Advanced Alert Building - help please.

Is there anywhere that documents either from Solarwinds or third parties how to build advanced alerts? Examples would be great as I'm not seeing hw I can achieve what I want ...

Which is...

Currently we have this alert for F5 pools which works as expected. The redacted bit is the name of the client, call it "Acme Co" if you need to

But now, we've been told there are certain specific pools that are 'taken down' every day between certain hours for maintenance purposes .... so I need to build in a bit of logic that says:

if xyz-pool is down and hours are: 22:00 to 08:00 then don't alert.

Or similar.

Has anyone done this and can point me in the right direction?

Find more posts tagged with

alertng

advanced

Accepted answers

All comments

coha

Hi,

If you know what nodes exactly they are you could just create 2 separate alerts.

1st on include all the pools except the ones that get shut down for maintenance.

2nd - create the same alert for just this nodes and you have the option in the next step to select when you do not want to get alert for them.

Like this :

Not sure if this helps but this is the only thing that came to mind.

stuartd

Thanks @coha ...

Whilst I know the nodes, the nodes have other pools that need to continue to alert should they go down. So I need to find some way to say just this pool from this node and then add a few more.

I did click through on one of the pool alerts to see if maintenance mode or scheduling was available but they aren't. Also, by the same extension the unmanage schedule tool doesn't work in this situation.

bobmarley

Could you also add a condition where the pool name contains the names for the pools you want to alert on? If so you could add that condition and use the suggestion to create multiple alerts.

stuartd

I'd have to say @bobmarley that I have absolutely no idea

Certainly I haven't found a way to directly reference a pool, let alone multiple pools across several nodes, yet. If I do, then yes, the above would clearly work. I'll dig some more but in the meantime hope that someone comes along that has already done this...

Or, I'll create a ticket and ask Solarwinds directly.

stuartd

In the end I had to log a ticket with support. Don't you just love it when support then put out thinly veiled snark which says "go learn about the product better" or "use THWACK" ... which, as I pointed out, is not a replacement for tech support as a company should never rely on their customers to provide it. Though this appears to be Solarwinds approach. [end mini-vent]

Anyway, to update on my initial query and the couple of responses I have had, I think I have a way forward but still need help understanding if my application of the logic is correct.

So, in the following screenshot, the top blue part was eventually extracted from support and the bottom part (purple section) is my adaption. I say that as the s/s they shared only included a single pool option so was a reasonably straightforward 'Orion Status Has Changed' AND 'So long as the pool is NOT named ZYX'.

My reading / understanding of this is:

Blue section says: If ANY F5 LTM pool is down

Then purple: UNLESS it is one of these two pools

--- ++++ ----

Or, shoud I be using one of the other argumnts in the drop down box?

My understanding is that the condition selected is essentially excluding these two pools from being alerted on.So, it will alert so long as the condition of one of the pool names is not satisfied.

stuartd

Bumping ...

Looking at the end of my last post, I now ownder if in fact I should be using the 2nd option: "at least one child condition must be satisfied (OR)"

My re-read is:

Blue section says - raise an alert if a Pool goes down
Unless (purple) it is Pool named X (OR) Pool named Y

Anybody please have any thoughts?

sum_giais

The logic looks sounds if the goal (per what's pictured) is to completely negate alerts from those two specific pools at all times.

The trouble... is it doesn't appear there's a way to apply maintenance windows to a pool. There is however the ability to create custom properties on them it looks like.

I see a couple options depending on your preference -

Option A) Create two alerts, the first being the one you mention above that would ignore those two pools, and another alert that only alerts on those pools (reverse the logic in the second section.. e.g MUST be satisfied) and then set the time of day for it so it's only enabled outside of the maintenance window timeframe. So if maintenance is 11pm-12am, the alert would only be enabled from 12am-11pm.

Option

Get creative with the customer properties, possibly making a set time-of-day custom property that defines your maintenance windows, so maybe maintenance_start_time, maintenance_end_time and recurring_maintenance (boolean). The alert could key off that in the logic. Definitely would be some leg work to get this going though.

I myself like Option B, it could scale better and saves time creating duplicate alerts (less load on SQL server, YAY!) I haven't really thought this one out yet but my hope is it would work in some respect.

cheers

stuartd

Thank you very much @sum_giais

Absolutely, this alert is designed to never trigger on those two pools, so it's good to have feedback that the logic is correct as far as what I am trying to achieve.

Option A was definitely the way I was looking, but I have since had feedback from the server team, and more importantly client, that these two pools are not vital for production purposes so we don't need to monitor / alert.