Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

What can you do with the Basic Alerts that you CANNOT do with the Advanced Alerts in 8.5?

In 2008, we intend to discontinue the basic alert engine and use only the advanced alert engine. In order to make that transition, we need to be sure that the Advanced Alert Engine can now do everything that the Basic Alert Engine can do. If we're still missing functionality, we'll need to add that in before we deprecate Basic Alerts.

Please don't look at 8.0 or 8.1, because we added functionality in 8.5.

So in 8.5, what's the gap between Basic Alerts and Advanced Alerts?

Find more posts tagged with

Accepted answers

All comments

jainsworth

I'm sure this is probably things I am doing incorrectly, but to this point I can't get the Advanced Alerts to do anything. Only basic alerts work for me, and haven't had time to deal with it.

FormerMember

I'm sure this is probably things I am doing incorrectly, but to this point I can't get the Advanced Alerts to do anything. Only basic alerts work for me, and haven't had time to deal with it.

"anything" is fairly broad. Have you tried with 8.5 yet? We made a lot of usability improvements to the UI.

jainsworth

None of the alerts I have tried have worked. These include Down Nodes, Volumes not responding, high memory usage, interface down.

My next step is to try 8.5, just have other items on the plate right now.

btp

I tried since 8.0 to move alerts to Advanced Alert engine. With 8.5 there seems to be a lot that actually works.. For the time being I only see one slight flaw regarded to time format, resulting in different alerts for same incident:

DSLAM nl-austsin-dsl (10.20.17.216) booted (Wednesday, September 19, 2007 11:15 AM)

DSLAM nl-austsin-dsl (10.20.17.216) booted (19. september 2007 11:15)

bleearg13

So in 8.5, what's the gap between Basic Alerts and Advanced Alerts?

Modifiers such as "-Raw", "-Cooked", etc.

mward

One thing I have found that is missing from the Advanced Alerts is a "Global" Temporary disable for all alert actions. This is best usable when maintenance activities are being done so that you don't get a number of alerts you already know are going to happen.

mward

Also,

Let's say you have 100 routers and you want to alert only on a single serial interface that goes down and not any other interface in the router. In the current basic alerts, you can select what interfaces easily you want applied for each rule, in the advanced alerts, this would mean 100 rules for a single alert for a trigger condition and 100 rules for a single alert for a reset condition. This cannot be good for processing of rules on the server or application. If you multiply that by a couple different alerts, it gets unmanageable quickly.

This could also be said if you have a large switch farm and you want different alerts based upon differnet switch ports in that single switch your rules get large and unmanageable almost immedialy. This could be you want critical alerts for critical servers and other alerts for other servers or if you have a server farm with multiple IT environments and need to notify different groups based on which set has problems.

The current basic rules do just that, simplify the rule process, you select the property to monitor, what element to apply that to and the actions to use. This is all done in a graphical manner which is easy to see what you are applying and what you are getting as a result.

FormerMember

Also,
Let's say you have 100 routers and you want to alert only on a single serial interface that goes down and not any other interface in the router. In the current basic alerts, you can select what interfaces easily you want applied for each rule, in the advanced alerts, this would mean 100 rules for a single alert for a trigger condition and 100 rules for a single alert for a reset condition. This cannot be good for processing of rules on the server or application. If you multiply that by a couple different alerts, it gets unmanageable quickly.
This could also be said if you have a large switch farm and you want different alerts based upon differnet switch ports in that single switch your rules get large and unmanageable almost immedialy. This could be you want critical alerts for critical servers and other alerts for other servers or if you have a server farm with multiple IT environments and need to notify different groups based on which set has problems.
The current basic rules do just that, simplify the rule process, you select the property to monitor, what element to apply that to and the actions to use. This is all done in a graphical manner which is easy to see what you are applying and what you are getting as a result.

Can't you accomplish this with Custom Properties?

mward

Using custom properties would solve some of the problem, but also make it more complex.

Basic rules are simple to implement and use, having to do multiple applications to generate simple results may put you in the position you have to hire someone just to build rule sets to support your network.

FormerMember

Using custom properties would solve some of the problem, but also make it more complex.
Basic rules are simple to implement and use, having to do multiple applications to generate simple results may put you in the position you have to hire someone just to build rule sets to support your network.

So it's not missing, but you're saying it's significantly more hassle. Fair enough.

videotech

OK, I have just finished testing with Advanced alerts in 8.5

Here is what I am trying to do:

Create an alert for when simple nodes go down and up. Also suppress the simple nodes if an upstream device goes into down or warning state.

