6 Replies Latest reply on Dec 16, 2016 9:02 AM by seniorza

    Reset an alert via Powershell/SWIS

    seniorza

      Hi,

       

      Is it possible to reset an alert via a powershell command?

       

      I would like to trigger a reset of an Orion alert when an associated incident is marked as resolved in a Service Desk application.

       

      Thanks,

      Andrew

       

      tdanner I believe you are the guru when it comes to this

        • Re: Reset an alert via Powershell/SWIS
          njoylif

          you could set a Custom Property <SDResolved> using powershell and the API for that object.

           

          your reset criteria would include this CP needing to be set...

           

          Also, you'd have to set up RESET action to clear that CP upon successful reset.

            • Re: Reset an alert via Powershell/SWIS
              seniorza

              Thanks for the idea.

               

              What I'm trying to do is clear the instance of the alert that is triggered when the related incident is closed in the SD.

               

              So if the incident is marked as resolved in the SD and the underlying issue has actually not resolved, a new instance of the alert is triggered along with a new incident in SD.

              1 of 1 people found this helpful
                • Re: Reset an alert via Powershell/SWIS
                  tdanner

                  There is a verb that might do what you want. It was missing from the https://github.com/solarwinds/OrionSDK/wiki/Alerts page on the wiki, so I just added it. It looks like this:

                   

                  Orion.AlertActive.ClearAlert

                   

                  One parameter: int[] alertObjectIds

                   

                  To clear an active alert manually, pass the AlertObjectID values to `Orion.AlertActive.ClearAlert`. It will return success or failure as a boolean. This will clear the alerts without running the normal Reset actions and without regards to the state of the trigger condition for that alert. If the condition that triggered the alert still holds, the alert will be triggered again the next time the condition is evaluated.

                   

                  It sounds like the "retrigger if the condition holds" behavior is what you want. So if the "skip running reset actions" behavior is also what you want (or can live with) then this will probably meet your needs.

                  1 of 1 people found this helpful
                    • Re: Reset an alert via Powershell/SWIS
                      seniorza

                      Hi tdanner,

                       

                      I'm trying to execute the following via the Powershell cmdlet to clear an alert with AlertObjectID 28071:

                       

                      $alertid = [int]28071

                      Invoke-SwisVerb $swis Orion.AlertActive ClearAlert $alertid

                       

                      I'm then met with this:

                       

                      Invoke-SwisVerb : Verb Orion.AlertActive.ClearAlert cannot unpackage parameter 0 of type System.Int32[]

                      At line:2 char:1

                      + Invoke-SwisVerb $swis Orion.AlertActive ClearAlert $alertid

                      + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

                          + CategoryInfo          : InvalidOperation: (:) [Invoke-SwisVerb], FaultException`1

                          + FullyQualifiedErrorId : SwisError,SwisPowerShell.InvokeSwisVerb

                       

                      Is my script incorrect?

                       

                      Thanks

                        • Re: Reset an alert via Powershell/SWIS
                          tdanner

                          Close. The last parameter for Invoke-SwisVerb is a list of the argument values to send to the verb. You provided a single int, which PowerShell has helpfully wrapped into a list of one int. Since the verb expects an array of ints, an error is thrown when a single int is provided. This should work:

                           

                          $alertid = 28071
                          Invoke-SwisVerb $swis Orion.AlertActive ClearAlert @( ,@( $alertid ) )
                          

                           

                          The PowerShell syntax for making a list containing a single list is a little weird. You would think that @( @( 42 ) ) would give you a list containing a list containing 42, but it does not. It only gives you a list containing 42. But if you prefix the inner list with a comma, then you get the desired list nesting behavior.

                          2 of 2 people found this helpful