Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Alert Suppression on Multiple Down Nodes

I am having a problem with suppressing alerts, here is the setup....

We have redundant WAN circuits to a firewall; if both circuits go down I want to suppress the firewall alert. Now I've tested the alert suppression with each WAN circuit down (individually) and suppression works. However when I try to test with both down the firewall alert is not suppressed.

To see what I mean please look at the picture, the first suppression rule doesn’t work the next does and the last does (obviously both nodes are down during this test).I’m confused on this one.

suppressi.JPG

Find more posts tagged with

Accepted answers

bshopp

This is an old thread. In NPM 10.1 we put alert suppression functionality into the web console, see here for more info

All comments

vhcato

JB,

I've spent the better part of 2 days trying to figure out a way to make this work while using the Advanced Alert Manager GUI to input the configuration, and here's what I've come up with...

It can't be done...

Below is the actual query used on the back end by the alerting engine to determine whether or not to suppress an alert.

SELECT Count(*) AS Supress
FROM Nodes
WHERE
(
(
   (Nodes.Caption = 'Router1') AND
   (Nodes.Status <> '1')) AND
(
   (Nodes.Caption = 'Router2') AND
   (Nodes.Status <> '1'))
)

In this example, I used with a couple of control devices "Router1" and "Router2" so that I could manipulate the status of each to see what values were derived via the SQL query. Due to the fact that it's doing a SQL "Count", and the criteria for each control device is actually overlapping, a SQL "Count" will never give you anything other than a "0" value, which equates to "don't suppress". If you are only tracking a single node or interface, then this will work just fine, but you can't do it with multiples.

If there was a way to input a custom SQL query as the criteria (removing the restrictions imposed by the GUI), as well as control what value determines suppression candidacy, then you could easily make this work with multiple nodes or interfaces.

Someone please correct me if I'm wrong...

There are some ways to accomplish this via some custom SQL work or perhaps some VB scripting, but at this point I'm not going to invest the time to pursue those avenues. I may implement suppression just for our sites with single routers/connections, and just live with the fact that redundant sites don't have suppression for now.

jbaulsir

Winner! You are correct, I opened a ticket and (was pleasently suprised) talked (yes, talked) to a suport engineer who was very helpful and explained basically what you discovered.

But there is light at the end of the tunnel.....

"I got with my senior tech and he explained that our Alerting Engine is not designed to process SQL queries that are this complex. But the good news is that our developers are working to include a condition type in the next version that will be "Node Status is equal to Unreachable". With the Unreachable option, you will be able to generate the type of suppression you are trying to generate.

Trigger Condition:
Node Name is equal to India Firewall
Status is equal to Down

Suppression Condition:
Node Name is equal to India Firewall
Status is equal to Unreachable

This way, if Orion can reach the firewall but discovers that it is down, it will send you the alert. But if it can't reach the firewall then it can ignore the up/down status for alerting purposes."

Node Status Unreachable will allow you to suppress not on the condition of an upstream node but on if the alerting node itself can be reached or not.

Thanks for looking into it though

vhcato

Yeah, I know this is something that they have on the radar. If we only had the ability to change the value of a custom property as an advanced alert action, then we could make this work. Though it wouldn't be scalable, and wouldn't be as pretty as having the app make intelligent decisions with regard to alerting based on inherent knowledge of the topology it would get us by for now.

richyb1234

Solarwinds always told me that putting anything in the alert supression tab cancelled everything else in the trigger condition tab. Assuming this is still the case.

bshopp

This is an old thread. In NPM 10.1 we put alert suppression functionality into the web console, see here for more info