Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Is there a way to set a special reset condition whose scope is limited to "the item that triggered the alert"?

While trying to build a special reset condition for an Alert I realized that I couldn't come up with a scope that would be limited to "the item that triggered the alert." Is there some way to specify this?

What I want to do is have a reset condition that specifies, "when the status of the triggered item is 'Up'". The current trigger specifies, "when the status of the triggered item is Warning for 3 hours." The problem is that, for various reasons, the status of several items often changes to "Down" or "Unreachable" (I believe due to networking issues). Since the status of the item is no longer "Warning", this resets the 3-hour clock and can reset the Alert when I don't want it to.

I could, of course, specify the trigger to be "when the status is Warning or Down or Unreachable for 3 hours," but this could potentially trigger the Alert if/when the network connection is lost for 3 hours or more, and I don't want that either. I'll take it if I must, but it's a sub-optimal config.

There ought to be a way to limit the scope of the special reset condition to "the item that triggered the alert," but so far I haven't been able to figure it out.

Find more posts tagged with

Accepted answers

All comments

ecmel

You don't need to define the scope for the triggering object in your reset condition. It is the default behavior in SolarWinds, reset condition will be checked for active alert objects only. So you just need to define your reset condition for status='down'.

elhannaford

So this Reset Condition would only reset when the item that triggered the alert changed its status to "Up"?

That seems wrong, but I'm willing to give it a try.

adam.beedell

I'd add in the OR

Component status = Down (assuming a seperate alert covers down states)
Component status = unmanaged

Component status = External (questionably)

Component status = Not running

Condition most exist for more than 30 mins (or so)

ecmel

Yes, this configuration should work as expected and only the active alert for a component should be reset when that specific component is up.

For your information, you can observe similar approach in out-of-the-box SolarWinds alerts that have special reset conditions. As can be seen below, scope is not filtered for this out-of-the-box alert:

adam.beedell

If you use components with a warning/critical threshold, bear in mind a quick reset time will lead to noise when the statistic is flapping around the threshold

elhannaford

I thought of that, and it's my second-best solution. The problem is, including those conditions in the OR would result in a false positive if (say, due to a network outage) the status went Down or Unreachable for an extended time, which is sub-optimal.

elhannaford

I hadn't thought of looking at the canned alerts. While it still seems wrong, this does lend credence to your answer. Thanks!