timt ✭✭✭✭✭

They show totally different time across the board.. An example of what I pulled from SQWL for Orion.Nodes Example for Orion.Events VS. What's being shown on Message Center (message center time is correct)

Getting an error mismatch input form case... is this correct? Thanks in advance! SELECT o.AlertConfigurations.Name AS [ALERT NAME] ,'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + ToString(o.AlertObjectID) AS [_LinkFor_ALERT NAME] ,o.AlertActive.TriggeredMessage AS [ALERT MESSAGE] ,o.EntityCaption AS [ALERT…

Thanks for the help, but that only maps directly to the F5 devices. I'm looking to map the IP/Host of the node to join into the IP address field.

That did not fix it. However query will work if I take out the custom properties. My question would be... how can I add some orion.nodescustomproperties into this query? SELECT DISTINCT EntityUri, SuppressFrom, SuppressUntil, ToLocal(SuppressFrom) AS [LocalSuppressFrom], ToLocal([SuppressUntil]) AS [LocalSuppressUntil],…

Found a workaround SWQL Query to select only records with latest timestamp SELECT N.Caption AS NodeCaption, N.ChildStatus, N.Status AS NodeStatus, TOLOCAL(N.UnManageFrom) AS UnManageFrom, TOLOCAL(N.UnManageUntil) AS UnManageUntil, TOLOCAL(AE.ObservationTimestamp) AS UnManagedWhen, AE.AccountID AS Who FROM Orion.Nodes N…

KMSigma , I am getting an issue where if someone suppressed the alert with a scheduled time, then when it triggers at the end of the scheduled time to re-enable the alerts, the information still remains on the mute alert report. Do you think you can take another look at this? Thanks much!

Hey KMSigma did you get a chance to see why there are still duplicated mute nodes from different AccountID? I'm still getting these 1-offs duplicate, but nevertheless, it's a great script.

It's showing a duplicate at the UserID when suppressed the alerts along with a different user. Code: SELECT DISTINCT CASE WHEN EntityUri LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%' AND EntityUri NOT LIKE 'swis://%/Orion/Orion.Nodes/NodeID=%/%' THEN N.Caption WHEN EntityUri LIKE…

Excellent Script. I've been using this to display currently muted nodes, however, I ran into an issue that if another users click on "suppress alerts", then it will show a duplicated event, where both userID are displayed. Is there a way to only select only the current user?

Hi wluther, can you share your code on how to get the panel of triggered items when you select on the date? BTW, this works like a charm thansk!

Keeping the NOC views simple is the best route for escalation. I created a duplicated Alerts View resource and filter specific alerts to be viewed by NOC, in this case, my alert is called "Critical" (See swql code) I used custom properties on each node to identify if the server is in production, and trigger the…

Better clarification. I need to join orion.ActionsProperties with Orion.AlertConfigurations Is there a table I can join on? Thanks!

I'm looking for how to do this with 'response time' group. But to answer the question, you will need to create a SAM custom application APM, then add in performance counters for CPU, assign the Nodes. Then create a group, and add in the APM application you just created for CPU. Next add to Network Atlas.

Thank you, that will work. I was hoping to create a template to apply to hundreds of applications per view, but I guess I can manually select the group.

More clarification: I need to add in a resource view to show a custom property node if it is muted and at the same time, show the account which muted the node. However, running this swql query resulted in an "audit type event" which will show multiple event of node being muted. Can I add this custom resource view to show…

Thank you! I didn't know you can just add more 'n.customproperties.[customproperty name]' after it to include more fields. All along, I though more codes were needed... this is great!

Yeah that's what I figured... Event Retention...

mesverrum , this is a great view, thank you for sharing. Since I have hundreds of servers for a certain application, would there be a way to have a high-level view, and group everything under a certain custom.property, instead of displaying servers per row? The idea would be just to have a single row to represent all…

I have custom 'application' groups that will join some nodes that have a customproperty value=i.e.,Application-1234. Some of these nodes also have customproperty='production' and 'dev' Now, I wanted to create an group SLA, availability report to list the application name with their group SLA. This is possible with the web…

I am able to get this out of SWQL, however, how can I link this to get the node name, instead of it just appearing in the message? SELECT o.TimeLoggedUtc, o.AccountID, o.ActionTypeID, o.AuditEventMessage, o.NetworkNode, o.NetObjectID, o.AuditingActionType.ActionTypeDisplayName FROM Orion.AuditingEvents o WHERE…

I am in need of this option, along with the "edit custom application properties" as well. Anyone knows a workaround?

Is it possible to put if 'node status = suppress alerts' ?

Does anyone knows how to remove the trailing %65535 from the F5, Virtual IP Address?

Thanks for the info, it was confusing trying to link the F5 tables, but his helped!