Alert Trigger Condition Question

I need to have an application fire out an alert if it is down or unknown. I think what I have will work but just need someone else to validate that this will work.

In the past I have had scope of the alert as one part and the trigger condition as another.

This looks like it should work but would like if someone could validate it. Thanks!!

Find more posts tagged with

trigger

Accepted answers

All comments

weston.hood

That should fire off, I too put the entire alert body in the below field. It works just fine. One thing is the bottom most OR block is redundant. You should be able to move the last condition up to the previous OR block and it would still work as intended.

And if you ever want to test, besides using the summary tab which will show triggering objects, you can test by setting instead of down/unknown set it to Up (temporarily). To see if your application gets listed. Another way is you can click the carrot on the far right of the yellow bar to "show SWQL" and copy the swql and paste it on the web console swql page:
https://YourHost /orion/admin/swis.aspx

and again modify unknown/down to Up status to see if it lists your application. It should.

martian_monster

I looked at the show SWQL and never thought about testing it that way. Thank you!!!

adam.beedell

Couple things i'd recommend changing here

Use the scope section to define your application name, not the trigger, it'll mess up stuff like the "all alerts this could trigger" widgets later down the line

The two application statuses can be in the single OR block, no need for two

(bonus one - Usually Unknown and Down end up in needing slightly different behaviour, down -> application owner, unknown -> monitoring guy)

martian_monster

The bonus is what stung us - the node was up but the apps were showing unknown not down.

adam.beedell

You want to have an eye like this for the equivalent on all the other layers that are important to you