Alert Monitor operation

rdowney

I have a couple basic questions.....

1. When an Alert is "Acknowledged" on the Alerts page what impact does that have to the alert? Will it refire again if the condition still exists?

2. There is an "Event Summary" graph that displays "Triggered Alerts" and " Reset Alerts". However, I do not see anyway to see which alerts are still "Active". IE: 100 Triggered Alerts and 95 Resets. How do I see the 5 active?

3. On the Alert Monitor page (NPM) how does it sort? It seems to be mixed up by a combination of alert name and date. Any plans to add a "Sorting" feature?

4. Are all the Alerts on that page still active?

5. Is there any plans to add deeper filtering on the Alerts Page (Such as on the Event page)? Like alerts that happen "Today", "last Hour", "24hrs" etc? Also "Active Alerts Filter"?

 

Thank You,

Bob Downey

Hanover Insurance

kweise

Bob,

I think I can answer some of your questions. 

1. Acknowledging an alert can impact the alert, depending on how you have it set up.  Advanced alerts have some "Alert Escalation" settings that allow you to configure the trigger action to execute repeatedly while the alert is triggered.  There is also a setting that tells the alert not to execute the trigger action if the alert has been acknowledged.  For example, if you configure your trigger action to send an email when the alert is triggered and every hour thereafter, you can configure the action to stop repeatedly sending the email if the alert has been acknowledged.

2.  I believe the Event Summary chart is just a listing by count of the recent alerts.  I think the only way to see the current active alerts is to go to the Alerts page.

3.  This might vary but at least in my environment, on the web console our alerts are sorted by alphabetical order of the network object column.  If you pull up the alert manager on your Orion server and look at active alerts, ours are grouped by the alert name and are ordered by the triggered time.

4.  I'm pretty sure any alert listed on the Alerts page are active.  The only option to filter out alerts that I'm aware of is to not display active alerts that have been acknowledged.

5. Someone from SW will have to answer that one for you.  You can always submit a feature request to get it on their radar.

Hope this helps!