1 Reply Latest reply on Sep 21, 2016 11:57 AM by xtraspecialj

    How to a query for past alerts that have since cleared?

    rupdegraff

      I had an incident with a Volume on a NetApp filling up very quickly. When the issue was identified, the Volume was increased to resolve the issue. I wanted to look in SRM for space alerts on the Volume in question to see if SRM caught it and when. Since the Volume is currently not in an alert state, any previous alerts would have cleared.

       

      I see no obvious way to show cleared alerts anywhere in the Alerts or Message Center screens. I see a table in the database called AlertHistory and a View called AlertHistoryView which seems to have some level of that history. I'm seeing both Triggered and Reset event types. Can I access this data from within Orion through a view or Report?

       

      Thanks

        • Re: How to a query for past alerts that have since cleared?
          xtraspecialj

          If you aren't afraid of a little SWQL, this should give you all the info you need: Alerts · solarwinds/OrionSDK Wiki · GitHub

           

          You'll basically want to query the AlertHistory table for AlertObjectID's that have both a 1 and a 2 EventType.  You can join (or navigate through SWQL) to the AlertObject and AlertConfiguration tables to get extra data in your results as needed.  You can also use SQL as a lot of the fields will be the same in the SQL AlertHistory table, but just remember that using SQL queries opens you up to having broken reports, alerts, or views in the future should SolarWinds change the database schema, and they can do this on any upgrade, so you should always use SWQL when possible.  I only use SQL when I can't get what I need out of SWQL.