This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Filter Active Alerts on Dashboard

Not sure if this is possible, but right now I have Node Alarms on the summary dashboard with Filter Nodes (SQL), filled in to only show the nodes I want. Works great, Dashboard is extremely useful and I'm watching it most of the day.

Soon we are going to a fully redundant network. In theory, Node Alarms won't exist because nothing will go down. BGP Neighbors will be lost and links will go down, but the Node will always be pingable.

We have an alert setup for "Alert me when a neighbor goes down" which works, but shows up on the All Active Alerts screen (we also have email alerts setup for "neighbor down"). Alerts can be searched, acknowledged etc on this page.

If I add "Active Alerts" to the dashboard, it works, but I'm unable to filter or search. Edit only allows changing the title and subtitle.

How can I only see the Active Alerts that I want to see instead of all alerts on the customized dashboard?

I understand I can keep a tab open for active alerts, but would really like to have a one-stop awesome, useful dashboard.

NPM 12.0

Thanks,

Wayne

  • I too would only like to see certain alerts when on certain pages/views as well.  Such as I don't really care about the vm tools alert on the main dashboard but would like to see them under the virtualization view.

  • I wrote a SWQL resource that does this for me a while ago, tailoring it would require you to be comfortable in SWQL but it can be made to show or not show anything you want.

    pastedImage_0.png

    SELECT

    o.AlertConfigurations.Name AS [ALERT NAME]

    ,'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + ToString(o.AlertObjectID) AS [_LinkFor_ALERT NAME]

    ,CASE

    WHEN o.AlertConfigurations.Severity = 2 THEN '/Orion/images/ActiveAlerts/Critical.png'

    WHEN o.AlertConfigurations.Severity = 3 THEN '/Orion/images/ActiveAlerts/Serious.png'

    WHEN o.AlertConfigurations.Severity = 1 THEN '/Orion/images/ActiveAlerts/Warning.png'

    WHEN o.AlertConfigurations.Severity = 0 THEN '/Orion/images/ActiveAlerts/InformationalAlert.png'

    WHEN o.AlertConfigurations.Severity = 4 THEN '/Orion/images/ActiveAlerts/Notice.png'

    END AS [_iconfor_ALERT NAME]

    ,o.EntityCaption AS [ALERT OBJECT]

    ,o.EntityDetailsURL AS [_LinkFor_ALERT OBJECT]

    ,case

    WHEN o.RelatedNodeCaption=EntityCaption THEN 'Self'

    When o.RelatedNodeCaption!=EntityCaption THEN RelatedNodeCaption

    End as [RELATED NODE]

    ,o.RelatedNodeDetailsURL AS [_LinkFor_RELATED NODE]

    ,ToLocal(o.AlertActive.TriggeredDateTime) AS [ALERT TRIGGER TIME]

    ,'/Orion/images/StatusIcons/Small-' + p.StatusIcon AS [_IconFor_RELATED NODE]

    ,CASE

    when minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())>1440 then (tostring(round(minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())/1440.0,1)) + ' Days')

    when minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())>60 then (tostring(round(minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())/60.0,1)) + ' Hours')

    else (tostring(minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())) + ' Minutes')

    end as [Time Active]

    ,aa.AcknowledgedBy

    ,ah.Message as [Note]

    From Orion.AlertActive aa

    join Orion.AlertObjects o on aa.alertobjectid=o.alertobjectid

    LEFT join Orion.Nodes p on p.nodeid=relatednodeid

    left join orion.alerthistory ah on ah.AlertActiveID=aa.AlertActiveID and ah.EventType in (2,3)

    --where (o.AlertConfigurations.Name like '%${SEARCH_STRING}%' or o.RelatedNodeCaption like '%${SEARCH_STRING}%' or o.EntityCaption like '%${SEARCH_STRING}%' or ah.Message like '%${SEARCH_STRING}%')

    ORDER by o.AlertActive.TriggeredDateTime DESC

    -Marc Netterfield

        Loop1 Systems: SolarWinds Training and Professional Services

  • This seems pretty complex, I'm not even sure where I'd begin to modify it to fit my needs :/

  • Helps if you know SWQL, but basically if you see an alert that you want to exclude from a view you just change the where condition to

    where o.AlertConfigurations.Name not like 'Alert I want to hide'

    and o.AlertConfigurations.Name not like 'second alert I want to hide'

    You can get a lot more elaborate than that if you are motivated. For example, I typically use this to hide all the VMAN alerts from my app admin dashboards since that is outside their area of interest

  • Great script marc!! I like to keep things in custom properties, so instead of “and” statements to filter -I decide to use a alert custom property.    Now what ever alert you want in the filtered alerts, just check the noc flag.  I also threw in number of triggers the alert has.

    pastedImage_0.png

    pastedImage_3.png

    What I have seen are two custom properties (NOC1, NOC2).  NOC1 will be critical issues (Node down,Volume full, Memory full). NOC2 will be less critical (High CPU, High Memory, High IOPS, service down, hardware issues, etc).

