Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Issue with using wildcards in alert suppression

Here is a brief overview of what I am trying to accomplish:

My company has ~200 remote sites spread out over the states. each site has its own unique subnet. All of the primary routers at these sites either end with a .1, .251, or .252 for their IP address. We have various alerts setup for the servers, switches, etc at each site.

I am trying to get alert suppression to suppress the site's alerts if their primary router is down and I have a separate alert that looks only at primary routers that sends out a separate alert. The problem i'm having is with using wildcards to look for any IP that ends in .1, .251, or .252 to suppress the alerts. I've tried simple conditions where the IP contains *.*.*.1 and where the IP equals *.*.*.1 and a few others without success, from what i can tell trying to use the wildcards breaks the alert completely.

I have a strong feeling the problem is related to how SolarWinds handles wildcard searches in general. I've noticed that doing a IP search of *.*.*.1 in NPM comes back with erroneous results as well.

Anyone have any ideas/suggestions on this?

Thanks, Joe

Find more posts tagged with

Accepted answers

All comments

Sohail.Bhamani

What you are creating is a SQL query. Thats all that the alert manager does is to provide a graphical frotn end for creating a sql statement used in alerting. So, have you tried using the SQL wildcard string of % instead of the *? This may work.

Also, if your goal is to supress child alerts when the upstream neighbor parent is down, you may find using dependancies with groups to accomplish this much easier. You create a parent child relationship between one or more devices to one or more devices. This allows for more granular control as well. When a parent goes down, the children get marked as unreachable. This is what I use with all my clients and then opt to use a more simple alerting structure since the complex alerts will not be needed.

Sohail Bhamani

Loop1 Systems

http://www.loop1systems.com

rjnicholson

To add to what Sohail is stating. Using Group and Dependancies will be much more managable to future Admins that work on SolarWinds with you. If you work all of this trhough your alerts you will cause newer Admins a slow-down in support when trying to find what alert and what trigger is causing your issue.

Using Groups with Dynamic queries and the Dependancies built on top of these you can have a more Global alert and not have to worry about tailoring your alerts when nodes change. The dynamic queries for the Groups will add and delete these nodes on the backend once you have added/deleted the nodes and assigned the Properties you are using for the Dynamic Queries.

joe55

Thank you both for your responses. I'm going to test the %'s as wildcards and see how that goes.

I found the following white paper that explains how groups work, would you say this is the best example available right now?

http://www.solarwinds.com/documentation/Orion/docs/Groupsanddependencies.pdf

Sohail.Bhamani

Yes indeed. That is a great doc. I share it often with my customers. There are also a number of good threads here on thwack but that document will definitely get you going in the right direction.

Sohail Bhamani

Loop1 Systems

http://www.loop1systems.com

zanderson92

Did you test the wildcard option out and did it work? I have the same question. I have a ton of servers around various locations worldwide that all have the same last two octets of x.x.233.218. I'm trying to get the system to alert me when any of the volumes on these Win servers is less than 5%. I wanted to do it on all the servers in one Node_Function but you can't mix property types in an alert so I went with a contains IP search. See screenshot.

6-6-2014 10-13-09 AM.jpg

Regards,

-Zac A.

mcbridea

My advice is to never use the suppression tab. The suppression and trigger logic are evaluated as two completely seperate queries. That means if you have a true condition in the suppression it makes no difference what is in the trigger because the true suppression always suppress the trigger.