Muted Nodes Resource

Version 2

    Muting of Nodes, Interfaces, and Applications is a great option added to Orion, but I've noticed that there wasn't an easy way to see these in a report.  With that in mind, I added a custom report in my environment.  There are three total variations of the report - for those running Network Performance Monitor, Server & Application, or both.

     

    You can also easily see muted elements from the new Managed Entities view, but I want them quicker.

    Muted Elements via Managed Entities

    Managed Entities is restricted to pseudo-admins, and some of my users don't have access to that page, nor do I want them to have access.  They could run the report, I don't always want them to run a report when they need a list of elements that are muted.

     

    Since the report is based around SWQL, I can leverage the same to build a custom query resource on the Enterprise Dashboard.

     

    For those new to the suite, I wanted to give you the step-by-step skinny on how I did this.

     

    Start by clicking on the pencil icon on the top-left of the page to Customize the page.

    Customize Page

    Next, we've got to add a new widget.

    Add a Widget

     

    Search in the Available Widgets for the Custom Query.

    Find that Widget!

     

    Now drag that Widget to a new location on your page.

    Drag that Widget

     

    In the Add Widgets bar, click "Done Adding Widgets."

    All Done!!!

     

    In the Customize Page bar, click on "Done Editing."

    No More Customizations

     

    The current resource is empty, now let's edit it.

    Edit that Query!

     

    Here's the meat and potatoes for the widget.

    Yum - Meat & Potatoes

    These are the settings that I'm using:

    Title: Muted Alerts

    Subtitle: Current or Scheduled Muted Alerts

    Custom SWQL Query:

    SELECT DISTINCT
           CASE
              WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
                 THEN [N].[Caption]
              WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
                 THEN [I].[FullName]
              WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
                 THEN [AA].[FullyQualifiedName]
              ELSE 'SomethingElse'
           END AS [Element],
           CASE
              WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
                 THEN [N].[DetailsUrl]
              WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
                 THEN [I].[DetailsUrl]
              WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
                 THEN [AA].[DetailsUrl]
              ELSE 'SomethingElse'
           END AS [_LinkFor_Element],
           [AE].AccountID AS [By],
           ToLocal([SuppressFrom]) AS [Start],       
           ToLocal([SuppressUntil]) AS [End]
    FROM Orion.AlertSuppression AS [AlertSup]
    LEFT OUTER JOIN Orion.Nodes AS [N]
       ON [AlertSup].[EntityUri] = [N].[Uri]
    LEFT OUTER JOIN Orion.NPM.Interfaces AS [I]
       ON [AlertSup].[EntityUri] = [I].[Uri]
    LEFT OUTER JOIN Orion.APM.Application AS [AA]
       ON [AlertSup].[EntityUri] = [AA].[Uri]
    LEFT OUTER JOIN Orion.AuditingEvents AS [AE]
       ON [AE].AuditEventMessage LIKE CONCAT('%', CASE
              WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
                 THEN [N].[NodeName]
              WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
                 THEN [I].[InterfaceCaption]
              WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
                 THEN [AA].[Name]
              ELSE 'Wrong'
           END, '%') AND [EntityUri] LIKE CONCAT('%=', [AE].NetObjectID)
    INNER JOIN Orion.AuditingActionTypes AS [AT]
       ON [AE].ActionTypeID = [AT].ActionTypeID
    WHERE [AT].ActionType IN  ( 'Orion.AlertSuppressionAdded', 'Orion.AlertSuppressionChanged' )
    ORDER BY [SuppressFrom]

     

    Search SQWL Query:

    SELECT DISTINCT
           CASE
              WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
                 THEN [N].[Caption]
              WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
                 THEN [I].[FullName]
              WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
                 THEN [AA].[FullyQualifiedName]
              ELSE 'SomethingElse'
           END AS [Element],
           CASE
              WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
                 THEN [N].[DetailsUrl]
              WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
                 THEN [I].[DetailsUrl]
              WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
                 THEN [AA].[DetailsUrl]
              ELSE 'SomethingElse'
           END AS [_LinkFor_Element],
           [AE].AccountID AS [By],
           ToLocal([SuppressFrom]) AS [Start],
           ToLocal([SuppressUntil]) AS [End]
    FROM Orion.AlertSuppression AS [AlertSup]
    LEFT OUTER JOIN Orion.Nodes AS [N]
       ON [AlertSup].[EntityUri] = [N].[Uri]
    LEFT OUTER JOIN Orion.NPM.Interfaces AS [I]
       ON [AlertSup].[EntityUri] = [I].[Uri]
    LEFT OUTER JOIN Orion.APM.Application AS [AA]
       ON [AlertSup].[EntityUri] = [AA].[Uri]
    LEFT OUTER JOIN Orion.AuditingEvents AS [AE]
       ON [AE].AuditEventMessage LIKE CONCAT('%', CASE
              WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
                 THEN [N].[NodeName]
              WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
                 THEN [I].[InterfaceCaption]
              WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
                 THEN [AA].[Name]
              ELSE 'Wrong'
           END, '%') AND [EntityUri] LIKE CONCAT('%=', [AE].NetObjectID)
    INNER JOIN Orion.AuditingActionTypes AS [AT]
       ON [AE].ActionTypeID = [AT].ActionTypeID
    WHERE [AT].ActionType IN  ( 'Orion.AlertSuppressionAdded', 'Orion.AlertSuppressionChanged' )
      AND CASE
             WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND [EntityUri] NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%'
                THEN [N].[Caption]
             WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Interfaces/InterfaceID=%'
                THEN [I].[FullName]
             WHEN [EntityUri] LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/Applications/ApplicationID=%'
                THEN [AA].[FullyQualifiedName]
             ELSE 'SomethingElse'
          END LIKE '%${SEARCH_STRING}%'
    ORDER BY ToLocal([SuppressFrom])

    Number Of Rows Per Page: 5 (choose this number as you like)

     

    Submit the changes and you are set.

    Now that's nice!

    Now you have quick access to all the elements that you have muted... oh and you get to see who requested the alerts being muted.