Solarwinds Custom Alert

akhilraj891

I am new to Solarwinds HCO , I am trying to setup couple of custom alerts 

1.  Interface flap > 5 times in 5 min trigger alert  for Critical Group
2.  Interface Error counter changed from last poll trigger critical alert 
3.  Device temp >80 trigger alert
4. . fan failure /Power Supply failures 

 Can you please help us to configure these alerts in Solarwinds>

ronan.tonilon

Disclaimer:
The content posted herein are provided as a suggestion or recommendation to you for your internal use. The information set forth herein may come from third party website or customers. SolarWinds is not liable for any downtime or any issue that may occur if you perform the following suggestions on the link provided. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.

You can open a support ticket to get insights, but please take note of our Working with Support Policy, customizations are not supported especially if this would involved custom scripts or queries, support can assist in a best effort practice since our support team is intended as a break fix support.

 1. Interface Flap > 5 Times in 5 Minutes

Objective: Trigger a critical alert if an interface goes up/down more than 5 times in 5 minutes.

Steps:

• Trigger Condition (Custom SQL/Condition):

  • Use a custom SWQL query via a Custom Table or alert variable, or create a custom poller if needed.

  • Or, create a custom property FlapCount updated by a scheduled script or UnDP.

• Simplified workaround (approximate method):

  1. Use the Interface Availability metric.

  2. Set alert Trigger Condition:

     vbnet

     CopyEdit

     <span>Trigger Alert <span class="hljs-keyword">when</span>:- <span class="hljs-keyword">Interface</span> <span class="hljs-built_in">is</span> Up- <span class="hljs-built_in">AND</span> Flapping Count (<span class="hljs-keyword">custom</span> <span class="hljs-keyword">property</span> <span class="hljs-built_in">or</span> UnDP) > <span class="hljs-number">5</span>- <span class="hljs-built_in">AND</span> Flapping Duration < <span class="hljs-number">5</span> minutes</span>

  3. OR script a log analysis on Event Type 11002/11003 ("Interface went down/up") using SWQL.

️ More accurate solutions require database queries or external log parsing to count flap events in time windows.

---

 2. Interface Error Counter Changed from Last Poll

Objective: Detect if the IfInErrors or IfOutErrors values change between polls.

Steps:

1. Create a new alert on Interface objects.

2. Trigger Condition:

   mathematica

   CopyEdit

   <span><span class="hljs-built_in">Trigger</span> <span class="hljs-variable">Alert</span> <span class="hljs-variable">when</span><span class="hljs-operator">:</span><span class="hljs-operator">-</span> <span class="hljs-punctuation">(</span><span class="hljs-variable">Current</span> <span class="hljs-variable">Value</span><span class="hljs-punctuation">)</span> <span class="hljs-built_in">In</span> <span class="hljs-variable">Errors</span> &ne; <span class="hljs-punctuation">(</span><span class="hljs-built_in">Previous</span> <span class="hljs-variable">Value</span><span class="hljs-punctuation">)</span> <span class="hljs-built_in">In</span> <span class="hljs-variable">Errors</span><span class="hljs-variable">OR</span><span class="hljs-operator">-</span> <span class="hljs-punctuation">(</span><span class="hljs-variable">Current</span> <span class="hljs-variable">Value</span><span class="hljs-punctuation">)</span> <span class="hljs-built_in">Out</span> <span class="hljs-variable">Errors</span> &ne; <span class="hljs-punctuation">(</span><span class="hljs-built_in">Previous</span> <span class="hljs-variable">Value</span><span class="hljs-punctuation">)</span> <span class="hljs-built_in">Out</span> <span class="hljs-variable">Errors</span></span>

3. Use Reset Condition:

   sql

   CopyEdit

   <span>Reset Alert <span class="hljs-keyword">when</span>:<span class="hljs-operator">-</span> <span class="hljs-keyword">In</span> Errors <span class="hljs-keyword">and</span> <span class="hljs-keyword">Out</span> Errors have <span class="hljs-keyword">not</span> changed <span class="hljs-keyword">for</span> X minutes</span>

4. Add logic to only trigger on specific interfaces or nodes (e.g., critical group).

---

️ 3. Device Temperature > 80°C

Objective: Alert if device temperature crosses 80°C.

Steps:

1. Alert on Hardware Sensor objects.

2. Trigger Condition:

   csharp

   CopyEdit

   <span>Trigger Alert <span class="hljs-keyword">when</span>:- Sensor Type <span class="hljs-keyword">is</span> Temperature- AND Sensor Status <span class="hljs-keyword">is</span> Up- AND Current Value > <span class="hljs-number">80</span></span>

3. Optionally, filter by node type, group, or device vendor (e.g., Cisco, Juniper).

---

️ 4. Fan or Power Supply Failure

Objective: Trigger critical alert on fan or power supply failure.

Steps:

1. Alert on Hardware Sensor objects.

2. Trigger Condition:

   csharp

   CopyEdit

   <span>Trigger Alert <span class="hljs-keyword">when</span>:- Sensor Type <span class="hljs-keyword">is</span> Fan OR Power Supply- <span class="hljs-function">AND Status <span class="hljs-keyword">is</span></span> <span class="hljs-keyword">not</span> <span class="hljs-title">Up</span> (<span class="hljs-params"><span class="hljs-keyword">or</span></span> Status <span class="hljs-keyword">is</span> Critical/Shutdown/Failed)</span>

3. You can also use Hardware Health summary on nodes:

   • Look for Fan Status or Power Supply Status ≠ Normal.

---

 Final Setup Tips

• Set alert severity = Critical in the Alert Properties step.

• Limit alert scope using:

  • Node custom property (e.g., "AlertGroup = Critical")

  • Interface custom property (e.g., "Monitored = Yes")

• Use Orion Groups for dynamic grouping if devices are tagged by region, function, or team.

• Add notifications: email, webhook to ITSM (e.g., ServiceNow), or run scripts.

Hope this helps.