3 Replies Latest reply on Jun 23, 2017 3:01 PM by osborne_graham

    repeat alerts

    trilobite rex

      I have an alert that sends out a message if a Node's (server) c$ is less than or equal to 1 GB free.  What I'd like to create is a report that can run to show any repeat offenders so that we can further troubleshoot the issue (either by expanding the drive or seeing what is causing the issue)

       

       

      Is this doable and how would I do it in report writer.

       

      Thanks...

        • Re: repeat alerts
          mesverrum

          Modifying a report I already had that counts the number of times a particular alert has happened, you would just need to change the alert name on row 25 in your environment to match the one you are hoping to filtering on, I used '%is down%' in my lab example

           

          --report on alerts triggered 
          select ac.Name
          --,ah.Message
          ,'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:'+ToString(AlertObjectID) as [_linkfor_Name]
          ,count(ah.message) as [Alert Count]
          ,EntityCaption as [Trigger Object]
          ,EntityDetailsUrl as [_linkfor_Trigger Object]
          ,case 
          WHEN RelatedNodeCaption=EntityCaption THEN 'Self'
          When RelatedNodeCaption!=EntityCaption THEN RelatedNodeCaption
          End as [Parent Node]
          ,RelatedNodeDetailsUrl as [_linkfor_Parent Node]
          ,tolocal(max(ah.TimeStamp)) as [Most Recent Trigger]
          ,'/Orion/images/StatusIcons/Small-' + p.StatusIcon AS [_IconFor_Parent Node]
          FROM Orion.AlertHistory ah
          left join Orion.AlertObjects ao on ao.alertobjectid=ah.alertobjectid
          left join Orion.AlertConfigurations ac on ac.alertid=ao.alertid
          left join Orion.Actions a on a.actionid=ah.actionid
          left join Orion.Nodes p on p.nodeid=RelatedNodeID
          WHERE 
          daydiff(ah.timestamp,GETUTCDATE())<30
          and eventtype=0
          and ac.Name like '%down%'
          group by name,  [Trigger Object], RelatedNodeCaption
          having count(ah.message) > 1
          order by [Alert Count] desc
          

           

           

          -Marc Netterfield

              Loop1 Systems: SolarWinds Training and Professional Services

          • Re: repeat alerts
            osborne_graham

            Create a web report and for the datasource use 'Event', advance selector and specify message -> is equal to -> [your alert message].

            a.JPG

            Create a table entering event time and node. Expand the event time settings and use the data aggregation type of 'count'.

             

            Add the event time for the time based setting.

            Group by 'node'

            You should get a report that looks something like this: