I have an alert that sends out a message if a Node's (server) c$ is less than or equal to 1 GB free. What I'd like to create is a report that can run to show any repeat offenders so that we can further troubleshoot the issue (either by expanding the drive or seeing what is causing the issue)
Is this doable and how would I do it in report writer.
Thanks...
Modifying a report I already had that counts the number of times a particular alert has happened, you would just need to change the alert name on row 25 in your environment to match the one you are hoping to filtering on, I used '%is down%' in my lab example
--report on alerts triggered
select ac.Name
--,ah.Message
,'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:'+ToString(AlertObjectID) as [_linkfor_Name]
,count(ah.message) as [Alert Count]
,EntityCaption as [Trigger Object]
,EntityDetailsUrl as [_linkfor_Trigger Object]
,case
WHEN RelatedNodeCaption=EntityCaption THEN 'Self'
When RelatedNodeCaption!=EntityCaption THEN RelatedNodeCaption
End as [Parent Node]
,RelatedNodeDetailsUrl as [_linkfor_Parent Node]
,tolocal(max(ah.TimeStamp)) as [Most Recent Trigger]
,'/Orion/images/StatusIcons/Small-' + p.StatusIcon AS [_IconFor_Parent Node]
FROM Orion.AlertHistory ah
left join Orion.AlertObjects ao on ao.alertobjectid=ah.alertobjectid
left join Orion.AlertConfigurations ac on ac.alertid=ao.alertid
left join Orion.Actions a on a.actionid=ah.actionid
left join Orion.Nodes p on p.nodeid=RelatedNodeID
WHERE
daydiff(ah.timestamp,GETUTCDATE())<30
and eventtype=0
and ac.Name like '%down%'
group by name, [Trigger Object], RelatedNodeCaption
having count(ah.message) > 1
order by [Alert Count] desc
Loop1 Systems: SolarWinds Training and Professional Services
As far as how to do it in Report Writer, don't. That part of the product is long since deprecated. You can take the query above and paste it into a "Custom Query" resource and be all set. If you need it to be in a scheduled report then you can take what I have there and use the web based report writer and hit Add Content, search for Query, and paste it there exactly the same as you would on a dashboard.
Loop1 Systems: SolarWinds Training and Professional Services
Create a web report and for the datasource use 'Event', advance selector and specify message -> is equal to -> [your alert message].
Create a table entering event time and node. Expand the event time settings and use the data aggregation type of 'count'.
Add the event time for the time based setting.
Group by 'node'
You should get a report that looks something like this:
