Hi all,
There are some devices which we don't alert on. These are devices on the end of DSL services which go up and down as expected. However, what I want to do is alert us to a potential major service failure. If we see X number of nodes go down within X number of minutes of each other, there's probably a major issue going on and we should investigate.
I've written the following but I'm not sure if it'll work as I want it to within an Advanced SQL Alert? Using an INNER JOIN because the SELECT part of the statement can't be changed when using an Advanced SQL Alert. This means I can't use COUNT within the SELECT statement, so I'm using HAVING COUNT (at the end) but I'm not sure if that will do what I think it'll do, because it's going to be returning rows of data and not a count. I hope that makes sense!
Here's the SQL:
SELECT Nodes.NodeID AS NetObjectID, Nodes.Caption AS Name
FROM Nodes
INNER JOIN Events
ON Nodes.NodeID = Events.NetObjectID
WHERE
(
Events.EventType = '1' AND
(
Events.EventTime BETWEEN DATEADD(minute, -10, GETUTCDATE()) AND GETUTCDATE()
)
)
GROUP BY Nodes.NodeID, Nodes.Caption
HAVING COUNT(*) >= 10
Can anyone offer any help with this? Or is this a bit too complicated for the Alert Manager?
Thanks!