cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 7

Extracting alert messages

Jump to solution

We are using the Solarwinds Information Service to retrieve the list of alerts currently in SW. Querying the Orion.AlertStatus table returns alerts but the AlertMessage field is blank. The Orion.Alerts table has several fields for storing messages but these seem to be templates with variables in them, e.g. "Current packet loss for ${NodeName} is ${%Loss}. Average Response time is ${AvgResponseTime} and is varying from ${MinResponseTime} to ${MaxResponseTime}."

Is there a way to get the actual alert message that shows up in the Events tab in SW?

0 Kudos
1 Solution
Level 13

Hello,

If you want name of alert it is

SELECT stat.AlertDefID, stat.ActiveObject, stat.ObjectType, stat.State, stat.WorkingState, stat.ObjectName, stat.AlertMessage, stat.TriggerTimeStamp, stat.TriggerTimeOffset, stat.TriggerCount, ResetTimeStamp, stat.Acknowledged, stat.AcknowledgedBy, stat.AcknowledgedTime, stat.LastUpdate, stat.AlertNotes, stat.Notes, def.name

FROM Orion.AlertStatus as stat

JOIN Orion.AlertDefinitions as def ON def.alertdefid=stat.alertdefid

Other way is using events table:

SELECT EventID, EventTime, NetworkNode, NetObjectID, EngineID, EventType, Message, Acknowledged, NetObjectType, TimeStamp

FROM Orion.Events

where EventType=5001 or EventType=5000

That's events triggered by alerts

5001 - Alert Reset

5000 - Alert Triggered

Is that enough for you?

Thanks

View solution in original post

4 Replies
Level 13

Hello,

If you want name of alert it is

SELECT stat.AlertDefID, stat.ActiveObject, stat.ObjectType, stat.State, stat.WorkingState, stat.ObjectName, stat.AlertMessage, stat.TriggerTimeStamp, stat.TriggerTimeOffset, stat.TriggerCount, ResetTimeStamp, stat.Acknowledged, stat.AcknowledgedBy, stat.AcknowledgedTime, stat.LastUpdate, stat.AlertNotes, stat.Notes, def.name

FROM Orion.AlertStatus as stat

JOIN Orion.AlertDefinitions as def ON def.alertdefid=stat.alertdefid

Other way is using events table:

SELECT EventID, EventTime, NetworkNode, NetObjectID, EngineID, EventType, Message, Acknowledged, NetObjectType, TimeStamp

FROM Orion.Events

where EventType=5001 or EventType=5000

That's events triggered by alerts

5001 - Alert Reset

5000 - Alert Triggered

Is that enough for you?

Thanks

View solution in original post

Yes that seems to be it.. although that requires the action to log the alert to the event log. Is that correct?

Also there does not seem to be a way to get the alert for the event.. nothing links them together.

0 Kudos

Hello

I think in default every alert has Action to log.

In Alerting page you see only alertName and netobjects etc... that is in first query.

In event page you see more information dynammically generated by alerting.

Also there does not seem to be a way to get the alert for the event.. nothing links them together.

You are right.

Thank you!

0 Kudos