Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Is there a way of monitoring whether Alerting is paused via the "pause actions of all alerts" option? If someone leaves Alerting Paused for too long I would like to know about it.

Is there a way that I can set up an alert to monitor how long the Pause actions of all alerts has been on and then alert if it is for a certain amount of time? I want to stop alerting being muted after the patching window has closed due to people forgetting to resume.

Find more posts tagged with

Accepted answers

All comments

ericw

We are looking for an answer to this as well. Did you ever get a response?

KMSigma.SWI

You can query the Audit Log for this information:

SELECT [AE].TimeLoggedUtc
     , [AE].AccountID
     , [AE].AuditEventMessage
     , CASE [AE].Arguments.ArgsValue
         WHEN '0' THEN 'Alert Actions Enabled'
         ELSE 'Alert Actions Disabled'
       END AS [Action Status]
FROM Orion.AuditingEvents AS [AE]
WHERE [AE].AuditingActionType.ActionTypeDisplayName = 'Orion settings edited'
  AND [AE].Arguments.ArgsKey = 'CurrentValue'
  AND [AE].Arguments.ArgsValue IN ( '0', '1' )
ORDER BY [AE].AuditEventID DESC

KMSigma.SWI

This issue is that if the "Actions" are paused, you can never have an "Action" (send an email, etc.) to let you know.

ericw

Thanks for the query. It looks like it could work for me. I'll let you know how it goes.

chisle

so, If I build a report and use this SWQL, how do I select only the latest status (TOP(1) or LIMIT 1 doesn't work, and you can't switch to SQL...).

Sine alerts won't fire during a 'disabled' status, if instead we send out a report every x hours, we would like to see on that report what the status is: disabled or enabled.

Any ideas?

KMSigma.SWI

Why can't you use TOP 1? It's supported.

SELECT TOP 1 [AE].TimeLoggedUtc
     , [AE].AccountID
     , [AE].AuditEventMessage
     , CASE [AE].Arguments.ArgsValue
         WHEN '0' THEN 'Alert Actions Enabled'
         ELSE 'Alert Actions Disabled'
       END AS [Action Status]
FROM Orion.AuditingEvents AS [AE]
WHERE [AE].AuditingActionType.ActionTypeDisplayName = 'Orion settings edited'
  AND [AE].Arguments.ArgsKey = 'CurrentValue'
  AND [AE].Arguments.ArgsValue IN ( '0', '1' )
ORDER BY [AE].AuditEventID DESC

chisle

Bingo! Not sure why it didn't work when I inserted that 'TOP 1' but it works fine. Thank you. Now I can write my reports.