    Thanks
    Amit

  • Good point,  if you are going to be filtering in more than one or two alert's it makes more sense to reference a property.   When I actually use this script I am usually filtering against alerts on certain object types, typically excluding all the orion.vim.xx object types from app team dashboards since they don't normally care to know that vmtools is out of date.

  • cscoengineer,

    Could you post your swql query in filtering alerts by custom properties?

  • ckillpack@melaleuca.com here's how I adapted the query to use a custom property:

    SELECT

         o.AlertConfigurations.Name AS [ALERT NAME],

         '/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + ToString(o.AlertObjectID) AS [_LinkFor_ALERT NAME],

         CASE

              WHEN o.AlertConfigurations.Severity = 2 THEN '/Orion/images/ActiveAlerts/Critical.png'

              WHEN o.AlertConfigurations.Severity = 3 THEN '/Orion/images/ActiveAlerts/Serious.png'

              WHEN o.AlertConfigurations.Severity = 1 THEN '/Orion/images/ActiveAlerts/Warning.png'

              WHEN o.AlertConfigurations.Severity = 0 THEN '/Orion/images/ActiveAlerts/InformationalAlert.png'

              WHEN o.AlertConfigurations.Severity = 4 THEN '/Orion/images/ActiveAlerts/Notice.png'

         END AS [_iconfor_ALERT NAME],

         o.EntityCaption AS [ALERT OBJECT],

         o.EntityDetailsURL AS [_LinkFor_ALERT OBJECT],

         CASE

              WHEN o.RelatedNodeCaption = EntityCaption THEN 'Self'

              WHEN o.RelatedNodeCaption != EntityCaption THEN RelatedNodeCaption

         END AS [RELATED NODE],

         o.RelatedNodeDetailsURL AS [_LinkFor_RELATED NODE],

         TOLOCAL(o.AlertActive.TriggeredDateTime) AS [ALERT TRIGGER TIME],

         '/Orion/images/StatusIcons/Small-' + p.StatusIcon AS [_IconFor_RELATED NODE],

         CASE

              WHEN MINUTEDIFF(o.AlertActive.TriggeredDateTime,GETUTCDATE()) > 1440

                   THEN (TOSTRING(ROUND(MINUTEDIFF(o.AlertActive.TriggeredDateTime,GETUTCDATE())/1440.0,1)) + ' Days')

              WHEN MINUTEDIFF(o.AlertActive.TriggeredDateTime,GETUTCDATE()) > 60

                   THEN (TOSTRING(ROUND(MINUTEDIFF(o.AlertActive.TriggeredDateTime,GETUTCDATE())/60.0,1)) + ' Hours')

              ELSE (TOSTRING(MINUTEDIFF(o.AlertActive.TriggeredDateTime,GETUTCDATE())) + ' Minutes')

         END AS [Time Active],

         aa.AcknowledgedBy,

         ah.Message as [Note]

    FROM Orion.AlertActive AS aa

    JOIN Orion.AlertObjects AS o ON aa.alertobjectid = o.alertobjectid

    LEFT JOIN Orion.Nodes AS p ON p.nodeid = o.relatednodeid

    LEFT JOIN Orion.alerthistory AS ah ON ah.AlertActiveID = aa.AlertActiveID AND ah.EventType IN (2,3)

    LEFT JOIN Orion.AlertConfigurationsCustomProperties AS acp ON o.AlertID = acp.AlertID

    WHERE acp.CUSTOMPROPERTYNAME = 'Networking'

         --AND (

              o.AlertConfigurations.Name LIKE '%${SEARCH_STRING}%'

              OR o.RelatedNodeCaption LIKE '%${SEARCH_STRING}%'

              OR o.EntityCaption LIKE '%${SEARCH_STRING}%'

              OR ah.Message LIKE '%${SEARCH_STRING}%')

    ORDER by o.AlertActive.TriggeredDateTime DESC

  • I create new ID with limited node filter so automaticly I only sees specific devices. Hope this help.

  • Have you looked at the custom tile widget? It allows you to get a quick summary of status and alerts for a filtered set of entities.

    pastedImage_0.png