Here are some SQL queries as doing weekly Solarwinds Maintenance and creating custom alerts that we as an MSP can't live without. I will most likely update this often but here are some I store in my evernote for now but I will update this frequently when i start looking through everything I use.
This first one isn't a SQL query but good for everyone use FoE to know:
cd C:\Program Files\SolarWinds\FoE\r2\bin\
nfpktfltr getstate
The failover should be set to Filter and the active should be PassThru
The nfpktfltr has a lot of good options to play with including forcing a set for filter or passthru in emergencies
Checking Ghost or Unknown Interfaces
selectInterfaceName,Nodes.CaptionfromInterfaces
innerjoinNodesonNodes.NodeID=Interfaces.NodeID
whereInterfaces.Status=0
Checking Nodes Not in Groups
where
not Caption in(
SELECTdistinctFullName
FROM ContainerMemberSnapshots
where EntityDisplayName ='Node'
)
Checking Total Number of Elements for Custom Value
LEFTjoinVolumesonVolumes.NodeID=Nodes.NodeID
LEFTjoinInterfacesonInterfaces.NodeID=Nodes.NodeID
LEFTJOINAPM_ApplicationonAPM_Application.NodeID=Nodes.NodeID
whereCustom= 'somethinghere'
Getting IP list for Weekly Sonar Discovery by polling engine
where
ObjectSubType ='SNMP'
andEngineID =_Engine ID Here_
andStatus<>'9
To get a list of your current engines with their ID number just simply run
selectEngineID,ServerName,IP fromEngines
Cleaning up bad hardware alerts manually
SET@NodeID =_NODE ID HERE_
DELETEFROMAPM_HardwareInfo WHERE NodeID =@NodeID
DELETEFROMAPM_HardwareCategoryStatus WHERE NodeID =@NodeID
DELETEFROMAPM_HardwareItem WHERE NodeID =@NodeID
Alerting Variables for Statistical Data
innerjoinAPM_DynamicEvidence_DetailData d on c.ID =d.ColumnSchemaID andc.ComponentID = ${ComponentID}
wherec.ThresholdWarning < d.NumericData groupby c.ID,c.Name} isinWARNING at
${SQL:selectMAX(d.NumericData)from APM_DynamicEvidenceColumnSchema c
innerjoinAPM_DynamicEvidence_DetailData d onc.ID =d.ColumnSchemaID andc.ComponentID = ${ComponentID}
where c.ThresholdWarning <d.NumericData groupbyc.ID,c.Name }
Alerting URL on HTTP Components that is being pulled
This can be used to get any of the values simply changing the [Key] condition to whatever your looking for. Also make sure you set your component type in your trigger condition to 6 to avoid non-http applications sending this alert off.
${SQL:selectValue fromAPM_ComponentSetting
where [Key] ='Url'and ComponentID ='${ComponentID}'}
Nice Heads up Display Board
I've created 2 reports for this, Critical Items and Action Items.
This is the script for Critical Items (This also gives a status of how long its been critical)
convert(varchar(10),(DATEDIFF(d,0,GETDATE()-MAX(Events.EventTime))))+' Days '+
convert(varchar(10),(DATEDIFF(HH,0,GETDATE()-MAX(Events.EventTime))%24 ))+' Hours '+
convert(varchar(10),(DATEDIFF(mi,0,GETDATE()-MAX(Events.EventTime))%60))+' Mins 'as'DD:HH:MM:SS'
from AlertStatus WITH (NOLOCK)
innerjoinEventsWITH (NOLOCK)onSUBSTRING(CONVERT(VARCHAR,AlertStatus.TriggerTimeStamp),0,19)=SUBSTRING(CONVERT(VARCHAR,Events.EventTime),0,19)
ANDAlertStatus.ActiveObject =Events.NetObjectID
INNERJOINNodes WITH (NOLOCK)onNodes.NodeID =Events.NetworkNode
WHERE (ObjectType <>'Custom Node Poller'AND ObjectType <>'Custom Node Table Poller')
AND(
(Events.MessageLIKE'%NO SNMP%')
OR(Nodes.Status=2 AND(Events.EventType = 1 OREvents.MessageLIKE'%down%'))
)
groupbyNodeID,IP_Address,Caption
OrderbyMAX(Events.EventTime)DESC
