All,
I've read several posts on how alert suppression should be configured and how alert rollup should work. My problem is finding the best way to make it all work together properly to get valuable triggered alerts, and properly displayed alerts on the maps.
Here's what I'm seeing on my large "hub-n-spoke" network (yes, I know this is 2 different issues, but they are closely linked) [timeline in minutes]:
1. Time 0:00 - An alert comes in that a remote router goes down and the map turns red (proper behavior).
2. Time 2:00 - After being polled again, the router turns grey (unknown) on the map, but the alert still says the down. I would think it should stay red.
3. Time 4:00 - Router is still grey on map, alert still says down.
4. Time 5:00 - Alerts come in that the remote switches are down (5min polling cycle). I would like the switches to remain unchanged and no alert to come in. They aren't down, just unavailable due to the router.
I may have missed something in all my research (forum posts, admin guide, and online videos), but shouldn't the above be defualt behavior? I really don't like the thought of configuring custom alerts for the entire network (1,000s of devices and interfaces).
Does anyone have some ideas on how best to implement a solution described above? Some best practice or how-to guides? Maybe I missed something in my research and its easier than I think. Please, and insight would be appreciated.
Dwyane
