Alert Logic - Reports on all components when one goes into error state

nmitsteve66

Its obviously my alert logic and probably a simple fix but I have an issue with Arista devices so I am excluding a known issue (DOM RX)  but when any component goes into critical it reports the critical component alongside all the other managed components for that device see screen grabs below.

Igonre the grey they will go green on next poll, I disabled the sensors in good state while I am investigating

stuartd

Not 100% sure this will fix it, but the first thing I'd do is get rid of this line:

If it's disabled, then it won't alert, so for me this would just confuse the system (it certainly gives me pause to try and unpick it)

And then I'd look at combining the remaining two statements into a single (AND) statement a la:

I don't have any Aristas here so can't test this ... but you can always click the little down arrow

and then copy/paste the SWQL into SWQL Studio to see what results it gives you. You may need to adjust the SWQL to show "what is up" if you don't have any faults at present. So change the '14' (critical) to something that works i.e. '1' (up).