cancel
Showing results for 
Search instead for 
Did you mean: 
trek333
Level 9

What are the options to mass Export/Edit/Import Alert Configurations for Orion 2015.1.2?

What are the options to mass Export/Edit/Import Alert Configurations for Orion 2015.1.2 (NPM 11.5.2)?

Actions taken so far with apparent dead-ends without upgrading Solarwinds:

Using Solarwinds web browser UI, only one alert can be exported at a time.

SWExportIssue.png

The Solarwinds Powershell modules (SwisPowerShell and PowerOrion) were installed on an evaluation server (MS Windows 2008 Standard SP2 server, Powershell 3.0), but the following error is received upon attempting to use the Orion.AlertConfigurations verb to export an alert.

PS C:\ps> $ExportedAlert = Invoke-SwisVerb $swis Orion.AlertConfigurations Export 1

Invoke-SwisVerb : Verb Orion.AlertConfigurations.Export: Not found

At line:1 char:18

+ $ExportedAlert = Invoke-SwisVerb $swis Orion.AlertConfigurations Export 1

+                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : InvalidOperation: (Smiley Happy [Invoke-SwisVerb], FaultException`1

    + FullyQualifiedErrorId : SwisError,SwisPowerShell.InvokeSwisVerb

PS C:\ps>  $PSVersionTable

Name                           Value

----                           -----

WSManStackVersion              3.0

PSCompatibleVersions           {1.0, 2.0, 3.0}

SerializationVersion           1.1.0.1

BuildVersion                   6.2.9200.16398

PSVersion                      3.0

CLRVersion                     4.0.30319.276

PSRemotingProtocolVersion      2.2

PS C:\ps> [environment]:Smiley SurprisedSVersion.Version

Major  Minor  Build  Revision

-----  -----  -----  --------

6      0      6002   131072

Per search of THWACK (see url below), it appears that the Powershell Orion.AlertConfigurations verb is not available for Orion 2015.1.2.

Re: Verb Orion.AlertConfigurations.Export: Not found

0 Kudos
7 Replies
tdanner
Level 19

Re: What are the options to mass Export/Edit/Import Alert Configurations for Orion 2015.1.2?

Without the Import and Export verbs, you won't be able to do this through the API. Depending on what kind of edits you are trying to make, you might get away with editing the data in the database directly. If you want to go that route, keep in mind:

* This is not a supported operation

* Back up your database first

* Make your database changes with at least the alerting service stopped

* When you start the alerting service after, look at the alerting service log (C:\ProgramData\SolarWinds\Logs\Orion\Alerting.Service.V2.log) and SWISv3 log (C:\ProgramData\SolarWinds\InformationService\v3.0\Orion.InformationService.log) for any errors

0 Kudos
trek333
Level 9

Re: What are the options to mass Export/Edit/Import Alert Configurations for Orion 2015.1.2?

tdanner...Thanks for the prompt response! Using MS SQL Profiler, the SELECT statement below was discovered to be used to query the alert configurations/definitions.

SELECT T4.*, T5.*, T1.*, T2.*, T3.* FROM

dbo.Actions AS T1

INNER JOIN dbo.ActionsAssignments AS T3 ON T3.ActionID = T1.ActionID

LEFT JOIN dbo.ActionsProperties AS T2 ON T2.ActionID = T1.ActionID

LEFT JOIN AlertConfigurations AS T4 ON T3.ParentID = T4.AlertID

LEFT JOIN AlertDefinitions AS T5 ON T4.AlertRefID = T5.AlertDefID

The data results from this query indicates that the SQL queries in the TriggerQuery and ResetQuery columns of the AlertDefinitions table are used to evaluate the alert triggers, but no records exist in the AlertDefinitions table for new alerts created using the Solarwinds web browser UI (and several existing alerts). In addition based on the data, the Trigger and Reset columns of the AlertConfigurations table may contain the evaluation equations for the alert triggers. The data in these columns appear to be in XML format with a XML element named "Configuration". The "Configuration" XML element's format seems to define the trigger, but its format seems to deviate from the XML concept of being human readable. In other words with no documentation on the details for alert configuration/definitions, it would be a time consuming process with prone to error to figure out the proper fields used for an alert configuration/definition.

