Suppress Node Alerts During APE Outages

Adelazz

Hello,

We are receiving "Node is down" and "Node rebooted" alerts for all nodes managed by a specific Additional Polling Engine (APE), triggered whenever that APE itself goes down.

Is there a way to suppress these node-level alerts when the root cause is an APE outage? This is generating excessive tickets in our ServiceNow instance, and we'd like to fine-tune the alerting logic accordingly.

Thanks in advance

jeremymayfield

Yes — this is a common design issue in distributed polling architectures within the SolarWinds Orion Platform. When an Additional Polling Engine (APE) goes offline:

• All nodes assigned to that engine stop responding
• “Node Down” and “Node Rebooted” alerts trigger
• Downstream systems (e.g., ServiceNow) receive a flood of false positives

The correct solution is alert dependency logic, not suppression at the ticketing layer.

(Best Practice)

Create an “APE Down” Alert (Infrastructure-Level)

Create a dedicated alert:

Trigger condition:

Node Caption contains <APE server name>ANDStatus = Down

Or better:

Node.EngineID = <APE EngineID>ANDNodes.Caption = <APE server name>

This becomes your root cause alert.

Modify Node Down Alert to Exclude APE Outage Condition

Edit your existing Node Down alert and add this suppression logic:

Add a Suppression Condition:

NOT EXISTS (  SELECT 1  FROM Orion.Nodes ape  WHERE ape.Caption = 'APE-SERVER-NAME'  AND ape.Status = 2)

Status 2 = Down

Simpler Version (Recommended)

Add condition:

ANDNode.PollingEngine.ServerName != 'APE-SERVER-NAME'

OR

ANDNode.PollingEngine.Status != 2

This ensures:

• If the polling engine is down,
• Node alerts do not trigger.

Cleaner Enterprise Approach (Preferred)

Instead of referencing a specific APE:

Modify Node Down alert condition to include:

ANDNode.PollingEngine.Status = 1

Where:

• 1 = Up
• 2 = Down

This scales automatically across multiple APEs.

Even Better: Use Alert Dependencies

If you are on a modern Orion build:

1. RootDependency = APE
2. Use:

Alert Suppression → Suppress this alert when:Polling Engine Node is Down

This creates true dependency suppression instead of filtering logic.

ServiceNow Consideration

If you are integrating with ServiceNow:

• Ensure the APE Down alert is set to “High Priority”
• Ensure node alerts are suppressed at source
• Avoid filtering in ServiceNow (not ideal)

Fixing this in Orion ensures:

• Cleaner event flow
• Lower API load
• Proper RCA mapping

(Not Recommended)

• Use alert delay (e.g., trigger after 10 minutes)
• Suppress during maintenance window

These do not address root cause properly.

Strategic Recommendation

For distributed polling environments:

Add infrastructure-level alerting (APE health)
Add polling-engine-status condition to Node Down alert
Standardize alert dependency logic
Validate in test by stopping APE service

Summary of What to Change

Modify your Node Down alert:

Add:

AND Node.PollingEngine.Status = 1

That is typically sufficient.