cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 7

SAM, How to show last x number of statistic messages

Jump to solution

I have created a powershell log parser application, with a 'number of newly found strings' component.

I am using a script that actually extracts the line of text from the log file and return this in the statistic message.

This is all working and it displays the error in the statistic message field. or displays 'No newly found strings' if no regex match was found

However I want to display the last 25 statistic messages when the statistic > 0 (i.e. a regex match was found for an error)

I have hundred and hundreds of this sort of application and have found that I can do this by creating a custom report and then using the 'Filter Nodes (SQL)' with a value of

applicationname='the application name' AND nodename = 'the node name'.

However this will be a lengthy process adding this value on all application (I would need a separate view for each application)


Is there any easier way to do this, perhaps by a variable in the 'Filter Nodes (SQL)'  value that auto inserts the application name and node name?


Thanks

0 Kudos
1 Solution

[ANSWERED]

OK, I have cracked it

Here we go...

(1)

Create the following report in Report-Writer:

002.JPG

(2)

Create new Action in Advance Alert to trigger Event Logging:

002.JPG

(3)

Add Report From Orion Report Writer Resource to Component Page:

003.JPG

(4)

Configure your Report Resource to display your report you have created in (1):

005.JPG

(5)

Sit Back > Take a Deep Breath > Enjoy!

006.JPG

--

Alex

View solution in original post

0 Kudos
24 Replies
Level 7

Thanks

Got it working like you instructed

0 Kudos
Level 7

and I can't use ' Records where ComponentID is equal to ${ComponentID}'

as it recognizes that componentID is an integer and therefore it doesn't allow me to type '${ComponentID}'

0 Kudos
Level 7

I can''t use eventlog as I want to report on 'statistic data message' of a component

0 Kudos

spike I am a bit confused - in the screenshot above you can see that I am reporting on "statistic data and statistic message" of a component through Event Log (see below). What exactly are you trying to achieve? Can you sketch an example of a desirable end-result?

001.jpg

002.JPG

${ComponentID} in the message body above is there only for the purpose of filtering out the right right event to be displayed on the component page. Ideally, an Event itself would have some meta-data to play with (probably feature request though). In the absence of this meta-data we just need to stick it in the body and then use it as a filter

0 Kudos

Take a look at this screenshot:

http://thwack.solarwinds.com/servlet/JiveServlet/showImage/102-173930-4-16697/99999.JPG

0 Kudos
Level 7

Are you 100% sur ethat is working, I am not sure how your ${ComponentID} variable works.

I was doing something similar and the dynamic variable wasn't working

13-03-2014 17-01-44.jpg

0 Kudos

spiker, when you chose a report type - select "Event Log", not "APM: Historical ..." as per your screenshot

0 Kudos

P.S. and also use only component related macroses, as application and nodes macros will probably not work (as per AlterEgo's comment above, as well as my own trial and terror tests)

0 Kudos

If this resource is going to be placed on the Component Details view than the ${ComponentID} macro should work. Your ${ApplicationName} macro will likely not though. It should work on the Application Details view, but probably not the Component Details view. I contend that Alex Slv's did exactly as I originally suggested. Nicely done Alex! All the "magic" is happening in Alex's screenshot below..

magic.png

And it's all tied together with this alert action

002.JPG

0 Kudos

[ANSWERED]

OK, I have cracked it

Here we go...

(1)

Create the following report in Report-Writer:

002.JPG

(2)

Create new Action in Advance Alert to trigger Event Logging:

002.JPG

(3)

Add Report From Orion Report Writer Resource to Component Page:

003.JPG

(4)

Configure your Report Resource to display your report you have created in (1):

005.JPG

(5)

Sit Back > Take a Deep Breath > Enjoy!

006.JPG

--

Alex

View solution in original post

0 Kudos

@aLTeReGo ,  Is this still the recommended method to get the last XX amount of component status messages into a SolarWinds resource?  Old component status messages are not stored in the database somewhere?  I looked through some views in my DB and it seems like only the most current component message is stored.  Thanks!

0 Kudos
Level 7


Sorry, you are correct

The macro's appear not to work in the reports.

However you can create a report and not specficy the node name and then on the user interface if you click edit on the report there is a 'Filter Nodes (SQL)' section

I also haven't found a way to add macro's here but you can add for instance 'ApplicationName = 'xxx' (Hopefully its possible though)

However this report is assigned to a view, so you can't even script a solution as you would need a seperate view for each application as the hard coded filter value would need to change for each

0 Kudos
Level 7

If you create a report for Historical - Statistic of multiple value components it allows you to speciofy application and component name

0 Kudos
Product Manager
Product Manager

Have you considered using the Advanced Alert Manager to write this value out to Orion Events and then use the Last XX Events Resource?

0 Kudos

Hi aLTeReGo,

Should the message be formated in any specific way? I do output as follows to NPM Even Log through Advanced Alert Manager:

STATISTIC: ${StatisticData}; MESSAGE: ${ComponentMessage}

However, when I go to the component's last 25 events - it is not there

I can see this message in Message Center though

0 Kudos

Including a multi-value script message into the text of an alert message can only be accomplished using a SQL macro. Below is an example of the SQL macro usage to add the numeric value of a multi-value script to the output of an advanced alert message.

0 Kudos

Thanks aLTeReGo,

I think that we may be talking about different things. I am trying to implement your suggestion above to use Advance Alert Manager to log and Event in Orion and then use this Event to display those historical records in Last XX Event Resource for the given component. I am not using any multi-value massages. My script has only one MESSAGE and only one STATISTIC. Here is what I do:

(1)

Advance Alert Manager triggers the following action to log an Event

Capture.JPG

(2)

Event is visible in Message Center alongside with other Events from same server

Capture1.JPG

(3)

However, this Event is NOT visible on the component details page in Last 25 Event resource

Capture2.JPG

Hence is my questions - do I need to format my message somehow in a specific way when triggering it, step (1), so that it is visible in Last XX Events for this component, step (3)

Thank you,

Alex

0 Kudos

Ahh I see the issue now. The problem is that the Last "XX" Component Events is filtered based on the specific type of event (component monitor), and the component ID being viewed. This cannot be replicated by events written through the Advanced Alert Manager. My recommendation above did not assume you would be using the events resource on the Component Details view using the "Last 25 Component Events" resource. Rather that you would have a record of this information in the Orion Events, which could be accessed through the Message Center, the Last XX Events summary resource, or through the Orion Report Writer. You could even use the Report Writer to further refine this down to just the information you're looking for. You might even be able to use the ComponentID macro to build a dynamic report that could be placed on the Component Details view.

0 Kudos

Hi aLTeReGo,

I think I have found similar thread where it is explained how to place a custom dynamic report on a node page: Determine Group Membership From Node Page

I am wondering if the same can be achieved with web-based reporting and for this particular scenario. Basically - the goal is - to display on a component page Last XX Events with MESSAGE/STATISTIC results as logged in Orion by Alert Manager (screenshot above). Also I would appreciate if you can give some guidance how to create this dynamic reports that can be placed on component page

0 Kudos

I am stuck...

I have created report with dynamic query to go on component page. I could not however find an option to specify macros fro ComponentID, so I used NodeName instead:

Capture.JPG

I do not have anything coming through to Component Details page Custom Report Resource unfortunately:

Capture2.JPG

If I will change above macros in report to static node name (for testing purpose only) - it works. But obviously I would want this to be dynamic

Capture3.JPG

Capture5.JPG

0 Kudos