Is it possible to take different actions for different trigger conditions using the same alert?

I'm setting up interface utilization alerts in NPM, and would like to avoid having to make different "tiers" of alerts. For example, I'd like to send an email with "Notice" in the subject line if an interface's receive utilization goes above 70%. I'd like to send a "Warning" email if it goes above 80%, and "Critical" if it goes above 90%. Would this require creating three separate alerts? I'd also like to do the same for the transmit utilization, which would require three more alerts for the 70/80/90% thresholds. Is there a more efficient way to set this up?

Find more posts tagged with

custom alerts

Accepted answers

mesverrum

So the easy answer is No,

But if you want to get into the world of wildly complex sql in your messages you could use a custom sql variable with case statements to change your verbiage based on whatever conditions you want.

something like

Subject: {SQL: Select top 1 case when n.cpuload > 90 then 'Critical' when n.cpuload > 80 then 'Warning' when n.cpuload > 70 'Notice' end as [Sev] from nodes n where n.nodeid = ${nodeid} }

All comments

mesverrum

So the easy answer is No,

But if you want to get into the world of wildly complex sql in your messages you could use a custom sql variable with case statements to change your verbiage based on whatever conditions you want.

something like

Subject: {SQL: Select top 1 case when n.cpuload > 90 then 'Critical' when n.cpuload > 80 then 'Warning' when n.cpuload > 70 'Notice' end as [Sev] from nodes n where n.nodeid = ${nodeid} }

jjmerrill

Thanks for the quick response and the guidance.

mesverrum

But getting a step more meta, sending email based alerts on 3 different thresholds is asking for alert fatigue where the users just start ignoring all your messages.

I only send emails on critical threshold violations, everything else can be seen in the GUI or in a report. I try to train people that if Orion is sending me an alert email it means I have to respond to something right away, if it can wait until tomorrow then it should just be packaged up as part of an end of day report of systems approaching their thresholds and I can check in on that list at my leisure.

Nobody has the time to deal with 100+ emails a day, and I can't tell you how many people have folders with 10k unread messages from the monitoring tool. I always press someone on what they do when they get a message, if the answer is nothing then I didn't accomplish anything by sending it.

jjmerrill

I agree with your overall philosophy, and like the idea of using a report for this instead of email alerts. I may still configure a utilization alert for 90%+ for certain interfaces, but leave it at that.

I'm still new to the SolarWinds platform as a whole, but have managed to clean up a fair amount of the alert fatigue that was present in the configuration that I inherited. It would be a shame to introduce more of it by using the three-tiered alerts that I asked about. This will be the first custom report that I've built, and I found good article that should guide me through the process.