I have created this one alert that does all of the above using the basic alerts and it works fine. I have been trying to do the
same with the advanced alerts, but the suppression does not work.

Our setup:

We 10 or so devices which are connected to Switch 1 and Switch 2.
Switch 2 is connected to Switch 1
Switch 1 is connected to Router.

I want this alert to suppress the any of the 10 devices if either Switch 1, Switch 2 or the Router go into DOWN or WARNING state.
I have this setup using basic alerts and works fine.

Advanced alert logic:

1)Trigger:

Trigger if ALL apply:

Trigger if ALL apply:
Node Stutus is equal to DOWN

Trigger if ANY apply:
NodeName is equal to Node1
NodeName is equal to Node2
NodeName is equal to Node3
NodeName is equal to Node4
NodeName is equal to Node5
NodeName is equal to Node6
NodeName is equal to Node7
NodeName is equal to Node8
NodeName is equal to Node9
NodeName is equal to Node10

2)Reset:

Reset if ALL apply:

Reset if ALL apply:
Node Stutus is equal to UP

Reset if ANY apply:
NodeName is equal to Node1
NodeName is equal to Node2
NodeName is equal to Node3
NodeName is equal to Node4
NodeName is equal to Node5
NodeName is equal to Node6
NodeName is equal to Node7
NodeName is equal to Node8
NodeName is equal to Node9
NodeName is equal to Node10

Please note that at this stage, both the trigger and reset alerting is working as expected.

3)Suppress:

Suppress if ALL of the following apply:

Suppress alert if ANY apply:
Node Status ie equal to DOWN
Node Status ie equal to WARNING

Suppress alert if ANY apply:
NodeName is equal to Router
NodeName is equal to Switch 1
NodeName is equal to Switch 2

Now I can do this using basic alerts with no problems. I think my logic is correct. There is no reason why I should
not be able to do this with one alert.

Please can you help me out here.

Thanks.

gbrance

The only gap that I can see is the ability to use one check box to disable all the alarms when you are doing maintenance.

bbusbey

We had many problems with Advanced Alerts that Solarwinds can testify to.

It was not until ver 8.1 that they were able to reliably work for us.

We wanted to get an alert when the serial interface exceeded certain amount of errors per hour, the trigger would work but it would never perform an action.

Network_Guru

OK, I have just finished testing with Advanced alerts in 8.5
Here is what I am trying to do:
Create an alert for when simple nodes go down and up. Also suppress the simple nodes if an upstream device goes into down or warning state.
I have created this one alert that does all of the above using the basic alerts and it works fine. I have been trying to do the
same with the advanced alerts, but the suppression does not work.

Our setup:
We 10 or so devices which are connected to Switch 1 and Switch 2.
Switch 2 is connected to Switch 1
Switch 1 is connected to Router.
I want this alert to suppress the any of the 10 devices if either Switch 1, Switch 2 or the Router go into DOWN or WARNING state.
I have this setup using basic alerts and works fine.
Advanced alert logic:

1)Trigger:
Trigger if ALL apply:
Trigger if ALL apply:
Node Stutus is equal to DOWN
Trigger if ANY apply:
NodeName is equal to Node1
NodeName is equal to Node2
NodeName is equal to Node3
NodeName is equal to Node4
NodeName is equal to Node5
NodeName is equal to Node6
NodeName is equal to Node7
NodeName is equal to Node8
NodeName is equal to Node9
NodeName is equal to Node10
2)Reset:
Reset if ALL apply:
Reset if ALL apply:
Node Stutus is equal to UP
Reset if ANY apply:
NodeName is equal to Node1
NodeName is equal to Node2
NodeName is equal to Node3
NodeName is equal to Node4
NodeName is equal to Node5
NodeName is equal to Node6
NodeName is equal to Node7
NodeName is equal to Node8
NodeName is equal to Node9
NodeName is equal to Node10
Please note that at this stage, both the trigger and reset alerting is working as expected.
3)Suppress:

Suppress if ALL of the following apply:
Suppress alert if ANY apply:
Node Status ie equal to DOWN
Node Status ie equal to WARNING
Suppress alert if ANY apply:
NodeName is equal to Router
NodeName is equal to Switch 1
NodeName is equal to Switch 2

Now I can do this using basic alerts with no problems. I think my logic is correct. There is no reason why I should
not be able to do this with one alert.
Please can you help me out here.
Thanks.

You could greatly simplify this using custom properties.
Create a custom property called "site" or WHY.
Then add the same site description "xyz" for all 10 nodes & Router 1 & Switch 1 & 2 to this custom property.

