Interface Error alert will not reset

Hi all,

I'm new to creating alerts in Orion Alert Manager, and I've run into an issue. I've created a simple alert condition that alerts when recv (interface) discards/errors or xmit discards/errors this hour are greater than 1000. After I create the alert it dumps a bunch of them out into my last 50 events appropriately, but then I do not see anymore. I'm assuming the reset condition is not working. I've tried multiple conditions.. Right now I have the reset alert set to last boot is greater than 1/1/2001 (since this will always be true) and I set the (do not reset until this condition exists to 3 minutes). I've tried various reset conditions with no success. Any help would be greatly appreciated.

Find more posts tagged with

Accepted answers

All comments

byrona

I would start by simplifying things. Set the Reset Condition to the default "Reset when trigger conditions are no longer true". Once you have done this see if your alert behaves properly.

If that doesn't work, you should post a screenshot of both your Alert Trigger Conditions and your Reset Conditions so that they can be reviewed.

rand000

Above are the trigger conditions. I do not really need to distinguish between the errors so I have it firing for any of the above being true. I have tried the reset condition when conditions are no longer true default with no success.

mdriskell

I had this same problem when I first created the alert. On mine I had set the trigger condition to be when xmt or rcv were greater than 1000 in an hour. I found that on the reset condition I had to set it to be when xmt AND rcv were less than 10 in an hour. Two points about this it had to be an AND on the reset otherwise if you are taking rcv errors but xmt is clean the alert will instantly reset and then immediately retrigger (vicious cycle). Second I set it to be less than 10 so that if the circuit cleaned up for a few minutes to change the number of alerts in the past hour from say 1000 to 990 I didn't want it instantly resetting. Setting it much lower to say 100 or 10 like I did is a much better gauge if the condition no longer exists.

mdriskell

Above are the trigger conditions. I do not really need to distinguish between the errors so I have it firing for any of the above being true. I have tried the reset condition when conditions are no longer true default with no success.

By setting it simply to no longer true that means if any of those statements are no longer true the alert will reset meaning if RCV is erroring but XMT is clean the alert will instantly reset and then immediately retrigger.

rand000

I'm not sure if I followed. I set the reset condition to the above. Thanks for the help by the way.

byrona

With these settings are things now working as expected?

rand000

No I'm not seeing any new alerts. I can view the Top 10 and confirm that I do have interfaces taking errors/and discards but I'm not generating any new alerts.