Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

How to create alert while two specific interfaces on any node are down?

Hi.

I've just started to learning some SQL, but so far I'm unable to setup the alert on Solarwinds that will inform about two specific interfaces (with caption "tunnel1700" and "tunnel2700") being down in any node.

Example:

Node name : Paris, which has 10 interfaces, two of them are with caption tunnel1700 and tunnel2700. Alert should trigger when those particular interfaces are down in Paris.

So far I only managed to use gui to add two sections with AND which contains those two tunnels, but it will also trigger when tunnel1700 for node1 is down, and tunnel2700 for node2 is down.

Find more posts tagged with

Accepted answers

All comments

stuartd

Something along the lines of the following should work. I don't have a node called paris or interfaces with those names, but as you type they should auto-populate.

Adjust the contains / is equal to as best suits your environment.

Si the scope is what objects you want to affect and the condition is what you want to happen or see. I've also circled a little arrow, if you click that and then click show SWQL, you could copy/paste that into SWQL Studio and run it as a query.

FWIW, it will generate to look like this:

SELECT DISTINCT E0.[Uri], E0.[DisplayName]

FROM Orion.NPM.Interfaces AS E0 

WHERE ( 
( 

( E0.[Node].[Caption] = 'PARIS' ) ) 
AND ( 
( E0.[Node].[Firewall].[Tunnels].[InterfaceName] LIKE '%Tunnel1700%' ) 
AND ( E0.[Node].[Firewall].[Tunnels].[InterfaceName] LIKE '%Tunnel2700%' ) 
AND ( E0.[Status] = '2' ) 
) 
)

Presumably the interfaces are not down, and the query would return no results. But to ensure it is targeting the right aspects, you could either comment out the final Status = line ( just add -- [dash dash] in front), or change the 2 to a 1. In this case 1 = UP and so long as they are UP, you should get a result in the query.

Gamas

Hi StuartD

Thanks for the reply. Maybe I didn't lay out the full problem here or I wasn't specific.

I don't have particular node name that I could use - I have a list of 200+ nodes within our organization and wish to monitor in every node those two interfaces. Paris was just example of the node. The question is if I can monitor those two interfaces (1700 and 2700) in 200+ nodes without using particular node name?

Would it work if removed ( E0.[Node].[Caption] = 'PARIS' ) ) from your code and just leave rest?

Thanks

stuartd

Ahh - well in the scope you can either select all your nodes, or pick them based on common criteria which is typically a custom property or similar.

Short, answer, yes that should work.

Gamas

Hi,

Unfortunately it doesn't work. It works only with condition with 1 interface (or using tunnel1700 OR tunnel2700). I guess if I use Interface as main category, there is only 1 interface you can monitor. Tried using Node, but then got 0 results (I guess under Node category Interface is something different).