cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 10

Trigger for each group member in a group?

Jump to solution

Hello,

As a test, I created a group with nodes as group members and set the logic for the alert to be that the Group Member Status is equal to Down.  This group contains 5 group members.  The alert triggers if one of the group members goes down, but what if a 2nd group member goes down before the 1st group member is back up or before the alert is acknowledged?  Is there a way to trigger the alert EACH time a group member goes down?  It doesn't have to apply to only groups of nodes, I want to do this with all kinds of object types.  Right now, this is what happens:

Test Group

Server1

Server2

Server3

Server4

Server5

Server1 goes down; alert trigger condition is true and email is sent for Server1 being down

Server2 goes down; no alert because the trigger condition is still true from Server1 being down still

I would like to see an alert for each time a group member goes down

0 Kudos
1 Solution
Level 12

Instead of creating a group, create a custom property instead, unique only to all members. Then create your alert that filters out this particular custom property, and that should meet your requirements.

View solution in original post

7 Replies
Level 9

I make an alert to email me if any group member status goes down (even when there were other nodes in the group that went down before), I write my solution and wish it can help you.

0.JPG

 

 

1. Make a custom property for groups as text) (e.g. chng_date).

1.JPG

 

 

2. Make an alert for groups:

    • Select I want to alert on to Custom SWQL Alert (Advanced)
    • Set up your SWQL condition to Groups
    • And write the following code:

INNER JOIN Orion.ContainerMembers cm ON Groups.ContainerID = cm.ContainerID

INNER JOIN ORION.Nodes n ON n.NodeID = cm.MemberPrimaryID

INNER JOIN ORION.EVENTS e ON n.NODEID = e.NETWORKNODE

WHERE Groups.name LIKE '%-SITE%' AND NOT Groups.Status = 1 AND e.EventType = 1 AND datetime(Groups.customproperties.chng_date) < e.EventTime

-- I made groups with "-SITE" identifier so I add Groups.name LIKE '%-SITE%’ to recognize them.

2-a.JPG

 

 

 

    • In reset condition select Create a special reset condition for this alert and change SWQL condition to:

INNER JOIN Orion.ContainerMembers cm ON Groups.ContainerID = cm.ContainerID

INNER JOIN ORION.Nodes n ON n.NodeID = cm.MemberPrimaryID

INNER JOIN ORION.EVENTS e ON n.NODEID = e.NETWORKNODE

 

WHERE Groups.name LIKE '%-SITE%' AND Groups.Status = 1 AND e.EventType = 1 AND datetime(Groups.customproperties.chng_date) < e.EventTime

2-b.JPG

 

 

    • In Trigger Actions add an action to change the chng_date value to Sortable Date (${N=Generic;M=S}).

2-c.JPG

 

 

    • And add Send an Email/Page action with the subect:

${N=SwisEntity;M=Name} Status is ${N=SwisEntity;M=StatusDescription} at ${N=Alerting;M=AlertTriggerTime;F=DateTime}

               And the Message:

${N=Generic;M=DateTime;F=DateTime}

NODES:

${SQL:SELECT cast(cast([GroupMemberFullName]as varchar(max)) + '' + ' ' + '-' + ' ' as XML), cast(cast([GroupMemberStatusName]as varchar(max)) + '' + CHAR(10) + CHAR(13) as XML) FROM  [SolarWindsOrion].[dbo].[Containers_AlertsAndReportsData] where   GroupID=${GroupID}  FOR XML PATH('')}

2-d.JPG

 

 

    • In Reset Actions add an action to change the chng_date value to Sortable Date (${N=Generic;M=S}).

2-e.JPG

 

And leave other fields as default.

 

0 Kudos
Level 12

Instead of creating a group, create a custom property instead, unique only to all members. Then create your alert that filters out this particular custom property, and that should meet your requirements.

View solution in original post

Looks like the custom property is much cleaner for the alert trigger and is working great.  Thanks all for the help!

0 Kudos

Thanks sirpaw.  I'll test it out and see how it goes too.  See my above post for some background on what I want to accomplish.  It didn't get approved until this morning.  This may do the trick!

0 Kudos

Don't make the object of the alert a group, the object of the alert should just be nodes if you want an alert on each node.

- Marc Netterfield, Github
0 Kudos

Thanks for the reply.  Let me try to describe what I want to do.  I just inherited this project and there are currently https monitors for some sites we have.  The way the alert trigger logic is currently setup is:

If Application Monitor for Site1 is Down

OR

If Application Monitor for Site2 is Down

OR

etc...30 times for 30 different sites.  We have more sites that need to be monitored.

I can't imagine that this is the most efficient way to design this, as it is easy for someone to forget to add logic to the alert for a new site.  That is where I came up with the idea of alerting on a group, and the group would be dynamically populated by custom properties.  Is there a more efficient or best practice for accomplishing this without a ton of ugly logic or creating an alert for every single site?  Thanks in advance

0 Kudos

So I feel like "groups" within solarwinds is basically a trap that a lot of new people fall into.  In most cases they are not helpful for alerts and only situationally helpful for organizing the layout/views of things.  You should do like sirpaw​ described and create custom propeerties to group up nodes or, better for your situation, sam application monitors with similar characteristics, then just set up your alarm with a filter that says something like alert on applications that have their custom property set how you need it.

- Marc Netterfield, Github