I have created a custom property called "Alerting" on my Group objects, and I want to know when a user changes the value of the "Alerting" custom property to "No." I've set up an Auditing Event alert that will trigger if the event's Action Type is equal to "Group changed." So far so good.
I'm running into problems because the Alert Manager doesn't provide an easy way to get from the Audit Event ID to the custom properties of the object of the audit. I wrote a SQL query to find the value of the custom property for the group that was changed:
SELECT Alerting from ContainerCustomProperties where ContainerID = (SELECT NetobjectID from AuditingEvents where AuditEventID = ${N=SwisEntity;M=AuditEventID})
Looking at the Alert Manager, it seems as though I should be able take that query and add it to the conditions as a custom variable:
However, when I do this, the alert doesn't trigger when a group's "Alerting" property is changed to False. I've tried replacing "False" with 0 (zero), but that doesn't work either.
When I view the generated SWQL for the trigger condition, this is what I see:
SUBSCRIBE CHANGES TO Orion.AuditingEvents
INCLUDE [Uri] AS [Uri], [DisplayName] AS [DisplayName]
WHEN ( ( ( AuditingActionType.[ActionType] = 'Orion.GroupChanged' ) AND ( '${SQL: SELECT Alerting from ContainerCustomProperties where ContainerID = (SELECT NetobjectID from AuditingEvents where AuditEventID = ${N=SwisEntity;M=AuditEventID})}' = 'False' ) ) AND ( ( ADDED ) ) )
This looks like it ought to work. Should it? Does Solarwinds actually support this, or is it something unsupported that the app just happens to let me set up that way?