nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Eliminating Duplicate Alerts

dkandola

Currently, we have a lot of duplicate alerts comming through, for example, one of the alerts is;

Alert when a server exceeds 95%+ CPU utilisation for 5 minutes.

When this is triggered, we get several alerts distributed for the same server in question. I would like only 1 alert.

The ALERT EVALUATION FREQUENCY for the above alert is 5 MINUTES.

The trigger action is: do not trigger this alert until condition exists for more than 5 MINUTES.

I could not see anyting within the alert surpression options.

Anyone able to help/advise?

Find more posts tagged with

Accepted answers

dkandola

Solarwinds have been looking into this for a while and recommended changing the 'property to monitor' from, 'volume' to 'node'.

They state that everytime the alert triggers, when the property type to monitor = volume, the alert is sent for each volume recorded against the node that triggers the alert. So if Node 'Y' has 8 volumes, I would get 8 alerts.

I have now changed the 'property type to monitor' to 'node' on the original alert and I will see how the alerts behave when they come in.

Regards

All comments

mrxinu

Okay, there's some confusion here. A couple of things to get clear on before jumping in. First, the 'alert evaluation frequency' is how often the *database* is being checked for that condition, not the device. If you haven't modified the default statistics gathering interval its default is 10 minutes. Second, if 'do not trigger this alert until' is set to 5 minutes, you're now going to wait for two 5-minute periods before sounding the alert. Since the device is only being checked every 10 minutes for its CPU consumption this doesn't do anything different than the default.

You don't want to use the alert suppression tab at all.

Set the alert evaluation frequency back to 1 minute.
Set the 'do not trigger this alert until' back to 0 seconds.

So now the database is being checked often and the CPU is being updated every 10 minutes (unless you've got statistics set to something lower on this device - if not, it's defaulted to 10 minutes). If the alert sees the CPU over 95%, an alert will fire and I assume you have an email action from the sound of your post. Now you say you're getting several alerts for the same server. What's the reset condition? Are you sending email only as a trigger action or as a reset action as well? Can you offer screenshots of the alert configuration?

FWIW, SolarWinds alerting is the least "spammy" and easiest to tame of any other product I've used. We'll get you there, we just need a little more information.

dkandola

Hi Steve

Thank you for the information. I am new to Solarwinds so slowly trying to get my head around it.

I have attached a screen shot of each of the tabs within the CPU Exceeding 95%+ Alert, as it stands at the moment. (I have earased the email addresses for security purposes).

CPU Alert - General Tab.png

CPU Alert - Trigger Condition.png

CPU Alert - Reset Condition.png

CPU Alert - Surpression.png

CPU Alert - Time of Day.png

CPU Alert - Trigger Actions.png

CPU ALert - Reset Actions.png

Any further assistance will be greatly appreciated.

Regards

dkandola

These are the polling settings;

polling settings.png

mrxinu

What does the escalation tab of the email trigger action alert look like? Any boxes checked?

dkandola

Alert Escalation.png

As you can see, no boxes are checked, this was left untouched as per default.

Regards

dkandola

I have crated an alert, to duplicate the original alert detailed above. (The duplicate alert contains "Re-Written") in its title, so that we can differentiate between the two. I have left both enabled to check for comparisons.

The screen capture below shows that, both of the alerts are behaving in the same manner - sending multiple alerts rather than just 1.

alerts email - 3005201.png

mrxinu

That's just odd. Try disabling all your other alerts and leaving one enabled? I'm thinking corruption at this point. Have you tried running the configuration wizard to have it run its sanity check against the database?

dkandola

Steven,

We have run the configuration wizard prior to the creation of the duplicate alert. The repair configuration was successful.

As our Solarwinds is within a live production environment, disabling all the other alerts is not feasible as that would prevent critical alerts (e.g network, websites, user journeys, applications) not being sent.

mrxinu

It might be time for some pizza and a late-night maintenance window. Are you database savvy by chance? You could poke around in the alert definitions table and see if there is extra stuff in there that shouldn't be there.

dkandola

Solarwinds have been looking into this for a while and recommended changing the 'property to monitor' from, 'volume' to 'node'.

I have now changed the 'property type to monitor' to 'node' on the original alert and I will see how the alerts behave when they come in.

Regards

mrxinu

Oh no! Of course that'd cause a problem. I can't believe I didn't catch that. Yes, change the type of property to node. )

dkandola

Success!

It appears that changing the property type to monitor from "volume" to "node" has solved the issue as highlighted below;

cpu alert fixed.png

It can be seen that, when the alert is triggered, I now only get 1 alert. I also only get 1 alert for the reset too.

I would like to thank Steve for his assistance through this issue. It took Solarwinds a few scratches of the head to work this one out too.

Regards

mrxinu

Outstanding! I'm glad it's all worked out.