cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post

How To "Disable All Actions" Programmatically (using script)

Jump to solution

Hi All,

I am looking for a way to be able to disable all alerts using a script. I know I can do it through Alert Manager by checking box "Disable All Actions" and I also know that this setting is not stored in anywhere in Database (have done tests with DB being offline). So, must be some kind of config file on app server or something...

Any help would be appreciated

Background (what am I trying to achieve):

I am trying to come up with solution to quickly disable all alerts in case of a major failure to avoid flood of emails whilst our engineers are focusing on resolving root cause. Ideally, later, I will link it to a text messaging service - let's say our engineers will send something like "mute" to a specific number and immediately all alert will be disable, until manually re-enabled again... well, for now I just need to first find a way how to script it

Thanks,

Alex

With Gratitude,
Alex Soul
0 Kudos
1 Solution
Product Manager
Product Manager

The easiest method would be to stop the Advanced Alert Manager service on the Orion server. That will stop the generation of any new alerts.

View solution in original post

0 Kudos
14 Replies
Level 18

While I can appreciate the creative approaches of updating the database, the idea of programatically running an UPDATE query give me the heebie jeebies.

If all you want is to make sure the emails stop, why not programatically disable the email account that Solarwinds is using to send those emails from instead? That seems much less dramatic, and much less likely to cause an issue to your MONITORING database - especially in light of the fact that it will be very busy processing all those alerts and you would likely run into record lock situations for an update command.

Leon Adato | Head Geek
------
"Measure what is measurable,
and make measurable what is not so." - Gallileo

0 Kudos

Hi Leon,

Thank you for your reply. I am not sure what account you are referring to. I have confirmed that stopping service (as mentioned above) does stop alerts, but I am yet to come up with an efficient way of triggering this via text message by an on-call engineers. I will update this post when I have a progress on this...

With Gratitude,
Alex Soul
0 Kudos

Your If you go into the third tab of your alert, that's where the email server settings are set up - what your email server is, what port, etc. including what account and password you use to connect to said email server to send out your emails.

Now some places allow anonymous connections to the SMTP server. BUT... assuming you don't (or that you can switch, you would

  1. Set up an account on the SMTP server (and make sure to set that account to be non-expiring so you don't have to worry about emails stopping when the password needs to be changed)
  2. Re-configure your alerts to use the SMTP username/password (you'll have to change existing alerts, but all NEW alerts will use the new settings)
  3. AND NOW... when you want to turn off alerts, you can just disable the email account in AD - via a NET USER command or however else you want to do it.

If turning off the service works for you, then go with it. This is just another option AND has the benefit of being something that NON-SolarWinds experts can do. You can say to lots of people in the org "disable the "solarwindsemailer" account in AD. It's harder from your recliner on a beach in Aruba to talk them through RDP-ing to the primary poller, running the Solarwinds service manager, and turning off JUST that one service.

Leon Adato | Head Geek
------
"Measure what is measurable,
and make measurable what is not so." - Gallileo

I would advise to place a simple suppress all alerting check box on the "Alerts and Reporting" page. This would act the same as "disable all actions" in Advanced Alert Manager on the alerting engine from previous version. PROBLEM SOLVED for everyone if you would implement this. In the first place, I do not see why this function was left out of the new release when they moved alerting to the web page.

0 Kudos

I just found out that you can disable all actions in the action manager tab in "Manage alerts" IF they are all on. This way you do not have to document which ones are on and off in the "Alert Manager" I can live with this.

0 Kudos

Hi there Alex, there is another field in AlertDefinitions Table which you can use - there is a field called 'Alert description' in the same table, when you run the query just update the 'Alert description' field with some text like 'Previously existing' - this would act as a pointer for your next query, and when you want to enable them back check the alerts with 'Alert description=Previously existing' in the query and Enable them. Hope this work around helps

Interesting question , but yes it is possible.

1. Add your Solarwinds DB to Monitoring

2. The field that you are looking for is present in AlertDefinitions Table , this query -> (SELECT * FROM [dbo].[AlertDefinitions] where Enabled=1) will provide all active alerts in your environment.

3. Create a template using SAM - use "SQL Server User Experience Monitor" component monitor and use an update query on  [dbo].[AlertDefinitions] - change Enabled to 0

Hope this would help you

this method will allow you to further tweak by alerting to NPM Event log but NOT send emails...I've been looking for exactly this b/c I want to ensure emails don't flood but also that we don't miss anything critical.

DISABLE ALL EMAIL ALERTS

assumptions:

     all emails go out every day (this will make resetting easy)

     you are doing your work on weekend

-- SELECT * FROM ActionDefinitions

-- UDPATE ActionDefinitions set DOW='4'

WHERE

AlertDefID IN (SELECT AlertDefID FROM [dbo].[AlertDefinitions] where Enabled=1)

and ActionType = 'EMail'

RE-ENABLE ALL EMAIL ALERTS

-- SELECT * FROM ActionDefinitions

-- UDPATE ActionDefinitions set DOW='1,2,3,4,5,6,7'

WHERE

AlertDefID IN (SELECT AlertDefID FROM [dbo].[AlertDefinitions] where Enabled=1)

and ActionType = 'EMail'

0 Kudos

Thanks njoylif and Vinay BY,

This is interesting way of approaching it. In my environment I have a bunch of alerts enabled and some of them disabled, but they are still present in the list of alerts. By running the above SQL query - how do I keep track of which alerts have been enabled before I have disabled them? ... I feel that I will need some kind of another axillary table which will hold temporary information about those alerts which were disabled in the first place. Hmmm... sounds like unnecessary complexity...  any other ideas?

With Gratitude,
Alex Soul
0 Kudos

if the alert is disabled, it is not a problem because of the inner select only includes enabled alerts [where Enabled=1]

the only time you will come into an issue [upon quick reflection] and need to address is if you have alerts enabled that are not 24x7.  this would require further programming efforts like you mentioned.

0 Kudos
Product Manager
Product Manager

The easiest method would be to stop the Advanced Alert Manager service on the Orion server. That will stop the generation of any new alerts.

View solution in original post

0 Kudos

Great, thanks aLTeReGo, this is exactly what I am going to take away as a answer

With Gratitude,
Alex Soul
0 Kudos

Hate to ask a silly question but I don't have a Advanced Alert Manager service.

I have a SolarWinds Alerting Engine, is this the 'same'?

Thanks

0 Kudos

Yes. That is the service I was referring too.

0 Kudos