Custom SWQL Alert won't trigger

russbishop

I've created an alert that I want to trigger when a node has been muted for over 14 days.  When I submit the alert is says it'll trigger on 12 objects in the alert scope, but after I submit nothing is triggered.  Any thoughts on why this is happening? 

SELECT Nodes.Uri, Nodes.DisplayName FROM Orion.Nodes AS Nodes

Join Orion.AlertSuppression n on n.EntityUri=Nodes.Uri

where n.SuppressFrom<=GETUTCDATE()-14 AND n.SuppressUntil is NULL</pre>

jm_sysadmin

If you are alerting on the node that is muted, the mute suppressed the alert from triggering. For this type of issue, I have a dash for admins to review, and a report that can be emailed. Unfortunately, a muted node can't alert on itself, so an alternative is to use SAM to poll the Main polling engine and to get a list of devices muted over 14 days, add that to the alert notes which you can alert on etc. It still won't be per node.