Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Alert Custom Status isn't resetting with SNMP Trap rule

I have a custom rule monitoring my SNMP traps looking for a specific trap message when my UPS units go off utility/on battery. Once that rule fires, it sends it over to the alert I've created which gives it a custom status of "UPS on battery". This works fine and my wallboard and NOC views show UPS units in need of help when power goes off. However, if power is restored, I want to have the status go back to using the polled status without the technicians having to interact with SW. So I have another SNMP trap rule that fires when the specific trap for "on utility" comes through. However, it never seems to reset the node in SW. I can confirm that the SNMP rule is working because I briefly changed it to a test alert that fires off an email when "on utility" comes through and I received the email. Is this a limitation with the SW alerting system? I'm running 2020.x

Find more posts tagged with

Accepted answers

All comments

micheal100

How is the alert reset configured? The best way is to create a second log processing rule to handle the reset trap, then update the logic of the alert itself to use that log rule for reset

joshuamichaelsanders

yeah, that's how it is setup. I have a second log processing rule looking for a specific trap from my UPS. That second log processing rule is then referenced in the alert in the reset settings. The second log processing rule doesn't appear to be the problem because I created a new temporary alert that sends me an email and it fired off with no problems.

joshuamichaelsanders

micheal100

Hey @joshuamichaelsanders,

the logic does indeed look correct. Are you able to test other reset actions as part of the alert? I would also suggest using the log adjuster to set the logging level to debug, you should see log data in C:\ProgramData\Solarwinds\Logs\Orion\Alerting.Service.V2.log

joshuamichaelsanders

Good find, I wasn't aware of (or had forgotten about) the log adjuster. I can see the alert firing off in there but nothing in that log indicating the reset action. Also I don't actually see the log that triggers the alert in the first place. Is there another section of the log adjuster I should temporarily set to debug to get some better data? I have some email reset actions in the alert that do not fire either. However, if I take the SNMP trap rule and send it to a completely different alert and trigger it, it works fine.

2023-06-15 07:26:20,070 [WorkPool-Session#15:Connection(52a8fc6e-87b9-4014-aeea-dfe9dd054924,amqp://SOLARWINDS:5671)] DEBUG SolarWinds.Orion.Core.Common.MacroParsing.MacroParser - Parsing macro: UPS Alert

2023-06-15 07:26:20,086 [WorkPool-Session#15:Connection(52a8fc6e-87b9-4014-aeea-dfe9dd054924,amqp://SOLARWINDS:5671)] DEBUG SolarWinds.Orion.Core.Common.MacroParsing.MacroParser - Parsing macro: UPS Alert was triggered.

2023-06-15 07:26:20,086 [WorkPool-Session#15:Connection(52a8fc6e-87b9-4014-aeea-dfe9dd054924,amqp://SOLARWINDS:5671)] DEBUG SolarWinds.Orion.Common.SqlHelper - SQL: UPDATE [AlertActive] SET TriggeredMessage = @triggeredMessage WHERE AlertActiveID = @alertActiveId (@alertActiveId=68515, @triggeredMessage=UPS Alert was triggered.)

2023-06-15 07:26:20,086 [WorkPool-Session#15:Connection(52a8fc6e-87b9-4014-aeea-dfe9dd054924,amqp://SOLARWINDS:5671)] DEBUG SolarWinds.Orion.Common.SqlHelper - SQL: INSERT INTO [AlertHistory] (EventType, TimeStamp, AlertActiveID, AlertObjectID, Message) OUTPUT inserted.AlertHistoryID VALUES(@eventType, @timeStamp, @alertActiveID, @alertObjectID, @message) (@eventType=0, @message=UPS Alert was triggered., @timeStamp=6/15/2023 2:26:20 PM, @alertActiveID=68515, @alertObjectID=9139)

2023-06-15 07:26:20,086 [WorkPool-Session#15:Connection(52a8fc6e-87b9-4014-aeea-dfe9dd054924,amqp://SOLARWINDS:5671)] DEBUG SolarWinds.Orion.Core.Alerting.Service.ActionsResolver - Adding Alert:250 Escalation level:00:00:00 minutes actions to monitor in context 'SolarWinds.Orion.Core.Models.Actions.Contexts.AlertingActionContext, EnviromentType: Alerting, ExecutionMode: Trigger, EntityType: Orion.Nodes, EntityUri: swis://SolarWinds.domain.local/Orion/Orion.Nodes/NodeID=2212, AlertContext: AlertName: UPS Alert, CreatedBy: domain\jsanders, AlertActiveId: 68515, AlertObjectId: 9139'.