Unable to get Advanced Alert Suppression filters working.

FormerMember

When I created an alert for highly utilized transmit interfaces it worked fine, but it was also giving me QAM interfaces and I don't want those. I added an Alert Suppression for  "interface name contains QAM" but now I get no alerts.

{code}

<?xml version="1.0" encoding="UTF-8"?>

<AlertDefinitions><AlertDefinition AlertDefID="{E8F56B65-DFC3-4013-9021-2634EF2F5AD1}" AlertName="Highly Utilized Transmit Interface" AlertDescription="This alert is when an interface transmits 85% or more of its bandwidth." Enabled="True" StartTime="12:00:00 AM" EndTime="11:59:59 PM" DOW="1,2,3,4,5,6,7" TriggerQuery="SELECT DISTINCT Interfaces.InterfaceID AS NetObjectID, Interfaces.FullName AS Name

FROM Interfaces

WHERE 

(

  (Interfaces.OutPercentUtil &gt;= 85)

)

" TriggerQueryDesign="&lt;QUERY&gt;&lt;KIND&gt;1&lt;/KIND&gt;&lt;COMPLEX&gt;&lt;TAG&gt;&lt;/TAG&gt;&lt;CONNECTIVE&gt;1&lt;/CONNECTIVE&gt;&lt;CHECKED&gt;1&lt;/CHECKED&gt;&lt;SIMPLE&gt;&lt;TAG&gt;&lt;/TAG&gt;&lt;ALIAS&gt;&lt;/ALIAS&gt;&lt;ADVANCED&gt;0&lt;/ADVANCED&gt;&lt;COMPARISON&gt;3&lt;/COMPARISON&gt;&lt;FUNCTION&gt;0&lt;/FUNCTION&gt;&lt;SORT&gt;0&lt;/SORT&gt;&lt;CHECKED&gt;1&lt;/CHECKED&gt;&lt;LEFTSIDEKIND&gt;2&lt;/LEFTSIDEKIND&gt;&lt;RIGHTSIDEKIND&gt;1&lt;/RIGHTSIDEKIND&gt;&lt;COMPARISONATTRIBUTES&gt;&lt;/COMPARISONATTRIBUTES&gt;&lt;FUNCTIONATTRIBUTES&gt;&lt;/FUNCTIONATTRIBUTES&gt;&lt;LEFTFIELDPATH&gt;Interfaces.Current Traffic.Xmit Percent Utilization&lt;/LEFTFIELDPATH&gt;&lt;RIGHTFIELDPATH&gt;&lt;/RIGHTFIELDPATH&gt;&lt;LEFTVALUETYPE&gt;0&lt;/LEFTVALUETYPE&gt;&lt;LEFTVALUE&gt;&lt;/LEFTVALUE&gt;&lt;LEFTCAPTION&gt;Xmit Percent Utilization&lt;/LEFTCAPTION&gt;&lt;RIGHTVALUETYPE&gt;5&lt;/RIGHTVALUETYPE&gt;&lt;RIGHTVALUE&gt;85&lt;/RIGHTVALUE&gt;&lt;RIGHTCAPTION&gt;85&lt;/RIGHTCAPTION&gt;&lt;/SIMPLE&gt;&lt;/COMPLEX&gt;&lt;/QUERY&gt;

" ResetQuery="SELECT DISTINCT Interfaces.InterfaceID AS NetObjectID

FROM Interfaces

WHERE 

(

  (Interfaces.OutPercentUtil &lt;= 65)

)

" ResetQueryDesign="&lt;QUERY&gt;&lt;KIND&gt;1&lt;/KIND&gt;&lt;COMPLEX&gt;&lt;TAG&gt;&lt;/TAG&gt;&lt;CONNECTIVE&gt;2&lt;/CONNECTIVE&gt;&lt;CHECKED&gt;1&lt;/CHECKED&gt;&lt;SIMPLE&gt;&lt;TAG&gt;&lt;/TAG&gt;&lt;ALIAS&gt;&lt;/ALIAS&gt;&lt;ADVANCED&gt;0&lt;/ADVANCED&gt;&lt;COMPARISON&gt;4&lt;/COMPARISON&gt;&lt;FUNCTION&gt;0&lt;/FUNCTION&gt;&lt;SORT&gt;0&lt;/SORT&gt;&lt;CHECKED&gt;1&lt;/CHECKED&gt;&lt;LEFTSIDEKIND&gt;2&lt;/LEFTSIDEKIND&gt;&lt;RIGHTSIDEKIND&gt;1&lt;/RIGHTSIDEKIND&gt;&lt;COMPARISONATTRIBUTES&gt;&lt;/COMPARISONATTRIBUTES&gt;&lt;FUNCTIONATTRIBUTES&gt;&lt;/FUNCTIONATTRIBUTES&gt;&lt;LEFTFIELDPATH&gt;Interfaces.Current Traffic.Xmit Percent Utilization&lt;/LEFTFIELDPATH&gt;&lt;RIGHTFIELDPATH&gt;&lt;/RIGHTFIELDPATH&gt;&lt;LEFTVALUETYPE&gt;0&lt;/LEFTVALUETYPE&gt;&lt;LEFTVALUE&gt;&lt;/LEFTVALUE&gt;&lt;LEFTCAPTION&gt;Xmit Percent Utilization&lt;/LEFTCAPTION&gt;&lt;RIGHTVALUETYPE&gt;5&lt;/RIGHTVALUETYPE&gt;&lt;RIGHTVALUE&gt;65&lt;/RIGHTVALUE&gt;&lt;RIGHTCAPTION&gt;65&lt;/RIGHTCAPTION&gt;&lt;/SIMPLE&gt;&lt;/COMPLEX&gt;&lt;/QUERY&gt;

