Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Advanced Alert Processing Question

I have a High Packet Loss alert that is as follows...

Alert when all of the following apply

Percent Packet Loss is Greater than 40

Node Status is not equal to Down

Now I have a node that tripped this alert and then a few moments later went down. However, despite the fact that the node is down, I still have an alert for the High Packet Loss.

My only reasoning for this is that since the High Packet Loss alert was tripped first, the Advanced Alert processing no longer looks for the Trigger Conditions for that Alert but instead now just looks for the Rearm Conditions for that node causing the High Packet Loss alert to stay tripped.

Is this correct?

Find more posts tagged with

Accepted answers

tdanner

When an alert is triggered, it only looks at the reset condition. If I understand what you want to do, I think you can just use the "Reset when trigger conditions are no longer true" radio button on the Reset Condition tab.

All comments

neilmborilla

Are you saying that you should not get the HIGH PACKET LOSS Alert since that node goes down eventually?

I hope I did get you correctly......

What about the trigger condition TIME? how did you set it up? (specific duration time where the conditions you set still exists)

My only reasoning for this is that since the High Packet Loss alert was tripped first, the Advanced Alert processing no longer looks for the Trigger Conditions for that Alert but instead now just looks for the Rearm Conditions for that node causing the High Packet Loss alert to stay tripped.
Is this correct?

I read this paragraph many times but I still didn't understand it ...

Are you talking about basic and advanced alert? two kinds of alert? or just the two conditions you set on the advanced alert?

jbaulsir

Yes that sounds correct, If you want the High Packect loss alert reset when the node goes "Down" why not add to the Reset Condition:

Reset alert when any of the following apply

Percent Packet Loss is less than 5

Node Status is equal to Down

But I think when the node goes UP you'll get another high packet loss alert until the Percent Pacet loss goes below 5% (or whatever you set)

robertcbrowning

The % loss is created by an average & it takes a while to average itself up to 40% after the node has gone down & then it takes a while to average itself back down when the node comes back up again.
Perhaps adding node down traps from the device would help speed up the real displayed status of the node and then you could trust your alert logic.

byrona

I guess what I really need to know is as follows...

When an Advanced Alert is in a tripped state, does the alert engine look at the Trigger Conditions or does it just look at the Rearm Conditions?

byrona

I guess what I really need to know is as follows...
When an Advanced Alert is in a tripped state, does the alert engine look at the Trigger Conditions or does it just look at the Rearm Conditions?

I really hope somebody out there can answer this for me as it is going to play an important role in how I have to handle alerts.

Thanks!

MarieB

Hi Byron--

I'm going to move this to the Alert Lab forum so that it gets more traction there.

qle

When an Advanced Alert is in a tripped state, does the alert engine look at the Trigger Conditions or does it just look at the Rearm Conditions?

I apologize if I'm a little slow here but what are Rearm Conditions? Is this a new feature in NPM v10?

morgolis

Not sure if this will work, but what about setting a Suppression condition that will suppress the alert if the node is in a 'Down' state? I will have to test this to see if it works, but as far as I know doesn't the check against the trigger condition still run even if the alert is tripped?

byrona

I don't think the suppression condition will work considering that suppression conditions are completely independent queries.

The real question I need to get answered is as stated above...

"When an Advanced Alert is in a tripped state, does the alert engine look at the Trigger Conditions or does it just look at the Rearm Conditions?"

Once I find the answer to that question I will be able to set things up properly. However, without knowing how this functions I am kind of flying blind.

tdanner

byrona

When an alert is triggered, it only looks at the reset condition. If I understand what you want to do, I think you can just use the "Reset when trigger conditions are no longer true" radio button on the Reset Condition tab.

Thanks Tim. My experience with it suggests that you are correct in both cases, I was just looking for confirmation on what I was seeing.