is there an easy way to replace his email address with mine on the alerts. He has about 100 different alerts.
There may be a way to do it via SQL if he entered it in to every alert. But you'd have to look at the ActionDefinitions Table (if he was using Advanced Alerts). First you'd run something like select * from ActionDefinitions Where ActionType = 'Email' to find one of the alerts that had his email address. Make note of the field content, it should have something like:
To:hisemail@youdomain.com CC: BCC: SMTPServer:yourSMTPserver SMTPPort:25 EnableSSL:False Format:HTML
You would then run something like this:
Update ActionDefinitions Set Target = 'To:youremail@yourdomain.com CC: BCC: SMTPServer:yourSMTPserver SMTPPort:25 EnableSSL:False Format:HTML'
Where ActionType = 'Email'
Please note, this would change all the EMAIL actions that are defined. Otherwise you'd have to change each alert in the Alert Manager.
Regards,
Matthew Harvey
Loop1 Systems
http://www.loop1systems.com
to piggyback off mharvey...
Where ActionType = 'Email' and
Target like '%<old admin's email>@yourcompany.com%'
it is definitely more difficult to find/replace just that email. If I have time, I'll work on it though and post back.
That's for the info. I think this device is running the 2005 SQL server. I'm not an SQL type person. So I'm kind of lost with the info you guys posted. : )
do you have a SQL DBA that you go to for the database part of your implementation?
They'd run it for you if it is not supposed to be you
You'd want to work with them to ensure you don't reset all of the entries that may not match the same, again, they should be able to help you with that.
What you would need to do is either use SQL Management Studio Express, or the Orion Database Manager (found on the Orion server in Start > All Programs > SolarWinds Orion >Advanced Features. You can then connect to the database, expand the database to see the tables, right click on any table, then choose Query table. Copy either query in and hit refresh to run it. Although, if you are too unfamiliar with it, do you have a DBA that can assist?
No DB admin, I'm all by my self. Solarwinds came in and set this up for them. I was going to go into each alert and add my name but I'm getting an error with that also.
What error are you getting?
great point mharvey, I forget about that tool.
Chris, I'll try and make time to do the sql that will replace his email and leave the rest in tact. that would probably be useful to others as well.
Thanks for the help
I just emailed you guys with a word doc with the error.
I could not see where to uplaod a word doc.
Doing some testing on this end with a DB I can thrash using this as posted by njoylif will replace the email you are trying to replace in one fail swoop without causing any issues.
Your error is due to custom properties that were setup in the alert that are no longer showing. Here are quick steps on correcting that.
I would highly recommend you using a Group E-Mail so you can updated the group in the future to include or take out a member from alerting.
Now for your error. I'm not sure how the alert was every working and allowed to be saved unless you added those conditions after the Interface Status is equal to Down.
Basically you have incomplete trigger conditions, and or bad logic.
* is equal to yes
* is equal to Mexico City
* is equal to LAN
These are bad. You basically are trying to say "Anything/Field" is equal to yes, Mexico City, and LAN. Define what is equal to those values, or take them out if you don't need them and it would fix this issue. They look to be Custom Properties that were added. If so you need to define what Custom Property Column would have the value you are looking for. Hope this help I will give you an example below using your values, but keep in mind this is an example since I don't know your custom properties.
Trigger Alert when "all" of the following apply
Interface Status is equal to Down
Switch is equal to Yes
Branch is equal to Mexico City
Network Area is equal to LAN
Using this model you can see I have defined what Column from the DB custom properties should match the values Yes, Mexico City, and LAN.
If these were custom properties that just lost the schema (such as if the old admin installed under his account, and you are logging under yours) then the schema update I posted above will resolve the conditions and correct the error.
This is why I only allow a singular admin account to be used to control functions of Orion. When someone builds stuff this way and leaves disaster can happen once that account is deactivated.
OK so I contacted my intel/AD/programming guru. He was showing me some stuff. The real problem is the HDD with the database is full and seems to have stop working September 22. So he/I are running a data base cleanup and integrity check on the data base. He also showed me and gave me access to the perfmon data base and I now kinda understand what it is you guys are trying to get me to do. Once we get this thing cleaned up a bit I will ping ya all. I have another question since we started looking at the data base. My config manager data base is like 28 gig. Do you think this is normal or are we saving like 5 years of device configs?
I'd say that's exceptionally large. you can run a job to prune all but xx configs (check requirements for compliance and auditing first though).
I agree, seems large, but it depends on number of devices you were backing up as well.
I just want to add.. That's an intense amount of config files.. Even more so if they are mainly Cisco devices.. Firewall configs can get big, but router configs are generally not that big when you aren't including the routing table. They are only text files in the end.
