Generate an alert when an interface exceeds warning/critical threshold multiples times within a specified time period?

HI all,

Looking for some guidance suggestions on if there is a way to Generate an alert when an interface exceeds warning/critical threshold multiples times within a specified time period?

My initial thoughts were
-> Generate an alert when it exceeds warning/critical threshold as normal -> Action - Write to Solarwinds Event Log

-> Generate an alert where trigger condition is checking if there are 5 events of the previous alert in the event log and all are within 24hours of the first event.

However, I quickly realized that we cannot generate an alert where the condition is the Event Log.

Another option/thought I had was to create a custom property and increment it - however bit unsure how this will track the criteria for within a specified time period ie 5 exceeds of thresholds within 24hours.

Any suggestions or options that I could try or if anyone has done something similar before - would be great.

Thanks!

Find more posts tagged with

network performance monitor

Alerts

Accepted answers

All comments

jodelgado

You can setup complex Alert trigger conditions.

https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-building-complex-conditions-sw971.htm?cshid=orioncoreag_alertsbuildingcomplexconditions

Hope that helps.

craiegg

Hi @jodelgado ,

Thank you for sending a suggestion. I did have a look at the complex conditions but it only allows me to select "If multiple conditions are fulfilled" or "AND Then After - x minutes/hours"

That won't satisfy the requirement as it needs to be counting the number of times it exceeds.

Lofstrand

The easiest way is to adjust the critical threshold on the interface itself. There you can set that the interface will be critical if the critical value has been bread x amount of times in a row OR x out of Y polls:

It can be done with a custom SWQL query alert as well but above is the easiest method.