Automatically tweak Polling Intervals with Alert and PowerShell

Hello Thwack

I really liked what adatole had put together TC18: Customize Polling Intervals With the Orion SDK a while back, so a big THANK YOU. I used this manually for some time due to lack of time to implement anything further. So I eventually put some time in to move it to PowerShell and add a few of my own spins to it. Sorry adatole, I can't claim to know Perl at all, and am slightly proficient in PowerShell. Also if anyone knows how to pass all the node IDs of the nodes that triggered the alert into the Run a Command action via either a string or array, I'm certainly interested and will tweak this more. A couple disclaimers...

1. I did not create this on my own. The hard work and much of the concept was already created here on Thwack and I just pulled some pieces together, added a bit and made it work for me and my use case.
   1. Again, please see TC18: Customize Polling Intervals With the Orion SDK
   2. See How To Trigger An Alert (Advanced) When Custom Property Has Been Changed

The Goal:

     To create a method of automatically tweaking the polling intervals based off of a custom property being edited.

Prerequisites:

1. Read TC18: Customize Polling Intervals With the Orion SDK
2. You'll need a custom property to hold the values of predetermined polling value names (e.g. Prod-Sev-5, Prod-Sev-4 etc. etc.)
3. SwisPowerShell installed as a PowerShell Module on the Primary SolarWinds server (and standby if run in HA) - PowerShell Gallery | SwisPowerShell 2.4.0.176

The PowerShell script...

     This script queries all the nodes existing Polling_Level custom property, PollingInterval, and StatCollection values and compares them to the presets in the script so to only attempt to edit what's necessary.

<##################################################################################################################################

Author: sum_giais (Just some random Thwack user)
Date created: 2.19.2019  
Purpose: This script was created to update Polling Interval and Statistics Collection values for nodes based off of the node custom property 'Polling_Level'

Prerequisites:
    SwisPowerShell (SolarWinds Orion Module) https://www.powershellgallery.com/packages/SwisPowerShell  
README FIRST:    https://thwack.solarwinds.com/docs/DOC-203337  
Command to run inside SolarWinds Alert:    powershell.exe -Command "&((Get-ItemProperty -Path Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\SolarWinds\Orion\Core).InstallPath + '/HighAvailability/Scripts/polling-levels-update.ps1')"

Update Password:
    To update the password use the 4 commands in powershell below and replace the      contents of $SecureStringAsPlainText in this script at line 49 with that of $StandardString

$SecureString = Read-Host -AsSecureString  
$Key = (11,4,6,201,5,37,254,20,3,1,90,29,44,54,33,221,1,30,2,7,6,5,35,43)
$StandardString = ConvertFrom-SecureString $SecureString -Key $Key  
Write-Host($StandardString)

##################################################################################################################################>  

### Set our SolarWinds Server Hostname
$SolarWindsServer = 'YOUR.SOLARWINDS.HOSTNAME'

### Set our defined Polling Levels and values for PollingInterval and StatCollection
$pollingLookup = @{
    "Decomissioned" = [PSCustomObject]@{Name = "Decomissioned";  PollingInterval = 600; StatCollection = 60}    "Training" = [PSCustomObject]@{Name = "Training";  PollingInterval = 300; StatCollection = 30}    "Build" = [PSCustomObject]@{Name = "Build";  PollingInterval = 300; StatCollection = 15}    "Dev" = [PSCustomObject]@{Name = "Dev";  PollingInterval = 300; StatCollection = 15}    "Prod-Sev-5" = [PSCustomObject]@{Name = "Prod-Sev-5";  PollingInterval = 300; StatCollection = 10}    "Prod-Sev-4" = [PSCustomObject]@{Name = "Prod-Sev-4";  PollingInterval = 240; StatCollection = 5}    "Prod-Sev-3" = [PSCustomObject]@{Name = "Prod-Sev-3";  PollingInterval = 120; StatCollection = 5}    "Prod-Sev-2" = [PSCustomObject]@{Name = "Prod-Sev-2";  PollingInterval = 60; StatCollection = 2}    "Prod-Sev-1" = [PSCustomObject]@{Name = "Prod-Sev-1";  PollingInterval = 30; StatCollection = 2}    "Scrutiny" = [PSCustomObject]@{Name = "Scrutiny";  PollingInterval = 10; StatCollection = 1}
}

