• State Not Answered
  • Locked Locked
  • Replies 8 replies
  • Subscribers 38 subscribers
  • Views 733 views
  • Users 0 members are here
Options
Related
This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Active Alerts View for NPM 11.5

jim.bingen

I don't know about you, but I really don't like the new Active Alerts view they created in NPM 11.5, to replace the old one they had since I started using Orion NPM. It only show 5 at a time, and you cannot sort it with the latest on the top. I like to see the newest alerts at the top of that view. So I created a Custom Query view to replicate the old view. I took the SWQL code from the All+Active+Alerts.xml script in NPM 11.5 RC4 Active Alerts and modified it a little and then put it into a Custom Query and added to the Summary page.

This is what it looks like:

active alerts.jpg

Here is the code to insert in the SWQL box:

SELECT DISTINCT

ToLocal(AlertActive.TriggeredDateTime) AS AlertTriggered,

Case

  When Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400)>0 Then

  ToString(ToString(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) +0.0)/86400))+'d '+

  ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 86400*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400))) + 0.0)/3600))+'h '+

  ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60))+'m ')

  When Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 86400*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400))) + 0.0)/3600)>0 Then

  ToString(ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 86400*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400))) + 0.0)/3600))+'h '+

  ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60))+'m ')

  When Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60)>0 Then

  ToString(ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60))+'m ')

  Else ''

End AS ActiveTime,

AlertObjects.RelatedNodeCaption AS NODE, AlertObjects.EntityCaption AS ENTITY, AlertConfigurations.Name AS ALERT

FROM Orion.AlertObjects (nolock=true) AlertObjects

INNER JOIN Orion.AlertActive (nolock=true) AlertActive ON AlertObjects.AlertObjectID=AlertActive.AlertObjectID

INNER JOIN Orion.AlertConfigurations (nolock=true) AlertConfigurations ON AlertConfigurations.AlertID=AlertObjects.AlertID

ORDER BY AlertTriggered DESC, RelatedNodeCaption ASC

  • 0

    Thanks! Certainly pointed me in the right direction, but two things to note:

    1. You lose the value of the eye-grabbing colors

    2. When I run the code it shows events that have already been acknowledged (and no longer show on the stock "All Active Alerts" table)

  • 0

    Yes, you lose the colors, but it is a much better looking display in my opinion. If you find a way to display colors, let me know. Also, to get rid of acknowledged alerts, add "WHERE (AlertActive.Acknowledged is Null OR AlertActive.Acknowledged = 'False')".

  • 0

    The WHERE worked great, thanks! Now that I've dug a bit more, I'm doubtful on the colors, given that it looks like that's controlled via xml, and it's not worth my time trying to figure out how to import/embed a custom xml object into Orion. The acknowledged alerts part was the key piece emoticons_cool.png

  • 0

    Hi Jim,

    I happen to pass your thread when I'm looking for alerts customization view. I can see that this thread was helpful to other fellow thwackers. But apologies for my ignorance, as I'm not that SQL geek guy. My question is this:

    Is it possible to do a custom view wherein acknowledged, cleared, and active alerts are segregated in different tabs

    pastedImage_0.png

    I could display all alerts, including the acknowledge/cleared ones, by checking "Show acknowledged alert" but can't seem to find the appropriate way to do the above customization. Could somebody help? Thank you very much in advance... emoticons_happy.png

  • 0

    Hi

    for the All acknowledged just put the: WHERE AlertActive.Acknowledged = 'True'

    For the Cleared Alert do not know how,

    thanks

  • 0

    Hi jim.bingen​,

    Great! works fine with me. emoticons_happy.png

    Just an additional question, on what frequency does the table being updated? is the customized list being updated for like ex: every 1 min?

    Also, on which part will the:

    WHERE (AlertActive.Acknowledged is Null OR AlertActive.Acknowledged = 'False')

    will be added?

    Br,

    Ian

  • 0

    It updates whenever the screen is refreshed.

  • 0

    Hello,

    This is fantastic. Great table. Could I ask tho, how can I add the severity of the alert?

    Many Thanks

    Sean

SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.

SolarWinds Customer Success Center Certification Media Vault Link Accounts
About THWACK Blogs For Government Edit Settings Free Tools & Trials
Legal Documents Terms of Use Privacy California Privacy Rights Security Information
©2024 SolarWinds Worldwide, LLC. All Rights Reserved.