Advanced Alerts logic question - suppression

Debbi

In one of my buildings, I want to be alerted if any boxes go down.  However, if mead-5h1-ssw1 is down, I only want to be alerted for that one box (since everything behind it would be "down" anyway).

Trigger alert when all of the following apply
 Node name starts with mead
 Node status is equal to Down

Reset when trigger conditions are no longer true

Suppress Alert when all of the following apply
 Node name is equal to mead-5h1-ssw1
 Node status is equal to Down

Firstly, does this make sense?  If so, then:

Here is my question:  Should I have a separate alert set up for the specific device mead-5h1-ssw1 so its alert is processed separately instead of including it here with the "Node name starts with mead" criterian?  (I already have its polling interval set lower than the suppressed devices.)  The problem I see is that this might also suppress the alert for mead-5h1-ssw1, which is the box I *do* need to be alerted about.

Thanks.

Debbi

mrxinu

Hi Debbi,

I'm going to assume that "any boxes" and "one of my buildings" means that the names all start with "mead" - if that's right, we're most of the way there. That alert will cover any node that goes down that isn't the mead-5h1-ssw1 device. You would have to have a separate alert to cover that since if that was the node being evaluated by this alert it would be suppressed and passed over.

Another thing to be careful about is using the default "reset when trigger conditions are no longer true". You only want to use that when the conditions truly have only two possible values. In this case node status can be up, down, unknown, unmanaged (and maybe another I'm forgetting). Use the "copy trigger condition" button on the reset tab and change 'Down' to 'Up'. That way you're being as specific as possible.