So upon returning from my vacation, I noticed after I got back that certain things happened that were missing. I had SOI running for 11 days and didnt' have any issues so the connectors were up and running the entire time
But I noticed that w/in one of our Domain Manger a site was down and I needed to dig into SOI to figure out when the alert happened, when it hit the console and then who closed it? This is not modeled within a service so i am completely relying on the Alert Queues that I have setup which categorizes everything.
I can find this info in the Domain Manager easily but I must know if SOI can provide this information as is?
I tried the following, selected the Alert Queue that the alert would reside in, Looked in the Information Tab and looked in the Cleared Alert History section. The initial 24 result was maxed out at 5000 already so 1st question is how do I increase the # of alerts returned from this query? I looked in View Preferences but the section for Cleared Alerts does not have this listed at something I can modify.
I was able to find the alert via using the time frame from which I occurred w/in the Domain Manager but there was no information as to who cleared it. There is no r-click ability to examine this alert further. All available columns are displayed yet it's still missing the information I need.
Even if I find the alert in the cleared Alert section, I then tried opening the "Auditor" tool, searched the Action Type of "CLEARED" and there is 0 cross reference between the Alert Queue | Information Tab: Closed Alerts section and the result from the Auditor tool to tell me the information I need.
This looks like a serious feature flaw. Unless I'm missing something can someone shed light on this simple query that an MSP would use on a daily basis to determine the life cycle of an alert?
Thank you, Dan