adam.beedell · SRE/Machine Learning Student · ✭✭✭✭✭

You can use nested queries in alerts despite the fact they're not supported. You probably want to Join to the subquery, eg [Forced top line] Select x.ID FROM TABLE as x [Your code] LEFT JOIN ( Select problems from y ) on x.ID = y.ID Use a RIGHT join is instead you're selecting OKs from y There are definitely easier ways to…

I've got some live NCM script actions, but also I've got no great knowledge of writing commands like this. What seems to be the problem so far? Looking for variables? If so, they at least work in the IP address section in the same dialogue box, I recommend using an email action to find/test macros, then once that's…

Smartcard auth, really? Seems rare! I imagine if the monitor doesnt have one of these smartcards you'd have a problem. If it does somehow you'd probably need to script it. There is a log file per component, and you can get more verbose logs with the log adjuster. Log adjuster is on the main polling engine and is…

Mesverrum is right, complex conditions solve this, select one poller for one and one for the other. The Why is worth considering. Here the alert is for a custom node poller, to trigger an alert the condition returns an ID from the home table (the custom node poller table in this instance). You've got two seperate pollers…

I had a thought about this over the weekend - Check if your SNOW integration definitively looks in the event log for alerts actions rather than alerts themselves, if it looks specifically for triggers and you dont add a specific "for SNOW"-thing then they may still trigger as alerts still function with actions off

Not sure how you'd get the api pollers creds over there, you can do local encryption/certs/etc on the server running the action though which allows you to secure everything

Huh, that was a quiet change, will have a look and report back if anything interesting happens

Hehe I had the capacity manager hat on for a while actually! Having no slack in the system always looks awesome until the moment any small problem gets multiplied into a massive one. Slack is good. @"ImNishat" If you've got an angry network capacity guy just roll out to a small site/subnet and measure over a week. Who…

Havnt had an issue with pausing other than people not unpausing. Havnt used SNOW integration with a pause yet I think You can script switching snow actions off to to dev or something in bulk if you need to. Perhaps breaking the instance. Seems unnecessary

Study -> Buy exam -> Do exam

There's a new perfstack?

I feel like that user needs to get off your back! Stick wireshack on to confirm. I dont know the default Node Status Poll offhand but lets say it's 4, then it's 4 per 120 seconds on the above. When the device gives less than ideal results it enters fastping mode, you get I think 4x the normal amount, so 16 per 120 in the…

How would you want it when one of these nodes had >1 interface down?

Excellent troubleshooting! I guess we need a bug report

Filter on each widget on tab 2

SELECT DISTINCT(data.Accountid) as Account --, data.AuditEventMessage , max(data.TimeLoggedUtc) as latesttime FROM orion.auditingevents AS data WHERE 1=1 AND [data].[ActionTypeID] = 1 GROUP by data.AccountID--, data.AuditEventMessage ORDER BY data.AccountID asc WITH NOLOCK Add a time where of your choice

God I love working this way - I find it's pretty hard to get through the "got it all on paper" step, got any tips for getting through it fast?

If classic: - Add a view - Add a filter, filter by that thing - (and/or add the filter to the resources on that page) If modern - Add a dashboard - Either make a a generic dash, then set the URL filter (search for more info) to that. I think there's a configurator coming in later patches for this. - Or add the filter to…

I'd say they're most useful for ctrl+f-ing your tickets that went to dev to see if they made it into the current release

This is probably "someone saved something by mistake" The way to understand this is the thing you're looking at is a view applied to an object There will be a details view which covers these (but maybe other stuff too, depends what it is), you can tell which by editing the node if it's a node, or editing the page. Details…

The "all alerts this object.." widget cares about the Scope, not the Trigger. Ie, the bit above you should put "fixed disk" in the scope to not get weird results Stuff without scopes will interact poorly with the widget Broken alerts will break the widget to some extent, though it'll try anyway and may still pull results

What happens with the failed link? Is it not clickable? or is it clickable and goes to a busted URL? (if so, busted how?) (right click copy link maybe, else could run the coe in swql studio and see what comes back Joining on 1=1 is cool, havnt done that in such a tidy format before

In addition to @"mesverrum" 's answer, which is great 1) I expect the issue there is that 0 amps = incomplete circuit, probably unplugged. But yeah up to the devs for that bit of kit 2) Yes, use that "set custom thresholds" radio button in the screenshot 3) Forcing it to Up without other thresholds isnt worth doing, may as…

I think what most of us do most of the time is to have the alert trigger a handler and feed in a target, and have the handler send the command out and report back to $notes Alert -> Trigger -> CurlMyJuniper.exe -Arguments "${NodeIP}", "${alertID}" (or .ps1, .py, etc) CurlMyJuniper says pull encrypted creds from X, $Results…

There's an alert for this OOTB called "not responding" or something simmilar. Usually if you've got 1 node that goes into that status, you've got one of a couple causes 1) Monitoring creds changed 2) Device is struggling 3) Service responsible for stats is struggling If there's 100's suddenly in that state, you probably…

Application tree with filter on applicationname like '%format you've set for this set of website checks%'

I think it's mostly in FROM Orion.SEUM.TransactionStepRequests You can use Hubble to find out for sure if need be

Beware the IP and auth token being exposed in the message above, maybe those have been filtered out, but if not best to remove em I believe the answer is probably yes, but hard to say for sure without testing it futher, @"mesverrum" 's workflow is a good one and can keep you close to a known working good curl if need be

Depends on how you write the alert. you can do it as an event, probably easiest as an event, then you'd want to set it to only live for an hour or so if you wanted to write one as a polled status you'd need to have a rule beyond "changed", like "WHERE node.bgp.neighbor not like node.customproperties.idealbgp" etc

You get APs and that as default. if you want them as nodes you'd need to ping em as nodes