13 Replies Latest reply on Mar 1, 2016 10:05 AM by wbrown

    ClearAlert Verb in Orion.AlertActive Entity

    muheet.hajela@contractor.xlgroup.com

      I'm trying to invoke the Orion.AlertActive entity's Clear Alert Verb, but I'm not sure what arguments to pass.

       

      Is there a document which I can refer to check which arguments to pass or can somebody tell me which arguments to pass?

      I tried the following invoke and in place of xxxx I passed the alert object ID:

      Invoke-SwisVerb $swis Orion.AlertStatus ClearAlert @(xxxx)

       

      But I get the following error:

      Invoke-SwisVerb : Verb Orion.AlertStatus.ClearAlert: Not found

      At line:7 char:1

      + Invoke-SwisVerb $swis Orion.AlertStatus ClearAlert @("33105")

      + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

          + CategoryInfo          : InvalidOperation: (:) [Invoke-SwisVerb], FaultException`1

          + FullyQualifiedErrorId : SwisError,SwisPowerShell.InvokeSwisVerb

       

      It says verb not found but its there in metadata so I'm pretty sure I'm  passing the wrong arguments. So, is there a document which I can refer to check which arguments to pass or can somebody tell me which arguments to pass?

        • Re: ClearAlert Verb in Orion.AlertActive Entity
          Jan Pelousek

          Hello. Problem is, that this verb doesn't belong to Orion.AlertStatus entity, but to Orion.AlertActive. The argument then is array of alertObjectIds, which you get from Orion.AlertObjects entity by filtering to the EntityUri (or other unique value, which also may be in your case EntityCaption, but not in general) and the AlertId (record in Orion.AlertConfigurations, defining the alert definition itself).

           

          I hope it helps.

           

          Regards,

          Honza

          ClearAlert.png

            • Re: ClearAlert Verb in Orion.AlertActive Entity
              muheet.hajela@contractor.xlgroup.com

              Thanks a lot Jan, this worked. I invoked using the SDK first and then by using a powershell script, also can you confirm this...I just had to pass the ObjectId for this verb and not the alertID, just an array of integers with object id.

                • Re: ClearAlert Verb in Orion.AlertActive Entity
                  sstark85

                  Would you mind posting your powershell code as an example with the object id as well. I am interested in how you are doing this.

                  • Re: ClearAlert Verb in Orion.AlertActive Entity
                    wbrown

                    I will second sstark85's request - please post your powershell code (minus the username and password, of course).

                    I'm trying to do the same thing and am banging my head against the wall at this point.

                        • Re: ClearAlert Verb in Orion.AlertActive Entity
                          wbrown

                          Many many times.

                          Below is what I'm executing in powershell and the resulting output.

                          The value 86108 in the arguments is the AlertID of a specific alert which is confirmed as not being acknowledged.

                           

                          PS D:\ProgramData\Solarwinds\Scripts> $swis = Connect-Swis -h localhost -u <removed> -p <removed>

                          PS D:\ProgramData\Solarwinds\Scripts> Invoke-SwisVerb -SwisConnection $swis -EntityName "Orion.AlertActive" -Verb "Ackno

                          wledge" -Arguments @(86108, "test")

                          Invoke-SwisVerb : Verb Orion.AlertActive.Acknowledge cannot unpackage parameter 0

                          At line:1 char:16

                          + Invoke-SwisVerb <<<<  -SwisConnection $swis -EntityName "Orion.AlertActive" -Verb "Acknowledge" -Arguments @(86108, "

                          test")

                              + CategoryInfo          : InvalidOperation: (:) [Invoke-SwisVerb], FaultException`1

                              + FullyQualifiedErrorId : SwisError,SwisPowerShell.InvokeSwisVerb

                            • Re: ClearAlert Verb in Orion.AlertActive Entity
                              tdanner

                              The first parameter to Orion.AlertActive.Acknowledge is an array of ints containing the AlertObjectID values of the alerts to ack. Your code sends a single int, not an array of ints, so it doesn't work. (Error message needs some work, for sure...)

                               

                              This will work:

                               

                              $swis = Connect-Swis -Hostname blah -Username blah -Password blah
                              $alertobjid = 42
                              $note = "remember to pick up milk"
                              $ids = New-Object int[] 1
                              $ids[0] = $alertobjid
                              Invoke-SwisVerb $swis Orion.AlertActive Acknowledge @($ids, $note)
                              

                               

                              With the current beta release of NPM (NPM 12.0 Beta 2 ) this is simplified a bit. Instead of having to create an int[] to hold the ids, you can just use a regular PowerShell list. Like this: Invoke-SwisVerb $swis Orion.AlertActive Acknowledge @( @( 42 ), "my note")

                              1 of 1 people found this helpful
                                • Re: ClearAlert Verb in Orion.AlertActive Entity
                                  wbrown

                                  Looks like what we were missing is the conversion of the $alertobjid from the single integer value to the array $ids[0].  Once that line was added to our script then we were able to run it without any error.

                                  After that we found that we had to use the alertobjectid rather than the alertid.

                                   

                                  One other thing not mentioned above is that we had to use SWIS version 3 rather than version 2 that is shown in many of the examples to be found via searches.  This is specified (or not specified) via the presence or lack of the string "-v2" in the Connect-Swis string.

                                  • Re: ClearAlert Verb in Orion.AlertActive Entity
                                    jbieber

                                    As wbrown stated in reply this script worked perfectly for us however we are now having an issue with implementation into Orion itself.

