Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Starting with Solarwinds, best things to alert on?

Hi Guys,

I've recently started at a company and I have been tasked with improving the Solarwinds monitoring. I had experience with other monitoring tools but I'm relatively new to Solarwinds.

Currently we mainly use NPM and NCM but we only really look for ups and downs. We are monitoring switches, routers, phone systems and servers. I'd like to branch out with the monitoring and do more than ups and downs but I'm wondering if you helpful people can give me some guidance on what’s best to alert on? I'd like to create some new alerts but I'd rather not do it just for the sake of adding new alerts...

The alerts I'm thinking of adding are:

Node Down
Node Reboot
Interface Down
Disk Space
CPU Load
Memory Utilization
Bandwidth Utilization
Packet Loss
Latency
Hardware Errors
NCM config backup fails
Fan speed
Power supply
Temperature
IP address change
DNS change
MAC address change
Monitor ports in switch to show unplugged/Up

Is this a good start or can anyone else think of others things that would be added benefit to Solarwinds?

Find more posts tagged with

Accepted answers

All comments

vjerez4129

you could do config changes in that list, just make sure you don't bombard yourself with too many alerts that you miss the important ones

cjfranca

For me

Node Down
Interface Down
Disk Space
CPU Load
Memory Utilization
Bandwidth Utilization
Packet Loss
Latency
Hardware Errors
NCM config backup fails

Temperature

IP address change
DNS change

this it´s more important the another you configure if you need. Is importnt you study that your company need

lynchnigel

UPS's

temperature

humidity

any other hardware that requires specific TLC and needs custom pollers sorting out

stacked switch status of each member

chad71

UGH! The interface down alert on edge switches is brutal!! LOL!

cjfranca

what ?

kkkkkkkkkkkkk

dave234

Thanks, for the help. They were only monitoring a few devices so I have just finished adding more of the important devices. I wanted a good starting point I could work on and as the work continues I'll start customizing it to our needs

dave234

Thanks for the reply, that is what I am wary of. I want to add more meaning without flooding everyone with pointless alerts.

vjerez4129

i recommend creating some dependencies too, especially if you have servers on esx hosts, devices hooked on switches, etc. it'll also help when something big goes down and you don't get flooded with alerts when something does go down

dave234

Good point, we have a number of ESX servers and it would be useful on switches

jstinson1

Hello Dave234,

These are all good alerts to start with. It's important to find that balance in alerting so you are not getting so many that you become desensitize, when you get an alert from Solarwinds it should be something worth stopping and checking out. I would recommend on your CPU and Memory alerts to set them to exist for at least more than one polling cycle, that way you are not getting alerts that you might not be able to address. Memory and CPU tend to spike and then go back down what you really want to know is this spiking and staying spiked. You don't want to get an alert and by the time you read it and check the server its already normalized. You can do this by checking the box under the trigger condition that states "Condition must exist for more than". You might find this feature useful for some of your other alerts as well as time goes on such on the interfaces on the edge switches that was mentioned. Created a custom property, add those interfaces to it and then create an alert that alerts you when those interfaces are down for a longer period of time say 2 or 3 polling cycles.

Good Luck!

chriso

BGP, EIGRP, OSPF, etc... peer changes is usally a good one to alert on as well that could trigger a syslog message or ticket to be sent ot the correct group.

lynchnigel

All our edge switch names end in -ESW ditto with distribution that way you can filter nodes:

Caption Like '*DSW*' OR caption LIKE '*VSS*' AND status <> 9

gives you all the VSS and DSW's that are down, so you can see if there is something major happening

dave234

Thanks, useful information

cjfranca

Great.

mattoz

Some thoughts:

1. Echo other comments... don't set up every alert you can think of right away. Grow them over time. As things happen, you will think, "hey, how can I alert on that for next time?". This is where some of the most interesting alerts come from. It may be something unique to your environment.

2. Are there any trouble spots in your environment right now? CPU or memory bottlenecks on a DC or critical server? Bandwidth issues? Weird app which gets flaky sometimes? Write alerts for these. They will be useful, and appreciated by others.

3. Get buy-in from other IT staff. Not sure how many you have, but in my environment, we have teams of 4-8 staff for network, data center, server infrastructure. Then field techs, and a NOC. Talk to people, and ask what they would like see. Some will only want up/down, because they have their own method of looking at the specifics, or because they don't want to know about performance issues (yes, that's what I typed). Sometimes you can get them to buy in to better monitoring by listening to what they complain about. Then write an alert that might help.