If it's for compliance then I would say you are WAY in compliance!
We have maybe 200 Cisco router and switches, No firewalls.
I would like to only keep 1 years worth of data.
Hi Chris,
I'm assuming you are refering to Orion. The steps below are based on Solarwinds Orion Core 2012.1.1. Other Orion versions should be similar.
1. Log onto the Orion server
2. Select Alerting, reporting and Mapping
3. Click on the type of alert you have either Basic or Advanced. I'm using basic for this example.
4. Click on View -> Configure Alerts
5. Highlight the alert you wish to modify
6. Go to the Actions tab
7. Modify the email address as you wish and then click Done till you back out to the main screen
For that you'd need to open the NCM Configuration Manager GUI and go through the Purge Configs job. You can actually automate this to purge anything older than 1 year.
Mharvey....Nice... I will try that after the database clean up.We are setting up a mail distribution list. So we will change the name to like solarwinds@campbell_soup.com.
Then add the network people to it. The problem is all the remote sites want emails also. So there names are site specific, hence all the alert triggers.
But we will work through this part first. BTW I was able to change one entry in the database table. I did it manually. But at least I could change it. So i'm hoping that when the database is fixed the trigger might get fixed. : ) lets hope at least.
Thanks but you missed the first part of the string.
Glad to hear you are making progress. For the site specific ones, here's a thought.
Go into the custom Property editor ( in Start >All Programs > SolarWinds Orion > Grouping and Access Control)
Create a new Node Property, choose the option to build a property from scratch and make SiteContact, keep it as a text value.
Once created click on Nodes, and put in those persons email address there.
Once that's configured, within the email action you can use ${SiteContact} as a variable in the To field.
This will then pull the value from the custom property for the specific node, and email that person. Then in the future if someone leaves, then it's easier to update a custom property for those remote sites, by changing the custom property value, rather than editing each alert for each site.
Yeah I realized that after I hit reply.
I would like to thank you all for trying to help out. I opened a case with solarwinds. With the help of my AD guy we were able to see that PolicyCacheResults is 15 gig with a 2 gig index. The old admin had a clear old configs job and he only keep the last 10 configs. I do not have enough disk space to do a clean up of the data base. The rabbit hole is getting very deep at this point and I keep getting pulled in further and further : ) But that is why we get paid.
Are you trying just to delete the PolicyCacheResults? If you don't need this data (which I believe can be re-added by running policy reports) a truncate command may work, even with the space issue. It will wipe all the data from the table without the same amount of transactions as a delete. The command would be Truncate table PolicyCacheResults.
I think I need some of the data for Audit compliance.
You can still get the data back by running the policy reports. This is older data that may no longer be relevant. Rerunning the reports once the table is cleared will repopulate the data.
Ugh...100 alerts sent to an individual...this is why I love using groups wherever possible.
Definitely setup the alerts to a distribution group instead of your e-mail address if you have not already.
Hope the DB cleanup is going well!
OK database is cleaned up and we have 26 gig of disk space. So now I'm back to my original problem and I'm hope to beable to run the
But I do not 100% understand what your telling me to do. Here is the current cc
To:oneil_brown@campbellsoup.com, bill_blue@campbeelsoup.com,charolette_howard@campbellsoup.com
CC:
BCC:
SMTPServer:smtpna02.soups.com
SMTPPort:25
EnableSSL:False
I also got a red check mark when I did it by hand. It didn't clear until I updated the title also.
Send E-Mail/Page to oneil_brown@campbellsoup.com, bill_blue@campbeelsoup.com,charolette_howard@campbellsoup.com
So if I run what you put in earlier will it wipe out the other people in the cc list and server info?
so for this, you would do similar to what we put, however with some exceptions. so you'd have
But if there is information in the CC, then put that into the Cc Here. If not, if it's just tha bove and your are replacing Oneil it would be
Update ActionDefinitions Set Target = 'To:youremail@campbellsoup.com, Bill_Blue@campbellsoup.com, Charlotte_Howard@campbellsoupc.om CC: BCC: SMTPServer: smtpna02.soups.com SMTPPort:25 EnableSSL:False Format:HTML'
This way it keeps the remainder of the configuration you have when you run this query using the Database Manager.
The problem is every alert has different people in it. But Oneil was the first one in every alert. So I need to replace o'Neil but keep all the different folks in the alerts.
ah, that makes it fun . I'll have to think about if there's a way to replace one value out of many. Will have to test on my garbage DB. I'll let you know what I'm able to find out.
So from what I can find there isn't just one query that would only replace his name and keep the remainder. Unfortunately due to the way the data is added into that one column, you'd have to copy the target column from each one, use that in an update query, and have to update each action one at at time. This would essentially be the same as updating the alerts one at a time in the Alert Manager just with more complications.
