1 Reply Latest reply on Oct 11, 2018 6:00 PM by mesverrum

    Alerting if Alert Fires Off X Times in X Days

    jonathanw84

      Hello,

       

      Is there a way to create an alert that will fire off if an alert (i.e. high transmit percent utilization) fires off more than a certain amount of times in a week span? We already get alerting on utilization, but I cannot figure a way to get an additional alert if the same node fires off the utilization alert more than say 10 times in a week? We would like to have this for visibility and to be more proactive on circuit upgrades.

       

      Thanks,

       

      Jonathan

        • Re: Alerting if Alert Fires Off X Times in X Days
          mesverrum

          It would have to be custom SWQL/SQL, here is a report I wrote in SWQL that shows how often alerts fire for specific objects, it would be possible to rework it to do what you are asking if you narrow it down.

           

          --report on alerts triggered

          select ac.Name

          ,'/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:'+ToString(AlertObjectID) as [_linkfor_Name]

          ,count(ah.message) as [Alert Count]

          ,EntityCaption as [Trigger Object]

          ,EntityDetailsUrl as [_linkfor_Trigger Object]

          ,case

          WHEN RelatedNodeCaption=EntityCaption THEN 'Self'

          When RelatedNodeCaption!=EntityCaption THEN RelatedNodeCaption

          End as [Parent Node]

          ,RelatedNodeDetailsUrl as [_linkfor_Parent Node]

          ,tolocal(max(ah.TimeStamp)) as [Most Recent Trigger]

          ,'/Orion/images/StatusIcons/Small-' + n.StatusIcon AS [_IconFor_Trigger Object]

          ,'/Orion/images/StatusIcons/Small-' + p.StatusIcon AS [_IconFor_Parent Node]

           

          FROM Orion.AlertHistory ah

          left join Orion.AlertObjects ao on ao.alertobjectid=ah.alertobjectid

          left join Orion.AlertConfigurations ac on ac.alertid=ao.alertid

          left join Orion.Actions a on a.actionid=ah.actionid

          left join Orion.Nodes n on n.caption=EntityCaption

          left join Orion.Nodes p on p.caption=RelatedNodeCaption

           

           

          WHERE

          daydiff(ah.timestamp,GETUTCDATE())<30

          and eventtype=0

           

           

          group by name, [Trigger Object], RelatedNodeCaption

          order by [Alert Count] desc