nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Alert Engine Beta

jonchill

The new alert engine is so much more flexible and usable but one aspect that it does fall down on is it's macros, it now does not even put any basic macro in the outbound alert you have to look them all up.

But what might of been an even bigger benefit and made the product almost perfect is a drop down list of all the different macros type you can select then just select them from the list and place them in the alert where required, rather than having to look them up all the time. Similar to how our ISS Preventia IDS appliance allows you to build alerts from a drop down list of all available macros.

Where has the test alert feature gone?

Thanks

Jon

IT Infrastructure Manager
Pilgrim Hospital
UK

Find more posts tagged with

Accepted answers

All comments

Don331

I agree, where's the test button?

Also, is there any docs of what has changed in the beta?
Don Barry
Aegis Mortgage Corp
Houston, TX

DonYonce

Keep in mind, this is a "pre-release", not the final release.

On the macros .... we will probably be adding a Macro Builder feature to the actions. The supported Macros in the new engine are far, far more advanced than the previous version. The new set of Macros can be as simple as the current set, or as complex as refering to related devices or interfaces, or even run SQL statements. So... a Macro Builder will be needed.

As for Test Alerts. It is not available in the pre-release. They are still unsure what the best method of implementing that feature is. Since, the new Alert Engine is service based, generating a genuine Test Alert is more difficult. But, I'm sure they will figure something out.

CCrew

Still no hooks into the Application Management pack?

-Roger

jonchill

Don,

Would it be possibler to add a feature to the alert reset that is customizasble by us, what I'm thinking off is the ability to add a reason why the Node\Interface triggered the alert, as our alerts get sent to everyone and there pet dog and rather than having to send out a sperate e-maile or phone everyone if we could incorporate it into the alert reset it would save us a lot of time?

With the alert escalation would it be possible that when someone acknowledges an alert a pop up comes up and asks for name and department and adds this to some sort of log that is kept when alerts are acknowledged either in the database or in a text file so we have an audit trail if nothings done about an alert even though it has been acknowledged?

Thanks

Jon

IT Infrastructure Manager
Pilgrim Hospital
UK

DonYonce

quote:Originally posted by CCrew

Still no hooks into the Application Management pack?

-Roger

Download and install the latest Application Monitor release. It should include extensions for the Orion V8 Alert Engine.

snowjay

I've been dying to try the new Alert Engine, but my question is what happens to all my current alerts? Do they get migrated? Or do I have to start over?

DonYonce

Excellent question !!

If you add the Orion Version 8 Alert Engine to an Orion Version 7 installation, you will now have 2 Alert Engines. The version 7 will continue to function as always. The version 8 will also be available (via a different user interface). There is no Alert migration in the pre-release version.... your existing Alert Engine and the new one will both function at the same time.

The version 8 Alert Engine (and Orion management packs) were originally designed for Orion V8 only, but we felt that Orion V7 customers would also receive benefit from using some of the Orion V8 extensions on the current release before Orion V8 was available.

The Orion Version 8 Alert Engine is a free upgrade to Orion Maintenance Customers.

snowjay

Don,

Thank you as always!

*off to try the new alert engine*

duncan_922

Hi,

I just downloaded the beta. But do I have to run the wizard again? Will it affect any of my data?

Thanks

jalgiere

New Engine is a Great improvement! I know it's still Beta but was wondering if anyone else was running into this problem. When I make a copy of an alert the Trigger Actions & Reset Actions seem to copy over but, if I go back and edit the actions they seemed to have disappeared.

Thanks

Jim Algiere

Don331

Still need some way to set up a global alert supression easily. A good example is a branch office that has a router, a switch, and a server.
Having to set up a rule for every device in a branch gets old real fast.
It would be cool to have a table to group the node ID's of nodes into logical groups, and then set up at least 2 levels of supression .

Don Barry
Aegis Mortgage Corp
Houston, TX

bleearg13

quote:Originally posted by Don331

Still need some way to set up a global alert supression easily. A good example is a branch office that has a router, a switch, and a server.
Having to set up a rule for every device in a branch gets old real fast.
It would be cool to have a table to group the node ID's of nodes into logical groups, and then set up at least 2 levels of supression .

