Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Is Solarwinds capable of combining alerts to give out 1 alert to say a whole site is down?

I'm looking for some help - here is the senario: Basically, there is a power issue on one of our sites, however we do NOT know this to be the root cause at the minute!

Our network devices are starting to trigger alerts…. Our L1 support Team are getting in different tickets one for each device that is triggered, so a different team members are working on different tickets. No one is asking if this is a bigger issue, is there more than one device down? At the minute the L1 support team are working on their 1 device individually and are NOT connecting the dots to see if there is a bigger picture.

Can we do anything from a SW point of view - create a trigger where if there are a number of alerts coming in from the one site that we can send an alert to say that a site is down rather than having our L1 support team troubleshooting individual tickets? Is SW clever enough to do this?

Find more posts tagged with

Accepted answers

All comments

Lofstrand

Hi, sure thing
You can use "dependencies" to have less alerts, showing the root cause better. You can also have another set of alerts that trigger if a certain number of devices on the same site are down at the same time.

There are even more options like alert stack and more.

cnorborg

Yep, you can try turning on auto-dependencies to see if that works for you. If not, look into using groups. ie: assign all devices at a site into a group and set up the dependencies on that. The router can't be a member of the group if you want to use a group in a dependency. You can also use it in your alerts if you want something more custom. ie: if a node in the group is down, but the router is too, alert on the router type thing.

mato1964

Can I check @Joanne.coleman, are you referring to SolarWinds SaaS or Self Hosted as it was posted in the SaaS forum?

Joanne.coleman

I wasn't sure which forum to post it in to be honest. Our SW is Self Hosted.

vinay.by

I don't think you have direct option to achieve this in SolarWinds, I do see a few responses above which is absolutely correct, but then it also depends on your environment. Now when you say I don't want device down alerts when entire site goes down, firstly do you have a specific naming convention for your device names ?

How do you identify that this device belongs to that site ? Is it based on custom properties or name of the device itself has site in it ? like say for example a router so does your device name look something like <Site><Router><Number>? ABCROUTER01 ?

You can try manual dependencies by creating groups keep your routers in parent group and all the other devices in that site in child group (you can automate this as well through dynamic queries on the group), this will reduce majority of the alerts and nothing from child group will be fired.
If you are controlling everything on your alerting in that case - check for advanced - complex condition Build complex conditions in the SolarWinds Platform - this again needs some logic - either use custom properties or groups in your logic, this is totally dependent on how things are in your environment
Lastly, I do not know how the clear works in your case - do you have a direct integration with the Ticketing Tool where you create an incident ? If you do, in that case you can get more creative and send your clear alerts from a second alert altogether. Something like below
1. Node down alert - fires alerts on 10 devices all from same site
2. Lets say you have a group for site - If group is down in your trigger action of the group when you raise a alert or incident you can as well create another condition to send clear alerts for all nodes in that group.

Just stating. Easiest approach in your case would be manual dependencies, I wouldnt say that the correct approach but I am sure you can reduce a lot of alerts, but you will need to design your manual dependencies accurately.

Hope this helps.