Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

ONLY alert when multiple things are down? Can't figure this alert out...

Basically, I have two routers and an interface on each. Only one interface is going to be "active" at any given time, and it doesn't matter which one.

I want to be alerted however, ONLY when both interfaces are down.

My logic so far is as follows:

Trigger Alert when all of the following apply

Interface Caption is equal to INTERNET

Trigger Alert when all of the following apply

Node Name is equal to ROUTERA

Recv bps is less than 5000

Trigger Alert when all of the following apply

Node Name is equal to ROUTERB

Recv bps is less than 5000

The alert is not triggering. I've looked through the SQL, and I've discovered my limitation. There is never a case when "Interface X" will have multiple values for "Node Name." The SQL returns a null value.

Any ideas on how to make this work? Maybe with some higher level logic?

Find more posts tagged with

Accepted answers

haris

With the help of a DBA, we've got some rather advanced SQL going to return the raw data we want.

However, the Alert Manager doesn't seem to be smart enough/capable of actually generating an alerts based off the advanced SQL which boggles my mind. Why can't it just spit out the data returned from a query?

Might give the suppression a shot..

Using NPM 10.1

All comments

Tensibai

Hi,

It should work if you write it as follow:

Trigger Alert when all of the following apply

Interface Caption is equal to INTERNET

Recv bps is less than 5000

Trigger Alert when any of the following apply

Node Name is equal to ROUTERA

Node Name is equal to ROUTERB

Pay attention of the grouping with ANY, it tells the alert to trigger when an interface with caption=INTERNET and bps < 5000 for a node named ROUTERA OR ROUTERB

Edit: Ooops, just figured out I had misread you thread. Unless using groups I see no way to write a correct trigger for it. You can't get the node name = to two values.

I think a correct SQL request may trigger, probably a very complex request. I think I'll have a look at something like that shortly.

cdoyle

This is possible, you just need a bit of creative use of the alert supression to get it working ;-)

Your trigger condition would be:

Trigger when all of the following apply:

Interface caption equal to internet

Node name equal to Router A

Interface status equal to down

Supression:

Supress when all of the following apply:

Interface caption equal to internet

Node name equal to Router B

Interface status equal to up

This way, your alert will only go off when the "Internet" interface on both routers is down.

haris

With the help of a DBA, we've got some rather advanced SQL going to return the raw data we want.

Might give the suppression a shot..

Using NPM 10.1

haris

I'm hesitant to use suppression at this point, because we actually have several hundred pairs of routers in this configuration that are managed.

Trying to set up alerts for each pair individually with suppression would be incredibly time consuming. Where as with a proper custom SQL query, I can write one query with multiple conditions rather easily.