cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 9

Active Alerts display by Host Name

Jump to solution

Hi All,

I'm working on something that should be simple but can't seem to make it work.

Wanting to show only active alerts for a subset of servers in a resource (view tile) in a console.

Let's say I want to make a console showing information for the Domain Controllers in my environment.  Domain Controllers all have '-DC-' in the host name (node caption).

In my Solarwinds system I've made a console for Domain Controllers.  I have set up a View Limitation defined for System Name like '-DC-'

O.K.  I add a Node List resource to the console and it only shows me Domain Controllers.  Groovy.

Now I add the Active Alert resource to my console.  But... it shows me every active alert in the entire system, not just those for DCs.  And... the 'edit' functionality does not allow the addition of any kind of filter.

Same with the 'All Alerts' resource.  Shows all alerts and seems to ignore view limitation on the console.  Also no filtering capability that will help me.

Next idea.  Custom Table resource.  I choose the 'Active Alerts' data source.  But what field to filter for hosts with '-DC-' in the name?  "Node Caption" and "Related Node" caption to not return anything.  The Active Alerts resource has a field called "Triggering Object" that looks like what I want but that does not seem to be present in the WHERE clause fields for Active Object.  I think the field name is "ObjectName" in the SQL table.

So... kind of stuck.

Can anyone in the community offer some pointers on how to get Active Alerts filtered by host name pattern to show up in a console view?  Thanks in advance for any assistance.

BTW Orion Platform 2019.2, NPM 12.5, SAM 6.9.0, running on Windows Server 2016 and SQL 2016.

1 Solution
Level 12

You're going to want to use the Custom Query resource a few times here.

Here's one I use which someone else put up on thwack and I've edited a tad:

SELECT

o.AlertConfigurations.Name AS [ALERT NAME]

,'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + ToString(o.AlertObjectID) AS [_LinkFor_ALERT NAME]

,CASE

WHEN o.AlertConfigurations.Severity = 2 THEN '/Orion/images/ActiveAlerts/Critical.png'

WHEN o.AlertConfigurations.Severity = 3 THEN '/Orion/images/ActiveAlerts/Serious.png'

WHEN o.AlertConfigurations.Severity = 1 THEN '/Orion/images/ActiveAlerts/Warning.png'

WHEN o.AlertConfigurations.Severity = 0 THEN '/Orion/images/ActiveAlerts/InformationalAlert.png'

WHEN o.AlertConfigurations.Severity = 4 THEN '/Orion/images/ActiveAlerts/Notice.png'

END AS [_iconfor_ALERT NAME]

,o.EntityCaption AS [ALERT OBJECT]

,o.EntityDetailsURL AS [_LinkFor_ALERT OBJECT]

,case

WHEN o.RelatedNodeCaption=EntityCaption THEN 'Self'

When o.RelatedNodeCaption!=EntityCaption THEN RelatedNodeCaption

End as [RELATED NODE]

,o.RelatedNodeDetailsURL AS [_LinkFor_RELATED NODE]

,ToLocal(o.AlertActive.TriggeredDateTime) AS [ALERT TRIGGER TIME]

,'/Orion/images/StatusIcons/Small-' + p.StatusIcon AS [_IconFor_RELATED NODE]

,CASE

when minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())>1440 then (tostring(round(minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())/1440.0,1)) + ' Days')

when minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())>60 then (tostring(round(minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())/60.0,1)) + ' Hours')

else (tostring(minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())) + ' Minutes')

end as [Time Active]

,aa.AcknowledgedBy

,ah.Message as [Note]

From Orion.AlertActive aa

join Orion.AlertObjects o on aa.alertobjectid=o.alertobjectid

LEFT join Orion.Nodes p on p.nodeid=relatednodeid

left join orion.alerthistory ah on ah.AlertActiveID=aa.AlertActiveID and ah.EventType in (2,3)

where (YOUR FILTER HERE - EG. p.Caption like '%-DC-%')

ORDER by o.AlertActive.TriggeredDateTime DESC

View solution in original post

10 Replies
Product Manager
Product Manager

Feel free to upvote this feature request based on your query.  

