Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Node Suppression for Interface Alert Not Working

I just wanted to mention I've opened case # 75635 for an issue I'm having with alert suppression. I've created an alert to notify if "critical" interfaces on routers go down. The alert triggers if the interface is "Not Equal" to Up. I had to include a supprression if the node was unmanaged otherwise unmanaged nodes will trigger in the alerts. There appears to be a bug that doesn't like suppressing an alert based on node when you're monitoring the interface.

Find more posts tagged with

Accepted answers

All comments

DirtySouth

It appears that this affects any monitor, Node or Interface. I'm unable to suppress any alerts based on a nodes status of "Unmanaged". Anyone else having this issue?

AMSW

i may be experiencing a similar issue. please provide us with an update when/if you get somewhere on that ticket. Thanks.

DirtySouth

Unfortunately no updates. I've had to remove that particular alert suppression so that all of my unmanaged devices don't show up in alerts and constantly email me. What issue are you seeing?

AMSW

interface down advanced alert worked fine until setting up the alert suppression based off node custom property Department. Now NO interface down alerts get triggered. I am just thinking there may be an issue when using any Node condition for an Interface supression...

Tuchux

I am having a similar problem with Advanced Alerts. Have set up an advanced alert to monitor %Volume Used. Have trigger at PercentVolumeUsed over 90%. This works fine by itself but for some reason it also alerts on Physical and Virtual memory. I added an Alert Suppression to say if Caption = Physical Memory OR Virtual Memory suppress the alert. Unfornately it suppresses all volume alerts.

DirtySouth

That sounds like it could be related. I haven't received any updates yet. I just emailed support again.

sedmo

Can you post the trigger and suppresion criteria for your alert?

The alert suppression function isn't particularly intuitive. I think most people would assume that the suppresion criteria is automatically associated to the trigger criteria but this is not the case. The suppression criteria is basically an independent query that uses the count function to see if any records are returned when the query is executed. For example, if you configure an alert criteria that says:

Trigger Alert when all of the following apply

InterfaceID is equal to 30

And then configure a suppresion that says:

Suppress Alert when all of the following apply

Status Description is equal to Node status is Unmanaged

You might assume that the suppression would only apply to the node that contains the interface specified in the trigger criteria but it doesn't. In this case, it would apply to any node in the database. This will cause the alert to be suppressed if any node in the database has an unmanaged status.

Hope I have explained this properly and clearly.

Tuchux

Sedmo,

Here is the trigger condition:

Volume Percent Used is Greater Than '90'

Vendor is equal to 'Windows'

The suppression is:

Caption Contains 'Physical Memory'

I made the assumption that the suppression criteria was based against a single trigger and if the trigger was on volume Physical Memory that it would be suppressed.

The idea being that Solarwinds sees Physical and Virtual Memory as volumes and we only want to alert on Physical Disk volumes.

Tuchux

Sedmo,

OK ...I re-read your post and if I understand correctly...In advanced alerts the Suppression function runs your query against the entire database not the trigger and; in my case, If I have a suppression of "Caption contains Physical Memory" then any node that has Physical memory being monitored would never trigger the alert correct..

Tuchux

DirtySouth

Sedmo, you're absolutely right. I did hear back from Support yesterday and that is basically what I was told. The suppression is not specific to the monitor that is triggered. Instead, it queries the entire database for any node matching the suppression.

I'm at a loss as to why suppressions would be configured this way. Support reccomended a workaround that seems to be doing the same thing...

-----------------

Type of Property to Monitor: Interface

Trigger Alert when all of the following apply:

Interface Status is not equal to UP

Node Status is Not Equal to UnManaged

Critical is Equal to Yes

------------------