m-milligan ✭✭✭✭✭

What kind of problems have you encountered? I usually use the offline installer because I like to pre-stage the install.

Sure. Bear in mind that in Solarwinds terms, a "Transaction" entity is the combination of a Location and a Recording. So, you're asking about cases where you have one Recording in two Locations, and both of those Transactions are down. Here's how to do it: * Create a new alert. * For "I want to alert on", choose "Custom…

Use this SWQL query: Select Caption from Orion.Nodes where NodeID IN ( select ChildNetObjectID from Orion.Dependencies where ParentNetObjectID = <NodeID> ) Where <NodeID> is the ID of the node that triggered the alert.

You'll need to use a SQL query with the FOR XML PATH('') clause. Try this: SELECT TOP 10 Convert(varchar,TimeGeneratedUtc)+' '+Message FROM APM_WindowsEvent_Detail INNER JOIN (SELECT ID as CID FROM APM_Component WHERE ComponentOrder=1 and ApplicationID = 728) CID ON ComponentID = CID ORDER BY TimeGeneratedUtc DESC for xml…

I have not! My experience is that all matching alerts are triggered.

If you have two alerts with identical conditions, they'll both be triggered when the conditions are met.

That worked really well with the legacy transaction recorder! The new transaction recorder encrypts the XML, though, so I can't just export/edit/import any more.

Yes, please.

This should do what you need: SELECT count(*) as AlertCount FROM Orion.AlertActive aa, ORION.Nodes N JOIN Orion.NodesCustomProperties NCP ON N.nodeid = NCP.nodeid WHERE aa.AlertObjects.AlertConfigurations.Severity=2 AND NCP.<CustomPropertyName> = '<CustomPropertyValue>' For example, my Solarwinds installation has a custom…

Can you post a screenshot of the table in the old dashboard, please?

1.3.6.1.4.1.47196.4.1.1.1.100 = HPE Aruba 6300M 24-Port SFP+ and 4-Port SFP56 Switch

And here's a version that support scheduling. It looks like the Node and App management tools, too! https://thwack.solarwinds.com/product-forums/the-orion-platform/f/alert-lab/89804/use-custom-html-to-unmanage-mute-all-members-of-a-group---the-drop-down-version

Hi @ralfs, thanks for creating this! I've expanded on it by adding the ability to umanage and remanage group members here.

Similar error here, re-running the Configuration Wizard fixed it.

See my reply to mesverrum​. Here's the revised query for unmanaged nodes (the revised query for muted nodes is in my reply): Select N.Caption, N.UnManageFrom, N.UnManageUntil, LastUnmanageEvent.TimeLoggedUtc, AE.AccountID from Orion.Nodes N LEFT OUTER JOIN ( SELECT NetObjectID, Max(AuditEventID) as [AuditEventID],…

Absolutely.

I should think so. Say the name of your node custom property is "Department" and you want to filter for nodes where the Department is "Financials". You'd need to add a line like this to the WHERE clause at the end: AND N.CustomProperties.Department = 'Financials' So the final query would look like: Select N.Caption,…

Excellent! Glad that did it!

So as an FYI, depending how old someone's instance is, and how many modules they have installed the audit events and regular events tables will have all kinds of different numbers for eventids. To make a query work in other people's environments I find it is 100% required to write queries with a join to the relevant types…

Great. So if you run the original query to show muted nodes, but you refer to EventTypes 55 and 56, does that produce the results you expected? Here's the revised query using your EventTypeIDs: Edited 2018-05-03 to account for variation in Orion.AuditingActionTypes.ActionTypeID across installations. Select N.Caption,…

OK, your installation is using different IDs for those actions. Replace (102,103) in the query I provided with (55,56).

Is Hospital_System a custom property of Nodes? If so, you'll need to refer to Nodes.CustomProperties.Hospital_System in the top query, and create a bogus field called Hospital_System in the bottom query, like this, so you can refer to it in the outside query: SELECT [Node], [Hospital_System], [OS], [OS Version], [Total CPU…

No problem. Can they show you a VM that's being picked up by the query? If it's really happening, I can help figure out why .

Sounds right to me! I didn't stop to think that date formats might be an issue. Edit: I've incorporated this change into my template and to the template I posted to the Content Exchange section.

Did you try the new code? Did it work?

I'll send you some new code in a minute. Check your messages.

The query, as-is, should only show physical servers. It looks for nodes that don't have a virtual machine ID linking them to the table of VMs, and it shows ESX hosts, which are physical servers.

OK, that suggests that Solarwinds is not logging auditing events for Alert Suppression (muting). That's why those three columns are empty in the query results - there is no matching data in the table that logs the auditing events. When you run the query below, what do you get? I wonder if your installation has a Action…

It should be on the Start menu on your main Orion poller, in the Solarwinds Orion SDK group.

No, I mean run the query in the SWQL Studio application. That's the SWQL equivalent to Database Manager. It should have been installed when you installed Solarwinds. In this case, running that query in Database Manager (after removing "Orion.") should produce the same result as running it in SWQL Studio. Does the…