mesverrum · Observability Architect · ✭✭✭✭✭

select ac.Name ,'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:'+ToString(AlertObjectID) as [_linkfor_Name] ,ac.CustomProperties.alertproperty -- this is my example property, change alertproperty to whatever you need ,EntityCaption as [Trigger Object] ,EntityDetailsUrl as [_linkfor_Trigger Object] ,case WHEN…

I'd agree the Appinsight template is useful and makes sense in situations like you describe with active web servers hosting multiple pages and a significant user base or faces the public internet and all that, but I just want to point out that not every server running IIS warrants that level of scrutiny. Even when we have…

If your system has already been running for at least a year and your retention is already set how you want it then you are all set. The longer term tables tend not to be very large because they only have one data point per element per day, where the detail stats page would have 144 data points per day

Like I mentioned that exact code was just me guessing as I sat on a plane and might not be 100%, but the idea is to use sub strings and character index to find where each delimiter ends, until the start of the next delimiter.

Nobody uses hyperv Anyway coneptually the idea is the same, in the process of updating your vm configuration I suspect that the interface indexes are getting changed. That is the primary indicator Orion uses to correlate the interfaces. One trick I have used in the past is just to go into the database and replace the old…

You are mistaken that the api has no ability to search. It's not specific to the ipam section of the api, but everything in the orion database is searchable. I'm on my phone at the moment so I can't paste in a code example, but I have made many search tools for ipam subnets in the past. As mentioned in the post by…

To your point about null values dumping out the whole SWQL query, the workaround I have been using is just to wrap the whole thing in an isnull function, usually something like "select top 1 isnull((select my thing from whatever table),'None Found') as Result from orion.nodes"

I feel like it's been around since maybe 2016, but i'm terrible at remembering time.

Yeah like bbowie says, if you want to automate it then you just pull the data from the API and build a "new" discovery each day/week/whatever, they have capabilities built in to even hide these discoveries from the GUI and to automatically delete them after they are finished. Would be nice as a native feature, but most of…

I think the point of the trouble is that the vlans don't exist yet, so they cannot be inventoried. I don't believe you can feed arrays of values into the CCT engine. It knows how to loop through existing nodes and existing interfaces but doesn't seem to have a method of feeding it any new arrays of things to loop through.…

Brian, components don't have custom properties I've worked around this before using custom swql alerts to alert on a "node" with a bunch of joined component conditions

DBA, as in a Database Administrator, a person who is trained in the care and feeding of databases. If you are really lucky you would have someone with some ETL (Extract, Transform and Load) experience as that's pretty much exactly what you are looking at doing in this case. Since the data was definitely collected then I…

As a quick example I set up a condition like this: FYI You have to treat 'is blank' separately from 'is not equal to' because SQL won't compare a null cell with a cell that has a value in it, thats just DB logic you have to learn the hard way sometimes. Anyway we reset automatically when it is no longer true, our alert…

Worth pointing out here as I have seen this a few times in the past, it looks like the actiontypeid list changes around based on the versions and order that you installed the modules in since it looks like different modules have different actions available to them and they just get added to the list when they are…

I wouldn't call that especially risky, what concerns do you have? If this is your DBA's first time setting up this kind of configuration then the risk is entirely on that end, whatever application you stick in this hybrid cloud dr situation is going to face some risks of being the guinea pig. Those issues really don't have…

If they are using platform 2015 then it will be a pain to work in the SDK as things have changed a bit and a number of the examples you find on thwack and on github will likely assume newer versions. Just something to be cautious of.

Since this whole thing is a set of script monitors I feel like the easiest way is just to combine them into a single script with 3 outputs and build in the logic to just exit with a 3/critical status. Way simpler to control the script than having to build some fancy one-off alert logic.

Ah yeah, i can imagine that stacking those functions could give you problems since it would seem like you are trying to do math against multiple objects in the array. I don't normally use any of those array functions in SWQL. Might be able to nest your whole array and subnet deal in a subquery and then do the 0+ and order…

i've done it about a year ago in scripts by using the executesql command under reporting to update the appropriate fields in the db, it worked at the time.

Also I see from your screenshot that these are layer 3 connections, the one that has full detail is a layer2. Is this actually a direct link between xxxxSWCore and IR-xxxx or is it routed in some way? Are you monitoring the interface on the other side of the link on IR-xxxxx? Is there a VLAN or something that that we need…

Ignore this if this doesn't apply to you, but whenever I see orgs who are maxing out the 100k limit I have to ask if there is actual material value in monitoring bandwidth on all those individual interfaces? A big UDT license would give you up/down/connected device visibility into all the switches, and is a hell of a lot…

Right after I posted it I realized you could just wrap the query up in a little powershell front end that prompts the user for the node they want to report on and have it request the list from the API and package the results into a csv for you.

For a point of reference, I'm working this week with a client running over 40 ape licenses, 160k interfaces, monitoring over 10k Sam apps and a mountain of components. Their system does take some babysitting now and then but the team handles it along with several other tools and custom integrations and it keeps up and…

It's doable, I have a query i wrote before that displays counts of servers in different states, its not exactly what you need but the SQL technique would be similar, adding nested select statements into the previous query i gave and maybe joining it from the containermembers table for the status. SELECT Count(*) as TOTAL…

tdanner​ You say this works in the custom query, you sure thats not just in custom table/report? When I try this code in a custom query resource I get this I can use it successfully in a custom table by checking the allow HTML box. Is there a bit I'm missing? And if that is WAI, how many cases of what liquor do I have to…

If you use the custom SWQL to feed into a custom table/report then there s an option in those that would allow you to process html,. but the basic custom query resources would ignore any formatting you try to put into it. See this thread Text colour to display alerts using custom query -Marc Netterfield Loop1 Systems:…

This is something I whipped up based on my lab environment. I'll admit my routing table skills are marginal so there may be some cleanup necessary depending on what you want to see but try it out and see if this gets you near where you want to be. From whatever view you want to use this just customize the view, add a…

You'll have to post your whole script to see what you are missing, sounds like you are breaking the syntax somewhere in there.

Probably referring to this post: Rest API Issue - Response Code 200

Actually you can pull the details of the windows event(s) that trigger the alert, I usually add these to my email messages because they can be a little verbose for showing on the event list. To add that variable to the email reference this variable in the message: ${N=SwisEntity;M=ComponentAlert.WindowsEventMessages} -Marc…