Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Alert suppression condition irreversibly breaks an alert

I have a support case open for this, but I want to bounce this off the SME's here.

It seems that if I add any alert suppression condition to any alert, it completely breaks the alert.

Specifically, I took the default "node rebooted" advanced alert and specified that it only send an alert if the node if the "Machine type = server". I was still getting some reboot notifications on printer nodes, so I added a suppression condition that if the node name contained "NPI" not to send the alert. As soon as I add that or any other suppression condition, the alert stops working. Removing the alert suppression does not return the alert to a working state.

When I worked through this problem with technical support, nothing short of doing a complete two hour long repair of the core Orion services resolved the problem. Once I completed that repair, all problematic alerts starting working again. As soon as I added once suppression condition to the "node rebooted" alert, it broke again. Oddly enough, if I "test" the alert an email is successfully sent. Also, a server reboot does appear in the list of events.

Thanks,

Craíg

Find more posts tagged with

Accepted answers

HolyGuacamole

The alert suppression should only affect that alert. If the alert did not return to a working state upon removing the suppression condition, did you try deleting and re-creating that alert instead? It should be much quicker than having to repair Core. Again, a screenshot of your Trigger condition will really help here.

All comments

adatole

The short answer is that "suppress" doesn't do what you think it does. Never ever ever use it.\\

https://thwack.solarwinds.com/message/204905#204905

HolyGuacamole

It sounds like Alert Supression is not what you need to define here. Instead, the Trigger conditions need to be defined properly. Is your Machine Type just an example, because the value is usually never Server for machine type? Can you post a screenshot of your Trigger Condition?

If you haven't seen already, this example in the admin guide is really useful to understand how Alert Suppression works

Alert Suppression Example

A typical usage of alert suppression would be the case where you do not want to trigger a specific alert when a main router is down. In this case, the suppression condition is configured as, "MyMainRouter has Status equals Down". If MyMainRouter is really down, then any alerts to which this suppression condition has been applied, regardless of what or where the monitored object is, will not trigger, as long as MyMainRouter remains down.

Warning: Be careful to avoid mismatching alert trigger and suppression conditions, as it is possible for a poorly stated suppressioncondition on a single monitored object to disable alert triggers for all net objects. The following conditions provide an example of such a case:

Alert trigger condition: Node Response Time is greater than 100 ms

Alert suppression condition: Node Location is not equal to "Austin"

This combination of conditions will NOT have the result of triggering alerts for all Nodes located in Austin having a response time greater than 100 ms. This combination of conditions WILL, however, only trigger alerts for any nodes showing a response time greater than 100 ms alert if all monitored nodes are located in Austin. If there is at least one node with a location other than Austin, the alert will be suppressed for all nodes, including the ones that are actually located in Austin.

craig16229

Thanks, HolyGuacamole

I don't have much experience yet with alerts, so I will read over the information you provided several times. Thank you very much for providing it.

Here is the bigger issue, though: removing the suppression condition does not return the alert to a working state. If an in-experienced user like myself makes the mistake of mis-understanding and mis-using alert suppression, the only way to undo it should not be to go through a complete repair of the Orion cores services. Is it, or is there some other way to reverse what was applied?

Craíg

HolyGuacamole

craig16229

Thanks again, HolyGuacamole

I just popped back in to say that instead of trying to reverse whatever happened to the default "Alert Me When a Node Reboots" alert, I just created a brand new one and it tested successfully. Now I just have to scrap the little I thought I understood about creating alerts and learn best practices.

Craíg