Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Advanced alert is sending reset action without trigger

I have a CPU Utilization advanced alert issue

The alert is configured to check every minute.

Trigger condtion is "CPU Load >= 95" and is configured for "Do not trigger this action until condition exists for more than 30 minutes"

Reset condition is "Reset when trigger conditions are no longer true"

No alert suppression is used.

The trigger action is to send an alert e-mail and the reset action is to send a clear e-mail.

When server's CPU load matches the above criteria, I get the appropriate alert and clear emails.

But I have many instances when a server's CPU load is over the 95% threshold but not for the 30 minutes. In those instances, I am not getting the trigger email, which is correct by design. But I am still getting a clear email from the reset action.

Any thoughts?

Find more posts tagged with

Accepted answers

All comments

superfly

Maybe try writing a Reset Condition such as CPU Load < 95% and see if that helps.

bhavikdalsania

I personally recommend that you use only > don't use >=.

and still you are having trouble than can try reset when trigger conditions are no longer true.

broeben

I have tried both suggestions to no avail. It seems almost as if the trigger and the hold is working. It feels like the alert has triggered and is waiting the 30 minutes. The alert then clears and does not send the alert trigger, like it is supposed to, but is sending the clear anyway.

stuartwhyte

I suspect the clear email is coming from another source. A few things to check:

When the alert is "stage 1 triggered" - i.e. the trigger condition is met but waiting for the 30 minutes - you should see a blue triangle in alert manager. This will go red once it enters stage 2, and a trigger action is performed. A reset action will not be performed if an alert enters stage 1 and is cleared before stage 2, so test the alert and check it remains in stage 1.
To ensure that I know EXACTLY which alert a trigger/reset action originates, I always add "This alert was generated by ${AlertName} at ${AlertTriggerTime}" to the bottom of the message. Add this and check that the reset action is indeed coming from the alert you are expecting it to be from.
As suggested above, I would always manually write your reset action to be the reverse of the trigger action, as it will give you a little more control.

If all the above doesn't help, if you could post some screenshots of your alert configuration I'll take a look and see if there's anything that jumps out.

Stuart