SAM, How to show last x number of statistic messages

Have you considered using the Advanced Alert Manager to write this value out to Orion Events and then use the Last XX Events Resource?

Hi aLTeReGo,

Should the message be formated in any specific way? I do output as follows to NPM Even Log through Advanced Alert Manager:

STATISTIC: ${StatisticData}; MESSAGE: ${ComponentMessage}

However, when I go to the component's last 25 events - it is not there

I can see this message in Message Center though

Including a multi-value script message into the text of an alert message can only be accomplished using a SQL macro. Below is an example of the SQL macro usage to add the numeric value of a multi-value script to the output of an advanced alert message.

• SolarWinds Knowledge Base :: Ability to pull individual numeric values from a multi-value script.

Thanks aLTeReGo,

I think that we may be talking about different things. I am trying to implement your suggestion above to use Advance Alert Manager to log and Event in Orion and then use this Event to display those historical records in Last XX Event Resource for the given component. I am not using any multi-value massages. My script has only one MESSAGE and only one STATISTIC. Here is what I do:

(1)

Advance Alert Manager triggers the following action to log an Event

(2)

Event is visible in Message Center alongside with other Events from same server

(3)

However, this Event is NOT visible on the component details page in Last 25 Event resource

Hence is my questions - do I need to format my message somehow in a specific way when triggering it, step (1), so that it is visible in Last XX Events for this component, step (3)

Thank you,

Alex

Ahh I see the issue now. The problem is that the Last "XX" Component Events is filtered based on the specific type of event (component monitor), and the component ID being viewed. This cannot be replicated by events written through the Advanced Alert Manager. My recommendation above did not assume you would be using the events resource on the Component Details view using the "Last 25 Component Events" resource. Rather that you would have a record of this information in the Orion Events, which could be accessed through the Message Center, the Last XX Events summary resource, or through the Orion Report Writer. You could even use the Report Writer to further refine this down to just the information you're looking for. You might even be able to use the ComponentID macro to build a dynamic report that could be placed on the Component Details view.

Wow, so much to learn... so much to do... 

I will start digging how to "use the ComponentID macro to build a dynamic report that could be placed on the Component Details view" and in the meantime would appreciate if you can post some links to existing resources you may think can be relevant to refer to

Appreciate your help Alter Ego

--

Alex

Hi aLTeReGo,

I think I have found similar thread where it is explained how to place a custom dynamic report on a node page: Determine Group Membership From Node Page

I am wondering if the same can be achieved with web-based reporting and for this particular scenario. Basically - the goal is - to display on a component page Last XX Events with MESSAGE/STATISTIC results as logged in Orion by Alert Manager (screenshot above). Also I would appreciate if you can give some guidance how to create this dynamic reports that can be placed on component page

I am stuck...

I have created report with dynamic query to go on component page. I could not however find an option to specify macros fro ComponentID, so I used NodeName instead:

I do not have anything coming through to Component Details page Custom Report Resource unfortunately:

If I will change above macros in report to static node name (for testing purpose only) - it works. But obviously I would want this to be dynamic

I am stuck...

I have created report with dynamic query to go on component page. I could not however find an option to specify macros fro ComponentID, so I used NodeName instead:

I do not have anything coming through to Component Details page Custom Report Resource unfortunately:

If I will change above macros in report to static node name (for testing purpose only) - it works. But obviously I would want this to be dynamic

I believe the issue you're having is that events generated via alerts are not associated with any particular node or entity. The alert engine writing that event to the event log breaks that association. You could get around this by including the Node name to the event and then use 'Contains' in your report to find events matching that node name in the message field. If you have a lot of events I imagine performance might suffer, but at least in theory, it should work. 

Thanks for the response.  Im more asking the question are the historical component messages stored in the database anywhere?  If they are not then I will use the method in this post to write them to the event log.