Alert Where Names Does Not Start With

I've been trying to exclude a number of servers from a CPU alert I have based on the node name.

I have a number of servers which I know will have high CPU usage, they're all named the same (for example WIN-APP1, 2 3 etc). I use 1 alert to send emails to the relevant team when CPU usage has been higher than 80% for 10 minutes, the alert is based on vendor, so the logic of the alert trigger condition goes ....

Tigger when all

- Trigger when any

- vendor is net-snmp

- vendor is Windows

- CPU > 80

Also the "Do not trigger this action until condition exists for more than" is set to 10 minutes.

This works perfectly for most of our servers, however I'd like to add a condition along the lines of "where node name does not start with 'WIN-APP'".

Anyone got any ideas ?

Find more posts tagged with

alerts_advanced_condition

Accepted answers

qle

I believe your problem is with the following condition:

- field Node Name starts with WIN-APP*

Try removing the asterisk and see if it works. I created a test alert which worked without the asterisk and failed with the asterisk.

All comments

lchance

Unless your number of nodes are many, I'd recommend using the NODEID number in this case. The uniqueness of the Node ID # would be nice for this scenario, I think...

NOT ALL

NODEID = 1756

NODEID = 956

.etc

mezdem

In the trigger condition tab for the alert, add a new conditional group.

In the condition group, select 'None' of the following apply.

Then after add your complex condition under this group, with a 'starts with' clause etc..

Should work as I have something very similar working fine

DeanBennett

This didn't work unfortunately, I thought it had, but not, I may be misunderstanding something.

mezdem

excellent )

DeanBennett

Seems I was mistaken, what I've put in place does not have the desired affect, of course it could be what I've done or NPM misbehaving.

What I've got is an alert which has the following trigger condition :

- Tigger Alert when all of the following apply

- Trigger Alert when none of the following apply

- field Node Name starts with WIN-APP*

- Trigger Alert when any of the following apply

- Vendor is equal to net-snmp

- Vendor is equal to Windows

- Vendor is equal to VMware Inc

- CPU Load is greater than 80

The "Do not trigger this action until condition exists for more than" is set to 10 Minutes. It works in the sense that I get informed by means of the trigger action (email in this case) when CPU usage > 80% for > 10 minutes for the nodes with the desired vendors, however I'm still getting spammed by messages about CPU usage on the WIN-APP* servers (of which there are 10+, so I'm getting serious amounts of alerts).

I'd appreciate any assistance with what I may have done wrong in the above or how I can exclude nodes by name.