limiting the scope of the alert

Hello Sw community,

please share your your suggestion/ view on the following situation and did not this on this form if there was similar discussion.

Let us say an alert was set up based on the out-of-the- box settings and I want to limit the scope to certain nodes/ objects by excluding some other nodes. The alert scope option does not have an option to exclude nodes or a group that I create.

is there any easier way of accomplishing this with out deleting the 1st alert ?

my thought was to define two or three groups of node base on some criteria ...exclude this group from the rest of all nodes/objects an apply a new customized alert settings.

Thanks

Find more posts tagged with

alert scope

Accepted answers

All comments

mesverrum

So in Orion you need to use custom properties for the majority of your sorting/filtering tasks. In this case you say you have some groups and you want to exclude them from alerts, coming up with logic to make that happen is a pain without a custom property. Add a new property, tell your alert to only apply to nodes where <myproperty> does not contain "value". This also makes managing your groups a lot easier because you can use a dynamic group definition to automatically add nodes where <myproperty> is "whatever"

mestasew

thank you for your suggestion to use the custom property in excluding some nodes. my situation is however more than that. let us say you want to take advantage of Orion auto discover feature. as a result your outofthebox alerts objects scope size has a very large number of objects. To the majority of objects the outof the box alert thresholds works fine. However you needed to modify thresholds (reset or triggering ) based on the characteristics of the some objects. At this point I would say creating the group based on your similar behavior helps. the problem is we can not 1) change the out of the box alert settings. if I leave the out-of the box alert as its and create new alert with my threshold settings say for APP group 1 Appgroup 2 etc these particular objects will be monitored with two alerts.

I am feeling my option is disabling the out-of the box alerts and create duplicate , redefine the scope size based on the custom property etc is there a better way ?

mesverrum

I always suggest anyone disable the ootb alerts, they are just recommendations for a starting point, not best practices.

alankar.srivastava

Hi,

Create the copy of OOB alert and then you can play as you want.

Thanks

dgsmith80

100% Agree. If you're unsure you could leave the OOB Alert running alongside until you are comfortable that your new alert is working correctly.

lmcbuilder

Identify your nodes with custom properties and then group them with dynamic queries, then alert on the groups you select.

mestasew

I agree the bottom line is the OOTB alerts management especially for large heterogeneous network could be difficult and their usefulness would be less. However until a custom alert is setup it would have been nice and easier if SW add a third option to exclude objects (since the oob alerts are already running ). For example my Orion already running the high response time oob alert for a global company network in USA. I can simply group the nodes using their IP based on geographical location like Europe , Africa and Latin America.

Exclude this groups from from the scope and create a new alert by customizing their thresholds to each group. still the oob alerts is running for thousands of objects located in the had office. in this way the oob alerts help( as a starting point you indicated) speedup deployment of SW and simplify planning by using all objects discovered under the network environment.