Alerts - Trigger One-Time Only in Server & Application Monitor?

We have certain alerts that are monitoring for System and Application events that we would like to trigger a single time. Currently, they trigger, then auto-reset fifteen minutes later, then trigger again. What's the best way to configure the SAM alert to trigger a single time per day and not continually trigger/reset?

Find more posts tagged with

event logs

alert triggers

alert_reset

server & application monitor

application event log

Accepted answers

All comments

Ballzo

Those values must be changing to clear the alert?. You might try using trigger action if exist for more than 20 minutes or something.

ktmorris

Here's the scenario I'm targeting with this question.

1. Windows Event appears in the syslogs, triggering the alert.

2. 15 minutes go by where there is no Windows Event, causing the alert to reset itself

3. Windows Event again appears in the syslogs, triggering the alert once again

As a result of this behavior, a single event (repeated, but still) can generate many dozens or hundreds of alerts. I was looking for a way to cause such an event to trigger once, then to delay the reset behavior for the next 24 hours or so. Is this something that is feasible within SAM?

aLTeReGo

Are you using Syslog via the Windows Event Log Forwarder or are you using SAM's Event Log Monitor?