1 alert with actions that differ based on a custom property

Hi All,

A question please.

Is it possible to have 1 alert, but with actions that differ based on a node custom property?

We have a node down alert that covers everything now. However what we're looking to do is for all other nodes, send SNMP trap A, however for specific nodes where custom property = Example, send SNMP trap B.

Can this be done in the 1 alert or would there need to be 2 alerts, one for the others excluding the example and vice versa?

Many thanks in advance.

Find more posts tagged with

alert_actions

Alerts

Accepted answers

SteveK

The easiest route would be to do 2 seperate alerts with different scopes based on your custom properties.

Depending on the action you are taking, you could potentially do this in a single alert and some custom SQL inside the alert action (or if you were calling an external PowerShell script), but I think that would overcomplicate things.

adam.beedell

Specific to what you're asking about: - You can add a macro with a case statement to switch out some bit of text, that might work.

"To: ${x.team}" or "To: ${SWQL: Select case when x.team like 'apps' then 'appsaddress' else x end as addressswitcher}

Note that when these fail it can mess up your action so build robustly

More generally:

A design of 1 alert per [different behaviour/timeframe] per [table you care about] works pretty well. Cant imagine going much lower than that.

You can round a few subtables up but cant go sideways easily.

Note if the primary table were to change, every macro would need to change with it

All comments

SteveK

The easiest route would be to do 2 seperate alerts with different scopes based on your custom properties.

adam.beedell

Note if the primary table were to change, every macro would need to change with it

vinay.by

What is your trigger action ? Are you integrating it with other tools ? Since you have mentioned SNMP Traps I am a bit curious.

You are asking about custom attributes/property - If you are using SolarWinds built in variables on your trigger action, yes its possible.

Create a custom attribute - like say for example 'group', update it with value accordingly like in your case TrapA or TrapB. Use this custom attribute value on your trigger action, as mentioned above it depends on what exactly your trigger action is and does it take SolarWinds built in variables (we are just trying to use the custom attribute value that you are updating here).

monitoringlife

Depending on what trigger condition your using. What are you doing with SNMP? Where are you sending the traps?

I also have a global node down that covers 90% of my nodes. If your using a ticketing system I would configure the alert notification there based on CI owner or assignment group.

Quizang

Many thanks all for the aid and direction.

Replying to all questions in this 1 post for brevity.

The existing alert is triggered when node = down, an snmp trap is thus sent, ultimately to our case management tool - ServiceNow. This raises a ticket to the respective team based on a custom property defined for every node. This has been in use for a considerable amount of time.

We are however now looking for only a handful of nodes, to during a specific timeframe send these to another team. Apart from node down we have a few other alerts as well interface down etc, so rather than creating a separate alert for each, was wondering if it was possible just to modify these existing alerts to do something different for this handful of nodes.

Will give the awesome suggestions a go and see how I go, thanks again all!

adam.beedell

Worth mentioning then - There's an out of the box servicenow integration in the settings menu and the servicenow app store that if you're not aware of will make your job easier

monitoringlife

Would the timer on the trigger actions help? Or set an escalation to make a 2nd ticket to the off hours crew?

Might also be able to setup an action in service-now to do time of day routing.

Quizang

Cool, will take a look at that. Many thanks again Adam!

Quizang

Not sure if the timer will help with delineating between the nodes, but it is certainly going to help us for our other requirement.

We did consider looking into the ServiceNow side as well, but opted to start with the Solarwinds side first in the hope it could all be done there.

Many thanks for your thoughts!