What is Node Status 'Warning' means and what is the threshold?

arijitnaha

Hi,

We have recently added Node status 'Warning' state in a alert. Now we are getting flooded with the alert trigger email. What I really want to understand is 

1> On what basis or factor solarwinds thinks or mark the node as warning?

2> Can this alert be set as single alert with a threshold value? 

jblankjblank

Nodes can be placed into a warning or critical state based on a variety of reasons. You can actually even use alerts to place a node into a specific state based on whatever trigger condition you set. For the most part your nodes are usually going into a warning or critical state based on crossing one of the thresholds for Response Time, Packet Loss, CPU or Memory. These thresholds can be customized globally or individually per node.

By editing a node or group of nodes you have the option of override thresholds, and if you are experiencing a flood based on every little bump, you may want to pay close attention to the ability to customize the sustained conditions. For example, you may not be interested in a device spiking CPU for a single poll, but if that device's CPU spiked for 3 consecutive polls, it may interest you. 

You may be receiving some alerts based on child contributors. With the introduction of Enhanced Node Status, you have the ability to control if entities such as interfaces or volumes for example, can also propagate their status up to the node, helping surface dependencies that could impact performance.

My colleague @aLTeReGo covered a lot of this in great detail here: Enhanced Node Status. 

In summary:

1) On what basis or factor solarwinds thinks or mark the node as warning? - Hopefully this was clearly articulated above or in the linked document. Please let us know if you need more info.

2) Can this alert be set as single alert with a threshold value? - The Orion Alerting engine is very powerful and with great power comes... you get the idea. Yes you can set alerts with hard coded values if that is what you are asking/after, but then you will likely find yourself creating and managing an insane amount of alerts. 

I recommend utilizing the customizations in thresholds and sustained conditions. And take a look at this thread from @adatole which also has some great insight to keep in mind. Fixing False Positives 

Hopefully this helps.