How do I create an alert for an OID that presents as an array?

I have a Palo Alto OID I am attempting to alert on. I created a custom poller, and it seems to be collecting the data as I expected. It is showing an array of integers, and for each backplane slot with active processors, I am getting a value, and the empty slots show the expected "0". AND Solarwinds has use the oid to find the name, and it is using sane looking labels. So the custom poller is working as expected.

For this node I'm testing, there are 8 cells in the array, and the values range from 0 to 3. The expected value is a 32 bit integer in the range of 0 to 100 (%).

In some nomenclatures, this array is hrProcessorLoad.1 through hrProcessorLoad.8. I attempted to create an alert that was based on the vendor AND hrProcessorLoad.1 >+ 40 OR hrProcessorLoad.2 >+ 40 OR ...hrProcessorLoad.8 >+ 40... So for all palo Alto's and any slot with over 40% cpu I want an alert.

This seems ok, but the summary page shows all nodes match (even though in reality none of my nodes is over 15% cpu on any slot, so clearly no nodes should be triggering the alert. So I am not creating a good alert.

Has anyone worked with a custom poller that returns an array? How do you build an alert for load on a slot crossing a threshold? I created this because the default Palo Alto processor load displayed by SolarWinds is *only* the management slot, which is useless, it is the one processor that isn't getting much use, and never will.

So hrProcessorLoad is collect an array, the data looks sane.

The 0 to 2 values are as expected from an idle node, and the desired alerting threshold is 40%. Some nodes will have only 1 or 2 slots, and those I will get zero's for the unused slots, and that is ok. How do I construct the alert?

Find more posts tagged with

hrProcessorLoad

custom pollers

OIDs that return array

Accepted answers

marlief22

Hi there,

The best way to do this would be through a custom SWQL alert, as their is no clear link for custom pollers for nodes unfortunately.

Have a look at the following query:

SELECT Nodes.Uri, Nodes.DisplayName, cpt.Status FROM Orion.Nodes AS Nodes
join Orion.NPM.CustomPollerStatusOnNodeTabular cpt on Nodes.nodeid = cpt.NodeID and cpt.CustomPollerAssignment.CustomPollerOid = '1.3.6.1.4.1.12356.101.12.2.1.1.4' --Change this to the OID for your tabular poller
where cpt.Status > 30000 --Change this to the value above/below/equal to your alert threshold

This can be used without the top line in the 'Custom SWQL alert' section of the Alerts area:

This should then create an alert on any NODES that have a poller that goes above that value you set.

Let me know how you get on.

Kind regards,

Marlie Fancourt | SolarWinds Pre-Sales Manager

Prosperon Networks | SolarWinds Partner since 2006

If this helps answer your question please mark my answer as confirmed to help other users, thank you!

keoki

Thanks for the tip there! I will test that and see how that works for me.

So I did create an alert that seems to work.

It turns out that the first value in the array is one I need to exclude from the alert, so an swql approach that allows me to drill down to the individual values is going to work best I think. So I think your approach will be a better starting point.

All comments

marlief22

Hi there,

The best way to do this would be through a custom SWQL alert, as their is no clear link for custom pollers for nodes unfortunately.

Have a look at the following query:

SELECT Nodes.Uri, Nodes.DisplayName, cpt.Status FROM Orion.Nodes AS Nodes
join Orion.NPM.CustomPollerStatusOnNodeTabular cpt on Nodes.nodeid = cpt.NodeID and cpt.CustomPollerAssignment.CustomPollerOid = '1.3.6.1.4.1.12356.101.12.2.1.1.4' --Change this to the OID for your tabular poller
where cpt.Status > 30000 --Change this to the value above/below/equal to your alert threshold

This can be used without the top line in the 'Custom SWQL alert' section of the Alerts area:

This should then create an alert on any NODES that have a poller that goes above that value you set.

Let me know how you get on.

Kind regards,

Marlie Fancourt | SolarWinds Pre-Sales Manager

Prosperon Networks | SolarWinds Partner since 2006

If this helps answer your question please mark my answer as confirmed to help other users, thank you!

keoki

Thanks for the tip there! I will test that and see how that works for me.

So I did create an alert that seems to work.

keoki

Ok, I am able to make a query using your example, and interestingly it seems to work the same as the solution I tried before.

I have this code I'm testing with:

join Orion.NPM.CustomPollerStatusOnNodeTabular cpt on Nodes.nodeid = cpt.NodeID and cpt.CustomPollerAssignment.CustomPollerOid = '1.3.6.1.2.1.25.3.3.1.2'
where cpt.Status > 20

This is triggering on 1.3.6.1.2.1.25.3.3.1.2.1, and that is the management CPU, and is to be expected. However the threshold for the management processor at 1.3.6.1.2.1.25.3.3.1.2.1 is already monitored, and should be set to a very high value. However the porocessor load values for 1.3.6.1.2.1.25.3.3.1.2.1 are not what we are looking for, what we want to alert on is 1.3.6.1.2.1.25.3.3.1.2.2 through 1.3.6.1.2.1.25.3.3.1.2.8

I tried using the value 1.3.6.1.2.1.25.3.3.1.2.2 for the OID, to capture a specific slot CPU average, and it sees nothing, I set the threshold to 0, so it should trigger on all nodes with ANY load on the cpu's in slot2 (there should be around 100) but it reports zero nodes would trigger, so that isn't going to work. What do I need to do to alert on rows .2 to .8 at one threshold, while using a different threshold on .1?

I tried to create custom pollers for each row of the array but that wasn't working for me. How can I evaluate only the second through 8th array rows?

keoki

I found two ways to alert on an array. Marlie's method is superior as it is more flexible. I simply found array options in the ui, very simple limited options.

Now to figure out how to access individual cells of the array next...