Hello everyone,
I need to create an alert to select ThinAP for which there are more than N (in the example below, 2) clients with ip address 0.0.0.0 for 10 minutes (so dhcp is not working correctly).
The standard alerting features for WIFI do not allow to do that, thus I've created a query that works perfectly in sql management studio, and works (partly) in alert manager.
The problem in alert manager is that it selects the correct nodes and put them as Alert State = 1 (so I can see those in the active alert list inside alert manager) but I also have the following error on each:
System.Data.SqlClient.SqlException (0x80131904): Incorrect syntax near the keyword 'Select'.
Incorrect syntax near ')'.
at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection)
at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)
at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning()
at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj)
at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString)
at System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async)
at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, DbAsyncResult result)
at System.Data.SqlClient.SqlCommand.InternalExecuteNonQuery(DbAsyncResult result, String methodName, Boolean sendToPipe)
at System.Data.SqlClient.SqlCommand.ExecuteNonQuery()
at SolarWinds.Orion.Common.SqlHelper.ExecuteNonQuery(SqlCommand command, SqlConnection connection, SqlTransaction transaction)
at AlertingEngine.CheckAlert.UpdateRowsThatAreReset()
And, when the time threshold has passed and orion is supposed to trigger alert action, it just 'reset' the alert state on those nodes. (And they won't come back to alert state 1 unless I change the alert condition in the alarm.)
The query is what follows:
Select NPM_NV_WL_Alert_APS_V.ID, NPM_NV_WL_Alert_APS_V.AP_Name from NPM_NV_WL_Alert_APS_V (this is the static part automatically filled in when I select the Wireless AP type of object, while below there is the part I add)
Where NPM_NV_WL_Alert_APS_V.ID in
(Select NPM_NV_WL_APS.ID from NPM_NV_WL_CLIENTS
inner join NPM_NV_WL_INTERFACES on
NPM_NV_WL_CLIENTS.parentID = NPM_NV_WL_INTERFACES.id
inner join NPM_NV_WL_APS on NPM_NV_WL_INTERFACES.parentID = NPM_NV_WL_APS.id
where NPM_NV_WL_CLIENTS.Client_ipaddress = '0.0.0.0'
Group by NPM_NV_WL_APS.ID
Having Count(NPM_NV_WL_CLIENTS.Client_Ipaddress) > 2)
I've also tried the equivalent Inner Join version of this, and both work with the SQL Validation and with the fact alert manager correctly select objects that fit the condition putting them in alert state 1, but also both generate the error above and do not trigger any action at all when the threshold time has passed.
Has someone got similar problems and can help me with this?
Thank you very much.
Dave