Multiple alerts from a single Component Monitor

Hello,

I have created a SAM monitoring template with one component monitor. The script in the component monitor produces multiple Outputs. How can I get each of these outputs to send an alert at the same time? Currently, it only sends one of the outputs as an alert. Is a component only able to produce a one alert at a time from the 10 possible outputs? This seems to be the case based on some testing. I'm wondering if I'm missing something?

Find more posts tagged with

template

sam

component monitor

Alerts

Accepted answers

All comments

stevenstadel

The status of the multiple outputs will affect the parent component. You can set different thresholds for each output, but only the overall status of the component will be available for the alert. (IE is two of the outputs are critical then the component status is critical) You can include all the outputs in the alert using the variable ${N=SwisEntity;M=ComponentAlert.MultiValueMessages}

dcoats

Thanks for the response. So, if there are 100 possible alerts then I will need to write 100 separate scripts? It's a shame all outputs can't create separate alerts at the same time.

stevenstadel

The lowest level we can configure alerts is at the component level. The ability to have 10 additional outputs per script component can allow for adding another context to the alert or another condition that would affect the main component.

A good example is this Folder Monitoring script. This script grabs different variables related to a specific folder. I can set critical or warning thresholds on any of the statistic outputs. But if one of those crosses the set threshold, the component status is what has changed and that is what the alert is configured on.

Statistic.ParentAge:

Statistic.FolderCount:

Statistic.FileCount:

Statistic.FolderSize:

Statistic.NewestFile:

Statistic.OldestFile:

Statistic.FolderExists:

#region Define Exit Codes
$ExitCode = @{ "Up"       = 0;
               "Down"     = 1;
               "Warning"  = 2;
               "Critical" = 3;
               "Unknown"  = 4
             }
#endregion Define Exit Codes

$Folder = $args[0]

try
{
    $ComputerName = [System.Net.Dns]::GetHostByAddress("${IP}") | Select-Object -ExpandProperty HostName -First 1
}
catch
{
    $ComputerName = ${IP}
}



$RemoteFolder = Join-Path -Path "\\$( $ComputerName )" -ChildPath $Folder.Replace(":", "$")


if ( Test-Path -Path $RemoteFolder -ErrorAction SilentlyContinue )
{

    $ParentFolder = Get-Item -Path $RemoteFolder

    # "-Force" forces reading of hidden and system files.
    $Folders = $ParentFolder | Get-ChildItem -Directory -Recurse -Force

    # By sorting here, we've got all the files in date order by LastWriteTime (oldest to newest)
    #This means $Files[0] is the oldest file and $Files[-1] is the newest file.
    $Files   = $ParentFolder | Get-ChildItem -File -Recurse -Force | Sort-Object -Property LastWriteTime

    # For the Files (because folders have size 0), sum the length, and then select only the sum - this is stored as a type [double]
    $ContentSize    = $Files | Measure-Object -Property Length -Sum | Select-Object -ExpandProperty Sum


    # Breakdown:
    #   Get the current date (as a [datetime])
    #   Subtract the last write time of the parent folder (also a [datetime]) which results in a [timespan] object
    #   The [timespan] object has a property "TotalSeconds" which is the number seconds between one time and another.
    #   Since we only need the Total Seconds, select just that as it's own variable.
    #   Since we don't want fractional seconds, round it with zero digits after the decimal
    #   Store that as the variable $ParentFolderAge
    $ParentFolderAge = [math]::Round(( ( ( Get-Date ) - $ParentFolder.LastWriteTime ) | Select-Object -ExpandProperty TotalSeconds ), 0)
    # Do the same for the newest and oldest files
    $NewestFileAge   = [math]::Round(( ( ( Get-Date ) - $Files[-1].LastWriteTime ) | Select-Object -ExpandProperty TotalSeconds ), 0)
    $OldestFileAge   = [math]::Round(( ( ( Get-Date ) - $Files[0].LastWriteTime ) | Select-Object -ExpandProperty TotalSeconds ), 0)

    # Output everything we've learned
    # I tend to go overly generous on the 'Message' part.
    # Few quick notes:
    #   .ToString("N0") - basically says show this number with thousands separators (1234 ==> 1,234).
    #   $( ~~~ )        - syntax says, evaluate the thing inside, and then display that within the string
    #   ' and " are not equal when it comes to strings.  Be careful when/where you use them.

