Getting used to the new web-based alerting interface. I'm seeing what I think is different behavior from the old engine.
In the past, we've set up somewhat broad SAM monitors for certain scenarios where a family of related ports/services are monitored but not all of the components in the application are present on all of the nodes being monitored.
Example:
Application Monitor: Active Batch Services
-- Component: Windows Service “Active Batch Execution Agent”
-- Component: Windows Service “Active Batch Job Scheduler”
We apply the Application monitor to all of our internal batch servers but then go in and disable the component on a specific node that we know isn't installed (not all batch servers are schedulers, etc.). This lets us have a single alert that has worked well in the past. Since the Scheduler is disabled on certain nodes, it isn't "Down" and therefore the alert doesn't fire for that node.
In the alert in the old alerting engine, we used one of the ComponentsWithProblemsFormatted or ComponentsWithStatusFormatted variables in the alert, and it didn't list any of the components that were disabled.
Now a newly created alert (not one converted or copied) with the new engine that uses ${N=SwisEntity;M=ApplicationAlert.ComponentsWithStatusFormatted} shows all of the components in the application monitor, even those that are disabled for the node we're alerting or simulating on. It also shows a Down status for the disabled components.
Can anyone else reproduce this?
