SWQL query showing invalid results?

patriot

The following query does produce a list of alerts, but I actually do not have any "unacknowledged" alerts at this time. Why am I seeing a rather long list ? Is this a database history thing? The report should be empty.

SELECT [AlertObjects].AlertConfigurations.Name AS [Alert Name]
     , CONCAT (
          '/Orion/View.aspx?NetObject=AAT:'
          , [AlertObjects].AlertObjectID
          ) AS [_LinkFor_Alert Name]
     , [AlertObjects].EntityCaption AS [Alert Object]
     , [AlertObjects].EntityDetailsUrl AS [_LinkFor_Alert Object]
--     , [AlertObjects].RelatedNodeCaption AS [Related Node]
     , [AlertObjects].RelatedNodeDetailsUrl AS [_LinkFor_Related Node]
     , ToLocal([AlertObjects].AlertActive.TriggeredDateTime) AS [Alert Trigger Time]
     , [AlertObjects].AlertActive.TriggeredMessage AS [Alert Message]
     , CASE
          WHEN [AlertObjects].AlertActive.Acknowledged IS NULL
               THEN 'Unacknowledged'
          ELSE 'Acknowledged'
          END AS [AckState]
     , CASE [AlertObjects].AlertConfigurations.Severity
          WHEN 0
               THEN 'Informational'
          WHEN 1
               THEN 'Warning'
          WHEN 2
               THEN 'Critical'
          WHEN 3
               THEN 'Serious'
          WHEN 4
               THEN 'Notice'
          ELSE CONCAT (
                    'Unknown Severity: '
                    , [AlertObjects].AlertConfigurations.Severity
                    )
          END AS [Severity]
     , CASE [AlertObjects].AlertConfigurations.Severity
          WHEN 0
               THEN '/Orion/images/ActiveAlerts/InformationalAlert.png'
          WHEN 1
               THEN '/Orion/images/ActiveAlerts/Warning.png'
          WHEN 2
               THEN '/Orion/images/ActiveAlerts/Critical.png'
          WHEN 3
               THEN '/Orion/images/ActiveAlerts/Serious.png'
          WHEN 4
               THEN '/Orion/images/ActiveAlerts/Notice.png'
          ELSE '/Orion/images/ActiveAlerts/Unknown.png'
          END AS [_IconFor_Severity]
FROM Orion.AlertObjects AS [AlertObjects]
WHERE CASE
          WHEN [AlertObjects].AlertActive.Acknowledged IS NULL
               THEN 'Unacknowledged'
          ELSE 'Acknowledged'
          END = 'Unacknowledged'
ORDER BY [AlertObjects].AlertActive.TriggeredDateTime DESC

ecmel

You can try the query below, it should display unacknowledged active alerts only. If you would like to see both acknowledged and unacknowledged alerts, then you can remove the "WHERE" clause in this query:

SELECT aa.AlertObjects.AlertConfigurations.Name AS [Alert Name]
     , CONCAT (
          '/Orion/View.aspx?NetObject=AAT:'
          , aa.AlertObjects.AlertObjectID
          ) AS [_LinkFor_Alert Name]
     , aa.AlertObjects.EntityCaption AS [Alert Object]
     , aa.AlertObjects.EntityDetailsUrl AS [_LinkFor_Alert Object]
--     , aa.AlertObjects.RelatedNodeCaption AS [Related Node]
     , aa.AlertObjects.RelatedNodeDetailsUrl AS [_LinkFor_Related Node]
     , ToLocal(aa.TriggeredDateTime) AS [Alert Trigger Time]
     , aa.TriggeredMessage AS [Alert Message]
     , CASE
          WHEN aa.Acknowledged IS NULL
               THEN 'Unacknowledged'
          ELSE 'Acknowledged'
          END AS [AckState]
     , CASE aa.AlertObjects.AlertConfigurations.Severity
          WHEN 0
               THEN 'Informational'
          WHEN 1
               THEN 'Warning'
          WHEN 2
               THEN 'Critical'
          WHEN 3
               THEN 'Serious'
          WHEN 4
               THEN 'Notice'
          ELSE CONCAT (
                    'Unknown Severity: '
                    , aa.AlertObjects.AlertConfigurations.Severity
                    )
          END AS [Severity]
     , CASE aa.AlertObjects.AlertConfigurations.Severity
          WHEN 0
               THEN '/Orion/images/ActiveAlerts/InformationalAlert.png'
          WHEN 1
               THEN '/Orion/images/ActiveAlerts/Warning.png'
          WHEN 2
               THEN '/Orion/images/ActiveAlerts/Critical.png'
          WHEN 3
               THEN '/Orion/images/ActiveAlerts/Serious.png'
          WHEN 4
               THEN '/Orion/images/ActiveAlerts/Notice.png'
          ELSE '/Orion/images/ActiveAlerts/Unknown.png'
          END AS [_IconFor_Severity]
FROM Orion.AlertActive AS aa
WHERE aa.AlertObjects.AlertActive.Acknowledged IS NULL
ORDER BY aa.TriggeredDateTime DESC