This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Active Alerts display by Host Name

Hi All,

I'm working on something that should be simple but can't seem to make it work.

Wanting to show only active alerts for a subset of servers in a resource (view tile) in a console.

Let's say I want to make a console showing information for the Domain Controllers in my environment.  Domain Controllers all have '-DC-' in the host name (node caption).

In my Solarwinds system I've made a console for Domain Controllers.  I have set up a View Limitation defined for System Name like '-DC-'

O.K.  I add a Node List resource to the console and it only shows me Domain Controllers.  Groovy.

Now I add the Active Alert resource to my console.  But... it shows me every active alert in the entire system, not just those for DCs.  And... the 'edit' functionality does not allow the addition of any kind of filter.

Same with the 'All Alerts' resource.  Shows all alerts and seems to ignore view limitation on the console.  Also no filtering capability that will help me.

Next idea.  Custom Table resource.  I choose the 'Active Alerts' data source.  But what field to filter for hosts with '-DC-' in the name?  "Node Caption" and "Related Node" caption to not return anything.  The Active Alerts resource has a field called "Triggering Object" that looks like what I want but that does not seem to be present in the WHERE clause fields for Active Object.  I think the field name is "ObjectName" in the SQL table.

So... kind of stuck.

Can anyone in the community offer some pointers on how to get Active Alerts filtered by host name pattern to show up in a console view?  Thanks in advance for any assistance.

BTW Orion Platform 2019.2, NPM 12.5, SAM 6.9.0, running on Windows Server 2016 and SQL 2016.

  • You're going to want to use the Custom Query resource a few times here.

    Here's one I use which someone else put up on thwack and I've edited a tad:

    SELECT

    o.AlertConfigurations.Name AS [ALERT NAME]

    ,'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:' + ToString(o.AlertObjectID) AS [_LinkFor_ALERT NAME]

    ,CASE

    WHEN o.AlertConfigurations.Severity = 2 THEN '/Orion/images/ActiveAlerts/Critical.png'

    WHEN o.AlertConfigurations.Severity = 3 THEN '/Orion/images/ActiveAlerts/Serious.png'

    WHEN o.AlertConfigurations.Severity = 1 THEN '/Orion/images/ActiveAlerts/Warning.png'

    WHEN o.AlertConfigurations.Severity = 0 THEN '/Orion/images/ActiveAlerts/InformationalAlert.png'

    WHEN o.AlertConfigurations.Severity = 4 THEN '/Orion/images/ActiveAlerts/Notice.png'

    END AS [_iconfor_ALERT NAME]

    ,o.EntityCaption AS [ALERT OBJECT]

    ,o.EntityDetailsURL AS [_LinkFor_ALERT OBJECT]

    ,case

    WHEN o.RelatedNodeCaption=EntityCaption THEN 'Self'

    When o.RelatedNodeCaption!=EntityCaption THEN RelatedNodeCaption

    End as [RELATED NODE]

    ,o.RelatedNodeDetailsURL AS [_LinkFor_RELATED NODE]

    ,ToLocal(o.AlertActive.TriggeredDateTime) AS [ALERT TRIGGER TIME]

    ,'/Orion/images/StatusIcons/Small-' + p.StatusIcon AS [_IconFor_RELATED NODE]

    ,CASE

    when minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())>1440 then (tostring(round(minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())/1440.0,1)) + ' Days')

    when minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())>60 then (tostring(round(minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())/60.0,1)) + ' Hours')

    else (tostring(minutediff(o.AlertActive.TriggeredDateTime,GETUTCDATE())) + ' Minutes')

    end as [Time Active]

    ,aa.AcknowledgedBy

    ,ah.Message as [Note]

    From Orion.AlertActive aa

    join Orion.AlertObjects o on aa.alertobjectid=o.alertobjectid

    LEFT join Orion.Nodes p on p.nodeid=relatednodeid

    left join orion.alerthistory ah on ah.AlertActiveID=aa.AlertActiveID and ah.EventType in (2,3)

    where (YOUR FILTER HERE - EG. p.Caption like '%-DC-%')

    ORDER by o.AlertActive.TriggeredDateTime DESC

  • In addition to that query (glad to see something I posted out in the wild) you can also use the new custom tiles resource and apply a filter to the tile.

    pastedImage_8.png

    pastedImage_1.png

    pastedImage_0.png

    pastedImage_2.png

    And to show something with an actual alert on it

    pastedImage_9.png

  • And just to clarify, the all alerts resources are sensitive to view limitations, but only for the category of objects in the limit.  Its kind of weird how it works but if you put in a limitation based on a node property then it will only show you Node alerts with that property, but it still shows all alerts for any object that is not a node.  It's very frustrating and is actually the specific reason I created the query adam.beedell​ mentioned above, so I could have more control of what I do and don't want to include on the all alerts widget.

  • Feel free to upvote this feature request based on your query.  

  • Ah ty again for the code then!

  • Hi Adam,

    Thank you for this SWQL query. Could you please share the same query where only alerts belonging to nodes with a specific Custom Property get displayed?

  • Hi Deltona,

    In the

    "

    where (YOUR FILTER HERE - EG. p.Caption like '%-DC-%')

    "

    bit you could try:

    "

    where (p.CustomProperties.Server_application like '%YOUR APPLICATION HERE%')

    "

    That works just fine in my environment. Any node custom property should fit in the italic section

  • Thanks, that worked great!

  • Hi,

    i'm not able to find "Custom Tile", i have the last version

    [edit : seems to be renamed as "Status Summary", but i can't use it, message :

    Authorization Failure

    Authorization has been denied for this request.

    ]

  • I think we need to incorporate this functionality on All Active reports. We are confused on which nodes we got the application status down.