of effort. When I used it, I was editing XML files by hand occasionally, but can't recall if custom properties could exist in them. Been a while since I used the unmanage utility. Have you considered converting the "don't care" nodes to type 'external'? They don't get polled.

It would be cool if you could use a group with dynamic membership as your ignore criteria in any alerts (which would actually negate any benefit in making non-polled/ external). I recall using basic alerts for the purpose of changing a custom property, so that property would then be useful. But the rest of the basic alerts were very inflexible. Unless things have changed since I last cared about this, advanced alerts can't set a custom property. Is that still the case?

miteethor

I guess I really don't want to unmanage the nodes at all - many of them could still have configuration changes, etc that I need to backup via NCM - they just aren't important enough to alert on except for specific weeks of the year. The group of devices is also very dynamic - I can't have a bunch of pre-created scheduled tasks that sit a year in advance with the nodes pre-determined. Many of our devices are created/deleted on the fly based on the needs of the event. We have a custom field already on the nodes called "monitoring" and it has a pick list - 24x7, 8-8, EventOnly, None to specify when this device needs to be alerted - now I just need to craft a method of alerting that can utilize this field with a calendar based schedule.

I've already found 1 method of activating a schedule using the "Starting on / Ending on" but the downside is I would have to create a separate alert for each site to do it this way. If I could have a table lookup then I could handle it all with a single alert.

Jfrazier

Support this idea !!

https://thwack.solarwinds.com/ideas/2655

miteethor

Well, I've worked out a way to accomplish this. It's a little clunky but it works. Here's what I did:

1. Create a new boolean custom property called "ActiveEvent" on all nodes

2. Create a new custom property called "Site" and apply a site tag to all nodes

3. Create 2 alerts

3a. First alert says "For site #1, if ActiveEvent is "No" change to "yes" and log. This uses the calendar to only be enabled during the event window.

4. Now create a custom property called "Monitoring" on all nodes. Possible values are "24x7", "8-8", "EventOnly","NoAlerts"

5. Create an alert that checks for ActiveEvent="yes" and Monitoring<>"NoAlerts" which will cover you for alarms during an event

6. Create an alert that checks for ActiveEvent="no" and Monitoring="24x7" which kicks off 24x7x365

7. Create an alert that checks for ActiveEvent="no" and Monitoring="8-8" which kicks off 8am to 8pm

9. Congratulations, you've made an event calendar for each location that will automatically set your alerting.

rschroeder

That's a nice (but complex) solution to your exact problem. You are to be elevated and praised for your creativity!