Hi All,
I've done some work to tidy up our alert definitions (both the Alert Manager and Alert Actions) and the more important alerts have now been tailored and given a "[ *** ]" prefix so it is easy to see the alerts we have catered for versus those that might appear once in a while.
I am monitoring this via a custom SWQL widget that produces a nice little summary for the past week as shown below:
The code for this is as follows:
SELECT
ISNULL(AC.Name, '[Deleted or Unknown Alert]') AS [Alert Name],
COUNT(CASE WHEN DATETRUNC('day', TOLOCAL(AH.TimeStamp)) = DATETRUNC('day', GETDATE() - 0) THEN AH.AlertHistoryID END) AS [Today],
COUNT(CASE WHEN DATETRUNC('day', TOLOCAL(AH.TimeStamp)) = DATETRUNC('day', GETDATE() - 1) THEN AH.AlertHistoryID END) AS [Day -1],
COUNT(CASE WHEN DATETRUNC('day', TOLOCAL(AH.TimeStamp)) = DATETRUNC('day', GETDATE() - 2) THEN AH.AlertHistoryID END) AS [Day -2],
COUNT(CASE WHEN DATETRUNC('day', TOLOCAL(AH.TimeStamp)) = DATETRUNC('day', GETDATE() - 3) THEN AH.AlertHistoryID END) AS [Day -3],
COUNT(CASE WHEN DATETRUNC('day', TOLOCAL(AH.TimeStamp)) = DATETRUNC('day', GETDATE() - 4) THEN AH.AlertHistoryID END) AS [Day -4],
COUNT(CASE WHEN DATETRUNC('day', TOLOCAL(AH.TimeStamp)) = DATETRUNC('day', GETDATE() - 5) THEN AH.AlertHistoryID END) AS [Day -5],
COUNT(CASE WHEN DATETRUNC('day', TOLOCAL(AH.TimeStamp)) = DATETRUNC('day', GETDATE() - 6) THEN AH.AlertHistoryID END) AS [Day -6],
COUNT(AH.AlertHistoryID) AS [Total Count]
FROM Orion.AlertHistory AS AH
JOIN Orion.AlertObjects AS AO ON AH.AlertObjectID = AO.AlertObjectID
JOIN Orion.AlertConfigurations AS AC ON AO.AlertID = AC.AlertID
WHERE AH.EventType = 0 -- Triggered
AND AH.TimeStamp >= GETUTCDATE() - 6
GROUP BY AC.Name
ORDER BY [Total Count] DESC
Hope this is useful to folks!