nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

How to ignore VMWare in the "alert me when a MAC address moves" alert?

patriot

I am testing the default UDT alert "alert me when a MAC address moves", but most of the alerts I get a related to virtual machines. I would like to exclude those. The alert variables seem to be limited to only four, none of which is Vendor or machine type. Id this something that I will have to do using a SQL query in the trigger condition? If so, can someone please help with the structure of the query?

I very much appreciate any help. Thanks you.

Find more posts tagged with

Accepted answers

zackm

You could try changing the scope of the alert to ignore anything with the VMware OUI. (vSphere 6.0 Documentation Center)

I haven't been able to test this in production, but it looks good when compared to the DB values in the UDT_MovedMACAlert view.

-ZackM

Loop1 Systems: SolarWinds Training and Professional Services

LinkedIN: Loop1 Systems
Facebook: Loop1 Systems
Twitter: @Loop1Systems

All comments

zackm

You could try changing the scope of the alert to ignore anything with the VMware OUI. (vSphere 6.0 Documentation Center)

I haven't been able to test this in production, but it looks good when compared to the DB values in the UDT_MovedMACAlert view.

-ZackM

Loop1 Systems: SolarWinds Training and Professional Services

LinkedIN: Loop1 Systems
Facebook: Loop1 Systems
Twitter: @Loop1Systems

patriot

That did it, I think. Testing it now. One additional question if you don't mind......

How would you include the IP address and the DNS name of the endpoint in the alert notification?

zackm

I'd have to go look to be sure, but you'd probably have to throw a little SQL together. The view that the alert is pulling from only has MAC addresses.