• State Verified Answer
  • Locked Locked
  • Replies 5 replies
  • Subscribers 19 subscribers
  • Views 894 views
  • Users 0 members are here
Options
Related
This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Advanced Alert on Node Added/Removed Event

jedatt01

I'm trying to set up an advanced alert to trigger when a node is added or removed from Orion. I've gotten the custom sql query correct

Select Message, EventTime
From Events
Where (EventTime BETWEEN 40917 AND 40924.625) and
(Message like 'removed%' or Message like 'added%')

But, I can't seem to get the variables correct for the alert action. Can somebody help me to use the sql variable creator so I can display the Message and EventTime in my alert action? 

  • 0

    jedatt01, what have you tried so far? The query you need will be something like this:

    SELECT TOP 10 Events.Message FROM Events WHERE Events.EventType = 8 or Events.EventType = 9

    Mav

  • 0

    I have made a few changes. One is that this will need to be 2 Alerts to simplify the messaging. You can set the Alert to Trigger once every 10 minutes for these Alerts. You will need to create the Alerts and select the Type of Property to Monitor to Custom SQL Alert and setup your Trigger query to Node. The below SQL Query will Join the Nodes Table to the Events Table, and will check to see if any Node was Added or Removed. I referenced the EventType out of the EventTypes Table since this is more accurate. 

    Trigger Query for Node Added:

    Inner Join Events on Nodes.NodeID=Events.NetworkNode

    WHERE (DATEDIFF(mi, Events.EventTime, getdate()) < 10)  AND EventType='9'

    For the Message, you can use the following:

    ${NodeName} has been added to Orion at ${DateTime}.

     

    Trigger Query for Node Removed:

    Inner Join Events on Nodes.NodeID=Events.NetworkNode

    WHERE (DATEDIFF(mi, Events.EventTime, getdate()) < 10)  AND EventType='8'

     

     

    For the Message, you can use the following:

    ${NodeName} has been Removed from Orion at ${DateTime}.

     

  • 0 in reply to sean.martinez

    Sean, this worked perfectly. Thanks!

  • 0 in reply to sean.martinez

    The "Node Added" criteria works fine, but "Node Removed" either won't work or will be unreliable depending on deletion timescales because the row in the Nodes table for the deleted node will no longer exist.

  • 0 in reply to smargh

    I was wondering, would it be possible to edit these alerts to include the login credentials of the person who removed or added the nodes?

SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.

SolarWinds Customer Success Center Certification Media Vault Link Accounts
About THWACK Blogs For Government Edit Settings Free Tools & Trials
Legal Documents Terms of Use Privacy California Privacy Rights Security Information
©2024 SolarWinds Worldwide, LLC. All Rights Reserved.