Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Alert query _flooded with alerts

I created an advanced alert , when executed, I am flooded with "false" alerts. It seemed simple enough. The logic was any node with a status of down. Except for a number of specific nodes. Attached is the export file of the query. I am a newbie so go easy on me. I may need some direction on how to present my problem as well as help with my query.

See also screen shot of trigger condition.

William Hall

><((('>

Message was edited by: Bill Hall added screen shot of trigger conditions.

attachments.zip

Find more posts tagged with

advanced_alerts

Accepted answers

All comments

zackm

could you perhaps post a screenshot of your alert conditions? that file is a beast to read!

-ZackM

Loop1 Systems: SolarWinds Training and Professional Services

LinkedIN: Loop1 Systems
Facebook: Loop1 Systems
Twitter: @Loop1Systems

mharvey

The reason is because your Node Down statement is under an any clause as are all the node names. This will cause it to trigger if anything in that alert is true. Change the ANY above Node Status is equal to down into ALL and leave the Any in the group with the node names and that will resolve the flood of alerts you are getting.

william.hall

There are a lot less alerts with the 1st trigger set to all. I still didn't get what I expected. I thought I would see an alert for a node that went from up to a down status. I received about 50 alerts soon as I turned it on because it put an alert out for each node that was in a down status. I also received alerts on the nodes that I tried to exclude. Ideas?

mharvey

The problem with your exclusion is going to be that any 1 device could match not being a device in that list, including a device in that list. If you are going to go with negative conditions, such as node name is not equal, then you need an AND condition as well. My apologies for not saying something more about that in my first reply. While you will get an alert for every node that is down, not one alert that lists all down nodes, you'll want to change the second any condition to an and to allow the alert to say, node is down and it isn't any of the following devices. Right now, the logic is saying well it may be node b which is in the list, but it's not node A and as such it will trigger. Change the other condition to and.

The way the Advanced Alerts are going to work is to scan the database looking for anything that meets the criteria. If there are already devices in the database that are going to meet the criteria you specify, the alert is going to fire for each device/element that meets the criteria.

william.hall

I work part time but finally got back to my problem with alerts. I now understand how I went wrong after reading your reply's. The negative logic (not equal to) didn't help. I decided to try to make my query simple as I could. I entered comments in custom properties for all the PC's and laptops. Then logically and-ed node status equals down and field comments is empty. All the other nodes have no comments. I would think there are better ways but this works well and I can use this same logic on some other queries too. I wish there were many example queries out there that I could adopt and adapt to my needs. For me sometimes an example is worth a thousand words. Thanks for the assist.