9 Replies Latest reply on Sep 12, 2017 9:41 AM by HerrDoktor

    How to set up an alert that compares two values from different components

    noeltz

      Hello Everyone,

       

      I have a SAM template with two components (A and B). Each component returns a statistic value and I want the alert to be active if the value from component A is greater than the value of component B.

      Is there a way to configure an alert in this manner?

       

      Thank you and best regards

        • Re: How to set up an alert that compares two values from different components
          yaquaholic

          Hi noeltz,

           

          have you tried the double block comparison, in the alert's trigger definition?

          This allows you to test two variables against each other.

          If this doesn't give you what you need, you can always use a custom SQL (or SWQL)  trigger definition.

          If you need to, just supply some more details, I am sure we can get it working for you.

           

          I hope it helps!

            • Re: How to set up an alert that compares two values from different components
              noeltz

              Hi yaquaholic,

               

              I already tried the double value comparison but the problem is, that I cannot specify which statistic data from which component I want to compare.

              Even if I set the scope so that this only applies to the desired two components I can't choose which statistic value is the first and which is the second variable in the comparison.

              What I need is a double value comparison like this: <Component A>  [Statistic Data] is greater than <Component B> [Statistic Data]

               

              Do you know a way to achieve this?

               

              Best regards

                • Re: How to set up an alert that compares two values from different components
                  yaquaholic

                  Okay, if the drop down boxes won;t cut it, SQL or SWQL is the way forward.

                   

                  Firstly, lets work out what you are looking at.

                  Open your trigger definition and populate each of the variables into a single trigger condition, especially the two you want to compare, but add as many as you need.

                  Next from the top right of the definition you'll see a little yellow drop down arrow, click it and select show SWQL:

                  And as if by magic, we get a SWQL trigger pop-up.

                  Now although this won't be firing any alerts it does tell us where the data is in the database and will allow us to create the trigger for you.

                  Hopefully the trigger definition doesn't contain any sensitive data (if so hide it) and post up the SWQL that is outputted, the variables of interest and what you need to compare against what and I'll have a crack a writing an example for you.

                    • Re: How to set up an alert that compares two values from different components
                      noeltz

                      Okay,
                      so here is my SWQL output:

                       

                      SELECT E0.[Uri], E0.[DisplayName]

                      FROM Orion.APM.Component AS E0

                      WHERE ( ( E0.[Application].[Node].[Vendor] = 'Windows' ) AND ( E0.[Application].[ApplicationAlert].[ApplicationName] = 'Windows Monitor' ) AND (( E0.[ComponentAlert].[ComponentName] = 'Win_Stat_A' ) OR ( E0.[ComponentAlert].[ComponentName] = 'Win_Stat_B' )) AND ( E0.[ComponentAlert].[StatisticData] > E0.[ComponentAlert].[StatisticData] ) )

                       

                      The problem is this part: ( E0.[ComponentAlert].[StatisticData] > E0.[ComponentAlert].[StatisticData] )

                      I need to compare the StatisticData from Win_Stat_A against StatisticData from Win_Stat_B

                       

                      Thank you very much for your help!

                • Re: How to set up an alert that compares two values from different components
                  yaquaholic

                  Try this, it should work (it certainly passed SWQL syntax):

                   

                  SELECT E0.[Uri], E0.[DisplayName]

                  FROM Orion.APM.Component AS E0

                  WHERE ( E0.[Application].[Node].[Vendor] = 'Windows' ) AND ( E0.[Application].[ApplicationAlert].[ApplicationName] = 'Windows Monitor')

                    AND ( SELECT E0.[ComponentAlert].[StatisticData] FROM Orion.APM.Component AS E0 WHERE  E0.[ComponentAlert].[ComponentName] = 'Win_Stat_A')

                         >

                         ( SELECT E0.[ComponentAlert].[StatisticData] FROM Orion.APM.Component AS E0 WHERE  E0.[ComponentAlert].[ComponentName] = 'Win_Stat_B' )

                   

                   

                  Hopefully by isolating each metric first, then comparing them, you should get the result you are after.

                   

                  If you have the Orion SDK installed (https://github.com/solarwinds/OrionSDK) you can test the SWQL in the SWQL studio, or you can use the native SWQL tools on your Orion server (http://<your Orion server>/Orion/admin/swis.aspx). The former is like a lightweight SQL studio, the later is not quite so dynamic.

                   

                   

                  Good luck! 

                  1 of 1 people found this helpful
                    • Re: How to set up an alert that compares two values from different components
                      noeltz

                      I tried your solution but unfortunately it didn't work.

                      I tested the SWQL in the SWQL Studio and got the error message:

                      Subquery returned more than 1 value. This is not permitted when the subquery follows =,!=,<,<=,>,>= or when the subquery is used as an expression.

                       

                      So I guessed the problem is that the subquerys output contains not only the statistic data for the components within the same application monitor.

                      I changed the entry object from component to application and modified the SWQL a little:

                       

                      SELECT Application.Uri, Application.DisplayName FROM Orion.APM.Application AS Application

                      WHERE DisplayName = 'Windows Monitor'

                      AND ( SELECT StatisticData FROM Orion.APM.ComponentAlert AS CompA WHERE CompA.[Component].[Application].[Uri] = Application.Uri  AND CompA.[ComponentName] = 'Win_Stat_A' )

                          >

                          ( SELECT StatisticData FROM Orion.APM.ComponentAlert AS CompB WHERE CompB.[Component].[Application].[Uri] = Application.Uri  AND CompB.[ComponentName] = 'Win_Stat_B' )

                         

                      And that works like a charm.

                      So your idea to isolate the two metrics was leading me in the right direction.

                       

                      Thank your for your help!

                      Best regards

                    • Re: How to set up an alert that compares two values from different components
                      HerrDoktor

                      I am working on a similar issue at the moment (with 2 Custom Pollers). I assume this will also end in a custom SQL or SWQL Alert.

                      If you are successful, let me know.

                       

                      Cheers,

                      Holger