8 Replies Latest reply on May 15, 2017 9:22 AM by bobmarley

    Alert action only trigger after being acknowledged

    immpagaduan

      Dear All,

       

      I would like to know if there's a way in doing this:

       

      The alert action is only triggered when the alert is  "Acknowledged."

       

      The alert still appears in the all active alerts but only when the time "Acknowledge" button is clicked, that's the only time/way the alert action would trigger.

       

       

      Please let me know if you were able to do a workaround for it.

       

       

      Br,

      Ian

        • Re: Alert action only trigger after being acknowledged
          Steven Klassen

          Since there's no way in the interface to check for an acknowledged alert I think you're going to be stuck doing something with the Execute External Executable action. You could pass it the AlertID, have it query for the current acknowledge state of the alert using the API, and then send an email on its own if it's not acknowledged.

            • Re: Alert action only trigger after being acknowledged
              immpagaduan

              Hi Steve!

               

              Thanks for the response.

               

              "... you're going to be stuck doing something with the Execute External Executable action. You could pass it the AlertID, have it query for the current acknowledge state of the alert using the API, and then send an email on its own if it's not acknowledged."

               

              Could you be more specific here my friend? I can't seem to follow the passage you've given..but jus to add some input, we were planning to integrate the alerts to RT (request tracker) ticketing tool and we plan to use the "acknowledge" button to be the trigger condition to execute the alert action.

               

              Br,

              Ian

                • Re: Alert action only trigger after being acknowledged
                  Steven Klassen

                  Hey immpagaduan, sorry for the vague reply. I think I was still blinking sleep out of my eyes when I wrote it.

                   

                  The short answer is that there is not currently any way to trigger an alert action when it is acknowledged. The longer answer is that with a developer that knows the SolarWinds API (e.g., Loop1) you could have something written that sits outside of SolarWinds (as Windows service or Windows Scheduled Task) that monitors alerts for their acknowledgement state that kicks off an email (or a message to Request Tracker) when it happens.

                    • Re: Alert action only trigger after being acknowledged
                      immpagaduan

                      Hey Steve,

                       

                      I found some alert action here:

                       

                      I believe I did get you at some point but what bothers me is to correctly filter/manage thousands of alerts that we would be receiving from thousands of servers. That's why I'm looking onto how to simply trigger the alert action in solarwinds and execute the action above and we'll meet RT people from here on on how to integrate.

                       

                      I did find some alert condition, " auditing event action type is = alert acknowledged" but not able to proceed or use it in helpful way since I can't limit the alert to the specific node and corresponding condition I want. Basically, it just triggers everytime there's an alert being acknowledged.

                       

                      Br,

                      Ian

                • Re: Alert action only trigger after being acknowledged
                  Steven Klassen

                  That's an interesting angle. This is where the interface falls short and you need to switch to a Custom SWQL Alert to trigger on a) the alert being acknowledged, and b) matching the rest of the criteria you want. Have you had a chance to look at SWQL at all yet?

                   

                  http://www.github.com/solarwinds/OrionSDK/wiki

                  • Re: Alert action only trigger after being acknowledged
                    bobmarley

                    I would really like it if there was a separate column called initiate action that would allow the operator to not only acknowledge (dismiss) the alert but allow them to run the alert action such as execute a script.