Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 11

Custom Alert Trigger for ASA VPN Active Sessions

I've always told my users any metric you see in NPM can be alerted on. Apparently that is not the case. My network team has asked me to alert on the number of  active VPN users on our Cisco ASAs. The metric is called VPN RA Detail\Active Sessions and here is a PerfStack showing this metric across our ASAs. This is a default value collected by NPM, nothing custom here.


I am finding it challenging to configure an alert trigger condition for this metric. It simply is not available under the default counters available nor can I setup anything custom.

Under the default trigger conditions we only have VPN RA Session not VPN RA Detail.


Under VPN RA Session we don't have any counters for Active Sessions.


Under groups ASA Node there is a counter for connections but its all connections to the node, not Active VPN Sessions, the value is tens of thousands.

So I moved on to attempt to create a custom trigger. No biggie right? SolarWinds is "awesome" and has a mechanism for custom SQL and SWQL.

I poked around in the database and found the correct value that matches Active Session.


FROM [SolarWindsOrion].[dbo].[ASA_RemoteAccessSessions]

WHERE NodeID=497

AND SessionStatus=1

I attempted to use custom SQL but the lovely developers decided to restrict what tables you can query.

There is no option for VPN RA Details in the drop down.


If I try custom SWQL there is an option for VPN RA Session but not VPN RA Details. So still not Active Session column. Close but fail.


So I attempt to make a completely custom macro to trigger off. Under Avanced if you choose User value/macro you can have the option of building a custom SQL variable.


But I can't get this to work. I cannot find any documentation or examples on how this is supposed to be formatted.


I have a case open with SolarWinds support but they are terrible at anything custom like this once you get off the beaten path. Their suggestion was to build a SAM SQL monitor to query the SolarWinds NPM table. That's like monitoring inception. Is there a way I can build a custom alert trigger to use this value? Any help is appreciated.

0 Kudos
8 Replies
Level 9

Select Custom SWQL option and set conditon for VPN RA session and then in the query write where SessionStatus = '1'

and then check "Enable Complex condition" option after that you will get a option like below

"Alert can be triggered if more or equal ---------- objects (at the same time) have met the specified condition and then trigger single alert."

Please select this option and fill the number or count in the box. I think it will work.



0 Kudos

I have the same issue and cannot get it to work.

@rahul.s  - Could you share a screenshot of what you mean? 




0 Kudos

Please find below the screenshot of my trigger condition.

Trigger condition.png

Thanks Rahul, this worked for me.

This worked for me thank you for sharing!

Level 11

I'm looking for help specifically with the custom SQL/SWQL variable function of the alert trigger. Nothing I try seems to work.


This is simplest test that I can imagine and it doesn't work.

Select 1 (always 1) is greater than 0, doesn't trigger the alert.


Oddly, setting the condition to "is not empty" triggers the alert condition.


Does the thing you want to alert on matter when using custom SQL?


I'm trying to understand this undocumented feature. I have a case open with support and they don't know how its supposed to work either. Examples would be helpful!

0 Kudos

My support case was closed. There is no way to do a custom SQL count on this table by either custom SQL alert trigger or custom SQL macro. I even had support escalate to the developers who don't even know how the custom macro works. Theres no documentation on it and nobody knows how it works. I'm very disappointed that both custom alert methods are useless.


Did you ever get resolution to this ? I am facing the same issue in that i want to alert on the number of any connect sessions even thought NPM can show me this i can't find a way to great the alert.


0 Kudos