" SuppressionQuery="SELECT Count(*) AS Supress

FROM Interfaces

WHERE 

(

  (Interfaces.InterfaceName LIKE '%QAM%')

)

" SuppressionQueryDesign="&lt;QUERY&gt;&lt;KIND&gt;1&lt;/KIND&gt;&lt;COMPLEX&gt;&lt;TAG&gt;&lt;/TAG&gt;&lt;CONNECTIVE&gt;2&lt;/CONNECTIVE&gt;&lt;CHECKED&gt;1&lt;/CHECKED&gt;&lt;SIMPLE&gt;&lt;TAG&gt;&lt;/TAG&gt;&lt;ALIAS&gt;&lt;/ALIAS&gt;&lt;ADVANCED&gt;0&lt;/ADVANCED&gt;&lt;COMPARISON&gt;8&lt;/COMPARISON&gt;&lt;FUNCTION&gt;0&lt;/FUNCTION&gt;&lt;SORT&gt;0&lt;/SORT&gt;&lt;CHECKED&gt;1&lt;/CHECKED&gt;&lt;LEFTSIDEKIND&gt;2&lt;/LEFTSIDEKIND&gt;&lt;RIGHTSIDEKIND&gt;1&lt;/RIGHTSIDEKIND&gt;&lt;COMPARISONATTRIBUTES&gt;&lt;/COMPARISONATTRIBUTES&gt;&lt;FUNCTIONATTRIBUTES&gt;&lt;/FUNCTIONATTRIBUTES&gt;&lt;LEFTFIELDPATH&gt;Interfaces.Interface Details.Interface Name&lt;/LEFTFIELDPATH&gt;&lt;RIGHTFIELDPATH&gt;&lt;/RIGHTFIELDPATH&gt;&lt;LEFTVALUETYPE&gt;0&lt;/LEFTVALUETYPE&gt;&lt;LEFTVALUE&gt;&lt;/LEFTVALUE&gt;&lt;LEFTCAPTION&gt;Interface Name&lt;/LEFTCAPTION&gt;&lt;RIGHTVALUETYPE&gt;8&lt;/RIGHTVALUETYPE&gt;&lt;RIGHTVALUE&gt;QAM&lt;/RIGHTVALUE&gt;&lt;RIGHTCAPTION&gt;QAM&lt;/RIGHTCAPTION&gt;&lt;/SIMPLE&gt;&lt;/COMPLEX&gt;&lt;/QUERY&gt;

" TriggerSustained="0" ResetSustained="0" LastExecuteTime="5/23/2014 10:55:34 AM" ExecuteInterval="60" BlockUntil="5/23/2014 10:55:34 AM" ResponseTime="0" LastErrorTime="12:00:00 AM" LastError="" ObjectType="Interface" IgnoreTimeout="True"><AlertActions><AlertAction ActionDefID="{A621CEA4-8D3D-4DF6-9A76-8F939260185F}" AlertDefID="{E8F56B65-DFC3-4013-9021-2634EF2F5AD1}" TriggerAction="True" ExecuteIfAcknowledged="True" TimeOffset="0" RepeatInterval="0" StartTime="12:00:00 AM" EndTime="11:59:59 PM" DOW="1,2,3,4,5,6,7" SortOrder="1" ActionType="NPMEventLog" Title="NetPerfMon Event Log : Interface Utilization has exceed 85% of the bandwitdh." Target="" Parameter1="Interface Utilization has exceed 85% of the bandwitdh." Parameter2="" Parameter3="" Parameter4="" NetObjectType=""/><AlertAction ActionDefID="{A4854E00-B1CA-410F-BB86-6EB5E1E7CD91}" AlertDefID="{E8F56B65-DFC3-4013-9021-2634EF2F5AD1}" TriggerAction="False" ExecuteIfAcknowledged="True" TimeOffset="0" RepeatInterval="0" StartTime="12:00:00 AM" EndTime="11:59:59 PM" DOW="1,2,3,4,5,6,7" SortOrder="1" ActionType="NPMEventLog" Title="NetPerfMon Event Log : Interface Utilization has dropped below 65% of the bandwitdh." Target="" Parameter1="Interface Utilization has dropped below 65% of the bandwitdh." Parameter2="" Parameter3="" Parameter4="" NetObjectType=""/></AlertActions></AlertDefinition></AlertDefinitions>

{\code}

RomeoG

I still have not figured out the exact use for the Alert Suppression tab. It doesn't work the way people usually thinks it does.

But, to do what you are wanting, I would add this rule in the Trigger Conditions:

Create a condition group that says "Trigger Alert when none of the following apply".

Then, under the condition group, add a simple condition that says "interface name contains QAM".