Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

SAM - Event Monitor - How to alert 1 time per Event ID

Is there a way to monitor all warning/error events from an event log (example Application) and then in the alert configure it to only alert once per event id with a reset of 30 minutes? I know I can set the reset condition to 30 minutes but this would silence all events, is there an advanced reset condition where you can specify the exact Event ID that triggered to reset after 30 minutes? Just wondering if anyone has mastered a solution for that.

Thank you.

Find more posts tagged with

Accepted answers

All comments

ahbrook

I don't think we found a good answer to this. Our best solution was to set our general application monitoring alert (shared between events and other sources) to require a manual reset. This way, even if the alerting event has moved on outside of the display time (1.5x polling rate, or 7.5 minutes by default), the alert would still be visible. The unfortunate side effect of this is that we need to instruct our users to clear alerts or they don't get any more alerts for a given application.

s-bolyard

Not sure if this is the best way to do this, but I'll throw it out there anyway. If you have an event ID that clears the original event ID error then you need to be monitoring for that event ID in SAM or none of this works. Under the Reset Condition tab, there is a Create a special reset condition for this alert. Select that option and it will give the option of creating a new reset option, copy the filter from the Trigger Condition tab or import an XML <see sample below>. I haven't tested this theory in my lab yet, but I can do that on Monday.