Custom Alert Message using Variables and/or SWQL

So what I'm trying to do is create an alert for when Agent Status is not equal to running, which is fine, but I also want the Alert Message to show the Agent Status Message so I can quickly see what reason the Agent is not running.

When you create the alert the fifth section allows you to configure trigger action and to show a custom message when the alert is triggered.

I can use the following built-in variable to get Agent Status but this just returns the Agent Status ID, which is no use.

${N=SwisEntity;M=AgentStatus}

What I want to be able to do, but doesn't work is this: -

${N=SwisEntity;M=AgentStatusMessage}

Looking at other forum posts I see suggestions about referring to Orion SDK Schema but I don't see how I can reference any data using SwisEntity, I've tried all the following but none of these work: -

${N=SwisEntity;M=Orion.AgentManagement.Agent.AgentStatusMessage}

${N=SwisEntity;M=AgentManagement.Agent.AgentStatusMessage}

${N=SwisEntity;M=Agent.AgentStatusMessage}

${N=SwisEntity;M=AgentStatusMessage}

So then I look to SWQL as I know from SWQL Studio that I can reference the correct information but if I use SWQL in variable, I cannot seem to pass NodeID to the WHERE clause so I cannot get it to return the correct information for Node that generated the alert.

This does nothing: -

${N=SWQL;M=SELECT OAM.AgentStatusMessage FROM Orion.AgentManagement.Agent OAM WHERE OAM.NodeId = ${N=SwisEntity;M=NodeID}}

This only resolves the NodeID but doesn't process the SWQL query: -

${N=SWQL;M=SELECT OAM.AgentStatusMessage FROM Orion.AgentManagement.Agent OAM WHERE OAM.NodeId = ${NodeID}}

So I get back this: -

${N=SWQL;M=SELECT OAM.AgentStatusMessage FROM Orion.AgentManagement.Agent OAM WHERE OAM.NodeId = 763}

If I don't use a WHERE clause the SWQL works but obviously the information returned is just from the first node, not the node that generated the alert.

${N=SWQL;M=SELECT OAM.AgentStatusMessage FROM Orion.AgentManagement.Agent OAM}

Returns: -

Agent is running

So how on earth can I get this Agent Status Message to populate in the Alert Message?

What is the point of being able to use SWQL/SQL statements in variables if you cannot pass anything into the query?

Am I missing something?

BTW I did raise a case with SolarWinds for this too but I just got a reply saying they don't support help with SWQL queries. Even though strictly speaking its not help with the query I want, I just want better documentation/syntax information to correctly construct this custom variable.

Cheers for help

Message was edited by: Anthony YatesCorrected SWQL statement

Find more posts tagged with

alert message

SWQL

custom variable

Accepted answers

m_roberts

Am not in front of Orion to check this, but 2 observations:

1. What Object are you defining under the Trigger Condition tab? this can play havoc with custom queries as the variable structure can be completely different dependant on object types

2. Following on from my first point, you can see in Rene's response, his variable is different from yours - ${N=SwisEntity;M=NodeID}} vs ${NodeID}}. this could be due to the object type issue, where the wrong variable structure is being used for the object type selected.

Update the variable value and recheck

All comments

rfroembgen

Hi there,

as you already mentioned you get the variable back (the NodeID) from the Agent actually triggering your alert. The Problem is your WHERE-Clause. You're getting the NodeID from the variable, but you are not telling Solarwinds in which coloumn to look at.

So your query should look like this: ${N=SWQL;M=SELECT OAM.AgentStatusMessage FROM Orion.AgentManagement.Agent OAM WHERE OAM.NodeID = ${NodeID}}

That will return the Information you are looking for.

Best Regards

Rene

anthony.yates

Hi rfroembgen,

Thanks for info, that was actually a mistake in my initial post, I did edit the post with the correct SWQL statement, but was not quick enough before you made your reply, sorry.

The query still does not work: -

${N=SWQL;M=SELECT OAM.AgentStatusMessage FROM Orion.AgentManagement.Agent OAM WHERE OAM.NodeId = ${NodeID}}

returns: -

${N=SWQL;M=SELECT OAM.AgentStatusMessage FROM Orion.AgentManagement.Agent OAM WHERE OAM.NodeId = 763}

Anthony

rfroembgen

Hi Anthony,

no worries, then your SWQL-Statement in general is correct.

I just created an alert to test it. With this query:

${N=SWQL;M=SELECT OAM.AgentStatusMessage FROM Orion.AgentManagement.Agent OAM WHERE OAM.NodeId = ${N=SwisEntity;M=NodeID}}

I get the an email with the message "Agent is running" within the email.

So im wondering why its not working for you. Which version are you running?

Best Regards

Rene

m_roberts

Am not in front of Orion to check this, but 2 observations:

1. What Object are you defining under the Trigger Condition tab? this can play havoc with custom queries as the variable structure can be completely different dependant on object types

Update the variable value and recheck

anthony.yates

Our version details: -

Orion Platform 2019.2 HF2, NPM 12.5, NTA 4.6.0, VMAN 8.5.0 HF1, SAM 6.9.1, NetPath 1.1.5

For me whether its in the agent message in the active alert list or sent via email I just get the whole variable statement in the message.

It's just odd that as soon as I take out the WHERE statement it correctly process the SWQL.

The problem seems to be having the nested variable that causes it to fall over.

anthony.yates

I have Agent as Trigger Condition.

If I just set email to have the following: -

${N=SwisEntity;M=NodeID}
${NodeID}

I get the following in the message or email: -

${N=SwisEntity;M=NodeID}

763

anthony.yates

Ah excellent, I changed the trigger from Agent to Node and now it works!

Also both those variables I previously mentioned now return a NodeID

Thanks for your help.