5 Replies Latest reply on Nov 7, 2013 3:26 AM by Vinay BY

    Advanced Alerting - Auto correlation

    Vinay BY

      Hi,

       

      I am trying to create an auto-correlation rule in Advanced Alerts (Custom SQL Alert : APM Component), I need to alert on the below condition:

      IF (Service/Process 1A on Server 1 is DOWN) AND (Service/Process 1B on Server 2 is DOWN) - Generate an alert.

      1. Service/Process running on Windows. Is this achievable ? Is there a way to do this?

      2. I have created a 2 Windows Service monitors to check availability of the Service on Windows ( Service 1A and Service 1B)

      3. I tried the below condition which returns zero rows in Solarwinds

      WHERE

      (

        (APM_AlertsAndReportsData.ComponentName='Service 1A') AND (APM_AlertsAndReportsData.ComponentName='Service 1B') AND (APM_AlertsAndReportsData.ComponentStatus='Down')

      )

      4. I tried to nest it as well, but same result - it will not return any rows

      WHERE

      (

        ((APM_AlertsAndReportsData.ComponentName='Service 1A') AND (APM_AlertsAndReportsData.ComponentStatus='Down'))

      AND

      ((APM_AlertsAndReportsData.ComponentName='Service 1B') AND (APM_AlertsAndReportsData.ComponentStatus='Down'))

      )

       

      Any suggestions, please advice.

      Thanks

        • Re: Advanced Alerting - Auto correlation
          Vinay BY

          We can do it through Grouping feature in Solarwinds - we can move these monitor's under a single group and create an alert on status of the group (Manage Groups -> Create a new group in Solarwinds move these monitors under it, tick best status, then create an alert based on Group status in Advanced Alerts) - but that isn't a great solution. I am looking for something within Custom SQL Alert: APM:Component. Nested SQL Query which can achieve this.

          1 of 1 people found this helpful
            • Re: Advanced Alerting - Auto correlation
              njoylif

              I don't believe you'll be able to do it through this mechanism.

              Reason being: the select statement is hard coded.

              In order for this to work, you have to compare one row of the table to another, and the only way I know to do this is via comparing one instance of the table to another; iterating one row of instance 1 against all rows of instance 2 until done, then moving to the next row of instance 1 and comparing to all rows of instance 2, ... (skipping of course the "same" row in each instance)

              1 of 1 people found this helpful
            • Re: Advanced Alerting - Auto correlation
              RichardLetts

              something like this:

               

              WHERE  ( apm_alertsandreportsdata.componentname = 'Service 1A'

                       AND apm_alertsandreportsdata.componentstatus = 'Down' )

                     AND EXISTS (SELECT 1

                                 FROM   apm_alertsandreportsdata apm2

                                 WHERE  ( apm2.componentname = 'Service 1B'

                                          AND apm2.componentstatus = 'Down' ))


              should generate an alert on 1A being down only if 1B is also down

              I'll leave the reset condition generation as a homework exercise.