Trigger if ALL apply:

Node Status is equal to DOWN
(custom property)Site is equal to "xyz"

Create a custom property called "suppression_level" or WHY.
Then add a number such as 10 for the router & 20 for Switch 1 & 2 to this custom property.

Suppress if ALL of the following apply:

Node Status is not equal to UP
(custom property)Site is equal to "xyz"
(custom property)suppression_level is equal or less than 20

This should suppress the alerts for the nodes if the router or any switch is not up.
Let me know if this logic works or even makes sense for you.

mkocsis

A simple Reboot Alert. I haven't tried it with 8.5 yet, but prior we had to customize the datebase. It shouldn't be that difficult.

Thank you.

Michael

FormerMember

A simple Reboot Alert. I haven't tried it with 8.5 yet, but prior we had to customize the datebase. It shouldn't be that difficult.

We specifically addressed that in 8.5, so that gap should be closed.

videotech

Sorry for the last response. Hmm this might work I will be trying it out soon and I will let you know of my findings...

Thanks.

jtimes

The CURRENT VALUE field is pretty much useless in the Active Alerts view, but it always has been in Advanced Alerts

Can we get the Active Alerts view as a resource that can be modify, like to add sort and or filter abilities?

FormerMember

The CURRENT VALUE field is pretty much useless in the Active Alerts view, but it always has been in Advanced Alerts

I assume you're talking about the Active Alerts resource. "Current Value" doesn't mean anything to Active Alerts, but as long as both Basic and Advanced alerts share the resource, we need that column. When Basic Alerts go away, that column will go away.

Can we get the Active Alerts view as a resource that can be modify, like to add sort and or filter abilities?

Can you elaborate? I'm not sure what you're looking for.

mkocsis

We want to monitor volume usage and alert if percent used is over a specific value. In Basic its fairly straight forward. I can't seem to find a straight forward solution for this alert in Advanced. I'm fine for CPU and memory, just not volume.

Michael

jtimes

Can you elaborate? I'm not sure what you're looking for.

The Active Alert (aka All Tiggered Alerts) section on the Summary view is a "locked" resource (it does not have an edit button.)

I would like the ability to edit it on the Summary view

Alerts.GIF

FormerMember

The Active Alert (aka All Tiggered Alerts) section on the Summary view is a "locked" resource (it does not have an edit button.)

Got it. That's a request for both Basic and Advanced, however, not something specific to Advanced Alerts.

FormerMember

We want to monitor volume usage and alert if percent used is over a specific value. In Basic its fairly straight forward. I can't seem to find a straight forward solution for this alert in Advanced. I'm fine for CPU and memory, just not volume.

Unless I'm unclear on what you want to do, that's already in the product. Does this screenshot represent what you want to do?:

advanced alert for volume %.jpg

mkocsis

Yup. So sorry. I didn't change the "Type of Property to Monitor" to "Volume".

FormerMember

Yup. So sorry.

Why sorry? Through a little cut-and-paste, I just gave you a feature you were asking for. Trust me, it's rarely that easy.

steele

The biggest thing that I have noticed was the inability to add a message to be included in traps. Every alert we create is forwarded to and event aggregator using SNMP traps. In 7, we mapped the OIDs and the msg field was populated with whatever we want in it. I was adding things like Remedy CTI fields, severity, etc which we pushed up in automatic ticket creation.

Basic Alerts using Traps allows a msg field to be populated. The advanced alerting obviously doesn't have that option.

videotech

Yes, this makes sense and does work, UNTIL the UP reset alerts come through!

Don't forget this 1 alert is meant to trigger when devices are DOWN and Trigger when devices come back up, whilst suppressing these down & up if the Router or switches go down.

Any ideas how this can be done in this one alert?

FormerMember

Yes, this makes sense and does work, UNTIL the UP reset alerts come through!

Not sure what you're referring to....

videotech

OK, I have just finished testing with Advanced alerts in 8.5
Here is what I am trying to do:
Create an alert for when simple nodes go down and up. Also suppress the simple nodes if an upstream device goes into down or warning state.
I have created this one alert that does all of the above using the basic alerts and it works fine. I have been trying to do the
same with the advanced alerts, but the suppression does not work.

