sguido · NOC Team Lead · ✭✭✭✭✭

I use the following SWQL functions: - Concat(a, b, c, ...) - Takes one or more arguments and returns a single string that is the concatenation of the values of the arguments. - SubString(s, start, length) - Returns a substring of length characters starting at position start (the first character is position 1). - Length(s)…

I'll do that and I'll continue to dig into the alert(s) and see if the problem is related to something other than the maintenance window. Thank you everyone for the wisdom and if anyone thinks of something to check, please let me know.

I ran another test today and the "Time of Day" settings worked and an alert triggered when the maintenance window ended. However, we have seen this fail in production and no alert was triggered when the maintenance window ended. Causing us major PR issues with people's view of SW reliability. I've also seen it fail in…

I discussed it with a couple of engineers here and we feel it's the wrong way to handle it but wasn't sure if it was a bug or just a different approach.

I find I have to play around a little bit to get the character counts right but I think this will get you what you need. It looked to me like you didn't account for "(1.3.6.1.4.1.562.3.10.10.2.10.0)" in your counting. I only worked out the first one but you should be able to use the same formula for the rest. Please let me…

Sorry, I haven't figured out how to fix it yet.

I still have a similar problem for my mainframe alerts. If more then one mainframe job is late or fails it won't show a separate alert, it just updates the alert triggered time. I haven't tried to fight this battle yet but if I find an answer to that problem I'll post it here.

Do you know if they have rolled this fix up into a release yet? Thanks.

The command that works for me to parse out specific information out of the very long list of varbinds is: ${N=SWQL;M=SELECT SUBSTRING('${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}', CHARINDEX(firstMarkerTextString, '${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}')+firstMarkerTextStringLength,…

I'm sorry...I didn't post the specific code. Not Working: ${SQL:SELECT SUBSTRING('${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}', CHARINDEX('enterprises.99998.25.3.6 = ', '${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}')+27, CHARINDEX(', enterprises.99998.25.3.7 =',…

I'm not sure I understand what you mean. Can you supply an example or describe the problem a little more?

Moving them like that is what we do today and in order to keep the coverage for any given area of my environment spread to several polling engines for resilience can be changing to keep up with (~3500 nodes on 6 polling engines).

The problem I'm having isn't managing the load but managing the coverage. I need to insure that a given building or region of our environment is not polled by just one or two polling engines. In fact the more polling engines that have a piece of a given pie the more resilient I am to issues with the polling engines. So…

I believe that "${N=SWQL;M=SELECT" and "AS Message FROM Orion.Nodes n}" in your statement where the parts missing from my SQL statement that caused it to print out the statement instead of executing it. I'm now able to parse any output from any SNMP shout I want to alert on. Thank you very much for the help. - Sam G

This doesn't link to a document. If the document has been replaced can someone update this thread with the new link?