                                     

                                    Our end goal has been to "Execute an External Program" and fire this powershell script for auto acknowledging a few different alerts in our environment. This works, but our issue is being able to grab the appropriate AlertObjectID from the AlertID of the active alert itself. I've tried utilizing a Get-SwisData cmdlet but am having trouble being able to reference the AlertID to grab the AlertObjectID from Orion.AlertActive.

                                     

                                    sstark85's example below had some insight, but I still am having problems wrapping my head around how to get the "AlertObjectID" to feed to the script above provided by the AlertID in the active alert itself.

                                     

                                    Many thanks to tdanner for the response and script sharing above.

                        • Re: ClearAlert Verb in Orion.AlertActive Entity
                          sstark85

                          I can actually answer this now. The basics of it are below. You need to make sure with any of api powershell methods you are using the correct XML schema. You can find all of this out by using the SWQL studio tool. In the example below I am getting the AlertID from the database. You can customize the query to your liking. Just make sure you are passing in an array of integers to the Clear and Acknowledge methods. I cover that below in the comments on Getting an AlertID

                           

                          Getting an Alert ID from SolarWinds

                          #Define the SQL Query to find the Alert in the Orion.AlertStatus Table

                          $Query = "SELECT AlertActiveID, AlertObjectID FROM Orion.AlertActive Where AlertObjectID = $AlertID"

                          #Query the Solarwinds Orion.AlertStatus Table for the Alert

                          $AlertQuery = Get-SwisData $swis $Query

                          #Convert AlertID to an Array of Integers. This is to support the Solarwinds ACK and Clear Method, it wants an array of integers.

                          $AlertID = @($AlertID -as [int])

                           

                           

                          Acknowledge an alert

                          #Create and XML String for Acking the Alert in Solarwinds

                          $xmlString = "<ArrayOfint xmlns='http://schemas.microsoft.com/2003/10/Serialization/Arrays'>

                                             <int>$($AlertID)</int>

                                        </ArrayOfint>"

                          $xmlElement = ([xml]$xmlString).DocumentElement                

                          #Ack Alert

                          Invoke-SwisVerb $swis Orion.AlertActive Acknowledge @($xmlElement,$AlertMessage)

                           

                          Clear an Alert

                          #Create an XML String for Clearing the Alert in Solarwinds

                          $xmlString = "<ArrayOfint xmlns='http://schemas.microsoft.com/2003/10/Serialization/Arrays'>

                                             <int>$($AlertID)</int>

                                        </ArrayOfint>"

                          $xmlElement = ([xml]$xmlString).DocumentElement

                          #Clear the Alert

                          Invoke-SwisVerb $swis Orion.AlertActive ClearAlert @($xmlElement)

                          1 of 1 people found this helpful
                            • Re: ClearAlert Verb in Orion.AlertActive Entity
                              muheet.hajela@contractor.xlgroup.com

                              Apologies guys I was on leave for quite sometime. Nicely put sstark85. Below is my snippet of the code, hope it helps:

                               

                              $hostname = "hostname"

                              $username = "username"

                              $password = New-Object System.Security.SecureString

                              $cred = New-Object -typename System.Management.Automation.PSCredential -argumentlist $username, $password

                              $swis = Connect-Swis -host $hostname -cred $cred

                              $xmlString = "<ArrayOfint xmlns='http://schemas.microsoft.com/2003/10/Serialization/Arrays'>

                                                <int>$($AlertID)</int>

                                            </ArrayOfint>"

                              $xmlElement = ([xml]$xmlString).DocumentElement  

                              Invoke-SwisVerb $swis Orion.AlertActive ClearAlert @( $xmlElement )

                              $ErrorActionPreference = 'Continue'

                               

                               

                              Here in Alert ID you just need to pass the Alert ObjectID.

                                • Re: ClearAlert Verb in Orion.AlertActive Entity
                                  wbrown

                                  Below is what we finally got working using no XML.

                                   

                                  The script is called via the alert with this command line:

                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy unrestricted -command "D:\ProgramData\Solarwinds\Scripts\AlertAckScript.ps1 "${N=Alerting;M=AcknowledgeUrl}

                                  The alert action is using no username defined within the alert action dialog.

                                   

                                  And the script on the Orion server is thus:

                                  # Load the SwisSnapin if not already loaded
                                  if (!(Get-PSSnapin | where {$_.Name -eq "SwisSnapin"})) {
                                      Add-PSSnapin "SwisSnapin"
                                  }

                                  $AlertUrlString=$args[0]
                                  # We are assuming that the arg passed is a URL.  This will need to be parsed for the AlertObjectID at the end.

                                  # Parse out the Alert object ID from the end of the url.
                                  [string]$AlertObjectIdString = [regex]::matches($AlertUrlString, "[0-9]+$")
                                  [int]$AlertObjectID = [convert]::ToInt32($AlertObjectIdString,10)

                                  # Windows event log for info
                                  write-eventlog -logname "Windows PowerShell" -source Powershell -eventID 1001 -entrytype Information -message "Orion alert processing called ack script with value $AlertObjectID" -category 1 -rawdata 0

                                  #Variables
                                  $hostname = "localhost"
                                  $username = "OrionLocalUsername"
                                  $userPasswordPlaintext = "OrionLocalPassword"
                                  $AlertArray = New-Object int[] 1
                                  $AlertArray[0] = $AlertObjectID

                                  $swisConnection = Connect-Swis -h $hostname -u $username -p $userPasswordPlaintext
                                  $AckString = "Auto Acknowledged by Orion alert processing service."
                                  $result = Invoke-SwisVerb $swisConnection Orion.AlertActive Acknowledge @($AlertArray, $AckString)
                                  exit $result

                                   

                                  p.s.:  our command string to call powershell references powershell v1.0 but we are actually running 2.0.