Our setup:
We 10 or so devices which are connected to Switch 1 and Switch 2.
Switch 2 is connected to Switch 1
Switch 1 is connected to Router.
I want this alert to suppress the any of the 10 devices if either Switch 1, Switch 2 or the Router go into DOWN or WARNING state.
I have this setup using basic alerts and works fine.
Advanced alert logic:

1)Trigger:
Trigger if ALL apply:
Trigger if ALL apply:
Node Stutus is equal to DOWN
Trigger if ANY apply:
NodeName is equal to Node1
NodeName is equal to Node2
NodeName is equal to Node3
NodeName is equal to Node4
NodeName is equal to Node5
NodeName is equal to Node6
NodeName is equal to Node7
NodeName is equal to Node8
NodeName is equal to Node9
NodeName is equal to Node10
2)Reset:
Reset if ALL apply:
Reset if ALL apply:
Node Stutus is equal to UP
Reset if ANY apply:
NodeName is equal to Node1
NodeName is equal to Node2
NodeName is equal to Node3
NodeName is equal to Node4
NodeName is equal to Node5
NodeName is equal to Node6
NodeName is equal to Node7
NodeName is equal to Node8
NodeName is equal to Node9
NodeName is equal to Node10
Please note that at this stage, both the trigger and reset alerting is working as expected.
3)Suppress:

Suppress if ALL of the following apply:
Suppress alert if ANY apply:
Node Status ie equal to DOWN
Node Status ie equal to WARNING
Suppress alert if ANY apply:
NodeName is equal to Router
NodeName is equal to Switch 1
NodeName is equal to Switch 2

Now I can do this using basic alerts with no problems. I think my logic is correct. There is no reason why I should
not be able to do this with one alert.
Please can you help me out here.
Thanks.

You could greatly simplify this using custom properties.
Create a custom property called "site" or WHY.
Then add the same site description "xyz" for all 10 nodes & Router 1 & Switch 1 & 2 to this custom property.
Trigger if ALL apply:

Node Status is equal to DOWN
(custom property)Site is equal to "xyz"
Create a custom property called "suppression_level" or WHY.
Then add a number such as 10 for the router & 20 for Switch 1 & 2 to this custom property.
Suppress if ALL of the following apply:

Node Status is not equal to UP
(custom property)Site is equal to "xyz"
(custom property)suppression_level is equal or less than 20
This should suppress the alerts for the nodes if the router or any switch is not up.
Let me know if this logic works or even makes sense for you.

Yes, this makes sense and does work, UNTIL the UP reset alerts come through!

Don't forget this 1 alert is meant to trigger when devices are DOWN and Trigger when devices come back up, whilst suppressing these down & up if the Router or switches go down.

Any ideas how this can be done in this one alert?

videotech

OK, I have just finished testing with Advanced alerts in 8.5
Here is what I am trying to do:
Create an alert for when simple nodes go down and up. Also suppress the simple nodes if an upstream device goes into down or warning state.
I have created this one alert that does all of the above using the basic alerts and it works fine. I have been trying to do the
same with the advanced alerts, but the suppression does not work.

Our setup:
We 10 or so devices which are connected to Switch 1 and Switch 2.
Switch 2 is connected to Switch 1
Switch 1 is connected to Router.
I want this alert to suppress the any of the 10 devices if either Switch 1, Switch 2 or the Router go into DOWN or WARNING state.
I have this setup using basic alerts and works fine.
Advanced alert logic:

1)Trigger:
Trigger if ALL apply:
Trigger if ALL apply:
Node Stutus is equal to DOWN
Trigger if ANY apply:
NodeName is equal to Node1
NodeName is equal to Node2
NodeName is equal to Node3
NodeName is equal to Node4
NodeName is equal to Node5
NodeName is equal to Node6
NodeName is equal to Node7
NodeName is equal to Node8
NodeName is equal to Node9
NodeName is equal to Node10
2)Reset:
Reset if ALL apply:
Reset if ALL apply:
Node Stutus is equal to UP
Reset if ANY apply:
NodeName is equal to Node1
NodeName is equal to Node2
NodeName is equal to Node3
NodeName is equal to Node4
NodeName is equal to Node5
NodeName is equal to Node6
NodeName is equal to Node7
NodeName is equal to Node8
NodeName is equal to Node9
NodeName is equal to Node10
Please note that at this stage, both the trigger and reset alerting is working as expected.
3)Suppress:

Suppress if ALL of the following apply:
Suppress alert if ANY apply:
Node Status ie equal to DOWN
Node Status ie equal to WARNING
Suppress alert if ANY apply:
NodeName is equal to Router
NodeName is equal to Switch 1
NodeName is equal to Switch 2

Now I can do this using basic alerts with no problems. I think my logic is correct. There is no reason why I should
not be able to do this with one alert.
Please can you help me out here.
Thanks.

