This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Alerts suppressed via Orion SDK are not being saved

We are using the following script to suppress alerts during our patching windows. The script is executing with no errors and the scheduled suppression is successful. 

Our issue is that the scheduled suppression time is being removed a few hours later and not being saved. Therefore if we mute alerts for the following day, the scheduled suppression time is being removed and the alerts are still triggering during the previously scheduled time.

I've modified the script to only select the top 4 nodes:

Import-Module SwisPowerShell

$SwindSrv = "server"

$Username = "username"

$Password = Read-Host "Enter Password" -AsSecureString

$cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $Username,$Password

$swis = connect-swis -Host [IP] -Credential $Cred

$SwqlQueryForDevices = "SELECT TOP 4 [Caption], [IP_Address], [NodeID] FROM Orion.Nodes"

$Nodes = Get-SwisData -SwisConnection $Swis -Query $SwqlQueryForDevices

ForEach ($Node in $Nodes) {

$NodeID = $Node.NodeID

$entityUris += @("swis://$SwindSrv/Orion/Orion.Nodes/NodeID=$NodeId")

Write-Host $entityUris

}

$now = ([DateTime] "04/24/2019 22:00").ToUniversalTime()

$later = $now.AddMinutes(1)

Invoke-SwisVerb $swis Orion.AlertSuppression SuppressAlerts @($entityUris, $Now, $Later)

The alert suppression information is being populated in the AlertSuppression table and can be viewed in the Node Details after executing the script, but within a short time after (approx. 2 hours) it is being removed automatically.

Has anyone experienced this issue or something similar?

  • Hey there,

    Are you running your script on a system that's the same time zone as the server? I'm wondering you're on the west coast offering a time, the server is on the east coast, and you're not putting it out into the future as far as you think you are. Wild guess here, but I thought it was worth a try. If you're in the same time zone let me know and I'll try to reproduce it.

  • Hey Steven,

    Thanks for the quick response. This turned out to be a case-sensitive issue. The rows in the database looks as follows for a node that was manually silenced:

    8342 swis://SERVER/Orion/Orion.Nodes/NodeID=3637 2019-04-25 19:20:00.000 2019-06-26 19:20:00.000

    8343 swis://SERVER/Orion/Orion.Nodes/NodeID=3638 2019-04-25 19:20:00.000 2019-06-26 19:20:00.000

    Where the script was inserting the nodes as:

    8342 swis://Server/Orion/Orion.Nodes/NodeID=3637 2019-04-25 19:20:00.000 2019-06-26 19:20:00.000

    8343 swis://Server/Orion/Orion.Nodes/NodeID=3638 2019-04-25 19:20:00.000 2019-06-26 19:20:00.000

    We changed this to ALL CAPS and it fixed the issue. I'm still curious what could have been causing this, but glad the issue is resolved.

  • Ah, I wondered about your manual creation of URIs. If they're off even a little things don't work at all. You don't need to construct them yourself - there's a URI inherited property. Adjust your query to look like this and you can skip that URI building step:

    $SwqlQueryForDevices = "SELECT TOP 4 [Caption], [IP_Address], [NodeID], [URI] FROM Orion.Nodes"
  • Thanks for the suggestion, we'll modify our query and use this method moving forward.