I think we need to incorporate this functionality on All Active reports. We are confused on which nodes we got the application status down.

 

0 Kudos

And just to clarify, the all alerts resources are sensitive to view limitations, but only for the category of objects in the limit.  Its kind of weird how it works but if you put in a limitation based on a node property then it will only show you Node alerts with that property, but it still shows all alerts for any object that is not a node.  It's very frustrating and is actually the specific reason I created the query adam.beedell​ mentioned above, so I could have more control of what I do and don't want to include on the all alerts widget.

- Marc Netterfield, Github

Ah ty again for the code then!

0 Kudos
Level 12

You're going to want to use the Custom Query resource a few times here.

Here's one I use which someone else put up on thwack and I've edited a tad:

SELECT

o.AlertConfigurations.Name AS [ALERT NAME]

,'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + ToString(o.AlertObjectID) AS [_LinkFor_ALERT NAME]

,CASE

WHEN o.AlertConfigurations.Severity = 2 THEN '/Orion/images/ActiveAlerts/Critical.png'

WHEN o.AlertConfigurations.Severity = 3 THEN '/Orion/images/ActiveAlerts/Serious.png'

WHEN o.AlertConfigurations.Severity = 1 THEN '/Orion/images/ActiveAlerts/Warning.png'

WHEN o.AlertConfigurations.Severity = 0 THEN '/Orion/images/ActiveAlerts/InformationalAlert.png'

WHEN o.AlertConfigurations.Severity = 4 THEN '/Orion/images/ActiveAlerts/Notice.png'

END AS [_iconfor_ALERT NAME]

,o.EntityCaption AS [ALERT OBJECT]

,o.EntityDetailsURL AS [_LinkFor_ALERT OBJECT]

,case

WHEN o.RelatedNodeCaption=EntityCaption THEN 'Self'

When o.RelatedNodeCaption!=EntityCaption THEN RelatedNodeCaption

End as [RELATED NODE]

,o.RelatedNodeDetailsURL AS [_LinkFor_RELATED NODE]

,ToLocal(o.AlertActive.TriggeredDateTime) AS [ALERT TRIGGER TIME]

,'/Orion/images/StatusIcons/Small-' + p.StatusIcon AS [_IconFor_RELATED NODE]

,CASE

when minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())>1440 then (tostring(round(minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())/1440.0,1)) + ' Days')

when minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())>60 then (tostring(round(minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())/60.0,1)) + ' Hours')

else (tostring(minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())) + ' Minutes')

end as [Time Active]

,aa.AcknowledgedBy

,ah.Message as [Note]

From Orion.AlertActive aa

join Orion.AlertObjects o on aa.alertobjectid=o.alertobjectid

LEFT join Orion.Nodes p on p.nodeid=relatednodeid

left join orion.alerthistory ah on ah.AlertActiveID=aa.AlertActiveID and ah.EventType in (2,3)

where (YOUR FILTER HERE - EG. p.Caption like '%-DC-%')

ORDER by o.AlertActive.TriggeredDateTime DESC

View solution in original post

Hi Adam,

Thank you for this SWQL query. Could you please share the same query where only alerts belonging to nodes with a specific Custom Property get displayed?

0 Kudos

Hi Deltona,

In the

"

where (YOUR FILTER HERE - EG. p.Caption like '%-DC-%')

"

bit you could try:

"

where (p.CustomProperties.Server_application like '%YOUR APPLICATION HERE%')

"

That works just fine in my environment. Any node custom property should fit in the italic section

Thanks, that worked great!

In addition to that query (glad to see something I posted out in the wild) you can also use the new custom tiles resource and apply a filter to the tile.

pastedImage_8.png

pastedImage_1.png

pastedImage_0.png

pastedImage_2.png

And to show something with an actual alert on it

pastedImage_9.png

- Marc Netterfield, Github

Hi,

i'm not able to find "Custom Tile", i have the last version

[edit : seems to be renamed as "Status Summary", but i can't use it, message :

Authorization Failure

Authorization has been denied for this request.

]

0 Kudos