Alerts

Question

I am new to Solarwinds and have recently been hired on to fix our Solarwinds environment.  We are getting way too many pages and missing some of the critical stuff.  What I would like to be able to do (not sure if it is possible) is to create a file that includes all of the properties of our current alerts (such as  Name of Alert, Trigger condition, Trigger Actions, and etc...).  An excel file of this data would be perfect.  I want to be able to see what I am dealing with, so we can decide what we need or don't need.  Basically, I want a report of our Configured Alerts.  I have noticed an export button on the Manage Alerts window, but it does not provide what I am looking for or I am not doing it right.  Anybody have any ideas?

Marlbs · Answer

Actually... I have a good report that I reccomend just for what you are taking about.

I call the report "All Alerts In The Last 24 Hour Period - Detailed" - You can search for the report and download it.

The report dumps the Log Date & Time, the Alert Namer, The Object Data, The Action, and The Message

By using this report daily I was able to isolate the issues with the too many alerts and scale back as necessary, change polling time, add black out windows, and most of all I was able to see if the alerts were going to the right people. In many cases when I was cleaning those issues up we were sending the alerts to the wrong people so they just were ignored.

Too many alerts can be a real problem. At one point when I started here, the team was getting on average 500+ alerts per day and with that much noise, everything was pretty much ignored. Once I re-focused our efforts and alerting strategy to only send "actionable alerts" to the right teams we were able to scale it back to less than 10 per team per day.

lross94 · Answer

Thanks.  Looks like I can get my SQL DBA to pull that info for me.

netlogix · Answer

you can also use this to figure out what the nosiest alerts are.

SELECT AlertDefinitions.AlertName, AlertLog.ActionType, left(AlertLog.[Message],20) as MessagePart, COUNT(*) as CountOf

FROM [AlertLog]

inner join AlertDefinitions on AlertLog.AlertDefID = AlertDefinitions.AlertDefID

where LogDateTime > DATEADD(day,-30,GETDATE())

Group by AlertDefinitions.AlertName, AlertLog.ActionType, left(AlertLog.[Message],20)

order by CountOf desc

Oh, don't forget to check for traps or syslog events that are forwarded... they can be noisy too.