SWQL Version
select '<img src=/NetPerfMon/images/Vendors/' + MAX(e.Nodes.VendorIcon) + '/>' as vimg
,'<img src=/NetPerfMon/images/small-' + MAX(e.Nodes.GroupStatus) + '/>' as simg
,'<a href=/Orion/NetPerfMon/NodeDetails.aspx?NetObject=N%3a' + ToString(MAX(n.nodeid))+ '>' + n.Caption + '</a>' as Caption
,MAX(e.Message) as Issue
,n.IP_Address
,MAX(a.TriggerTimeStamp) as AlertTime
,ToString(DayDiff(0,GETUTCDATE() - MAX(EventTime))) + ' Days ' +
ToString(Ceiling((HourDiff(0, GETUTCDATE() - MAX(EventTime)) / 24.0 - Floor(HourDiff(0,GETUTCDATE() - MAX(EventTime)) / 24.0)) * 24 )) + ' Hours ' +
ToString(Ceiling((MinuteDiff(0, GETUTCDATE() - MAX(EventTime)) / 60.0 - Floor(MinuteDiff(0,GETUTCDATE() - MAX(EventTime)) / 60.0) ) * 60 )) + ' Minutes ' AS DownTime
from Orion.AlertStatus(nolock=true) as a
inner join Orion.Events(nolock=true) as e on SUBSTRING(ToString(a.TriggerTimeStamp),0,19) = SUBSTRING(ToString(e.EventTime),0,19)
inner join Orion.Nodes(nolock=true) as n on n.NodeID = e.NetworkNode
inner join Orion.NodesCustomProperties(nolock=true) as nc on nc.NodeID = n.NodeID
AND a.ActiveObject = e.NetObjectID
WHERE (a.ObjectType <> 'Custom Node Poller' AND a.ObjectType <> 'Custom Node Table Poller')
AND (n.Status = 2 AND (e.EventType = 1 OR e.Message LIKE '%down%'))
group by n.IP_Address,n.Caption
This is the script for Action Items
Select
Nodes.NodeID,Nodes.GroupStatus ,Nodes.VendorIcon,Nodes.Caption,TriggerTimeStamp,Message,EventTime,Nodes.IP_Address,Nodes.CRM_Account
from AlertStatus WITH(NOLOCK)
innerjoinEventsWITH(NOLOCK)ONDATEADD(MINUTE,DATEDIFF(MINUTE,0,AlertStatus.TriggerTimeStamp),0)=DATEADD(MINUTE,DATEDIFF(MINUTE,0,Events.EventTime),0)
ANDCONVERT(varchar(255), AlertStatus.ActiveObject)=convert(varchar(255),Events.NetObjectID)
INNERJOIN Nodes WITH(NOLOCK)on Nodes.NodeID =Events.NetworkNode
UNION
Select
Nodes.NodeID,Nodes.GroupStatus ,Nodes.VendorIcon,Nodes.Caption,TriggerTimeStamp,Message,EventTime,Nodes.IP_Address
from AlertStatus WITH(NOLOCK)
leftouterjoin CustomPollerStatusTable as cps WITH(NOLOCK)on cps.UniqueID = AlertStatus.ActiveObject
Leftouterjoin CustomPollerAssignmentView as cpa WITH(NOLOCK)onconvert(varchar(255),cpa.CustomPollerAssignmentID)= AlertStatus.ActiveObject
innerjoinEventsWITH(NOLOCK)ONDATEADD(MINUTE,DATEDIFF(MINUTE,0,AlertStatus.TriggerTimeStamp),0)=DATEADD(MINUTE,DATEDIFF(MINUTE,0,Events.EventTime),0)
AND( cps.NodeID =Events.NetworkNode
OR
cpa.NodeID =Events.NetworkNode
)
INNERJOIN Nodes WITH(NOLOCK)on Nodes.NodeID =Events.NetworkNode
WHERE Nodes.Status<> 9
AND AlertStatus.Acknowledged <> 1
SWQL Version
Select '<img src=/NetPerfMon/images/Vendors/' + ToString(n.VendorIcon) + '/>' as Vendor
,'<a href=/Orion/NetPerfMon/NodeDetails.aspx?NetObject=N%3a' + ToString(n.nodeid)+ '>' + n.Caption + '</a>' as Node_Name
,'<img src=/NetPerfMon/images/small-' + ToString(n.GroupStatus) + '/>' as Status
,e.Message
,ToLocal(e.EventTime) as EventTime
,n.IP_Address as IP_Address from Orion.AlertStatus(nolock=true) as a
inner join Orion.Events(nolock=true) as e on MINUTEDIFF(0,a.TriggerTimeStamp) = MINUTEDIFF(0,e.EventTime) AND ToString(a.ActiveObject) = ToString(e.NetObjectID)
inner join Orion.Nodes(nolock=true) as n on n.NodeID = e.NetworkNode
inner join Orion.NodesCustomProperties(nolock=true) as nc on nc.NodeID = n.NodeID
n.Status NOT IN (2,9)
AND a.Acknowledged <> 1
That's all I can muster at the moment while trying to get some work done but I will try to update this as often as possible.