Alerts with 0 Child Objects

I am looking to go through all of our companys Alerts and see if they still relevant since they were created.

Users might have changed the custom properties, IPs, Captions of devices and not told the SW team, so the alerts are null & void until they are updated.

Is there a way to see in the DB or a report to show what Child Objects would be detected on an alert without going through each one 1x1?

Below are 2 examples.

1 with child objects detected and 1 without any detected.

Find more posts tagged with

NPM 2020.2.6

alerts_trigger

child objects

detected objects

conditon

Alerts

sql query

report

Accepted answers

All comments

bobmarley

Hopefully someone has a better solution for you. What I can offer up is in your alert under Trigger Conditions there is a small arrow you can expand to show the SWQL used by the alert.

If you cut/paste that SWQL query into SWQL Studio you at least have a base query that includes the tables you need to look in to pull the data out. May be you can create a query for the different alert types such as node, component, application etc to look for the missing items.

stuartd

I usually use bobmarley's approach when building a new alert, but @sum_giais has provided a bit of SWQL code here that will do this for you.

I've re-copied it below for ease:

SELECT
    A.Name AS [Alert Name]
    ,A.LastEdit
    ,A.CreatedBy
    ,MAX(AO.LastTriggeredDateTime) AS [Last Triggered]
FROM Orion.AlertConfigurations AS A
LEFT OUTER JOIN Orion.AlertObjects AS AO ON A.AlertID=AO.AlertID
WHERE
    A.Enabled=TRUE
GROUP BY A.Name,a.LastEdit,a.CreatedBy
ORDER BY [Last Triggered]