Would you be able to offer any details/documentation that would make it possible to “get away with editing the data in the database directly”?

0 Kudos
tdanner
Level 19

Re: What are the options to mass Export/Edit/Import Alert Configurations for Orion 2015.1.2?

The AlertDefinitions table relates to the "Advanced Alerts" system. This is the system that was replaced by the "alerting v2" system that has the web-based editor. In 11.5 you could use either system.

I agree that those XML blobs are not human friendly. The are produced by serializing the model objects using DataContractSerializer. There is no documentation for this format.

What kind of mass edit are you trying to make?

0 Kudos
mesverrum
Level 20

Re: What are the options to mass Export/Edit/Import Alert Configurations for Orion 2015.1.2?

Like tdanner mentioned, you are going to be pretty much on your won when it comes to parsing that trigger and reset XML.  I've seen the request come up often and nobody has been able to put forth an easy to use solution.  I've done mass edits before to the trigger and query XML, but it was a relatively simple set of substitutions where I took the existing info, made the change via the UI once to understand what impacts it would have, then built a SQL update to push out a similar set of changes to all the related alerts.  Took a long time to get it right but it was still faster in that case than editing 100 alerts by hand.

- Marc Netterfield, Github
0 Kudos
Highlighted
trek333
Level 9

Re: What are the options to mass Export/Edit/Import Alert Configurations for Orion 2015.1.2?

tdanner ,

I think that mesverrum explained the type of edits (i.e. alert creation/duplication) that I am trying to accomplish. It sounds a bit time consuming, complicated, and prone to error.

A related topic at the url below is feature request for “conditional trigger actions” for alerts that would eliminate the need to create numerous “similar” alerts. For my organization’s use case, this requested feature would be used to execute different sets of alert actions based on the value of a custom node property. The custom node property value would indicate the importance of the node (critical, high, medium, low). For example, a critical priority node would send a SNMP Trap message to create a ServiceNow incident (and other actions) while a low priority node would just log the alert. To implement this functionality, it will require 4X the alerts without “conditional trigger actions” or some similar feature of Alert Manager.

https://thwack.solarwinds.com/ideas/1110#start=75

While off topic of this thread, would you be able to offer an alternative feature of the Solarwinds Alert Manager that would negate the need to create 4X alerts to implement the functionality described in the above text?

Another alternative…does Solarwinds offer a more advanced alerting solution that can implement more complex conditions (like the one described above) than Alert Manager? I saw the post(s) about Alert Central being End of Life as of January 2017, and customers pointed to OpsGenie. A third party cloud service is not an option for us.

https://thwack.solarwinds.com/community/solarwinds-community/product-blog/blog/2017/01/04/so-long-an...

0 Kudos
tdanner
Level 19

Re: What are the options to mass Export/Edit/Import Alert Configurations for Orion 2015.1.2?

Ok, the use case is clear now. Unfortunately I don't know of any better way to accomplish this than duplicating the alerts. With the discontinuation of Alert Central, SolarWinds does not have another solution for you.

0 Kudos
cgregors
Level 12

Re: What are the options to mass Export/Edit/Import Alert Configurations for Orion 2015.1.2?

There is one possible path that I don't see mentioned here.

When you're in the alert editor, there is a javascript drop-down menu that will allow you to see the swql that the XML creates.  IF you can find a way of poking the UI remotely and getting it to cough up the output of the pop-up box that the swql is presented in, you'd be set.

In the sql days I was pulling the trigger & reset conditions out and parsing/processing them with my own code.  I did look at doing the same thing when the alert definition world changed to XML but I suspect there is some of the developers personality in the XML structure.  Without trying to emulate that personality, the swql path would be the best option.

Chris

0 Kudos