Need second set of eyes on my alert trigger...

Question

I'm in the process of suppressing alerts.  There is one generic alert that triggers with any node named "corp%".

As I add suppression to various locations, my plan was to exclude entries to the above alert with any location I suppress.

I "think" I got this correct but there have been times when  "what I think" does not match reality.

Would appreciate if someone could look at this and respond if it looks good...

Here is my alert:

2010-04-26_135822.jpg

gbutler · Answer

I see what you mean. When I set this up I looked at the "none" and the "not-all" and was more comfortable with the "none"... I should have investigated more.

Sure enough.  The "none" has a logical OR and the "not-all" has the logical AND.

Thanks so much!

Questionario · Answer

You will need to change "none" to "not all" as the logic is vice versa (bug)

other than that you should be fine...

it would alert on any nodes that are down, the nodename starts with corp and the nodename does not start with either corpa-kun, corpr-kun or corps-kun

gbutler · Answer

Thanks.

Those "Not" conditions always make me do a double take.  Much appreciated.