Alert Conditions for 2 Related SAM Monitors

Question

Hi Thwack,

I have an AD account lockout monitor on each one of my DC's (2). When an account gets locked out, it will alert on the DC it is primary to it, but will eventually alert on the other once it replicates about 15 minutes later. I would like to avoid this double alert notification by building it into the alert conditions. I thought this would do it, but I am not receiving an alert at all when set to the following:

- Instance is Monitor A

- Monitor A is critical

-------AND-------

- Instance is Monitor B

- Monitor B is up

OR

- Instance is Monitor B

- Monitor B is critical

-------AND-------

- Instance is Monitor A

- Monitor A is up

Does anyone have this set up currently or have suggestions on how to correctly set this up? Is this even feasible?

Thanks in advance!

vinay.by · Answer

You can always build that logic in same alert or if you want to keep it simple you can use 2 different alerts as mentioned by you (This way admin activity is much easy to maintain).

koneal · Answer

Hi vinay.by,

Thanks! This looks to be going in the right direction. From what I understand, the primary for each account is not necessarily the same. Can I build that into the existing alert or would you suggest a separate alert reversing the monitors?

vinay.by · Answer

Possible.

1. I am assuming you have already setup component monitors as Monitor A and Monitor B, make sure the component names in your SAM application is different, on Primary DC keep the component monitor name as 'AD account lockout monitor Primary' and on Secondary/ Second DC keep the component monitor name as 'AD account lockout monitor Secondary' this is to differentiate that they are different component monitors. Two ways to do it either change the component name directly on the device by logging in into the application and changing the name there OR second approach is to keep it generic, have 2 different SAM Application templates, both templates are same but just rename the component monitor name as mentioned above. Apply the first Application template on Primary DC and second Application template on Secondary DC like this you can reuse these templates for multiple AD's which you have in your environment and you can as well keep the alert generic.

2. Creation of alert - in your trigger condition click on 'Advanced Options' and check 'Enable complex conditions (e.g. Alert me when (Application A on Server X is down) AND (Application B on Server Y is down))'

As shown in the above pic create the first condition and component name should be 'AD account lockout monitor Primary'

Click on ADD SECTION and then define your second condition, select component name 'AD account lockout monitor Secondary' and check out the status in first section i have set it to 'Critical' as per your requirement and second section it is 'Up' like this you can create alerts for your use case.

Hope this helps.