Custom Alert with SWQL request

Hello,

I would like to create a custom alert with SWQL request but I don't understand how it works. my request is this :

Select Count(CA.ApplicationID) AS CountProcess

From Orion.APM.ComponentAlert AS CA

WHERE CA.ComponentName = 'Interface Backup Audit < 1' and CA.ComponentAvailability like '%up%' and CA.Component.Application.Name = 'LOGIPREN_Appli'

But when i create a custom alert it displays this :

I can't change the "SELECT" condition to use the function "Count". I also don't understand what is the "URI" attribute.

Someone can help me please ?

Find more posts tagged with

custom alert

SWQL

Custom Query

Alerts

Accepted answers

All comments

monitoringlife

you can use the advanced query at the bottom to setup a count (or use sub select in the WHERE clause)

URI is the unique identifier for the nodes/objects.

Seashore

You have to create a query that includes the first part, as the alert process needs that to continue. URI is an internal identifier of the object.

But I think you need to change your base query a bit. You can't ask for "count(ca.application)..." as that will not return an application with issues and that is what your result must be.

So, what is it you want to alert on? That should be in the WHERE-part. In the Select part you will need to have the uri of the component, like "CA.URI". Then you can join your query with the static one ON the URI

M.M

TY for your answer. I want to be alerted about the number of active processes. Example for an application: I have 3 X processes and I want to know if all 3 are active or if one of them is down and report it.

Seashore

I haven't tested below query but I think it should work. At least this is the theory on how the query should look like:

SELECT component.uri, component.DisplayName FROM Orion.Apm.Component AS Component

-- Mandatory Query part above

INNER JOIN
(
Select 
    Count(CA.ApplicationID) AS CountProcess
    ,MAX(CA.Uri) AS uri
From Orion.APM.ComponentAlert AS CA
WHERE 
    CA.ComponentName = 'Interface Backup Audit < 1' 
    and CA.ComponentAvailability like '%up%' 
    and CA.Component.Application.Name = 'LOGIPREN_Appli'
) AS Q1 ON Component.uri=Q1.uri
WHERE Q1.CountProcess<3</pre>So, the first part is the one you can't change. The rest is the optional part. You can see how we have joined the two parts. Hope it works or at least give you some info on how to proceed.

M.M

Thank you very much for your help. My request was not exactly what I said to you, I would like to monitor the number of processes running on the machine, if 10 cmd processes are running this is not normal so I want to be alerted. But your explanation is helpful and I understand alert queries better.

M.M

Sorry but the request doesn't work.