Group Alerting fine but not suppressing nodes outside of the group

I am having an issue with Group Alerting. I will give you guys the trigger, reset and suppression values so you know what I am trying to accomplish.

Trigger:

Trigger Alert when all of the following apply

Group Name is equal to Internet Circuits

field Member Status is equal to value Unreachable

field Member Status is equal to value Down

Reset:

Reset Alert when all of the following apply

Group Name is equal to Internet Circuits

Group Status is equal to UP

Suppression:

Suppress Alert when all of the following apply

Group Name is not equal to Internet Circuits

field Member Status is not equal to value Unreachable

When I test the alert on a node outside of the group, it still sends alerts to NPM and sends an email like I have it set to do, instead of suppressing it. This is the message I send to NPM and an email address. The cicuit ${NodeName} with address ${IP_Address} is ${Status} at ${Time} on ${LongDate}. The funny thing is when the alert is sent to NPM and email the IP Address is still ${IP_Address} and the status is unknown on devices I know are up.

This is the first time I have worked with group variables so I am struggling and it is starting to make me crazy. Any help would be greatly appreciated.....Thanks for your time!

Find more posts tagged with

advanced_alerts

advanced_alert_setup_question

custom_alerting

group_alerts

Alerts

Accepted answers

All comments

qle

There's a couple of different issues here:

1) When you test an alert, it doesn't actually test the trigger condition, it only tests the alert actions that you have defined. This explains why an e-mail alert is still delivered when testing a node outside of your defined group.

2) Your trigger condition is set to trigger when Member Status is equal to Unreachable and Down. As you can see, it'll never trigger so instead you should update your condition so that it triggers when the status is Unreachable or Down like the following:

Trigger Alert when all of the following apply

Group Name is equal to Internet Circuits

Trigger Alert when any of the following apply

Member Status is equal to Unreachable

Member Status is equal to Down

You'll notice the addition of a condition group with it set to trigger on any, not all. Add the two status conditions under the group and you should be good to go.

brian3

I'm trying to understand how I can customize the out of the box Group alert for a particular group and get some detail specific to the group in the email trigger.

What I have done so far is to copy the out of the box alert entitled: "Alert me when a group goes into warning or critical state"

Which has two simple conditions under the same "ANY" condition group the following: Group Status is equal to Warning OR Group Status is equal to Critical.

For my custom copied alert, I tried changing the condition group to "ALL" and adding a Complex condition that attempt to define the Group Name is equal to XXXX. Then I moved the two simple conditions under that complex condition still using ANY.

What I don't understand the logic to is how to make sure that the detail in the email alert ties back to this particular trigger. I think I need to use the "Define SQL Variable" line to do that, but I'm not a SQL expert. Can someone tell me if this is the right way to do this and if my SQL Variable definition below is correct?

${SQL:Select ${GroupStatusRootCause} WHERE ${GroupName} = 'XXXX'}

When I run a test I get the following error:

MACRO SQL ERROR - Incorrect syntax near the keyword 'is'

I tried this ${SQL:SELECT Message FROM Events WHERE Message LIKE 'Group XXXX%'} and got a message, however, I think I need to add a variable for either EventTime or Acknowledged status???

brian3

Here's what I tried:

XXXX Group Events within the last 24 hours that have not been acknowledged:
${SQL:SELECT Message FROM Events WHERE Message LIKE 'Group XXXX%' AND EventTime > getdate()-1 AND Acknowledged = 0}

Does anyone have a better way of doing this?

qle

Ok, wait. So, is your alert triggering properly? You're essentially looking to compose a proper e-mail alert for this? What exactly are you trying to include in your message?

If you're looking for something simple, maybe the following works for you:

${GroupName} is currently ${GroupStatusName} for the following reason(s):

${GroupStatusRootCause}