### Import the SolarWinds PowerShell Module  
Import-Module SwisPowerShell   

### Setup our username and password to login to the SolarWinds Information Service (SWIS)  
$key = (11,4,6,201,5,37,254,20,3,1,90,29,44,54,33,221,1,30,2,7,6,5,35,43)
$SecureStringAsPlainText = 'SECURE_KEY_PLAIN_TEXT_HERE'
$password = ConvertTo-SecureString $SecureStringAsPlainText -key $key
$username = 'YOUR_SOLARWINDS_USER'
$creds = New-Object System.Management.Automation.PSCredential ($username, $password)     
### Connect to SWIS
$swis = Connect-Swis -Credential $creds -Hostname $SolarWindsServer  

### Query SWIS for every nodes current Polling Levels and values
$nodeData = Get-SwisData $swis 'SELECT n1.NodeID, n1.Caption, n1.PollInterval, n1.StatCollection, n1.URI, nc1.Polling_Level FROM Orion.Nodes n1 JOIN Orion.NodesCustomProperties nc1 on n1.NodeID = nc1.NodeID WHERE nc1.Polling_Level IS NOT NULL'

### Add a property to determine if an update is necessary for nodes
$nodeData | Add-Member -MemberType NoteProperty "Update_Polling_Level" -Value "No"

### Iterate through all the nodes queried above, and determine if any need updates
foreach($node in $nodeData)
    {    ### If either the nodes PollInterval or StatCollection do not match the defined Polling Levels values, mark for update    if (-Not (($node.PollInterval -eq $pollingLookup[$node.Polling_Level].PollingInterval) -or ($node.StatCollection -eq $pollingLookup[$node.Polling_Level].StatCollection)))    {        $node.Update_Polling_Level = "Yes"    }
}

### Get list of nodes requiring updates
$nodesToUpdate = $nodeData | Where-Object Update_Polling_Level -eq "Yes"

### If any nodes need updating, proceed to update
if (($nodesToUpdate | Measure-Object).Count -ge 1)
{
    ### Iterate through all nodes requiring updates and update SolarWinds    foreach($node in $nodesToUpdate)    {        ### Craft the Uri for each node        $uri = 'swis://' + $SolarWindsServer + '/Orion/Orion.Nodes/NodeID=' + $node.NodeID        Set-SwisObject $swis -Uri $uri -Properties @{ PollInterval = $pollingLookup[$node.Polling_Level].PollingInterval; StatCollection = $pollingLookup[$node.Polling_Level].StatCollection }                ### Print that updates were done        Write-Host($node.Caption + " updated to " + $node.Polling_Level)    }
} else {    ### Ok -- so no updates    Write-Host("There were no updates necessary. Exiting")
}

The custom SQL alert:

1. Evaluation Frequency of Alert is set to 1 hour (works for us), is Informational and resets after 15 minutes
2. Enable complex conditions and set it to trigger if more or equal to 1 objects
   
3. Grab the PowerShell command mentioned in the script, probably a good idea to change the location of the script etc.
4. Add a trigger action to Run a Command which executes the PowerShell script (an example of this is in the script)
5. The SQL condition:

WHERE
(AuditingEvents.AuditEventMessage LIKE '%changed custom property ''Polling_Level''%node%') AND
(DATEDIFF(minute, AuditingEvents.TimeLoggedUtc, GETUTCDATE()) <= 60)

That's it! Cheers and have a great day!!

Thank you to all the folks who helped inspire this / did most of the work. adatole, KMSigma, alexslv