This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Down Event Time & Up Event Time in Alerts

We have option for Alert Trigger time variable while creating Alert (which I may assume is the event time when the node went down, but to me it is time when Alert is triggered after observing node is down).

${N=Alerting;M=AlertTriggerTime;F=DateTime}

pastedImage_11.png

Is there same variable to have AlertReset Time or lets say Node UP event time (means when the node was back "UP") ?, It will be helpful to have this variable sent in RESET action, then the RESET email message will be;

 

Node Name
Node IP Address
Node StatusUp
Node Down Event Time

11/22/2016 7:18:58 AM

${N=Alerting;M=AlertTriggerTime;F=DateTime}

Node Up  Event Time11/22/2016 7:30:58 AM ??? how to get this time as variable
Total Downtime12 minutes
  • Hi Abdul,

    As there is no native way to do this the only option is to use a custom Defined Variable.

    Thinking about the alert reset actions we could add an entry to write to the netperfmon event log, however this would not be available until after the reset action has triggered. The only way i can see right now, (and i am sure there must be a better way of doing this) is to add 2 reset actions

    2016-12-08 13_44_27-Edit Alert - _Alert me when Custom Property 'Trigger_Alert' is Yes_.png

    The end results in the event log looks like this.

    2016-12-08 13_38_04-Events.png

    The custom variable I have used would need some adjustment as i was testing with just 1 enabled alert but to give you a general idea...

    This is the 1st reset action. If we look at the database right now we can see that the Last time this reset action happened was  ${N=SWQL;M=

    SELECT TOP 1 EventTime,NetObjectID,Message from orion.events

    WHERE EventType=5001

    ORDER BY EventTime desc}

    That's all I have for now, although the orion.alertHistory entity looks interesting it will take some more testing and it possible that it may have the same limitation as using the events info.

    Thanks,

    Tony

  • Finally found a way to get UP Event time when the node comes back up.

    The below query can be inserted in email message body of Alert RESET action.

    ${SQL: SELECT * from (

    SELECT

    StartTime.EventTime AS Down_Event_time,

    (SELECT TOP 1

    EventTime

    FROM Events AS Endtime

    WHERE EndTime.EventTime >= StartTime.EventTime

    AND EndTime.EventType = 5

    AND EndTime.NetObjectType = 'N'

    AND EndTime.NetObjectID = StartTime.NetObjectID

    AND EventTime IS NOT NULL

    ORDER BY EndTime.EventTime) AS Up_Event_Time, Nodes.IP_Address

    FROM Events StartTime INNER JOIN Nodes ON StartTime.NetObjectID = Nodes.NodeID

    WHERE (StartTime.EventType = 5)

    ) as uptimetable

    ORDER BY Down_Event_time desc}

  • there sould be a native way to doo this, it is mutch more interesting to see the "time where the node went down" then to see the time of the alert. And all the information ist in the "EventLog" so it is very unfortunat.... nice post, I was looking vor a variable as well, but could not find anything....