Unique Reference or unique id for every alert?

Are there any ID's for an alert that uniquely identifies each alert, so that I can store the ID and fetch the same alert in the future for investigation.

If there are combination of ID's that can be used to form an unique ID will also be helpful,

and also It's getting really hard and pain to understand what are all these ID's and what do they reference and cross reference,
AlertActiveID, AlertObjectID, AlertID, AlertRefID, NodeID, objects, definations and so on,

Please explain me like I am 5 year old, or in very simple general words.

Find more posts tagged with

Alerting

Alerts

Accepted answers

m_roberts

Yes, each Alert has a unique identifier. In the SWQL Entity Orion.AlertActive, you will see a column called AlertActiveID

You can include this value in the Alert Actions output, but using the following variable: ${N=Alerting;M=AlertActiveID}

For your reference, the database still contains tables and therefore ID's that relate to the old Alerting engine and can be ignored.

I hope this helps.

m_roberts

This is where the SWQL Studio is useful, as this is kinda documented, where the entity structure includes the cross navigation linkage. This allows you to see the relationships across entities (tables). A full schema diagram would indeed be lovely, but you can accomplish what you need much of the time using this method.

Glad to hear this helped.

All comments

m_roberts

Yes, each Alert has a unique identifier. In the SWQL Entity Orion.AlertActive, you will see a column called AlertActiveID

You can include this value in the Alert Actions output, but using the following variable: ${N=Alerting;M=AlertActiveID}

For your reference, the database still contains tables and therefore ID's that relate to the old Alerting engine and can be ignored.

I hope this helps.

network_noob

Once the alert is cleared, can I refer back to the same alert using AlertActiveID? if not they how I will refer back to that particular alert in the future if I have it's AlertActiveID.

m_roberts

The AlertActiveID is also within the Orion.AlertHistory, which has a navigation path in SWQL to Orion.AlertObjects based on the AlertObjectID, which in turn has navigation to Orion.AlertConfigurations so you can see with both of these the object in question and the alert definition.

The following is an example quick and dirty query to hopefully give you some direction on what you may wish to achieve. Note: this uses SWQL navigation rather than JOINS, as that is my preference, but JOINS can be used too.

SELECT TOP 100 h.Message, h.Timestamp, h.AlertObjects.EntityType, h.AlertObjects.EntityCaption, h.AlertObjects.RelatedNodeCaption, h.AlertObjects.LastTriggeredDateTime, h.AlertObjects.TriggeredCount, h.AlertObjects.AlertConfigurations.Name
FROM Orion.AlertHistory h

network_noob

This all makes sense now, but good god, someone needs to write a proper documentation for all this, this will help others save all the time.