We are trying to pull the Alerts and Events from the SolarWinds platform in the form of the Incidents for our product. It uses a polling mechanism to fetch incidents based on a checkpoint mechanism which usually uses the timestamp. To avoid duplication of incidents we are using AlertActiveID/EventID instead of the TriggeredDateTime/EventTime.
Can anyone from the team please confirm whether the AlertActiveID and the EventID are changeable or not?
Also is it a part of SolarWinds Orion's business logic that the IDs are auto-incremented?
Please refer to the below SWQL queries for reference:
Query to fetch Alerts:
SELECT A.AlertActiveID
, A.AlertObjectID
, A.Acknowledged
, A.AcknowledgedBy
, A.AcknowledgedDateTime
, A.AcknowledgedNote
, A.TriggeredDateTime
, A.TriggeredMessage
, A.NumberOfNotes
, A.LastExecutedEscalationLevel
, A.DisplayName
, A.Description as AlertDescription
, A.InstanceType
, A.Uri
, A.InstanceSiteId
, B.AlertID
, B.EntityUri
, B.EntityType
, B.EntityCaption
, B.EntityDetailsUrl
, B.EntityNetObjectId
, B.RelatedNodeUri
, B.RelatedNodeId
, B.RelatedNodeDetailsUrl
, B.RelatedNodeCaption
, B.RealEntityUri
, B.RealEntityType
, B.TriggeredCount
, B.LastTriggeredDateTime
, B.Context
, B.AlertNote
, C.AlertMessage
, C.AlertRefID
, C.Name
, C.Description as ConfigurationDescription
, C.ObjectType
, C.Enabled
, C.Frequency
, C.Trigger
, C.Reset
, C.Severity
, C.NotifyEnabled
, C.NotificationSettings
, C.LastEdit
, C.CreatedBy
, C.Category
, C.Canned
, D.ResponsibleTeam
FROM Orion.AlertActive AS A
INNER JOIN Orion.AlertObjects AS B
ON A.AlertObjectID = B.AlertObjectID
INNER JOIN Orion.AlertConfigurations AS C
ON B.AlertID = C.AlertID
INNER JOIN Orion.AlertConfigurationsCustomProperties AS D
ON C.AlertID = D.AlertID
WHERE A.AlertActiveID > @AlertActiveID
Query to fetch Events:
SELECT A.EventID
, A.EventTime
, A.NetworkNode
, A.NetObjectID
, A.NetObjectValue
, A.EngineID
, A.EventType
, A.Message
, A.Acknowledged
, A.NetObjectType
, A.TimeStamp
, A.DisplayName
, A.Description
, A.InstanceType
, A.Uri
, A.InstanceSiteId
, B.Name
FROM Orion.Events AS A
INNER JOIN Orion.EventTypes AS B
ON A.EventType = B.EventType
WHERE A.EventID > @EventID