Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

When monitored nodes go down, but no Alert is received--what possible conditions can explain this?

I've configured NPM to monitor a few Windows workstations via WMI, but when they go down, the Alert built to notify a specific team isn't being received.

I'm not finding the logs in NPM to show the alert sent an e-mail to expected group. Where is that information logged in NPM?

How many times does a node have to fail to respond to NPM before NPM generates an alert? Is a single missed Monitor polling session enough to generate an Alert?

Rick Schroeder

Find more posts tagged with

Accepted answers

All comments

bkyle

How is your alert configured?

rschroeder

Four Windows workstations are monitored by NPM via WMI. The polling happens once a minute. When any of those workstations goes unreachable NPM is supposed to fire off an e-mail notifying a team of the outage. When the node is reachable by NPM again, another e-mail is fired off to the same team noting the device is back up.

mesverrum

To your last question about how many times you have to fail, see this:
https://support.solarwinds.com/SuccessCenter/s/article/Orion-Fast-Poll-and-Node-Statuses-Explained

Assuming you haven't changed any of the relevant settings it would be 12 failed pings in a row over the course of 2 minutes to get a node marked down. Then on your alert you can additionally set a timer that says the node needs to be down for X minutes before triggering the alert.

To see the alert actions that Orion took you can go to the alert details view for that incident and there is a history widget that shows you all the related info about what orion did or tried to do. In the default UI it is kind of a pain to pull up the alert details view for an alert after it closes, so I use this custom query widget on my node details view so I can look into historical issues.

select
'Last 24 Hours' as [Time]
, concat(count(ah.AlertHistoryID),' Alerts') as [Alert Name]
, '' as [_linkfor_Alert Name]
, CASE
WHEN count(ah.AlertHistoryID) > 0 THEN '/Orion/images/StatusIcons/Small-Warning.gif'
ELSE '/Orion/images/StatusIcons/Small-Up.gif'
END AS [_iconfor_Alert Name]
, '' as [Triggering Object]
, '' as [_linkfor_Triggering Object]
, '1' as [_linkfor_ ]

from orion.AlertHistory ah
where ah.EventType=0
and ah.TimeStamp > addhour(-24,GETUTCDATE())
and ah.AlertObjects.RelatedNodeID='${NodeID}'
--and ah.AlertObjects.AlertConfigurations.Name like '%${SEARCH_STRING}%'

UNION ALL

(
select
'Last 7 days' as [Time]
, concat(count(ah.AlertHistoryID),' Alerts') as [Alert Name]
, '' as [_linkfor_Alert Name]
, CASE
WHEN count(ah.AlertHistoryID) > 0 THEN '/Orion/images/StatusIcons/Small-Warning.gif'
ELSE '/Orion/images/StatusIcons/Small-Up.gif'
END AS [_iconfor_Alert Name]
, '' as [Triggering Object]
, '' as [_linkfor_Triggering Object]
, '2' as [_linkfor_ ]

from orion.AlertHistory ah
where ah.EventType=0
and ah.TimeStamp > addday(-7,GETUTCDATE())
and ah.AlertObjects.RelatedNodeID='${NodeID}'
--and ah.AlertObjects.AlertConfigurations.Name like '%${SEARCH_STRING}%'
)

Union ALL

(
select
'Last 30 Days' as [Time]
, concat(count(ah.AlertHistoryID),' Alerts') as [Alert Name]
, '' as [_linkfor_Alert Name]
, CASE
WHEN count(ah.AlertHistoryID) > 0 THEN '/Orion/images/StatusIcons/Small-Warning.gif'
ELSE '/Orion/images/StatusIcons/Small-Up.gif'
END AS [_iconfor_Alert Name]
, '' as [Triggering Object]
, '' as [_linkfor_Triggering Object]
, '3' as [_linkfor_ ]

from orion.AlertHistory ah
where ah.EventType=0
and ah.TimeStamp > addday(-30,GETUTCDATE())
and ah.AlertObjects.RelatedNodeID='${NodeID}'
--and ah.AlertObjects.AlertConfigurations.Name like '%${SEARCH_STRING}%'
)

union all

(select
tostring(ToLocal(ah.Timestamp)) as [Time]
, ah.AlertObjects.AlertConfigurations.Name as [Alert Name]
, '/Orion/NetPerfMon/ActiveAlertDetails.aspx?NetObject=AAT:'+ToString(ah.AlertObjectID) as [_linkfor_Alert Name]
, CASE
WHEN ah.AlertObjects.AlertConfigurations.Severity = 2 THEN '/Orion/images/ActiveAlerts/Critical.png'
WHEN ah.AlertObjects.AlertConfigurations.Severity = 3 THEN '/Orion/images/ActiveAlerts/Serious.png'
WHEN ah.AlertObjects.AlertConfigurations.Severity = 1 THEN '/Orion/images/ActiveAlerts/Warning.png'
WHEN ah.AlertObjects.AlertConfigurations.Severity = 0 THEN '/Orion/images/ActiveAlerts/InformationalAlert.png'
WHEN ah.AlertObjects.AlertConfigurations.Severity = 4 THEN '/Orion/images/ActiveAlerts/Notice.png'
END AS [_iconfor_Alert Name]
, ah.AlertObjects.EntityCaption as [Triggering Object]
, ah.AlertObjects.EntityDetailsUrl as [_linkfor_Triggering Object]
, '4' as [_linkfor_ ]

from Orion.AlertHistory ah
where
eventtype=0
and ah.AlertObjects.RelatedNodeID='${NodeID}'
--and ah.AlertObjects.AlertConfigurations.Name like '%${SEARCH_STRING}%'
)

order by [_linkfor_ ], [Time] desc

bobmarley

I have had similar instances and sometimes its in the alert logic and once in awhile I just re-create the alert and it works.

Here is one tip I use. You can pull the SWSQL from the alert trigger and view it in SWSQL Studio by getting it from the area below.

Sometimes this helps in troubleshooting.

bobmarley

According to mesverrum's post above the node has to be down for at least 2 minutes in order to alert. Maybe that is the actual problem. May be 1 minute is not long enough?