Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Alerting on Applications vs Components within templates-should I add multiple compoments templates?

Warning: I've been thrown into Solarwinds and I'm trying to learn as much as I can and I apologize if my questions are newbie/not worded correctly. I appreciate all feedback and guidance on how to best learn Solarwinds product (and I'm not even sure which products we have. When I login it says "Orion" and "APM" is in the URL.

My question: I'm creating Application Monitor Templates and generally I've been creating a single component per template. However, it kind of feels like perhaps I should be creating multiple components if my application has a few parts?

For example, I have an application that has a windows service and a URL. If I create an application monitor template and add two components, how would I setup an alert to notify me if either component is down? How do I future proof my alert so if someone adds a component later, I don't have to change my alert?

I have a million other questions, but probably best to create separate posts .

Thank you for your help and advice (and any suggestions you have existing tutorials I can follow to learn all things Server and Application Monitor would be appreciated too).

Find more posts tagged with

Accepted answers

shuth

Welcome to using SolarWinds!

A couple of the terms out of the way first:

Orion - the platform that the modules run on, most of the SolarWinds modules share this core platform
APM - effectively SAM, it used to be called Application Performance Monitor but got renamed at some point to Server & Application Monitor. Various URLs, database entries, etc will still reference APM.

At a very high level for the application monitoring:

You can add multiple components of the same application to the same template
- Template ABC has the following components: service 1, service 2, performance counter 1, URL 1
You can assign that template to multiple servers if the same application is running on them
- Template ABC -> Server 01
- Template ABC -> Server 02
I usually recommend separate templates for different applications rather than trying to combine all applications into one template on the server. E.g. don't monitor application ABC and application DEF in the same template. It makes it harder to see which of the two applications is down.
- Template ABC -> Server 01
- Template DEF -> Server 01
- Template ABC -> Server 02
You can use the same template and disable (or enable) particular components for specific nodes
- Template ABC -> Server 01 - 2 services, 1 performance counter, 1 URL
- Template ABC -> Server 02 - 1 service, 1 URL (the same as above but 1 service and performance counter is disabled because it may not exist on that server)

Now for the alerting. You can do this one of two ways and it depends on how granular you want to get when it comes to the notifications.

Application alerting
- When you create the alert, you use Application as the alert object
- Define the scope for this alert, e.g. application status is down AND
  - Does it have to match application ABC exactly?
  - Is it any application that contains ABC in the name?
  - Is it application ABC or DEF?
  - etc
- If you add more components to the template/application, the alert doesn't need to change
- Pros
  - You don't get spammed with multiple notifications when multiple components go down in the same application
- Cons
  - If component A goes down you will get an alert for the application going down.
  - If component B then goes down, you will NOT get another alert (the alert for the application being down is already active from component A making the application go down)

Component alerting
- Similar to the above but more granular
- When you create the alert, you use Component as the alert object
- Define the scope for this alert, e.g. component status is down AND
  - Does it have to match application ABC exactly?
  - Is it any application that contains ABC in the name?
  - Is it application ABC or DEF?
  - Or more granularly, you can match on specific component names. Does it match component name, does the component name contain ABC...
  - etc
- If you add more components to the template/application:
  - If you used application definitions in the trigger, the alert doesn't need to change
  - If you used component definitions in the trigger, i.e. to only look at specific components, you may need to update the alert for the new components
- Pros
  - If multiple components go down in the same application, you will get individual notifications
- Cons
  - You will get spammed for every single component going down - if you have an application with 10 components and 7 of them are services that stop, you will get 7 alerts.

Personally I prefer application alerts for general application health alerting and use component alerts for more specific/targeted alerting (e.g. component statistics above/below/equal to a certain value).

If you have the time, under your Customer Portal login there is an Eduction & Training menu with a link to Virtual Classrooms. You can access training sessions and pre-recorded videos covering the various module basics and move onto things like dashboarding, alerting, etc.

Feel free to keep posting your questions to thwack as well!

All comments

shuth

Welcome to using SolarWinds!

A couple of the terms out of the way first:

Orion - the platform that the modules run on, most of the SolarWinds modules share this core platform
APM - effectively SAM, it used to be called Application Performance Monitor but got renamed at some point to Server & Application Monitor. Various URLs, database entries, etc will still reference APM.

At a very high level for the application monitoring:

You can add multiple components of the same application to the same template
- Template ABC has the following components: service 1, service 2, performance counter 1, URL 1
You can assign that template to multiple servers if the same application is running on them
- Template ABC -> Server 01
- Template ABC -> Server 02
I usually recommend separate templates for different applications rather than trying to combine all applications into one template on the server. E.g. don't monitor application ABC and application DEF in the same template. It makes it harder to see which of the two applications is down.
- Template ABC -> Server 01
- Template DEF -> Server 01
- Template ABC -> Server 02
You can use the same template and disable (or enable) particular components for specific nodes
- Template ABC -> Server 01 - 2 services, 1 performance counter, 1 URL
- Template ABC -> Server 02 - 1 service, 1 URL (the same as above but 1 service and performance counter is disabled because it may not exist on that server)

Now for the alerting. You can do this one of two ways and it depends on how granular you want to get when it comes to the notifications.

