9 Replies Latest reply on Apr 25, 2017 7:50 AM by foonly

    NTA 4.2 Top Talker alerts no longer work


      We've just upgraded our 3 separate Orion installs to NPM12, NTA4.2, etc. We really like NPM12, and the install of NTA4.2 went fairly smoothly.


      But Top Talker events and emailed alerts that had been setup under NTA4.1 no longer work due to a SQL error:



      The current SQL code for the event is:


      Interface ${NetObjectName} on node ${NodeName} transmitted at ${Interface.OutPercentUtil}% of its utilization, which triggered this alert. ${SQL:SELECT Macro FROM NetFlowAlertMacros WHERE ID='OutInterfaceDetailsLink'}


      For the emailed alert, it's a little more complicated because of a username and password, but it also references OutInterfaceDetailsLink.


      I expected to get a fresh Top Talker template with the new install, the Top Talker Alert template has much of my local modified actions and other settings. Maybe I'm forgetting how Top Talker Alerts originated - maybe they didn't ship with NTA.


      Delving into the SQL tables, I find that:


      OutInterfaceDetailsLink = ${SQL:SELECT REPLACE(Macro, '$$direction$$', 'Egress') FROM NetFlowAlertMacros WHERE ID='InterfaceDetailsLink'}


      InterfaceDetailsLink = ${SQL:SELECT CASE WHEN '${SQL:SELECT Macro FROM NetFlowAlertMacros WHERE ID='NetFlowEnabled'}' = 'true' THEN '<a href="/Orion/TrafficAnalysis/Utils/AlertRedirect.aspx?InterfaceID=${InterfaceID}&UtcTime=${SQL:SELECT CONVERT(NVARCHAR(30), GETUTCDATE(), 126)}&Direction=$$direction$$&NetFlowEnabled=${SQL:SELECT Macro FROM NetFlowAlertMacros WHERE ID = 'NetFlowEnabled'}"><u>NetFlow Interface Details - ${NodeName} - ${NetObjectName} (NetFlow)</u></a>' ELSE '' END}


      That's a lotta nests to go parsing through, and I'm not sure how to even test it by itself. I'm the shortest giant in our SQL family, and I was adopted out of pity.


      Does anyone spot anything obvious here? It seems to be complaining about the substitution of the interface name, an ASA 'outside' interface.


      If I don't hear back in a day or 2, I'll open a case.