Hello,
Our team needs a dashboard that shows active alerts, and each dedicated raw for the alerts should be remove when the status is cleared or the trigger condition is no longer true alerts Like Node Down and High CPU Load ...
the issue I have faced as this is not applied to all kind of alerts I can see some alerts have cleared but their raw is still there on the dashboard which I have to deleted it in active alerts manually which is not preferable, is this system bug or issue with my SWQL query.
for the attached photo the trigger condition is no longer true while the raw for that specific alert is still present on my dashboard !
## this is query that I use : by KMSigma.SWI
SELECT
[AlertObjects].AlertConfigurations.Name AS [Name],
'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + TOSTRING([AlertObjects].AlertObjectID) AS [Name_URL],
[AlertObjects].AlertConfigurations.Severity AS [Name_Severity],
[AlertObjects].Node.Caption AS [Object],
[AlertObjects].Node.Status AS [Object_Status],
[AlertObjects].EntitYDetailsUrl AS [Object_URL],
TOSTRING(TOLOCAL([AlertObjects].AlertActive.TriggeredDateTime)) AS [Time],
TOLOCAL([AlertObjects].AlertActive.TriggeredDateTime) AS [Time_SORT],
CASE
WHEN MINUTEDIFF([AlertObjects].AlertActive.TriggeredDateTime,
GETUTCDATE()) > 1440
THEN (TOSTRING(ROUND(MINUTEDIFF([AlertObjects].AlertActive.TriggeredDateTime,
GETUTCDATE()) / 1440.0, 1)) + ' Days')
WHEN MINUTEDIFF([AlertObjects].AlertActive.TriggeredDateTime,
GETUTCDATE()) > 60
THEN (TOSTRING(ROUND(MINUTEDIFF([AlertObjects].AlertActive.TriggeredDateTime,
GETUTCDATE()) / 60.0, 1)) + ' Hours')
ELSE (TOSTRING(MINUTEDIFF([AlertObjects].AlertActive.TriggeredDateTime,GETUTCDATE())) + ' Minutes')
END AS [Active],
CASE
WHEN DayDIFF([AlertObjects].AlertActive.TriggeredDateTime,
GETUTCDATE()) > 7
THEN 14 WHEN DayDIFF([AlertObjects].AlertActive.TriggeredDateTime,
GETUTCDATE()) < 2
THEN 1
ELSE 3
END AS [ActiveIcon],
CASE
WHEN [AlertObjects].AlertActive.Acknowledged IS NULL
THEN 'Unacknowledged'
ELSE CONCAT([AlertObjects].AlertActive.AcknowledgedBy,' (', TOLOCAL([AlertObjects].AlertActive.AcknowledgedDateTime), ')')
END AS [Acknowledge],
CASE
WHEN [AlertObjects].AlertActive.Acknowledged IS NULL
THEN CONCAT('/Orion/NetPerfMon/AckAlert.aspx?AlertDefID=', [AlertObjects].AlertObjectID)
ELSE CONCAT('/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:', [AlertObjects].AlertObjectID)
END AS [Acknowledge_URL]
FROM Orion.AlertObjects AS [AlertObjects]
--for Node Down
WHERE [AlertObjects].AlertActive.TriggeredMessage LIKE '%Node Down%'
-- for HIGH CPU
OR [AlertObjects].AlertActive.TriggeredMessage LIKE '%CPU%'
ORDER BY[AlertObjects].AlertActive.TriggeredDateTime DESC
