Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

How to supress cascading alerts?

Hi Everyone,

I'm working on a network with some devices having single attachments up and down. They would like to be alerted on devices being down, but not be alerted on devices further down the chain.

So, if devices are like this: Orion----A----B-----C----D and say A fails, that's the only alert they want, because obviously, B-D will be unreachable.

For only a few devices, I can see setting up a group - so for B, that says if B is down, and A is down, suppress. That's fine ... but if there's A LOT of devices up the chain, it becomes unweildy to build a larger and larger group each time.

Would there be a way to set a variable that says something like this, (on C)

MyUpstreamDevice=B
If, I am down & MyUpstreamDevice is down,
Then, Suppress
Else, alert.

I'm just trying to prevent a gazillion alerts if the high upstream device fails.

Thanks for your help!

Find more posts tagged with

alert_engine

Accepted answers

FormerMember

We plan to make this easier in a future release, but for now this is how it's done.

All comments

Donald_Francis

I would think you could just do that with the alert supression variables.

But you would have to make a lot of alerts.

Let them supress if the node above is also down.

So for the alert for D

Supress if node C is down

Just a thought

pseudocyber

Right - I see that I can suppress a dependent node individually, by suppressing if a node status is Down.

However, what if the node I'm monitoring is say 10 down in a list of dependent nodes? I would have to add 10 individual suppressions for that node?!? And the one above would require 9 suppressions, and above that 8 and so on?

Or I could create Condition Groups - and add all the nodes into the group - but each monitored node would then require an individual condition group for that particular "level"? And I would need tons and tons of alerts?

So, what I envision is the ability to add a field, something like "parent node" to each node. Then, one suppression condition - if the node goes down, and the parent node is down, then suppress. Then I would only need one alert for all my nodes, right?

I see where I can use variables in the alert message, but I don't see where I can check on the status of a variable to determine if to alert or not.

I want to create a custom field/attribute - parent node. Then I want to see if that parent node is up/down. So, if a given node drops, check the parent node, if down suppress, else alert. However, I don't want to create an alert per node, or a condition group per node. Is there an easier way?

pseudocyber

Bump.

pseudocyber

Does anyone know of an eaiser way to suppress dependent node alerts - for a long chain of devices? Please read prior posts.

Thanks!