Alert when an Element is Muted

I am trying to create an alert to trigger if any object is set to Mute. I have the report that looks good but now I want an alert. Any ideas would be helpful.

Find more posts tagged with

muted

npm

Alerts

Accepted answers

marcrobinson

You can do this via the normal web alerts too. See image below, you may want to delete the unmanaged conditions. This works pretty well for me. The trigger action sends an email with the audit message. THe message includes who and what. Here is the variable string that I use:

${N=SwisEntity;M=AuditEventMessage} on ${N=Generic;M=DateTime;F=DateTime}

Trigger condition:

All comments

KMSigma.SWI

This is a non-trivial request because the only place that the mute 'action' is stored is in the Auditing tables as far as I know. The Auditing tables aren't directly accessible by the alerting engine - because they aren't 'things' that you are monitoring. You can look in the AlertSuppression tables which have some of the info you might want, and that's where I went with this build out.

I took a stab at seeing if I could link the things and you can, by using a Custom SWQL query. I have not tested this, but it should work. The alert message (email you send) would need significant work to get it to something that's useful to the recipient.

Create a new Alert.
Name it whatever you like, but use a meaningful name and description. I'd also change the Evaluation frequency to something other than 1 minute. I can't imagine that you've so many that you need to worry about.
Under Trigger Conditions, select "Custom SWQL Alert (Advanced)" for the "I want to alert on."

Leave the Condition type as Node (You'd have to repeat this process for Groups, Applications, and Interfaces) and in the lower section of the query put:

-- Copied From 'upper' condition
-- SELECT Nodes.Uri, Nodes.DisplayName FROM Orion.Nodes AS Nodes
--
-- Lower Portion
INNER JOIN Orion.AlertSuppression AS Muted
ON Nodes.Uri = Muted.EntityUri

This is doing a VERY simple check. If a Node is listed in the AlertSuppression table, then trigger. It does not care about time, expiration, or anything else.

Like I said, it should work as a trigger condition. The rest (Reset condition, Trigger/Reset actions, etc.) would vary based on your needs and it gets very complex to try an go through the Audit tables via the alerting engine.

I'm also attaching an export of this alert that I built. Again note that this is NOT tested.

[View:/cfs-file/__key/communityserver-discussions-components-files/47/Alert_2B00_me_2B00_on_2B00_a_2B00_muted_2B00_thing.xml:640:480]

marcrobinson

${N=SwisEntity;M=AuditEventMessage} on ${N=Generic;M=DateTime;F=DateTime}

Trigger condition:

lmangum

This worked perfectly! I tried the first suggestion but was having trouble with it firing the Alert consistently, this works everytime! thank you

KMSigma.SWI

Definitely go with @marcrobinson's response. I wasn't aware that the Audit logs were part of the default options for web based reporting. That was an oversight on my part.

hnz980

Hi,

I did exactly what you mentioned.

Having trouble firing the alert.

Orion Platform HF3, IPAM, SCM HF2, NCM HF1, NPM HF3, PM HF1, NTA HF2, VMAN HF3, SAM HF3: 2020.2.6