Alert superseding

Hi,

Question: Is it possible to have a critical level alert supersede and then automatically clear/remove the warning level alert, if triggered for the same object. Node/Volume etc.

Example; We have two different alerts with thresholds for disk warning and critical level. When the disk usage is at critical, there is no reason that the warning alert is also shown in the dashboard - this is just now a redundant alert. Would be nice if the critical alert can "supersede" the warning alert and be the only one shown/triggered.

I have not been able to find a smart way of solving this. Any ideas thwack?

Thanks in advance.

Find more posts tagged with

custom alerts

advanced alerts

npm 12

Alerts

solarwinds alerts

Accepted answers

jkrenzien

In this case I would use custom properties. Create a property (v_alertlevel) and allow it to be null, warning, or critical. In my examples below I do not have this, so I used my v_mute property as a placeholder. change your trigger times so the critical will go off first and the warning is after it (I would use a full polling cycle, but you may be able to get away with a shorter time). In your trigger actions set v_alertlevel to the correct alert level and in the reset actions set it to null. This should have the affect of allowing your critical to fire and set the property ans thus excluding them from the warning alert. Another note about the custom property for you warning alert set it so that it is not equal to critical, You may not even want to check what v_alertlevel is set to on the critical alert, it may work better. On top of these 2 alerts if you have people clearing the alerts, instead of letting them reset you may need to go back through and clear v_alertlevel. Let me know if this this works for you or if you have issues with it.

Warning:

Critical:

All comments

jkrenzien

I think combining it into one alert may be your best bet. I would probably use the status has changed event(1x) and the status is not Up field comparisons. I can try to set up a similar alert, but are you using the warning and critical thresholds or have you defined something specific in the alert itself? Sorry if this post is vague, the caffeine is still settling in.

husum182

Yeah I have tried looking at that possibility, however since you set the alert warning/critical severity on the alert itself, it seems that one alert can only have one severity(Level). Sadly you cannot have two trigger conditions, with two alert levels in the same alert (As far as I can see at least).

I am using self defines threshold within the alert, since the built in Orion thresholds, only look at % usage. I have defined both % and a minimum of actual disk space left for each trigger condition, since disk sizes vary a lot.

Screenshot of actual trigger condition on one of the warning alerts.

Edit Alert - Low Disk Space C - Under 10% + 500MB - Windows Servers - Mozil_2016-09-08_07-48-07.png

This is then the critical severity alert - this will cause both alerts to trigger at the same time, when within the critical level. This is what makes the warning alert redundant.

jkrenzien

Warning:

Critical:

husum182

I think this might be the best workaround possible. Would be nice if they built this in as an option, to do this superseding. I will try this out. Thanks for the idea.