Help with keeping track of changes to alerts and nodes (Alert Auditing)

In our environment we have several people on our team that have access to making changes to alerts and nodes. I'm trying to come up with a method of keeping track of what changes are being made to help prevent a problem we recently had where one of our alerts was toggled off and we weren't aware of it for about a week. Could anyone provide some suggestions please? This is what I've done so far:

Some questions I had are, for the reset conditions does there need to be anything set other than "when trigger conditions are no longer true"? Should the triggers be put under different alerts? What variables should I have in the message for accurate reporting? I welcome any suggestions, comments, or snide remarks

Find more posts tagged with

alert_auditing

alert_changes

audits

Accepted answers

All comments

techbender

I just saw in the NPM 12 beta version 3 that they're adding in the web console based alert management. I think I'm just going to hold off till I can take a look at that as they're adding a lot more functionality and try to set it up then. Thanks anyways guys.

jbiggley

We use something very similar in our environment for things like new alerts, etc. They key is avoiding the use of common accounts. Every member of the team has to have a unique username or else the alerts become useless when enabled.

As for waiting for NPM 12 -- I wouldn't hold my breath since NPM 11 was just released. I'd roll out your alert as defined and worry about migrating it later.

techbender

I have, and it's partially working. I can see when Nodes are deleted,added, managed, or unmanaged. I can see when list resources are added or removed. I'm not seeing when alerts are added, disabled, or deleted. Also custom properties being added, changed or deleted. I haven't taken a look at if any Orion settings get changed if that works or not yet, but I wasn't as interested in alerting for that one anyways. I just posted my comment so that other people wouldn't spend resources trying to troubleshoot this issue whenever we're about to have a new method of setting up alerts where I'm pretty sure there are a lot of changes and improved methods of alerting on things. Thanks for the feed back though.

hilbertd21

working with version 11.5.2, and set up alerts similarly. What's NOT working that I thought would is when resource listings are 'edited' aka, reselected/deselected from monitoring for an already discovered element. We ran into an issue where some existing selected volume resources were de-selected/unchecked, but not deleted, that made us blind to a volume capacity issue. We want to know if a resource that was selected and being monitored is deselected/unmonitored.