We are trying to pull the Alerts and Events from the SolarWinds platform in the form of the Incidents for our product. It uses a polling mechanism to fetch incidents based on a checkpoint mechanism which usually uses the timestamp. To avoid duplication of incidents we are using AlertActiveID/EventID instead of the TriggeredDateTime/EventTime.
Can anyone from the team please confirm whether the AlertActiveID and the EventID are changeable or not?
Also is it a part of SolarWinds Orion's business logic that the IDs are auto-incremented?
Please refer to the below SWQL queries for reference:
Query to fetch Alerts:
SELECT A.AlertActiveID , A.AlertObjectID , A.Acknowledged , A.AcknowledgedBy , A.AcknowledgedDateTime , A.AcknowledgedNote , A.TriggeredDateTime , A.TriggeredMessage , A.NumberOfNotes , A.LastExecutedEscalationLevel , A.DisplayName , A.Description as AlertDescription , A.InstanceType , A.Uri , A.InstanceSiteId , B.AlertID , B.EntityUri , B.EntityType , B.EntityCaption , B.EntityDetailsUrl , B.EntityNetObjectId , B.RelatedNodeUri , B.RelatedNodeId , B.RelatedNodeDetailsUrl , B.RelatedNodeCaption , B.RealEntityUri , B.RealEntityType , B.TriggeredCount , B.LastTriggeredDateTime , B.Context , B.AlertNote , C.AlertMessage , C.AlertRefID , C.Name , C.Description as ConfigurationDescription , C.ObjectType , C.Enabled , C.Frequency , C.Trigger , C.Reset , C.Severity , C.NotifyEnabled , C.NotificationSettings , C.LastEdit , C.CreatedBy , C.Category , C.Canned , D.ResponsibleTeam FROM Orion.AlertActive AS A INNER JOIN Orion.AlertObjects AS B ON A.AlertObjectID = B.AlertObjectID INNER JOIN Orion.AlertConfigurations AS C ON B.AlertID = C.AlertID INNER JOIN Orion.AlertConfigurationsCustomProperties AS D ON C.AlertID = D.AlertID WHERE A.AlertActiveID > @AlertActiveID
Query to fetch Events:
SELECT A.EventID , A.EventTime , A.NetworkNode , A.NetObjectID , A.NetObjectValue , A.EngineID , A.EventType , A.Message , A.Acknowledged , A.NetObjectType , A.TimeStamp , A.DisplayName , A.Description , A.InstanceType , A.Uri , A.InstanceSiteId , B.Name FROM Orion.Events AS A INNER JOIN Orion.EventTypes AS B ON A.EventType = B.EventType WHERE A.EventID > @EventID