Decrease in number of alerts sent.

Question

At the start of every month, we run a SQL query to determine the amount of email alerts sent in the previous month. Over the last two months, the amount has permitted. Here are the numbers:

November

December

January

February

4304

6466

591

31

The only major thing we did was upgrade NPM, NTA and SAM in December. Could that be the cause of the massive drop? Any ideas on how to determine the cause and verify it?

mesverrum · Answer

Like  silverbacksays​ told you, you need to investigate which alerts specifically were firing before and figure out if they were valid or some kind of noise.  I often go into environments where there are out of the box alerts that have not been fully configured that are firing off hundreds or thousands of times a day.

Ask whoever set up that SQL query to set it up to group by message in the alerthistory table.  If you need more details instructions on that I can upload a query I use to get that info.  It relies on the alerts having a decently detailed message in the alert configuration which is sometimes not the case when people have been setting up their own custom alerts, but the default alerts are all set up with them.

-Marc Netterfield

Loop1 Systems: SolarWinds Training and Professional Services

*                 LinkedIN: Loop1 Systems
*                 Facebook: Loop1 Systems
*                 Twitter: @Loop1Systems

silverbacksays · Answer

Cheers sans​ (great ThwackID btw!).

You may have had some legacy alert profiles in the old Advanced Alert Manager which are not supported by the new Web Alerts. They should remain active, but not editable, although I have heard that some people have had alert profiles disabled after an upgrade. I'd check that all the alerts you want are active in Settings>Manage Alerts.

sans · Answer

My bad, we upgraded NPM from 10.7 to 11.5.2 on Jan 5th. We upgraded SAM from 6.1.1 to 6.2.2 and NTA from 4.0.3 to 4.1.1 on Jan 12th.

As for looking at the alerts, If some where shut off, I have no way to know what. I started the 1st of Dec and we have a real lack of documentation.