Alert on an Application Monitor Template

You are wanting to Alert when that "component" goes into a warning or critical state.  The built-in blanket Alerts for SAM are:

Alert me when a component goes down

Alert me when a component goes into a warning or critical state

There are two other ones

Alert me when an application  goes down

Alert me when an application goes into a warning or critical state.

I would recommend that you do not turn on the Application alerts as the application status is nothing more than a roll up status of the components included in the application.  What we really care about are the components that are acting up, and if you have both the application and component alerts turned on, it will produce duplicate Alerts, and thus extra noise.

Copy and modify the "Alert me when a component goes into a warning or critical state" alert, and edit the email trigger action to send to the email address(es) you want.  Remember that this is a blanket alert that will trigger on ANY SAM component that goes into a warning or critical state.  To include or exclude applications from triggering this alert, you'd modify the Trigger Condition scope.   

For that particular sql component you are working on, you should ensure that the warning and critical threshold values are configured correctly just so it actually gets put into a warning or critical state when those thresholds are met by the statistic data.

Hope this helps,

- Parker

Here is a video - see at the 4 minute mark for how to alert on a component. https://support.solarwinds.com/Success_Center/Server_Application_Monitor_(SAM)/Alerting_on_an_application_-_Video

I answered the question myself. Through pure luck I discovered other (in-house) alerts which fired on components.  It was a matter of creating the SWQL to query on the statistical queries I created in the component.

For instance, the component (SQL Server User Experience Monitor) was set to query a SQL Server Database and the Statistical Threshold was set to Critical when the value => 399000.

In creating the Alert I set up the Trigger Condition to alert on: "Customer SQL Alert (Advanced)". Then I set up my SQL Condition as: "APM: Component" so that it was focused on the component instead of the app template. Then I set up the SWQL so that it resembles this:

SELECT APM_AlertsAndReportsData.ComponentName, APM_AlertsAndReportsData.ComponentID FROM APM_AlertsAndReportsData

WHERE

(componentname = 'SQL Server User Experience Monitor'

and applicationname = 'MyApplication'

and statisticdata > 398999

and NodeName = 'MyServer')

This looks for the application I created (MyApplication) and the component to be checked against (SQL Server User Experience Monitor) and the Statistical Threshold/statisticdata (398999). As I didn't know how to incorporate an "equal to or greater than" 399000 in SWQL I chose to use a greater than 398999.

Perhaps this was too easy for this forum but if any other newbie needs this kind of guidance...here ya go.

parafordo,

As you will see, there is more than one way to do something in Solarwinds.  Your answer that you marked as correct will work, but is it the best way?  That will trigger for that one single component, but what about other components?  You don't want to have to create a new custom SWQL alert for every component you want to Alert on.  I have found this to be the easiest way:

1. Create blanket "component down" and "component is in critical state" Alerts that will trigger on all components
2. At this time, you will probably receive too many component Alerts.
3. Research components that are triggering often, and see if they are actual problems.  If not, modify the components threshold values so that they don't trigger as often.
4. If you want to keep an application from triggering these Alerts at all, create an application custom property and include it in the trigger condition scope of the two component Alerts.  Tag the applications with the value that will exclude them from the Alert.  i.e. cp named "AlertMute" that has Yes/No values, in the alert trigger condtion scope:  "AlertMute is equal to Yes".  Tag applications you want to exclude with a "Yes" value for this cp.

Plus, using the UI is easier than custom SQL or SWQL scripts.

The Log Analytics Alert REST API is RESTful and can be accessed via the Azure Resource Manager REST API. The API can thus be accessed from a PowerShell command line and will output search results to you in JSON format, allowing you to use the results in many different ways programmatically. Tutuapp 9Apps Showbox

Thank you for creating the topic. It is very helpful to me. Parafordo had a great answer.

Best regards!

art - kingroot

Flexbox is intended to give a reliable format on various screen sizes. You will regularly utilize a blend of flexDirection, alignItems, and justifyContent to accomplish the correct format. Flexbox works a similar route in React Native as it does in CSS on the web, with a couple of special cases. d&d character sheet pdf

Thanks for this topic. I was looking for this...