Like me, Many Users are looking for a feature to trigger alert based on event-id ( Netperfmon Event ).
For testing we created an alert action on trap based alert ( OLV_Rule + Orion_Alert ) to log an netperfmon event-id with required message and use them into alert custom query (As OLV module have very limited option)
As of now, Alert is possible to create by below query ( one can change parameter and achieve it ).
It will check the event-id in event table and trigger alert in Orion alert console against the node.
Lets discuss with scenario -
we received the 3 event ( event-id = 1, 2 , 3 ) , Query check the events and trigger the alerts for event-1 for object ( node - ABC) . however when same query checks the event-2 and create alert, this alert overwrite the existing alert... When same query check the event-3 and create alert then this new alert overwrite the previous alert. So you have active alert in console for event-id-3.
why it is happen, because object is identical ( node ) in all 3 alerts and existing alert gets overwritten by new one.
I am looking for a solution on it, how we can create a separate alert based on event-id as alert object rather than node as alert object.
so all 3 individual event-id based alert display on alert console.
