SAM Alerts not triggering

I'm trying to figure out what I'm doing wrong in an alert trigger and need some help. What I want it to do is trigger an alert when an application component is in warning or critical. Using this trigger I want to send an alert saying that Component y of Application x on Server z is ${status}.

Currently I the in the trigger condition:

Trigger Alert when any of the following apply

Component Status is not equal to Up

Trigger Action:

Subject

${ApplicationName} is ${ApplicationStatus}: ${ComponentName} is ${ComponentStatus}

Message

${ShortDate} ${ShortTime}

Apllication ${ApplicationName} on ${NodeName} is ${ApplicationStatus}.

Component ${ComponentName} is in ${ComponentStatus}

Results: ${StatisticData}

Why doesn't this alert trigger when I have an application component that is in warning of critical?

Find more posts tagged with

Alert

trigger_condition

Accepted answers

aLTeReGo

Sorry about that. I didn't follow the very logic I outlined above. The example below should work as intended.

Not UPS Alert Working.png

All comments

aLTeReGo

This alert is very similar to the out-of-the-box "Alert me when an application goes down" Advanced Alert. First ensure the alert is enabled.

Enabled Alert.png

The next question is if this alert appears in the list of All Triggered Alerts resource on the Orion summary view?

All Triggered Alerts.png

mjbehrendt

I used the out of the box "alert me when an application goes down" alert and modified it to display the information I want.

The alert is enabled.

I have changed the threshold of components so they appear as warning or critical, but it does not show up under active alerts, nor send emails. If I test the alert using Advanced Alert Manager, I get an email picking a seemingly random component from a random application on the server I specify stating that it is up.

Any ideas? I didn't see anything on the content exchange section to see any triggers or alerts that any one had posted. Thanks for the advice!

mjbehrendt

So I've figured out something interesting about this alert. I had an "Alert Suppression" condition set. It was set like this:

Suppress Alert when any of the following apply

Node name starts with UPS

The idea was to not trigger this alert if it was a component of our UPS system. I have a separate alert for them that sends messages to our facilities people about the temperature and power conditions.

When this suppression is in place, the alert doesn't trigger on any component of any application, for any node.

aLTeReGo

This criteria should be added to the Trigger Condition and not the alert suppression. The Alert Suppression tab was designed to address dependencies before dependencies were natively added to Orion. As written, your alert would never fire as long as any node name in Orion begins with "UPS". So it's functioning as designed, but perhaps not as you expected.

mjbehrendt

Thanks,

How would I set this up? Would it looks something like this:

Trigger Alert when all of the following apply

-Node Name does not start with UPS

--Trigger alert when Any of the following apply

---Component status is equal to warning

---Component status is equal to critical

The only problem with that is there isn't an option for "does not start with".

aLTeReGo

Correct, Remember, "all" is equal to "and", and "any" is equal to "or". So your alert reads in plain English as "Trigger Alert when Node name does not start with UPS and component status is equal to warning or critical.

mjbehrendt

I set my trigger conditions as you have in your example, but now I am being bombarded with emails about every node being up. Um... what?

aLTeReGo

Sorry about that. I didn't follow the very logic I outlined above. The example below should work as intended.

Not UPS Alert Working.png

mjbehrendt

*edit*

That did the trick. Thanks!