Change alert definitions without triggering that alert

Hello team. Whenever I try to edit an alert, I am forced to have the alert trigger on nodes/entities that have states satisfying the alert criteria. For example, if I already received email saying that a server was down, and I edit the "Node is down" alert while that server is still down then I'll get another email telling me what I already know. Now multiply by that 100 known issues, that's a lot of unnecessary noise. How can I make changes to my alert definitions without triggering any further emails to techs or logs to NPM?

Find more posts tagged with

alert configuration

alert triggers

Accepted answers

stuartd

On the presumption you mean the alert "Trigger Condition", then you can't, as far as I know, edit definitions without it triggering.

You can however edit the "trigger actions" - just navigate to 'Manage Alerts' and click the 2nd tab 'Action Manager'. And this doesn't re-trigger anything.

Here's a thought though... if it is the conditions you want to edit. then do this:

edit alert as normal
adjust conditions to whatever you need
then adjust trigger actions to do nothing
click submit
Navigate to action manager
edit triggers there

Essentially you edit the alert and remove triggers so you don't get the noise, and then afterwards you re-add / or edit the triggers

All comments

stuartd

edit alert as normal
adjust conditions to whatever you need
then adjust trigger actions to do nothing
click submit
Navigate to action manager
edit triggers there

Essentially you edit the alert and remove triggers so you don't get the noise, and then afterwards you re-add / or edit the triggers

k_bolt

Hi, thank you for this thought. I hadn't considered that approach. I just checked and it seems that once an action isn't assigned to an alert, it's removed from the list of actions. I think I'll have to keep a dummy alert turned off with all my actions added to it to keep them safe, and then try your suggestion. Definitely will dig into this some more, thanks again!

stuartd

Yes, I should have expanded point 3 to be a bit clearer. You would need an "empty" or dummy action so you can go back to edit it.

But I heartily agree with you that we SolarWinds needs a means to be able to edit an alert without it instantly re-triggering. Other tools that do a similar job can do that, so why so hard for SolarWinds not to include it. Not sure if it's been requested as an FR, but I haven't seen one yet.

One other thought: I haven't tried this, but it might work. Disable the alert, edit to your hearts content, and then once saved re-enable it. My theory is that editing a live alert causes the alert to look across the entirety of the DB for issues that match, whereas enabling an alert causes it to only alert from that point on.

k_bolt

You are an actual genius, your idea seems to be working so far. Thank you. I need to do more testing but it seems solid. I also thought of, in cases where I need to only edit the action and not the alert, I'd just use my dummy alert to create/edit an action and then assign it to actual production alerts. I think SW should allow actions to be created in the Action Manager, and not just within an alert. It only makes sense.

As for your other thought, I had tried that before once I re-enabled the alert, the trigger was there waiting. Got a ton of unnecessary emails.