Modern Dashboard - Active Alerts Acknowledgement

Hi,

Under the acknowledgeit column I want it to go to the active alert of the specific node that is being clicked on so it can be acknowledged.

So this URL https://servername/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:9435 example

instead of this URL  http://server/Orion/Netperfmon/Alerts.aspx

any help would be appreciated thanks

SELECT DISTINCT
AlertObjects.EntityDetailsURL,
Nodes.Caption AS NodeName,
Nodes.Status as NodeStatus,
Nodes.DetailsURL,
'/Orion/Netperfmon/AckAlert.aspx?AlertDefID='+tostring(AlertObjects.AlertObjectID) AS AcknowledgeIt,
'Acknowledge' As AckLabel,
AlertActive.AlertActiveID, AlertObjects.AlertObjectID, AlertConfigurations.Name, AlertConfigurations.Severity, AlertConfigurations.ObjectType,
AlertObjects.EntityUri, AlertObjects.EntityType, AlertObjects.EntityCaption,
ToLocal(AlertActive.TriggeredDateTime) AS TriggeredDateTime, AlertObjects.LastTriggeredDateTime, AlertActive.TriggeredMessage AS Message,
AlertActive.AcknowledgedDateTime, AlertActive.Acknowledged AS Acknowledged, AlertActive.AcknowledgedBy, AlertActive.AcknowledgedNote,
Case
When Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400)>0 Then
ToString(ToString(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) +0.0)/86400))+'d '+
ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 86400*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400))) + 0.0)/3600))+'h '+
ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60))+'m ')
When Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 86400*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400))) + 0.0)/3600)>0 Then
ToString(ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 86400*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400))) + 0.0)/3600))+'h '+
ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60))+'m ')
When Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60)>0 Then
ToString(ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60))+'m ')
Else ''
End AS ActiveTime
FROM Orion.AlertObjects (nolock=true) AlertObjects
INNER JOIN Orion.AlertActive (nolock=true) AlertActive ON AlertObjects.AlertObjectID=AlertActive.AlertObjectID
INNER JOIN Orion.AlertConfigurations (nolock=true) AlertConfigurations ON AlertConfigurations.AlertID=AlertObjects.AlertID
INNER JOIN Orion.NodesCustomProperties (nolock=true) NodeCP ON AlertObjects.RelatedNodeID = NodeCP.NodeID
INNER JOIN Orion.Nodes (nolock=true) Nodes ON AlertObjects.RelatedNodeID = Nodes.NodeID
where Nodes.Caption like '%device%'
Order By AlertConfigurations.Name, AlertObjects.EntityCaption

  • ok I have fixed it by amending a part of the code to 

    '/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:'+tostring(AlertObjects.AlertObjectID) AS AcknowledgeIt,
    Issue I have now is can the alerts be removed after x amount of days once acknowledged?
  • There is an AcknowledgedDateTime in the Orion.AlertActive SWQL table. You could try modifying your WHERE clause to only show alerts where the difference between AlertActive.AcknowledgedDateTime and the current UTC time is < 7 days? Not sure if you need < or <= so test it out.

    WHERE DAYDIFF(AlertActive.AcknowledgedDateTime, GETUTCDATE() ) <= 7

    If you mean removed from the system completely, you could probably find a way to clear out the alert but if the trigger condition still exists then the alert will retrigger immediately anyway.

  • Just removed from the report. Ok thanks will give that a try.

  • I've incorporated the swql, but now it is only displaying devices that have been actioned within 7 days. I need it to remove these actioned items after x amount of days from the report please. I have tried it with an = as well with the same outcome. Any ideas cheers?

