Alert logic, false alert?

feltonlewis

GM -

I have a number of nodes where we have overridden the global CPU and MEM thresholds and set node specific CPU and MEM thresholds.

For the MEM thresholds with those nodes as the scope I created an alert and set the triggers to for Warning Value Reached = YES and Critical Value Reached = YES

Yesterday the my MEM alert triggered for one of the servers.  In the messaging for my alert I have a memory section which showed as follows.

### MEMORY INFORMATION ###
Total memory: 32.0 G
Percent memory used: 16 %
Warning value % memory used threshold: 20
Warning value reached % memory threshold: False
Critical value % memory used threshold: 90
Critical value reached % memory threshold: False

I am wondering why this alert triggered because the warning value which is set at 20% was not reached and the critical value set at 90% was not reached.  My understanding of the thresholds is that the alert will trigger if the threshold is met.  Am I incorrect?  If I am incorrect, what is the logic in Orion?

TIA.

FL

saw10

Please take this with a grain of salt -
There are a couple of questions that would need to be answered -

• What is the polling interval for the device?
• What is the alert interrogation interval?
• Is your alert looking for sustained utilization?
  • The condition must exist for x time (alert polling)
  • I use this to avoid alerting on spikes

I know this does not answer your question directly but your device polling and alert polling may be having an over lap, giving a false positive.  

Again just some thing to think about.  I hope this is of help.