Explain Advanced Alert Trigger Condition tab & Alert State values - 'Do not trigger until this condition exists for more than'

_Can someone please explain this in more detail as it relates to the 'Alert Manager - Active Alerts' window and the triggered time? This article is a good start, http://thwack.solarwinds.com/thread/49441 but I need more. I have the 'do not trigger...' set to 1 hour once the CPU reaches 95%. I am seeing entries in the alert window, but I'm not getting the email. I've been playing around with it, and I'm starting to think it shows in the window before the 1 hour has been reached. Also, is the triggered time the time the condition first exists (not including the 'do not trigger' time) or would it wait the hour and use that as the triggered time.

p.s. I hope the webpage saves this entry this time. This is my 3rd attempt. I tried to copy in text from another article & lost everything. The other time I saved it, but never could find it the article, even after searching on my name.

Find more posts tagged with

advanced_alert

Alert

do_not_trigger

triggered_time

state

alert_state

active_alerts

Accepted answers

clubjuggle

Gotcha. I wasn't clear that you were using the Advanced Alert Manager to monitor your alerts; since we do that from the web console I did not think of that.

I was able to find the answer you were looking for in another thread:

1 - trigger condition met but not for configured period of time

2 - trigger condition met (if there was a time condition this was met too)

3 - reset condition met but not for configured period of time

4 - reset condition met (if there was a time condition this was met too)

Since only alerts in condition 2 or 3 seem to appear in the web console alerts screen, I was not clear on what you were referring to before. Hope this helps.

~Terry

All comments

marunderwood

Why can't I find this conversation? The only way I can find it is because I tagged it. I added it while in the alert lab. Do I need to move it?

clubjuggle

There are two different places to delay execution of an action. The first, on the Trigger Condition page, is labeled "Do not trigger this action until condition exists for more than," and will delay the alert being triggered. The alert will not show up until the amount of time listed has elapsed.

The second is available on the when editing a particular action from the Trigger Actions tab. This allows delay of a particular action for a set amount of time, and is useful for escalations; for example, you can alert management or additional technicians if an alert is not resolved within a certain amount of time. To access this feature, select a Trigger Action, click "Edit Selected Action", and then navigate to the Alert Escalation tab. Check the box labeled "Delay the execution of this action" and enter the desired time. When this is done, the alert will trigger as soon as the Trigger Condition is met (including any delays listed on the "do not trigger" there, but the specific action will be delayed as defines on the trigger action.

In the example screenshots above, an alert configured as in the first screenshot would show up in the web console when the drive was at least 90% full AND stayed that way for at least 1 hour. The action in the second screenshot means that one hour after that (in other words, 2 hours after the drive became at least 90% full), an email would be sent if the condition still existed.

I hope this is helpful.

~Terry

marunderwood

Thanks for these explanations, although I already understood. What I'm trying to understand is how these relate to the active alert window in the Alert Manager. More specifically, why am I seeing an entry in the Alert Manager - Active Alerts window (on the SolarWinds server in the Advanced Alert Manager), but never getting an email? The entry is in an alert state = 1. (In the screen shot below, 1 is the alert state, I blanked out the object name, and the date/time is the triggered time.)

alert window.bmp

In my alert, the 'Do not trigger this action ...' is set to 1 hour.

Right now, I have 4 trigger actions. Two had no delay, which I am assuming I was getting after the entry (in state = 1) was an hour old. The alert state then changes to = 2. (One executes the RealTimeProcessPoller & the other sent a message with no delay.) And, the others are delayed 10 minutes until the RealTimeProcess Poller has time to gather the top 10 processes.

I think the key is to understand the 'alert state' column represents, but I haven't found anything.

clubjuggle

Gotcha. I wasn't clear that you were using the Advanced Alert Manager to monitor your alerts; since we do that from the web console I did not think of that.

I was able to find the answer you were looking for in another thread:

1 - trigger condition met but not for configured period of time

2 - trigger condition met (if there was a time condition this was met too)

3 - reset condition met but not for configured period of time

4 - reset condition met (if there was a time condition this was met too)

Since only alerts in condition 2 or 3 seem to appear in the web console alerts screen, I was not clear on what you were referring to before. Hope this helps.

~Terry

marunderwood

Thank you!! When I try to find the article you referred to using 'alert state' as search criteria, I scrolled thru 9 pages (sorted by latest activity) and still didn't find it. Is the search engine limited to 9 pages? I would have thought since this key information is missing from the manuals and was pointed out in 2009, that 4 years later it would have made it into the documentation. I guess I'll need to be more creative when searching. Thanks again!!