Hello everyone. Just wanted to make a note about some of my findings today...
With the Orion core 2015.1 release (such as NPM v11.5 or SAM v6.2), the entire alert system has been re-written. Yes we all know this thanks to blog posts here on Thwack from the various SW product managers. With these alert system changes also comes several changes with the tables in the SolarWinds SQL database. Two tables that were particularly important to me (dbo.AlertLogs and dbo.Nodes) because of custom SQL queries in reports and custom SAM monitors have been abandoned and new tables are now in use. I'll share what I know about AlertLogs for now.
Here is an example:
I have a custom SQL User Experience monitor in SAM that gets the count of email alerts triggered within a 1 minute period. This tells us a few things. 1) If there is a mass outage occurring at this moment in time, or 2) if there is a weird problem in SolarWinds... Long story short, I just want to know how many emails that SolarWinds is sending per minute. I put this monitor in place due to a bug in the Orion Core version prior to SAM 6.2 (I think it was the Orion core version in SAM v6.1.1) where the MSMQ folder on the Orion server would fill up with data well past 1gb on one of our secondary pollers, then the poller would simply 'stop' monitoring nodes and alerts emails would stop too but the MSMQ would fill up and SolarWinds would keep trying to send emails repeatedly --- hence the need to know if there were a mass amount of emails trying to be sent from SolarWinds (NOTE: We used this custom monitor well before we knew about the SolarWinds Orion Server Monitor SAM template). We could have installed the hotfix but since it would require an outage we opted to wait until the SAM 6.2 release and just deal with the issue as it came up. To help us we set up a monitor to keep an eye on how many emails were triggered by querying the SolarWinds SQL database directly using the query below.
/*
OLD Query -- Doesn't work anymore
*/
SELECT Count(LogDateTime) As 'Total' FROM [NetPerfMon-Serverv10].[dbo].[AlertLog]
WHERE ActionType = 'EMail'
AND LogDateTime
BETWEEN DATEADD(MINUTE, -1, getdate()) AND getdate()
After Orion core was running 2015.1, we had to modify it to look at the AlertHistory table:
/*
NEW QUERY
*/
SELECT Count(TimeStamp) As 'Total' FROM [NetPerfMon-Serverv10].[dbo].[AlertHistory]
WHERE EventType = 6
AND TimeStamp
BETWEEN DATEADD(MINUTE, -1, getdate()) AND getdate()
Yes, we are still using this custom SQL query monitor because it is useful. We like getting the 'count' of emails as a simple way to detect if SolarWinds is spamming our enterprise IT department 
I hope this info helps someone.
- Joe