    Write-Host "Message.ParentAge: [$( $Folder ) on ${Node.Caption}] was last updated/created $( $ParentFolderAge.ToString("N0") ) seconds ago"
    Write-Host "Statistic.ParentAge: $( $ParentFolderAge )"

    Write-Host "Message.FolderCount: [$( $Folder ) on ${Node.Caption}] contains $( $Folders.Count.ToString("N0") ) child directories"
    Write-Host "Statistic.FolderCount: $( $Folders.Count )"

    Write-Host "Message.FileCount: [$( $Folder ) on ${Node.Caption}] contains $( $Files.Count.ToString("N0") ) child files" 
    Write-Host "Statistic.FileCount: $( $Files.Count )"

    Write-Host "Message.FolderSize: [$( $Folder ) on ${Node.Caption}] and all children use $( $ContentSize.ToString("N0") ) bytes" 
    Write-Host "Statistic.FolderSize: $( $ContentSize )"

    Write-Host "Message.NewestFile: The newest file in [$( $Folder ) on ${Node.Caption}] is [$( $Files[-1].FullName.Replace($RemoteFolder, $Folder) )] and was updated $( $NewestFileAge.ToString("N0") ) seconds ago"
    Write-Host "Statistic.NewestFile: $( $NewestFileAge )"

    Write-Host "Message.OldestFile: The oldest file in [$( $Folder ) on ${Node.Caption}] is [$( $Files[0].FullName.Replace($RemoteFolder, $Folder) )] and was updated $( $OldestFileAge.ToString("N0") ) seconds ago"
    Write-Host "Statistic.OldestFile: $( $OldestFileAge )"

    Write-Host "Message.FolderExists: [$( $Folder ) on ${Node.Caption}] exists"
    Write-Host "Statistic.FolderExists: 1"

    $ExitState = "Up"
}

else
{

    # I'd rather include all the returns here in case the folder was deleted after you started monitoring it.

    Write-Host "Message.ParentAge: ERROR - [$( $Folder ) on ${Node.Caption}] NOT FOUND!"
    Write-Host "Statistic.ParentAge: 0"

    Write-Host "Message.FolderCount: ERROR - [$( $Folder ) on ${Node.Caption}] NOT FOUND!"
    Write-Host "Statistic.FolderCount: 0"

    Write-Host "Message.FileCount: ERROR - [$( $Folder ) on ${Node.Caption}] NOT FOUND!"
    Write-Host "Statistic.FileCount: 0"

    Write-Host "Message.FolderSize: ERROR - [$( $Folder ) on ${Node.Caption}] NOT FOUND!"
    Write-Host "Statistic.FolderSize: 0"

    Write-Host "Message.NewestFile: ERROR - [$( $Folder ) on ${Node.Caption}] NOT FOUND!"
    Write-Host "Statistic.NewestFile: 0"

    Write-Host "Message.OldestFile: ERROR - [$( $Folder ) on ${Node.Caption}] NOT FOUND!"
    Write-Host "Statistic.OldestFile: 0"

    Write-Host "Message.FolderExists: [$( $Folder ) on ${Node.Caption}] NOT FOUND!"
    Write-Host "Statistic.FolderExists: 0"

    $ExitState = "Unknown"
}


exit $ExitCode[$ExitState]

If you want to generate separate alerts, then adding an additional component per what you want to alert on makes sense. If they all logically apply to the same application or service you can keep them in the same application template and configure your alerts based on the component level status.

bobmarley

Maybe check the Orion.Events table and see if each individual component monitor output is logging into the table. If they are perhaps you could create a custom SWQL alert to include multiple events.

dcoats

Thank you. I will take a look.

SteveK

So I'm going to preface this with an "In theory" yes.

If you create specific alerts per component, you should be able to continue down that path. You would want to set your scope to have a specific "Statistic Data Label." In your alert, you would set your alert type to component. Then under scope, the first drop down box should be component. Then in the 2nd field, select "Browse all fields." Then select "Multiple Statsitic Data" from the selection list, and then you should have the option to alert based off the label.

The annoying part though, is you would most likely need to create an alert per statistic item.

I haven't personally tested it out, but in theory should be doable. I could see this being a bit of a management nightmare. If someone would rename the label, you would need to update the alert (rather in the template or an override)