Trigger for each group member in a group?

[solarwinded]

Hello,

As a test, I created a group with nodes as group members and set the logic for the alert to be that the Group Member Status is equal to Down.  This group contains 5 group members.  The alert triggers if one of the group members goes down, but what if a 2nd group member goes down before the 1st group member is back up or before the alert is acknowledged?  Is there a way to trigger the alert EACH time a group member goes down?  It doesn't have to apply to only groups of nodes, I want to do this with all kinds of object types.  Right now, this is what happens:

Test Group

Server1

Server2

Server3

Server4

Server5

Server1 goes down; alert trigger condition is true and email is sent for Server1 being down

Server2 goes down; no alert because the trigger condition is still true from Server1 being down still

I would like to see an alert for each time a group member goes down

[m.shagerdi]

I make an alert to email me if any group member status goes down (even when there were other nodes in the group that went down before), I write my solution and wish it can help you.

1. Make a custom property for groups as text) (e.g. chng_date).

2. Make an alert for groups:

• Select I want to alert on to Custom SWQL Alert (Advanced)
• Set up your SWQL condition to Groups
• And write the following code:

INNER JOIN Orion.ContainerMembers cm ON Groups.ContainerID = cm.ContainerID

INNER JOIN ORION.Nodes n ON n.NodeID = cm.MemberPrimaryID

INNER JOIN ORION.EVENTS e ON n.NODEID = e.NETWORKNODE

WHERE Groups.name LIKE '%-SITE%' AND NOT Groups.Status = 1 AND e.EventType = 1 AND datetime(Groups.customproperties.chng_date) < e.EventTime

-- I made groups with "-SITE" identifier so I add Groups.name LIKE '%-SITE%’ to recognize them.

• In reset condition select Create a special reset condition for this alert and change SWQL condition to:

INNER JOIN Orion.ContainerMembers cm ON Groups.ContainerID = cm.ContainerID

INNER JOIN ORION.Nodes n ON n.NodeID = cm.MemberPrimaryID

INNER JOIN ORION.EVENTS e ON n.NODEID = e.NETWORKNODE

WHERE Groups.name LIKE '%-SITE%' AND Groups.Status = 1 AND e.EventType = 1 AND datetime(Groups.customproperties.chng_date) < e.EventTime

• In Trigger Actions add an action to change the chng_date value to Sortable Date (${N=Generic;M=S}).

• And add Send an Email/Page action with the subect:

${N=SwisEntity;M=Name} Status is ${N=SwisEntity;M=StatusDescription} at ${N=Alerting;M=AlertTriggerTime;F=DateTime}

               And the Message:

${N=Generic;M=DateTime;F=DateTime}

NODES:

${SQL:SELECT cast(cast([GroupMemberFullName]as varchar(max)) + '' + ' ' + '-' + ' ' as XML), cast(cast([GroupMemberStatusName]as varchar(max)) + '' + CHAR(10) + CHAR(13) as XML) FROM  [SolarWindsOrion].[dbo].[Containers_AlertsAndReportsData] where   GroupID=${GroupID}  FOR XML PATH('')}

• In Reset Actions add an action to change the chng_date value to Sortable Date (${N=Generic;M=S}).

And leave other fields as default.

[sirpaw · Accepted solution]

Instead of creating a group, create a custom property instead, unique only to all members. Then create your alert that filters out this particular custom property, and that should meet your requirements.

[solarwinded]

Looks like the custom property is much cleaner for the alert trigger and is working great.  Thanks all for the help!

[solarwinded]

Thanks sirpaw.  I'll test it out and see how it goes too.  See my above post for some background on what I want to accomplish.  It didn't get approved until this morning.  This may do the trick!

[mesverrum]

Don't make the object of the alert a group, the object of the alert should just be nodes if you want an alert on each node.

[solarwinded]

Thanks for the reply.  Let me try to describe what I want to do.  I just inherited this project and there are currently https monitors for some sites we have.  The way the alert trigger logic is currently setup is:

If Application Monitor for Site1 is Down

OR

If Application Monitor for Site2 is Down

OR

etc...30 times for 30 different sites.  We have more sites that need to be monitored.

I can't imagine that this is the most efficient way to design this, as it is easy for someone to forget to add logic to the alert for a new site.  That is where I came up with the idea of alerting on a group, and the group would be dynamically populated by custom properties.  Is there a more efficient or best practice for accomplishing this without a ton of ugly logic or creating an alert for every single site?  Thanks in advance

[mesverrum]

So I feel like "groups" within solarwinds is basically a trap that a lot of new people fall into.  In most cases they are not helpful for alerts and only situationally helpful for organizing the layout/views of things.  You should do like sirpaw​ described and create custom propeerties to group up nodes or, better for your situation, sam application monitors with similar characteristics, then just set up your alarm with a filter that says something like alert on applications that have their custom property set how you need it.