Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Help with condition group in alert (eliminating some alerts)

So I'm looking to tune the interface down alerts so they only happen for network interconnects and not servers, and other systems. We have a fairly strict naming convention so I thought i would alert like this

trigger when all

interface status down

trigger when none

interface alias contains server

I still get alerts for everything. Is my logic wrong?

Find more posts tagged with

Accepted answers

bthornto

I got the following from support this morning.

Good Morning,

I think I found where was the issue.

First re-configure your alert like you did before to open the case without any alert supression.

Then modify the operator in the second part of the Trigger Condition to:

trigger when not all of the following apply

interface alias contains server_ms
interface alias contains server_ux

I checked the difference between the SQL Queries executed between none and not all operators and here are the results:

1) None

Will return an interface if one of the condition is false. e.g. an interface is named server_mx but due to the server_ux condition the interface will be triggered.

SELECT Interfaces.InterfaceID AS NetObjectID, Interfaces.FullName AS Name FROM Interfaces WHERE ( (Interfaces.Status = '2') OR ( NOT (Interfaces.InterfaceName LIKE '%server_mx%') AND NOT (Interfaces.InterfaceName LIKE '%server_ux%')) )

2) Not All

Will return an interface if it does not contain any string defined in the conditions. This is what you want.

SELECT Interfaces.InterfaceID AS NetObjectID, Interfaces.FullName AS Name FROM Interfaces WHERE ( (Interfaces.Status = '2') AND ( NOT (Interfaces.InterfaceName LIKE '%server_mx%') AND NOT (Interfaces.InterfaceName LIKE '%server_ux%')) )

I think we have been both confused with the NONE operator...

Let me know if this helps.

All comments

FormerMember

Try and re-write it without using "none". It's unclear what you mean, but I almost never see an alert that needs "none". Use "all" or "any". If you want to alert when an interface but is NOT any of those names, then say

Trigger when ALL apply

Interface Status is equal to Down

Interface Alias does not contain x

jbaulsir

How about:

Trigger Alert when all the following apply:

Interface Status is equal to Down

Vendor is equal to Cisco (assuming you use Cisco gear)

bthornto

I'd be happy to do that but there is no 'does not contain' filter. I was trying to use none to not the contain. (If that makes sense)

bthornto

The interface are all on switches. Basically we monitor server ports and uplinks on field lan switches. So I'm trying to get alerts when the uplinks go down.

We do the same in our DCs, uplinks and server ports, but we don't want to wake a network engineer up in the middle of the night for a server.

There was a suggestion from a support case to use a custom property but that seems a bit extreme when I know exactly how the interface desriptions read and are formatted for server/access ports.

I've been testng and still no luck.

bthornto

I got the following from support this morning.

afsprau

Did you get this to work?

I am try to do something similar to this and I can get a Advanced alert to fire.

I have 4 switches that I want to monitor the ports on, (any other switch ports I do not want to alert)

Then I have several thresholds on these interfaces if hit should trigger the alert.

below is what I have ( have lowered thresholds to try and force an alert)

FormerMember

Another way to do this is and is more simple is to make a custom property for the nodes

An example of a custom property is

System Type, and the value can be Servers, Routers, Switches, Firewalls, or anything you want.

then you can build a basic condition that says to alert on any node where the custom property has a value of "Router".

I did this for Tier 1 and 2 servers. My problem was i wanted to be alerted on servers but not all servers. Naming convention was all over the place so I couldn't isolate it there so I created a custom property called "Tier Level" and set the value to 1, 2, 3 for each server I'm monitoring, then build an alert that says to alert me when nodes exceeds a CPU threshold that have a Tier Value of 1. To take it a step further I created this in the advanced alerts so that I can tell it to only alert me if Tier 1 servers with a CPU utilization greater than 90% is occuring for more than 8 minutes, then send me the alert.

This way the conditioning is not as complex but you do have to setup the custom properties. By the way that can also help you with Reports to because your reports can be conditioned against these custom properties.