Include the Command Line Filter in alert

As far as I know, there is no alert variable for this.

In previous cases where I have monitored the same process with multiple instances on one server and used a command line filter (i.e. Java), I have put the name of the app in the Component Name, e.g.

• Java - /dev/whateverapp
• Java - /blah/somethingelse
• Java - process controller

I had a look through the database and SWQL and you can pull the value using a custom query. If there is an easier way than below, please let me know!

I found the following:

1. The default Command Line Filter value from the template is stored in the Orion.APM.ComponentTemplateSetting table
2. If you edit the application monitor to override the template, the value is stored in the Orion.APM.ComponentSetting table

Here are the two queries - I haven't figured out how to combine them yet into one query but you can pick one to use depending on how your application monitors are configured.

These queries are based on using a component alert and they can be used in your trigger action notifications.

If your command line filters are configured at the template level:

Command Line Filter (Template): ${N=SWQL;M=SELECT cts.Value 
FROM Orion.APM.Component c
JOIN Orion.APM.ComponentDefinition cd ON cd.ComponentType = c.ComponentType
JOIN Orion.APM.ComponentDefinitionSetting cds ON cds.ComponentDefinitionID = cd.ID
LEFT JOIN Orion.APM.ComponentTemplateSetting cts ON cts.ComponentTemplateID = c.TemplateID AND cts.[Key] = cds.[Key]
WHERE c.ComponentID = ${N=SwisEntity;M=ComponentAlert.ComponentID}
AND cts.Key = 'CommandLineFilter'}

If your command line filters are overriding the template at the application monitor level:

Note: If you are NOT overriding the template, this will return the full query as an output

Command Line Filter (Application Override): ${N=SWQL;M=SELECT cs.Value
FROM Orion.APM.Component c
LEFT JOIN Orion.APM.ComponentSetting cs ON cs.ComponentID = c.ComponentID
WHERE c.ComponentID = ${N=SwisEntity;M=ComponentAlert.ComponentID}
AND cs.Key = 'CommandLineFilter'}

I have tried combining the two queries and it works fine if there is an applicaiton monitor override configured. However if there is no override it returns a null rather than the template value...  someone else with better SWQL skills might be able to combine them.

This is an example of the kind of SWQL I use for displaying the over ride when needed, or the template value when there is no over ride

SELECT case when isnull(cs.Value,'') = '' then  cts.value else cs.value end as setting
--, cts.Key, cts.value, cs.Key, cs.Value

FROM Orion.APM.Component c
JOIN Orion.APM.ComponentDefinition cd ON cd.ComponentType = c.ComponentType
JOIN Orion.APM.ComponentDefinitionSetting cds ON cds.ComponentDefinitionID = cd.ID
JOIN Orion.APM.ComponentTemplateSetting cts ON cts.ComponentTemplateID = c.TemplateID AND cts.[Key] = cds.[Key] and cts.Key = 'CommandLineFilter' 
left join Orion.APM.ComponentSetting cs on cs.ComponentID=c.ComponentID and cs.Key = 'CommandLineFilter' 

WHERE c.ComponentID = ${N=SwisEntity;M=ComponentAlert.ComponentID} 

See, someone else better at SWQL!