Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Advanced Alert Suppression

Created a simple advanced alert based on a custom node poller. The trigger is custom node poller name = pollername1 and custom node poller status = 0 . Very simple works exactly as expected. There are devices that fire off alerts based on this trigger that we don't care about because these devices are in a backup state and in fact I have another custom poller that looks for this status. So I thought suppressing just these alerts would be a snap. Went to the Alert Suppression tab and added custom node poller name = pollername2 and custom node poller status = 2. When I applied this it suppressed every alert instance even though some of the triggered device alerts aren't even being polled by the poller specified under the suppression tab. Tried changing the logic in the suppression from "all' must be true to "none" must be true and still all alerts are suppressed. In fact it didn't seem to matter what I put in the suppression tab if there was anything there I get no alerts. What am I missing ?? Thanks in advance.

Find more posts tagged with

Accepted answers

All comments

justsomeguy1988

Alert suppression suppresses the entire alert if the condition is true. What you may want to try is putting custom node poller name = pollername2 and custom node poller status = 2 as a second trigger condition. Ensure that the trigger alert setting is for all the following to apply.

Ralphr

Thanks Steve,

Tried that and no alerts trigger. To check my logic I created three separate alerts

1)custompollername =pollername1 and custompollerstatus=0 this fires off about 17 alerts

2)custompollername=pollername2 and custompollerstatus=3 fires off about 21 alerts

a comparison between the two shows only two nodes appear on both alert lists, which is what I would have expected so then I combine them and create

3)custompollername =pollername1 and custompollerstatus=0 and custompollername=pollername2 and custompollerstatus=3 this fires off zero alerts

I tried changing the order so that pollername2/status2 was first...no good

I tried adding a second condition group so that each pollername/status was under it's own group (all must apply) ..no good

I tried changing them from simple conditions to complex conditions...no good

I even tried changing the order so that I had pollername1 and pollername2 and status1 and status2..no good.

Any ideas ?

justsomeguy1988

Ralph,

I have to admit I have read your last post over several times and I am confused what exactly you are wanting to be the true condition. I think you want an alert that fires when either (custompollername=pollername1 and custompollerstatus=0) or (custompollername=pollername2 and custompollerstatus=3). If my understanding is correct (forgive if not) then I would create two condition groups.

Trigger Alert when any of the following apply (not all)

Group 1 would be: custompollername=pollername1 and custompollerstatus=0

Group 2 would be: custompollername=pollername2 and custompollerstatus=3

If my understanding is correct from you last post this should do what you are asking. Hope this helps. Have a great weekend.

It is getting late on Friday. I think I need a beer. :-)

Ralphr

Sorry for the confusion Steve and if you weren't in Texas we could have this figured out before beer # 2. Not sure why I posted this in such generic terms so let me be more specific. I have a custom poller that checks the status of the VPN tunnels on my firewalls. The issue I have is that at many of our locations we have dual firewalls in an HA configuration. In those situations all of the tunnels show down on the firewall that is in a backup state. This initially did not seem like a big deal as I have another custom poller that checks all of my HA firewalls to determine which are in a master state and which are in backup mode. So my initial logic was the trigger is based on VPN tunnel status=down and the suppression mechanism would be the HA Status=backup. But when I did this I get no alerts even though when I run the alerts separately I can see there maybe 20 VPN tunnels down and 2 of them are from "master" firewalls. So I also tried what you suggested and just built a single trigger condition that stated if the VPN Tunnel is down and the HA status is primary then fire an alert. Again just like with suppression I get no alerts. Hope this makes more sense..