How do I create an alert based off the sum of the Total Bps of two interfaces?

I was tasked to create a report that would show the total internet bandwidth usage of our network, which I believe i did in the following:

Now I have been tasked with creating an alert that would trigger when the sum of both is over a certain amount.

Any ideas how i could do this? i've been kinda poking around creating an alert that would simulate it but any feed back or ideas would be appreciated!

Find more posts tagged with

Alert

sum

total bandwidth

report

Accepted answers

mesverrum

I feel like there is probably a way to make this happen through the GUI if you get very creative. I was considering building some kind of UnDP's and a transform so we could set an alarm when that combined value went above the threshold, and I'm pretty sure that would work but this SWQL based alert does it so much faster and isn't as complicated for you to set up on your end.

Go to alerts and set up a custom SWQL alert like so, and in the lower box paste in the text I have here

join (SELECT nodeid, sum(outbps) as [totalout]FROM Orion.NPM.Interfaceswhere (fullname like '%%%%%' -- FULL NAME OF FIRST INTERFACE HEREor fullname like '%%%%%') -- FULL NAME OF SECOND INTERFACE HEREgroup by nodeid) t2 on t2.nodeid=nodes.nodeidwhere t2.totalout>800000 -- SET BPS THRESHOLD HERE

This assumes that both interfaces are on the same node, if they weren't then it will get a little more complicated to write up the logic but in my test environment this works for what you have in your picture. If it was me I would probably include a link to that report as part of the message or include something like "Combined bps of WAN interfaces is ${SQL: SELECT sum(outbps) as [totalout] FROM Orion.NPM.Interfaces where (fullname like '%%%%%' or fullname like '%%%%%')}

You would also want to set up another alert for inbps to let you know if you were getting hammered on that end.

-Marc Netterfield

Loop1 Systems: SolarWinds Training and Professional Services

LinkedIN: Loop1 Systems
Facebook: Loop1 Systems
Twitter: @Loop1Systems

All comments

mesverrum

Go to alerts and set up a custom SWQL alert like so, and in the lower box paste in the text I have here

join (SELECT nodeid, sum(outbps) as [totalout]FROM Orion.NPM.Interfaceswhere (fullname like '%%%%%' -- FULL NAME OF FIRST INTERFACE HEREor fullname like '%%%%%') -- FULL NAME OF SECOND INTERFACE HEREgroup by nodeid) t2 on t2.nodeid=nodes.nodeidwhere t2.totalout>800000 -- SET BPS THRESHOLD HERE

You would also want to set up another alert for inbps to let you know if you were getting hammered on that end.

-Marc Netterfield

Loop1 Systems: SolarWinds Training and Professional Services

LinkedIN: Loop1 Systems
Facebook: Loop1 Systems
Twitter: @Loop1Systems

vjerez4129

Thanks! had to do some tweaking in it, but otherwise worked for me I had been working on a SWSQL query that got me generally what i wanted but i was still a bit confused on a few pieces of it. I had thought about creating a Undp for what i wanted like you suggested earlier, but i thought it would be nicer to create the query for it.