Global Variable to mute component alerts

I currently have an Application that consists of 100+ HTTP and HTTPS monitors, each monitoring a different web site. The application is attached to 40 web servers, as well as the vips on the load balancers which are set up as nodes. When one of our customers performs maintenance, I would like to ability to not generate an alert for that one web site (mute it). Since this is a component and is on 40 servers, it makes it difficult to disable or enable the alert.
Each customer has a 4 digit identifier 5000 6000 2883 2004 etc and these are part of the component monitor name ie 5000 http monitor or 6000 https

If we could set a global variable (Call it IGNORELIST) that would contain an array of customer numbers to not generate alerts for, I could then either filter or add a rule in the advanced alerts manager to ignore those components.

1) Is there a better way to do this?

2) Can this way be done?

Thanks in advance for your help.

--Evan

Find more posts tagged with

sam

global

Alerts

variable

advanced

apm_components

Accepted answers

All comments

aLTeReGo

Yes, using Custom Properties for the node or application and using this information as part of the alert criteria is likely the simplest/easiest way of handling this. I know Leon Adato has make extensive use of this approach. Alternatively, if you have an automation system you could programmatically unmanage these nodes or applications using the Orion SDK. Admittedly this it a bit more advanced, but if the process can be automated in some fashion then it might be worth the investment of time.

Detroiter

Evan,

Are you looking to disable a SINGLE component out of a list of 100+ in that are all in the SAME application monitor? If that is teh case, you likely will not be able to use the SAM Custom Property method since those are only settable at the Application level, not the Component level. Additionally, you can only unmanage at the Application level, not Component.

Not sure how SQL savvy you are, but you could use an update query to change the "IsDisabled" value within the APM_Component table to 1 for the affected websites.

--Something like this:

update [ORION].[dbo].[APM_Component]

set IsDisabled = 1

where

APM_Component.ApplicationID = 1

And APM_Component.Name LIKE '%test%'

As long as you know the ApplicationID, which is specific to each node. Conversely, you could execute a similar SQL command to change the SAM Template where teh affected website component exists and set THAT to "IsDisabled = 1" which would apply to an node where that template is assigned.

But, SQL table changes are not recommended by Solarwinds Support (or even me for that matter) since they can royally screw up things. This should only be attempted if you have good knowledge of SQL and update queries and have a reliable database backup solution....just in case.

emarksrpi86

The same component across multiple nodes is what I am looking to silence. Sounds like the easiest solution to manage would be to create 100 applications rather than have 100 components part of a single application, then just disable each application.

emarksrpi86

I ended up using alert suppression on advanced alert manager combined with renaming my application components to always include a unique identifier that ties them together.

The unique identifier is a 4 digit number, for example 5555.

When we are doing a build for institution 5555

In advanced alert manager, I coded in the alert suppression tab:

If Component name contains "5555" suppress the alert.

If I have more than one institution number I need to suppress, I use the any clause with multiple lines, each listing one 4 digit number to suppress.

Since implemented, this appears to work well.