Adv. Alert Suppression

rossw

Has anyone played with alert suppression in the advanced alerts?

It doesnt seem that I can create a NODE alert and suppress it with a INTERFACE down status.

Example: DS3 interface on a router goes down.. Dont alert on all the Satellite modems behind that DS3.

Simple suppresion example, but it doesnt seem like i can do it in advanced alerts.

Anyone help?

Support says it "might be" in 8.1

Ross Warren

Find more posts tagged with

advanced_alerts

suppression

Accepted answers

All comments

aLTeReGo

I think the problem your seeing is a permissions problem with the Advanced Alerting Engine. Currently you can't suppress or reset alert triggers that cross alert classification groups. Such as Application, Node, Interface, Volume, Custom Node Poller, or Custom. For instance you can't reset a Node down condition by with an application status equal to up, or as you found, suppress a node down condition with an interface status equal to down. This has been identified as a permissions issue in the Advanced Alerting Engine. With any luck this, and many other issues with the Advanced Alerting Engine will be addresses in 8.1, but I'm not holding my breath. The entire history of the Advanced Alerting Engine has been full of broken promises.

To summarize

An application alert only has access to the applications table, a custom poller alerts only has access to the CustomPollerAssignment and CustomPollers table, a node alert only has access to node information.

mfinnigan

Well, not strictly true, I think. I have application alerts that are suppressed if the node is down.

aLTeReGo

What I think you're seeing is the Advanced Alerting Engine will not alert you that an application is down if it can't query SNMP on the remote node. This would be the fact if the node was down, SNMP daemon is stopped, or misconfigured.

I have many application alerts configured, none with suppression and I only get notified of their down status when the node is up and properly responding to SNMP queries.

mfinnigan

Well, I also suppress on SNMP being down. Because if I didn't, and SNMP stopped or was slow to respond, I will get one alert per application.

aLTeReGo

Is this something you've tested? The way the application monitoring works is that it downloads a table of running applications via SNMP, then looks to see if the process name that is being monitored is listed or not. If the table isn't downloaded because the node is down or SNMP daemon isn't running then the status doesn't change in the application monitor, and if the status doesn't change then there is nothing to alert or suppress in the advanced alerting engine.

Junyoure

This is an old thread, but the answer to this specific question is not here. Can you suppress an alert on node(s) by tracking the interface status on an upstream device? If so, How? I have advanced alerts configured correctly, except the upstream node has to be down to suppress the hundreds of alerts for devices behind it. I can't seem to find where to select the interface status instead of the node status for the suppression condition.

thanks

-Jr.

FormerMember

Here are some threads that address the topic in some detail: