Escalation Level Alert - Log File

istevenr

Sorry if this was asked before...searched the the forum/threads and didn't see any questions related to what I needed to know.

So my question or scenario that I'm trying to figure out is, as I have it setup

Step 1. > I have an action setup to write to a log file when a node/server goes down.

Wait 5 minutes then escalate to send an email to "Check log file report". 

My Concern is if let's say 20 nodes/server go down within a matter of 4 min and get written to the log file...now after 5 min, how many escalated email alerts will I receive...20 or 1 ?   

Note:  I set this testing scenario up to reduce email noise

blsanner

Short answer is that there would be 20 different emails.  Each node down event would be treated as a separate instance of a triggered alert and would have it's own actions that are not related to the others.  All that the 5 minute escalation period is doing is waiting 5 minutes and, if the alert reset conditions haven't been met, taking the next step.

What you could do is just have the alert write to the log file and then set up a SAM monitor (assuming you have the SAM module) to parse that log file and alert when it finds something.  That way, it could check the log file every 5 minutes and only do one notification if anything was found in the log.