You could greatly simplify this using custom properties.
Create a custom property called "site" or WHY.
Then add the same site description "xyz" for all 10 nodes & Router 1 & Switch 1 & 2 to this custom property.
Trigger if ALL apply:

Node Status is equal to DOWN
(custom property)Site is equal to "xyz"
Create a custom property called "suppression_level" or WHY.
Then add a number such as 10 for the router & 20 for Switch 1 & 2 to this custom property.
Suppress if ALL of the following apply:

Node Status is not equal to UP
(custom property)Site is equal to "xyz"
(custom property)suppression_level is equal or less than 20
This should suppress the alerts for the nodes if the router or any switch is not up.
Let me know if this logic works or even makes sense for you.

Yes, this makes sense and does work, UNTIL the UP reset alerts come through!
Don't forget this 1 alert is meant to trigger when devices are DOWN and Trigger when devices come back up, whilst suppressing these down & up if the Router or switches go down.
Any ideas how this can be done in this one alert?

Does anyone have an answer to this question? can what I am trying to achieve be done in 1 advanved alert, like it is done with 1 basic alert?

If not can a developer or a senior SW guy (dclecompte)
please explain why this is the case. What is the fundamental difference between the way basic and advanced alerts work.

Thanks.

clefranc

The 'Change Custom Property' is not include in 'Select an Action' ('Add New Action' button of the 'Trigger Actions' tab in 'Edit Advanced Alert'). It is only available with a 'Basic Alert'. I think there is another 'Action' missing in 'Advanced Alert'.

aLTeReGo

Denny for some reason any advanced alerts that I create for applications don't display in the "Active Alerts" resource when triggered.

The display properly under "Alerts - Advanced Alerts" but never in the "Active Alerts" resource. Any idea why and if/when this will be fixed?

FormerMember

Is this a change from 8.1?

aLTeReGo

Not that I'm aware, but I remember this working on a 8.x beta somewhere along the line. Is there any particular reason why Application Alerts don't display in Active Alerts?

FormerMember

I'll look into the issue with Application Monitor. The AM replacement due out early Q1 will not have the same problem.

torrielw

I totally agree with you on that. Being able to simply select the single device/interface(s) you are targeting versus implementing CPE is the more efficient method. I've spent several hrs trying to get Advanced Alerts to work in different scenarios to move away from Basic Alerts only to send alerts on 100s of devices that I didn't think fit all my criteria. I would say leave Basic Alerting IN. Don't add any additonal functionality to it but leave it. Anybody can sit down a setup a BASIC alert.

dbatten

The main functionality to address is improving the user interface for the Advanced Alerts. I made the decision for our organization to only use the Advanced alerts since we need to integrate with other systems.

I do not like having to check to different lists of alerts, so I am glad to see the Basic Alerts being retired--from that perspective.

dbatten

Also,
Let's say you have 100 routers and you want to alert only on a single serial interface that goes down and not any other interface in the router. In the current basic alerts, you can select what interfaces easily you want applied for each rule, in the advanced alerts, this would mean 100 rules for a single alert for a trigger condition and 100 rules for a single alert for a reset condition. This cannot be good for processing of rules on the server or application. If you multiply that by a couple different alerts, it gets unmanageable quickly.
This could also be said if you have a large switch farm and you want different alerts based upon differnet switch ports in that single switch your rules get large and unmanageable almost immedialy. This could be you want critical alerts for critical servers and other alerts for other servers or if you have a server farm with multiple IT environments and need to notify different groups based on which set has problems.
The current basic rules do just that, simplify the rule process, you select the property to monitor, what element to apply that to and the actions to use. This is all done in a graphical manner which is easy to see what you are applying and what you are getting as a result.

Can't you accomplish this with Custom Properties?

I find using the basic alerts for the purpose you describe more time consuming and complex over the long-term. Depending on the size of the environment you can end up with many alerts for the same purpose, becoming difficult to manage over time. However the same purpose can be achieved with fewer advanced alerts.

We have 4 important custom properties for use in our environment: site name (location), line of business (a.k.a. company/client), group (e.g. Internet edge, or server farm), and support level. The latter two properties are used in the node table and interface tables.

In our environment we have established an "Alert Framework" that aligns with our SLA model for Incidents and Problems--4 different levels of support (or severity). The support level drives the notification response requirements (i.e. 7x24 page out, etc.). In this manner we apply alerts to groups of devices and interfaces that have like attributes. This avoids the 1 alert to 1 device possibility that becomes unmanagable.

We build alerts based on group error conditions, using the custom properties to determine if the alert should get triggered, and the appropriate response actions. This way the same error on a non-critical device does not cause a false alarm, and generate irrelevant Incident tickets.

Ralphr

Basic Alerts allow you to change Custom Properties as an action. This action is not available via the Advanced Alert Engine.