    SELECT DISTINCT
    AlertObjects.EntityDetailsURL,
    Nodes.Caption AS NodeName,
    Nodes.Status as NodeStatus,
    Nodes.DetailsURL,
    '/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:'+tostring(AlertObjects.AlertObjectID) AS AcknowledgeIt,
    'Acknowledge' As AckLabel,
    AlertActive.AlertActiveID, AlertObjects.AlertObjectID, AlertConfigurations.Name, AlertConfigurations.Severity, AlertConfigurations.ObjectType,
    AlertObjects.EntityUri, AlertObjects.EntityType, AlertObjects.EntityCaption,
    ToLocal(AlertActive.TriggeredDateTime) AS TriggeredDateTime, AlertObjects.LastTriggeredDateTime, AlertActive.TriggeredMessage AS Message,
    AlertActive.AcknowledgedDateTime, AlertActive.Acknowledged AS Acknowledged, AlertActive.AcknowledgedBy, AlertActive.AcknowledgedNote,
    Case
    When Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400)>0 Then
    ToString(ToString(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) +0.0)/86400))+'d '+
    ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 86400*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400))) + 0.0)/3600))+'h '+
    ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60))+'m ')
    When Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 86400*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400))) + 0.0)/3600)>0 Then
    ToString(ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 86400*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/86400))) + 0.0)/3600))+'h '+
    ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60))+'m ')
    When Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60)>0 Then
    ToString(ToString(Floor(((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) - 3600*(Floor((SecondDiff(AlertActive.TriggeredDateTime,GetUtcDate()) + 0.0)/3600))) + 0.0)/60))+'m ')
    Else ''
    End AS ActiveTime
    FROM Orion.AlertObjects (nolock=true) AlertObjects
    INNER JOIN Orion.AlertActive (nolock=true) AlertActive ON AlertObjects.AlertObjectID=AlertActive.AlertObjectID
    INNER JOIN Orion.AlertConfigurations (nolock=true) AlertConfigurations ON AlertConfigurations.AlertID=AlertObjects.AlertID
    INNER JOIN Orion.NodesCustomProperties (nolock=true) NodeCP ON AlertObjects.RelatedNodeID = NodeCP.NodeID
    INNER JOIN Orion.Nodes (nolock=true) Nodes ON AlertObjects.RelatedNodeID = Nodes.NodeID
    where Nodes.Caption like '%device%' AND DAYDIFF(AlertActive.AcknowledgedDateTime, GETUTCDATE() ) < 7
    Order By AlertConfigurations.Name, AlertObjects.EntityCaption

  • With the additional where clause it is probably only showing alerts that have been acknowledged.

    You might be able to try something like the below but I haven't tested it. Should show any alerts that match your caption filter, and have either not been acknowledged or have been acknowledged for more than 7 days.

    WHERE Nodes.Caption like '%device%' AND (
        (DAYDIFF(AlertActive.AcknowledgedDateTime, GETUTCDATE() ) < 7 )
        OR
        AlertActive.AcknowledgedDateTime IS NULL
        )

    Edit: Following comments below, updated code from IS NOT NULL to IS NULL, removed additional clause.

  • I am getting 

    Provided SWQL query is not valid. Details: RunQuery failed, check fault information. Conversion failed when parsing the value to data type datetime.
  • Looks to be this section of the code

     

    AlertActive.AcknowledgedDateTime = ' '

    when I have just have this it still only brings back the 3 acknowledged items and does not show any un-acknowledged items still.

     

    WHERE Nodes.Caption like '%device%' AND (
        (DAYDIFF(AlertActive.AcknowledgedDateTime, GETUTCDATE() ) < 7 )
        OR
       AlertActive.AcknowledgedDateTime IS NOT NULL
        )

  • think I may have it

    WHERE Nodes.Caption like '%Device%' AND (
        (DAYDIFF(AlertActive.AcknowledgedDateTime, GETUTCDATE() ) < 7 )
        OR
       AlertActive.AcknowledgedDateTime IS NULL
        )

  • Ooops, yes.  "IS NULL" for the ones where you haven't acknowledged it yet as those alerts won't have a DateTime value yet. 

    You should be fine without the = '' clause. That was more for if you acknowledge an alert and then unacknowledge it, I'm not sure if the DateTime will go back to NULL or an empty field ( '' ).

    EDIT/UPDATE: I did a quick test. If you unacknowledge an alert, the field reverts to NULL in the database so you should be fine with just the additional "IS NULL" check.