Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Alerting went BESERK!

I have recevied a number of emails and SMS from SAM and i cannot explain why this is.

The Alert in question is configured as such:

I have two trigger actions configured for this Alert, one emails the support team, the other emails our SMS provider (which in turn sends a SMS to our on call phone).

One server today rebooted and as such i had a flurry of alerts for components being down, such as windows services - this I expected. What i didn't expect were the same amount of alerts minutes later, triggered from the above alert, to tell me that each component is UP. Can anyone see where in the Alert i have asked to be notified for things that are UP?

To confirm, there is no reset action configured.

Puzzled!

** Off the back of this, i also wonder if anyone has any great method of reducing the mass of component alerts received when a server goes down (in such situations as above) - to just provide a single alert for SMS to an on call engineer? **

Find more posts tagged with

Accepted answers

All comments

silverbacksays

To reduce the email alerts for components, set up dependencies so that all the applications on the server in question depend on the server being up. With this setup correctly you should only get one email when the host server goes down, and not one for each component.

prawij

So in the Reset Condition page, which of these did you select?

reset condition.png

JaroslawLadyga

If your alert setup has so many ORs then you probably get flooded by alerts. Try to limit conditions to exact DOWN or CRITICAL situation to be worth of alerting.

silverbacksays

Th default option is usually fine. Dependancies are set in Settings>Manage Dependencies under the 'Node & Group Management' section. Check out http://www.solarwinds.com/resources/videos/orion-groups-and-dependencies.html

In addition, I tend to add a delay equal to 3 x the default polling interval to each of my alerts before they fire off. The logic behind this is that it eliminates false positives. If something is still down after two clear polls, then it's generally a legit problem we need to be made aware of and investigate.

In the old alert manager this was set at the bottom of the trigger page. Unfortunately as I've not upgraded to 11.5 in any of my cleint's instances as yet, I don't know where it is in the Web Alert Manager.

prawij

In Web Alert Manager in NPM 11.5, the trigger delay is set at the bottom of the trigger config page (just below what the OPs screenshot shows).

The reason I asked what reset option the OP chose was that he stated "To confirm, there is no reset action configured."