I was afraid you were gonna say that : ( Oh well.
So i'm going to wait for the distribution list to be made from our mail folks and start to do it manually.This surely has been interesting to say the least. I still have the problem with the invalid trigger.
The machine is running poorly, all the memory on the machine is used up.I need to move the data base off of this machine and I have never managed a solarwinds server before..How did I get my self into this mess...LOL..
give me this weekend to try and build something automated in SQL. If you don't hear back, I didn't get a chance.
Managing is the easy part. It's the problems that make it seem worse than it is. Did you run through the custom property steps I put earlier in the thread for the invalid trigger? Easy way to move the database is first, stop all SolarWinds services. Once done, use the Database Manager to make a backup of the database. If you are able to identify a new SQL server, take the new backup (will have a .BAK) and move it to the new server. Using the Database Manager you can connect to that new SQL server and restore the backup. Once done, run the Orion Configuration wizard (Start > All Programs> SolarWinds Orion > Configuraiton and Auto-Discovery), choose all three options (Database, Website, Services), and connect to the new SQL server. Choose the defaults for the rest. This should help with the memory issue at least.
@njoylif i'll wait for as long as it's needed... : )
@mhavey I did do the steps you out lined earlier and it did not help. But maybe I did something wrong. i will go back over them again.
I'm not sure but we thought maybe the wacked out database was causing problems. As for the moving of the data base we will be doing that some time down the road soon so thats for the direction. This should help with the machine bogging down. This is running on a vmware instance with the databse, NPM and NMC all running on one machine.
Until you are able to move the database, if you are able to, since this is a VM you may want to see about adding more disc space if it is available.
I did the custom properties again and it is still failing the same way.
I followed the custom properties again and it is still failing the same way. I sent you the word doc.
Chris,
It would almost seem like the alert was made of custom properties that were deleted............Not trying to assume something bad here about what happened before you took over. You may have to rebuild this conditions.
Don't worry you will get through it even if you had to go through it 1 by 1. I had to do the same thing in the environment I took over except all of the alerts this company pre built were all Basic!!! Ugh.. talk about a headache. I had to custom build all 200 plus alerts in the advanced alert manager. The plus side to this was it allowed me to document all my work and alerts for future reference if I'm no longer managing the system.
Documentation is priceless. Just look at it like that. You get to come in and clean up the solution and provide proper documentation and building to your liking. Once you're done the satisfaction of providing a solution at the highest level of implementation is very rewarding.. Just wait till your management team sees the final product and what a clean and fully thought out set up of SolarWinds can do for them.
I took a 4 year build out that was never finished here at my company. Completely scrapped it and started over on my Node management and alerts. Now that it has been rebuilt I have been able to completely turn off the Half-Ass implementation of HPOV they had as well, and given our entire IS department visibility to the infrastructure in a clean and efficient manner. I did this in 2 months what they were working on for 4 years.
Because of this I now have secured a 100k budget for next year to build on top of NPM/SAM/NCM with SEUM/Storage Manager/VM Manager..
Keep plugging away and give any of us a shout when you need it.. This is by far the best product forum that I have been a part of, and use it extensively.
Sounds like it.. Can you open the Custom Property editor and see if you even have any properties filled with those values we were talking about earlier. Mexico City, LAN, etc... If you don't see any fields with these labels then is correct and the entire Custom property has been removed, and will need to be added back and re-populated to get these to work again.
Here you go - 2 SQL scripts, one for testing and one for updating.
These will run through alertDefinitions table and replace any instance of <a@b.com> with <x@y.net> in the "target" column
Let me know how it works!
http://thwack.solarwinds.com/docs/DOC-167531
Hi Chris welcome to thwack and the SolarWinds Community!
I'm a UX Researcher and my job is to work with our users to understand how to make our products easier to use, more useful, more efficient--and to create better experiences with anything SolarWinds. We do lots of different types of activities and feedback sessions where we solicit input from our users on early designs of new features, entirely new products, revised features etc. And--we have several opportunities coming up for NCM and NPM feedback, especially from new users. You can read the snippet below for details of the most pressing activity, friend me directly or send me an email to learn more.
The UX (user experience) team is running 60-minute feedback sessions where you can take a look at some concepts for scheduling jobs in NCM and give your thoughts on the early sketches. If you currently run scheduled jobs in NCM, and ideally, if you have more than one poller (but not a requirement), we'd love to talk to you! Sessions will be any hour at your convenience on any of the following 3 days:
any time between 8:30 am Central time and 12 noon Central time. Please email Kellie at kellie.mecham@solarwinds.com for more information or to schedule a date and time. Each participant will receive 2,000 points in the thwack store! NCM