Application alerting
- When you create the alert, you use Application as the alert object
- Define the scope for this alert, e.g. application status is down AND
  - Does it have to match application ABC exactly?
  - Is it any application that contains ABC in the name?
  - Is it application ABC or DEF?
  - etc
- If you add more components to the template/application, the alert doesn't need to change
- Pros
  - You don't get spammed with multiple notifications when multiple components go down in the same application
- Cons
  - If component A goes down you will get an alert for the application going down.
  - If component B then goes down, you will NOT get another alert (the alert for the application being down is already active from component A making the application go down)

Component alerting
- Similar to the above but more granular
- When you create the alert, you use Component as the alert object
- Define the scope for this alert, e.g. component status is down AND
  - Does it have to match application ABC exactly?
  - Is it any application that contains ABC in the name?
  - Is it application ABC or DEF?
  - Or more granularly, you can match on specific component names. Does it match component name, does the component name contain ABC...
  - etc
- If you add more components to the template/application:
  - If you used application definitions in the trigger, the alert doesn't need to change
  - If you used component definitions in the trigger, i.e. to only look at specific components, you may need to update the alert for the new components
- Pros
  - If multiple components go down in the same application, you will get individual notifications
- Cons
  - You will get spammed for every single component going down - if you have an application with 10 components and 7 of them are services that stop, you will get 7 alerts.

Feel free to keep posting your questions to thwack as well!

ctech291

@shuth - YOU. ARE. AMAZING.

In one post, you provided exactly the information I needed at the level I needed it at. You answered my question, you provided pros and cons, you pointed me to the virtual classrooms.

This is exactly what I was looking for. With your post, I now have enough knowledge to move forward and train my coworkers and help our company monitor our applications (made up of various components) and provide better reliability for our customers.

Thank you!

And, here's the follow up question:

As I create my application monitor templates, made of components, and then alert on those applications to the application owners, I imagine from time-to-time there are going be application dependencies. Application A depends on Application B running, and Application B depends on the Node being in a good state.

Since Team A only owns application A (and Team B owns Application B, and Team C owns the node), Team A doesn't want to get alerted when Application B goes down. Nor does Team B want to get notified when the Node goes down.

I'm hoping that this can be setup in the Alert configuration? I tried doing it this way (for Team A's alert), but I wasn't sure if this was right:

For Team A, I want to make sure the Node is Up and Application B ("Anaylitcs Service shallow health check") is also working. If those two things are true, then verify that Application A ("Azure Pipelines Agents") isn't in a bad state.

I'm worried, though, that the Application Status clauses aren't going to be tied to the correct application?

Do I need to switch to an advanced SQL query at this point to make sure that the alert only fires if dependent applications and nodes are in a good state?

Thank you!

(And apologies if this escalated quickly... I've been working with monitoring tools for over a decade but my experience with solarwinds is still new. I've picked up a few things here and there, but it is these underlying concepts and some advanced topics that I seem to have a need to learn quickly. I'll definitely go start watching the virtual trainings they have!)

shuth

That's getting more complicated.

Generally when you require different alert trigger conditions and/or actions, you will need a separate alert.

Alert 1 - Application A goes down, email Team A
Alert 2 - Application B goes down, email Team B
Alert 3 - Node goes down, email Team C

There are some ways around this if the only difference is an email address.

Create an application (or node custom property)
In the alert trigger action, rather than hardcode an email address, reference the custom property.
For each application (or node), you will need to input the email address(es) into the custom property
There are various threads around on thwack for this. This will give you an idea: https://thwack.solarwinds.com/t5/Announcements-Discussions/Email-Custom-Property-Variable/m-p/416411

You can configure the alerts like your screenshot but it all comes down to how granular you want to get. If you only need to do this for 5-10 applications, you could probably get by with very specific alerts. If we're talking 50 applications, that's considerably more work/effort.

If you are going down the granular path, you could look at the complex condition option. Expand the Advanced Options on the Trigger Condition step of the alert and click the checkbox.

Other possibilities include:

Groups - populate the group with the node and applications
Dependencies - set up dependencies where object A is dependent on object B not being down
- https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Core-Creating-a-New-Dependency-sw1316.htm
- https://documentation.solarwinds.com/en/Success_Center/orionplatform/Content/Core-Managing-Groups-and-Dependencies-sw1694.htm

Other things to consider:

There is an implicit dependency between applications and their node
- If the node goes down, the application will change status to Unreachable
- If your Team B application alert is configured for "Application Status is equal to Down", the node going down will not trigger this alert (as the status will be unreachable, not down)
If you want to look at VERY SPECIFIC applications in the alert, you can use the "instance" option and select the specific application/object.
- Note that if you delete the application and re-add it, you'll need to update this alert as that previous instance/object will no longer exist

There's a whole bunch of different ways to handle this.

ctech291

Thank you. I think I'm going to spend a few hours reading documentation, watching videos, and become more proficient in solarwinds and I'm hoping that will give me the added knowledge I need to better understand the best option for our situation (and also the knowledge to better understand your response ).

Thank you again for your help. You've unlocked all sorts of capabilities for us!