< BACK TO TO THE MAGIC OF SQL SCRIPTS SERIES LIST
Hi All,
This solution is going to be based on the previous work, which has been done for SWQL. Version 2 if you will... SQL based
Challenge:
- Be able to see all your components with problems in one convenient report/resource with click-able URLs
End result:
Features:
- Display your components with problems along-side with nodes, apps, message, etc in one SQL report
- Direct click-able links for the objects
- Status icons
- Use this report as a resource on the page
- Support for exclusions (mute) on any level - node, app, components itself and even template(new)
- Hide acknowledged alerts(new)
- Ensure that disabled components would not show up(new)
Step-by-step:
(1)
To be able to mute you would need to have the following Custom Properties (obviously if you already have some for this purpose - please adopt SQL script as per your set-up):
- n_mute_eAlerts Node's CS AS a date-type, where you can set date in the future until when to mute
- a_mute_eAlerts App's CS AS a date-type, where you can set date in the future until when to mute
(2)
Download attached report and import it into Orion Report Writer**
PLEASE OPEN IT AND UPDATE SQL SCRIPT TO USE YOUR DATABASE NAME (8 instances in total)
** Here is an SQL script for those who would like to do it themselves
(keep it mind that for URLs to work you would need to copy paste URLs (which is in the SQL column comments below) into Web URL field of the Orion Report Writer, under Field Formatting tab. You can also hide ID fields as they are only used to build URLs. If you will download report - all this is done for you already)
SELECT APM_AlertsAndReportsData.NodeId ,APM_AlertsAndReportsData.ApplicationID ,APM_AlertsAndReportsData.ComponentID ,APM_AlertsAndReportsData.ComponentStatus+'.gif' AS 'ICON' ,APM_AlertsAndReportsData.NodeName AS 'NODE' --/Orion/View.aspx?View=NodeDetails&NetObject=N:${NodeID} ,APM_AlertsAndReportsData.ApplicationName AS 'APP' --/Orion/APM/ApplicationDetails.aspx?NetObject=AA:${ApplicationID} ,APM_AlertsAndReportsData.ComponentName AS 'CMPNT' --/Orion/APM/MonitorDetails.aspx?NetObject=AM:${ComponentID} ,Round(APM_AlertsAndReportsData.StatisticData, 2) AS 'STAT' ,CASE WHEN len(APM_AlertsAndReportsData.ComponentMessage)>100 THEN left(APM_AlertsAndReportsData.ComponentMessage,100) + ' [...]' ELSE APM_AlertsAndReportsData.ComponentMessage END AS 'MSG' --/Orion/APM/MonitorDetails.aspx?NetObject=AM:${ComponentID}
FROM SolarWinds.dbo.APM_AlertsAndReportsData WITH (NOLOCK)
INNER JOIN SolarWinds.dbo.Nodes n WITH (NOLOCK) ON n.NodeID = APM_AlertsAndReportsData.NodeId
INNER JOIN SolarWinds.dbo.APM_Application a WITH (NOLOCK) ON a.ID = APM_AlertsAndReportsData.ApplicationID
INNER JOIN SolarWinds.dbo.APM_ApplicationCustomProperties appcp WITH (NOLOCK) ON appcp.ApplicationID = APM_AlertsAndReportsData.ApplicationID
INNER JOIN SolarWinds.dbo.APM_ApplicationTemplate at WITH (NOLOCK) ON at.ID = a.TemplateID
INNER JOIN Solarwinds.dbo.APM_Component c WITH (NOLOCK) ON c.ID = APM_AlertsAndReportsData.ComponentID
INNER JOIN Solarwinds.dbo.APM_ComponentTemplate ct WITH (NOLOCK) ON ct.ID = c.TemplateID
LEFT JOIN Solarwinds.dbo.AlertStatus ast WITH (NOLOCK) ON (ast.ActiveObject = APM_AlertsAndReportsData.ComponentID AND ast.ObjectType = 'APM: Component')
WHERE
(n.n_mute_eAlerts IS NULL OR n.n_mute_eAlerts < n.LastSync) AND --not muted on Node level (appcp.a_mute_eAlerts IS NULL OR appcp.a_mute_eAlerts < n.LastSync) AND --not muted on App level APM_AlertsAndReportsData.UserNotes NOT LIKE '%mute_eAlerts%' AND --not muted on Component level at.Description NOT LIKE '%mute_eAlerts%' AND --not muted on template level ISNULL(ast.Acknowledged,0) <> 1 AND --if alert has fired - it has not been yet acknowledged n.Status IN ('1','3') AND --Node is either (1)Up or (3)Warning n.UnManaged = 0 AND --Node is not unmanaged APM_AlertsAndReportsData.ApplicationStatus <> 'Unmanaged' AND --App is not unmanaged ( (ct.IsDisabled = 0 AND ISNULL(c.IsDisabled,0) <> 1) OR --Component is enabled on template level and is not disabled on component level (ct.IsDisabled = 1 AND ISNULL(c.IsDisabled,1) = 0) --Component is disabled on template level, but is overridden (enabled) on component level ) AND APM_AlertsAndReportsData.ComponentStatus <> 'Up' -- Component is not Up
(3)
Add "Report from Orion Writer" resource to any page you like (usually it would be your summary or NOC page)
Select this new report from the resource:
(4)
And last one - download attached ALERT and import into your Advanced Alert Manager
You are done!
How to mute
- Simply acknowledge an alert for this component (if you have an alert configured for this component)
- To mute on node level: set n_mute_eAlerts to any date in the future you would like to mute until
- To mute on application level: set a_mute_eAlerts to any date in the future you would like to mute until
- To mute on a component level: add "mute_eAlerts" string into User Notes field of your component
- To mute on a template level: add "mute_eAlerts" string into Template description field
Tips
- When I introduce a new monitoring application - I would mute it on template level. In this case our team don't receive any alerts whilst I am testing it.
- I do use same SQL script (with just few minor adjustments) to fire email alerts. Therefore - all flagged issues can be muted by simply acknowledging an alert for a particular component. If you don't like this feature - cimply comment out (or remove) corresponding SQL line which is performing this check
- My original script (which I use in production) has few additional checks, such as Environemnt and Impact. It will only trigger if Environment is set to PROD and impact either HIGH or MEDIUM. I will discuss this solution later, as it is a very robust and flexible approach for managing scopes in the environment of any size, which deserves a separate article
Have fun
To Your Success,
Alex Soul