Event/Alarm De duplication and Correlation in Solarwinds SAM

Is it possible to have event/alarm de-duplication and correlation in Solarwinds SAM?

What I mean by de-duplication and correlation here is that if an event for a resource of a node is already there and at the next poll/check if the condition exists and an uncleared alarm already exists for it, it just creates an event for the reoccurence or maybe increments a column in the events table as part of the reoccurence but does not create a new alarm for the same?

I am aware that this is possible via LEM but I'm trying to achieve the same in SAM itself.

Find more posts tagged with

alert_lab

server & application monitor

Accepted answers

All comments

aLTeReGo

Can you provide a detailed example of what you're trying to accomplish? I'm afraid your description is a bit too vague to follow, making it difficult to provide an answer.

muheet.hajela

So what I'm trying to achieve here is that say I have a critical disk alert check configured at every 5 minutes for disk usage greater than 80%, and a server A generates this alert1 and event1 for for C:\ Drive which is using 92%, then after 5 minutes it recheck server A and finds that the usage is still 92%,

Case 1:

then it should generate event2, but should not generate a new alert if alert1 is not cleared/acknowledged

Case 2:

it shouldn't generate a new event but just increment a counter attached with this event1 in the form of an additional variable for the events, if if alert1 is not cleared/acknowledged

Hope this helps clarify a bit more.

daveb7114

Muheet, Is this functionality not covered by the execution settings in the alert manager? See below. Not sure if this is what you're referring to. I understand your event1, event2 logic, but the alert can be configured here.

Dave Burton

Loop1 Systems

muheet.hajela

I believe that is available for just the alert actions and not for the alert itself right?