Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Help with custom Alert - Muted Node without End-date

Good afternoon everyone!

I working on an alert to trigger whenever a user mutes a node without specifying a end-date. I tested the following SWQL query in SWQL Studio:

SELECT Nodes.Uri, Nodes.DisplayName FROM Orion.Nodes AS Nodes

Join Orion.AlertSuppression n on n.EntityUri=Nodes.Uri

where n.SuppressUntil is NULL

It successfully provides me a list of nodes muted without an end-date. When I popped into the alert I attached to this thread, it even gives me a warning about the nodes listed as objects that will be triggered immediately. However nothing happens when I make it active. I expected it to pop up as an active alert, what have I done wrong? I would appreciate any advice that anyone can provide. Thanks!

Muted+Node+(No+end+date).xml

Find more posts tagged with

Accepted answers

majames84

Ok everyone, I appreciate all the attention this got and with some additional time to think about it, I got it figured out. I just needed to target the audit events opposed to the nodes themselves.

SELECT * FROM [dbo].[AuditingEvents]

Where AuditingEvents.AuditEventMessage like '% muted alerts on %' and TimeLoggedUtc > DATEADD (minute, -1, SYSUTCDATETIME())

Problem solved! Now I have an alert that will trigger every time a user fails to schedule end time for muting a node. I appreciate everyone's help!

Muted+Node+(No+end+date)(1).xml

All comments

brscott

No, I had the same issue. Everything is working as expected. Your alert is perfect, the condition is met, then the next step is to see if the node is muted, which it is, so the alert doesn't fire.

I had to end up writing a script using the API to check for this and create tickets in our helpdesk system. It would be nice to have a checkbox on the alert like "always alert even on muted nodes or applications"

majames84

Ah ok.... that makes sense. I'll have to find another solution. Thanks!

brscott

And to just head off the question "Why would you want to alert on muted nodes?"... because people will mute them and forget to unmute them.

So yes, if you mute the node (without a schedule) you will get called. If you mute the node with a scheduled end date more than two weeks out, you will get called. Muting is for production nodes that you want to work on for a reasonable, temporary time and not get called. If it can be down for more than two weeks, then it's not a production server and you need to set the custom properties accordingly. Yeah go ahead and roll those eyes at me...

majames84

That's exactly why I am trying to find a solution. I got called into my boss' office to explain why monitoring was broken. It wasn't broken, but a tech had muted a node forever and thus it never alerted. I'd love to just disable the mute and unmonitor option entirely (not the schedule part, just forever part). I've thought about doing some custom coding to remove it, but I'd have to reapply every time I update the software.

mesverrum

Why not just generate a dashboard or a report displaying all these unmuted objects? I add unmanaged or muted objects lists to every team dashboard that way they know they are responsible for their own stuff.

majames84

Ok everyone, I appreciate all the attention this got and with some additional time to think about it, I got it figured out. I just needed to target the audit events opposed to the nodes themselves.

SELECT * FROM [dbo].[AuditingEvents]

Where AuditingEvents.AuditEventMessage like '% muted alerts on %' and TimeLoggedUtc > DATEADD (minute, -1, SYSUTCDATETIME())

Problem solved! Now I have an alert that will trigger every time a user fails to schedule end time for muting a node. I appreciate everyone's help!

Muted+Node+(No+end+date)(1).xml