Please see above images. I've set the alert to monitor the nodes every 1 minute (small environment) and even so, I keep getting e-mails sent where the condition has not been met.
Did you copy an alert to build this new one? Is that old one still active? Best thing I've found is to make sure that I've got the "Alert Name" and "Link to Alert" in the message as a variable in the email (or whatever) so I know which alert actually fired this message.
Yeah I agree with @KMSigma.SWI, it seems like you might have a duplicate alert that is still active because looking at the screenshots you have things set up correctly. Let us know, I would be interested in work with you to get this solved.
I have taken @KMSigma.SWI's advice and linked to the alert I created (It was a copy of an out of the box alert), and I'm currently monitoring it to see if I can figure out where the other alert is coming from. I did have the original alert that I copied turned off, however. I'll keep you updated.
In your alerts it helps to provide a string of data to indicate where it came from so it is easier to locate the alert rule after the fact. We used a catalog id in the alert rule name and included that in the alert text. The catalog id was a reference from a spreadsheet where we kept a version/modification history as well as the purpose of the alert and any change request numbers for adding the alert or modifications.
It ran again over the weekend, and it is the correct alert that is generating the e-mails too early.Here are the only two alerts that cover transmission. I copied the out of the box alert and added in the delay to the message as seen in my original post. The out of the box alert was then disabled at the time of creation, in December 2021.
Now while the link to the alert was incorrect, the name of the alert is clearly visible, and there's only one alert with this name. See above.
What I'm seeing above is the "reset" action - not the "trigger" action. Can you export the alert to XML and attach so we can see it?
Sure! But we're getting into the: "This is Greek to me" territory!
<?xml version="1.0"?>
-<ArrayOfAlertConditionShelve xmlns:i="">www.w3.org/.../XMLSchema-instance" xmlns="">schemas.datacontract.org/.../SolarWinds.Orion.Core.Models.Alerting">
-<AlertConditionShelve>
<AndThenTimeInterval i:nil="true"/>
<ChainType>Trigger</ChainType>
<ConditionTypeID>Core.Dynamic</ConditionTypeID>
<Configuration><AlertConditionDynamic xmlns="">schemas.datacontract.org/.../SolarWinds.Orion.Core.Alerting.Plugins.Conditions.Dynamic" xmlns:i="">www.w3.org/.../XMLSchema-instance"><ExprTree xmlns:a="">schemas.datacontract.org/.../ExprTree><Scope i:nil="true" xmlns:a="">schemas.datacontract.org/.../><TimeWindow i:nil="true"/></AlertConditionDynamic></Configuration>
<ConjunctionOperator>None</ConjunctionOperator>
<IsInvertedMinCountThreshold>false</IsInvertedMinCountThreshold>
<NetObjectsMinCountThreshold i:nil="true"/>
<ObjectType>Interface</ObjectType>
<SustainTime>PT20M</SustainTime>
</AlertConditionShelve>
</ArrayOfAlertConditionShelve>
Reset action:
<SustainTime i:nil="true"/>
Any chance I can get the whole XML? What you provided wasn't in a (Insert > Code) code block, so a bunch of it got abbreviated which messes with the syntax.
Just go to your alerts, check the box for the one in question, and select Export/Import > Export Alert.
That'll download an XML file to your computer.
Then just start a reply to this thread and select Insert > Image/video/file and browse for that file.
