Avoid multiple alerts for the same configuration item

Question

Hi,

I have a below scenario. Is this possible in SolarWinds ?

Node down alert is triggered for a CI on 1st day and is resolved within 1hour. Same alert pattern can be triggered in 2nd day and also in 4th day. Our requirement is to trigger the alert only if the 4th node down alert triggered for the same CI / same alert pattern within a week, whereas all the other 3 alerts should be kept as duplicate and only the 4th alert should be in the critical alert page.

marlief22 · Accepted Answer

Hi there,

Just to confirm, you're asking for a system that works like this?

Monday: Node X goes down(1), alert is triggered and actions fire. Resolved in an hour and alert is reset.

Tuesday: Node X goes down(2), nothing is triggered.

Wednesday: Node X goes down(3), nothing is triggered.

Thursday: Node X goes down(4), alert is triggered and actions fire.

If that's the case, then you can do this based on the number of events in the event table for this week. I would use a query like this:

SELECT nodes.uri, nodes.displayname
FROM orion.nodes AS Nodes
WHERE nodes.nodeid IN(SELECT e.netobjectid
                      FROM orion.events e
                      WHERE e.eventtype='1' AND Week(e.eventtime)=Week(Getdate())
                      GROUP BY e.netobjectid
                      HAVING Count(e.eventid)=1 OR Count(e.eventid)>=4)

This SWQL code will return all nodes that have gone down either 1 time or, 4 or more times this week.

You can put it into the alert by using the Custom SWQL Alert drop-down:

Let me know how you get on.

Kind regards,

Marlie Fancourt | SolarWinds Pre-Sales Manager

Prosperon Networks | SolarWinds Partner since 2006

If this helps answer your question please mark my answer as confirmed to help other users, thank you!