Filter Node for Down node more than 1 hour

Hi All,

I want to make a view of Node List (Resources: All Nodes) in Orion NPM, but only show down nodes that already down for 1 hour. So can anyone please help to build the filtering SQL?

The only SQL I know is to filter down node "Status=2", but I still got no clue to filter the SQL for condition this 'more than 1 hour'

Really appreciate for your help. Thanks a lot

Find more posts tagged with

view resource

npm downtime

Accepted answers

All comments

d09h

I think you would find it easier to define an alert and show the alert status instead.

Use duration in the alert trigger - SolarWinds Worldwide, LLC. Help and Support

I am sure there is a SQL way or SWQL way too.

bobmarley

If you search for 'Node Down Time' you will get several different correct answers with different ways to do it.

Or here is one I used:

syarifuddin

Hi d09h,

Thanks for the advice. But if I want to make a view of 'Active Alert' resource that shows alert for specific nodes only, for example just Alert for vendor Cisco, is the a way to create it?

Actually in the account, it has several products, and my user wants to separate the resource view

d09h

syarifuddin wrote:
Hi d09h,
Thanks for the advice. But if I want to make a view of 'Active Alert' resource that shows alert for specific nodes only, for example just Alert for vendor Cisco, is the a way to create it?
Actually in the account, it has several products, and my user wants to separate the resource view

Yes. Build your conditions (vendor = Cisco) into your alert definition.

syarifuddin

Hi bobmarley,

Thanks a lot for the info. In think that's a good alternative to show the nodes with problem and short it by 'last changed' time.

I'll surely take your suggestion to note for now, while waiting for others opinions to see if there is another good suggestions or maybe an exact answer I'm looking for

Warm regards

syarifuddin

But, how about the other alerts? For example I have 2 different alerts. 1 for cisco and 1 for MikroTik for example. Wouldn't it show both alert in 1 view? resource?

The thing is I want to create are 2 active alert resources where the 1st one will show just alert for Cisco, while 2nd one will show alert for Mikrotik only.

conguir

something like this will show you which nodes have been down for more than one hour:

SELECT n.caption,n.ip_address, n.vendor, avg(rt.availability) FROM ResponseTime rt inner join nodes n on rt.nodeid = n.nodeid

where datediff(minute,rt.datetime,getdate())<60

group by n.caption,n.ip_address, n.vendor

having sum(rt.availability)=0

Raul Gonzalez

Prosperon - UK SolarWinds Partners

Installation | Consultancy | Training | Licenses