Here are some SQL queries as doing weekly Solarwinds Maintenance and creating custom alerts that we as an MSP can't live without. I will most likely update this often but here are some I store in my evernote for now but I will update this frequently when i start looking through everything I use.
This first one isn't a SQL query but good for everyone use FoE to know:
cd C:\Program Files\SolarWinds\FoE\r2\bin\
nfpktfltr getstate
The failover should be set to Filter and the active should be PassThru
The nfpktfltr has a lot of good options to play with including forcing a set for filter or passthru in emergencies
Checking Ghost or Unknown Interfaces
selectInterfaceName,Nodes.CaptionfromInterfaces
innerjoinNodesonNodes.NodeID=Interfaces.NodeID
whereInterfaces.Status=0
Checking Nodes Not in Groups
where
not Caption in(
SELECTdistinctFullName
FROM ContainerMemberSnapshots
where EntityDisplayName ='Node'
)
Checking Total Number of Elements for Custom Value
LEFTjoinVolumesonVolumes.NodeID=Nodes.NodeID
LEFTjoinInterfacesonInterfaces.NodeID=Nodes.NodeID
LEFTJOINAPM_ApplicationonAPM_Application.NodeID=Nodes.NodeID
whereCustom= 'somethinghere'
Getting IP list for Weekly Sonar Discovery by polling engine
where
ObjectSubType ='SNMP'
andEngineID =_Engine ID Here_
andStatus<>'9
To get a list of your current engines with their ID number just simply run
selectEngineID,ServerName,IP fromEngines
Cleaning up bad hardware alerts manually
SET@NodeID =_NODE ID HERE_
DELETEFROMAPM_HardwareInfo WHERE NodeID =@NodeID
DELETEFROMAPM_HardwareCategoryStatus WHERE NodeID =@NodeID
DELETEFROMAPM_HardwareItem WHERE NodeID =@NodeID
Alerting Variables for Statistical Data
innerjoinAPM_DynamicEvidence_DetailData d on c.ID =d.ColumnSchemaID andc.ComponentID = ${ComponentID}
wherec.ThresholdWarning < d.NumericData groupby c.ID,c.Name} isinWARNING at
${SQL:selectMAX(d.NumericData)from APM_DynamicEvidenceColumnSchema c
innerjoinAPM_DynamicEvidence_DetailData d onc.ID =d.ColumnSchemaID andc.ComponentID = ${ComponentID}
where c.ThresholdWarning <d.NumericData groupbyc.ID,c.Name }
Alerting URL on HTTP Components that is being pulled
This can be used to get any of the values simply changing the [Key] condition to whatever your looking for. Also make sure you set your component type in your trigger condition to 6 to avoid non-http applications sending this alert off.
${SQL:selectValue fromAPM_ComponentSetting
where [Key] ='Url'and ComponentID ='${ComponentID}'}
That's all I can muster at the moment while trying to get some work done but I will try to update this as often as possible.
Nice Heads up Display Board
I've created 2 reports for this, Critical Items and Action Items.
This is the script for Critical Items (This also gives a status of how long its been critical)
convert(varchar(10),(DATEDIFF(d,0,GETDATE()-MAX(Events.EventTime))))+' Days '+
convert(varchar(10),(DATEDIFF(HH,0,GETDATE()-MAX(Events.EventTime))%24 ))+' Hours '+
convert(varchar(10),(DATEDIFF(mi,0,GETDATE()-MAX(Events.EventTime))%60))+' Mins 'as'DD:HH:MM:SS',
MAX(Nodes.CRM_Case)
from AlertStatus WITH (NOLOCK)
innerjoinEventsWITH (NOLOCK)onSUBSTRING(CONVERT(VARCHAR,AlertStatus.TriggerTimeStamp),0,19)=SUBSTRING(CONVERT(VARCHAR,Events.EventTime),0,19)
ANDAlertStatus.ActiveObject =Events.NetObjectID
INNERJOINNodes WITH (NOLOCK)onNodes.NodeID =Events.NetworkNode
WHERE (ObjectType <>'Custom Node Poller'AND ObjectType <>'Custom Node Table Poller')
AND(
(Events.MessageLIKE'%NO SNMP%')
OR(Nodes.Status=2 AND(Events.EventType = 1 OREvents.MessageLIKE'%down%'))
)
groupbyNodeID,IP_Address,Caption
OrderbyMAX(Events.EventTime)DESC
This is the script for Action Items
Select
Nodes.NodeID,Nodes.GroupStatus ,Nodes.VendorIcon,Nodes.Caption,TriggerTimeStamp,Message,EventTime,Nodes.IP_Address,Nodes.CRM_Account
from AlertStatus WITH(NOLOCK)
innerjoinEventsWITH(NOLOCK)ONDATEADD(MINUTE,DATEDIFF(MINUTE,0,AlertStatus.TriggerTimeStamp),0)=DATEADD(MINUTE,DATEDIFF(MINUTE,0,Events.EventTime),0)
ANDCONVERT(varchar(255), AlertStatus.ActiveObject)=convert(varchar(255),Events.NetObjectID)
INNERJOIN Nodes WITH(NOLOCK)on Nodes.NodeID =Events.NetworkNode
UNION
Select
Nodes.NodeID,Nodes.GroupStatus ,Nodes.VendorIcon,Nodes.Caption,TriggerTimeStamp,Message,EventTime,Nodes.IP_Address,Nodes.CRM_Account
from AlertStatus WITH(NOLOCK)
leftouterjoin CustomPollerStatusTable as cps WITH(NOLOCK)on cps.UniqueID = AlertStatus.ActiveObject
Leftouterjoin CustomPollerAssignmentView as cpa WITH(NOLOCK)onconvert(varchar(255),cpa.CustomPollerAssignmentID)= AlertStatus.ActiveObject
innerjoinEventsWITH(NOLOCK)ONDATEADD(MINUTE,DATEDIFF(MINUTE,0,AlertStatus.TriggerTimeStamp),0)=DATEADD(MINUTE,DATEDIFF(MINUTE,0,Events.EventTime),0)
AND( cps.NodeID =Events.NetworkNode
OR
cpa.NodeID =Events.NetworkNode
)
INNERJOIN Nodes WITH(NOLOCK)on Nodes.NodeID =Events.NetworkNode
WHERE Nodes.Status<> 9
AND AlertStatus.Acknowledged <> 1