Help needed with "layered" alerts - Dependancies

Warlynx

Hi all

I could do with some advise on how to build an Advanced Alert that will give me alerts for lower priority devices, medium and high priority devices with exclusions.

Example:

knwig0004-map320-001
knwig0004-map320-002
knwig0004-map320-003
knwig0004-map320-004
knwig0004-msc3200-gw-001
knwig0004-poepd6506-poe-001
knwig0004-swcat2960-sw-001

The first 4 devices are devices with a low priority, the GW, the PoE and the SW would be the single point of failures for all 4 of the other devices if there was a power failure to the GW, PoE and SW.

So, basically I want to create and alert that tell me if the individual MAP's go down, but it should also tell me when the GW, SW or PoE went down, but then not trigger an alert for the MAP's, since their "failure" is due to the failure of one of the main devices in the network.

Can this all be done in one alert, or would I need separate alerts for that?

ecklerwr1

While solarwinds doesn't have built in event correlation per se here's a good article on the logic behind advanced alerts with some examples of the kind of thing you are looking to do:

http://www.solarwinds.com/support/Orion/docs/UnderstandingOrionAdvancedAlerts.pdf

The section in Case 2 applies the logic needed to solve:

Case 2 – Suppressing Multiple Alerts for an Unreachable Remote Site

Perhaps the most common use of custom properties is to create a suppression condition for devices where the reachability of those devices from Orion is dependent on the status of a single connecting device, such as a gateway router. This is common where a remote site is connected to the Orion server location via a single WAN link. There may be scores of devices located in the remote location which are managed by Orion. If the WAN link to the remote site or the gateway router at the remote site fails, then scores of alerts would be generated to indicate the down status of all the unreachable devices. By applying custom properties to the devices at the remote site and including a dependency on the remote gateway router, we can avoid the multiple alerts and only alert on the actual issue - the remote site is unreachable.By applying the solution in the pdf you can avoid the problem where many devices live behind an as you say "main device" typically for me a wan edge router with an entire network full of devices behind it.  Without some logic like this when the wan circuit goes down alerts are triggered for every device the NPM can't reach behind the WAN edge router.I've found it's an art doing your own event correlation but if you plan it out you create your own solution to the problem using custom properties and advanced alerts.