Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Alert for agents not responding?

Background:

About 5 years ago this post appeared: https://thwack.solarwinds.com/product-forums/the-orion-platform/f/alert-lab/10442/alert-on-agents-not-responding/188970#188970 and it referenced some queries you could run to determine when a server was not able to be polled for data. It used CPU data to basically look for "no more CPU data is coming in" and with some work you could make an alert in Orion if the server in question had not posted (had collected) CPU data in some time (I custom tuned my query for several hours, to allow for server work/booting/normal downtime so my exact query is not in the link above).

I am making a new post for this question as for some reason people really get miffed when you reply to an "old post" and resurrect it. To me "old" isn't 2 years old...but I digress...

Recently, some of my reporting/alerting/queries started failing. It appears the 'CPULoad_Detail' table in the Orion database no longer exists that was referenced in the above link.

Question: Is there a new or updated query (like the ones in the URL above) to detect when nodes are not able to be pulled for data or a specific statistic?

Using a query to detect CPU data "missing" appeared to work very well as at times other statistics would report stats (like interfaces) but CPU and often memory would not. Additionally sometimes there are issues with the server where the IP address "pings" but data is not able to be collected. It's usually a WMI issue, or something impacting WMI, but also sometimes DNS/IP changes, etc where the IP responded to ICMP Ping to a different host using that IP that Orion could not pull data from.

Find more posts tagged with

Accepted answers

All comments

KMSigma.SWI

Something like this?

SELECT [Agent].Name
     , [Agent].Hostname
     , [Agent].DNSName
     , [Agent].IP
     , [Agent].OSVersion
     , [Agent].Node.Caption
     , [Agent].Node.LastSync
     , [Agent].Node.Status
FROM Orion.AgentManagement.Agent AS [Agent]
WHERE [Agent].Node.LastSync

This should show nodes that have agents installed where they haven't sync'd in the last 24 hours.

chucksimalchik

I make use of that alert structure and found that I had to change the table to CPULoad_CS_cur after one of the more recent upgrades.

To be honest over the years the alert was semi-unreliable, but has gotten much better in the incarnation I've currently got running shown below. It doesn't isolate to just agent nodes. Works for us in our environment, but as always, YMMV.

SELECT Nodes.Caption, Nodes.NodeID FROM Nodes

left join (select CPULoad_CS_cur.NodeID, MAX(CPULoad_CS_cur.Timestamp) as LastCPU
from CPULoad_CS_cur
group by CPULoad_CS_cur.NodeID) c1
on Nodes.NodeID = c1.NodeID
where
Nodes.Status = 1
and Nodes.UnManaged = 0
and Nodes.IsServer = 1
and DATEDIFF(mi,c1.LastCPU, getdate()) > 30

KMSigma.SWI

Yeah - your query above is in SQL, and the SQL data structures are not guaranteed to 'stick' between versions. That's why the query I provided was written in SWQL (SolarWinds Query Language) which doesn't care about the underlying SQL tables/views.