How about setting up custom properties in your nodes which denote a "dependency level" or "dependency class" and setting up your suppression based upon those values? For instance, we have colocation customers and different types of access customers. In my Orion DB, I've set up a DepClass property which has values such as "immediate", "hosting", "t1-access", "eth-access", etc. Depending on the alert I'm setting up, I add a different dependency class to the suppression. I know it's not automatic, but it seems to work okay for me and doesn't take long at all if you sort nodes by various properties in the Custom Property editor.

bleearg13

2 suggestions:

1. I think it would also help to have a "Are you sure?" to "PEBKAC"-proof the deletion of alerts. I've deleted an important alert at least once in the alert engine that comes with the Orion distributation. I'll say it was because of an overanxious trigger finger :-/

2. The ability to acknowledge an alert via the Orion website. Maybe this is already integrated, but I'm too blind to find it?

-evt

craig999

Hi,
When installing the new alert engine, do I need to re configure the database and website with the config tool? Or have i done something wrong?

Thanks

casmith32

What about dependencies ? I would be great to have the ability to create device groups, then assign dependencies to the group as a whole - i.e. all switches behind a router at a site are dependant on the router. Then have the option to have alerting set to not alert on the nodes dependant on another node... i.e. if router x goes down, automatically do not alert on all the nodes dependant on that node.

will this ever happen ? it's a real pain to have to setup an alert and it's supression for every site I have, as well as dependencies within that site for larger locations. I'd like to see this simplified. that way if I add a switch or any other node to a group - I know it's automatically going to be covered in an alert that's already been created, vs having to go update the alert each time.

I imagine this grouping capability could also be applied to numerous other functionality within orion - view limitations, reporting, etc...

casmith32

quote:Originally posted by bleearg13

2 suggestions:

1. I think it would also help to have a "Are you sure?" to "PEBKAC"-proof the deletion of alerts. I've deleted an important alert at least once in the alert engine that comes with the Orion distributation. I'll say it was because of an overanxious trigger finger :-/

2. The ability to acknowledge an alert via the Orion website. Maybe this is already integrated, but I'm too blind to find it?

-evt

Along those same lines - I put in a feature request to have annotations for events.. this would be key in my mind!!

bleearg13

I know the Alert Engine is still in beta, but any word on when the final product will be released? I'm very eagerly awaiting the release of this, since the beta leaves much to be desired in the way of Macros (read: about 1/3 of them work).

cherrypicker

quote:Originally posted by CCrew

Still no hooks into the Application Management pack?

-Roger

Is Solarwinds looking at integrating the alert engine into other components of Orion such as application monitoring, syslog etc? Having one alert manager to configure/manage alerts for application monitoring and syslog would be more beneficial.

CP

praghubar

Our weekend computer staff frequently re-boot servers, which sends Email and phone call alerts to the On-call person. How can I suppress these type of alerts with the New alert engine?

thanks
Peter

gbrance

Our weekend computer staff frequently re-boot servers, which sends Email and phone call alerts to the On-call person. How can I suppress these type of alerts with the New alert engine?

You could either request that the weekend computer staff manually disable the alerts in Orion when they reboot the computers.

Our you could setup three alerts.

Alert#1-During certain hours off the weekend when there is staff onsite working any alerts are sent to them instead of the on-call person. When they are not working this alert is setup not to send out a alert.

Alert#2-You then setup a second alert for your on-call people that only sends out alerts when the computer staff on-site is not there during the weekends. You could setup these alerts to only alert on Saturday and Sunday.

Alert#3-Then you setup a alert for Mon-Fri as normal.

GB

cherrypicker

quote:Originally posted by praghubar

Our weekend computer staff frequently re-boot servers, which sends Email and phone call alerts to the On-call person. How can I suppress these type of alerts with the New alert engine?

thanks
Peter

praghubar

If you know that the servers will be offline for several minutes cause of a reboot then you can set a delay under alert escalation - you must edit your current trigger actions (mail, phone call..etc).

Under the Alert Escalation tab check off "Delay the execution of this Action" - then set the time (minutes) for the delay. For example, if you set 10 minutes - when an alert is triggered (server down) it will not execute the action (mail, phone call) but put it in pending mode. It will only execute the action if the server is still down after 10 minutes.

Hope this helps.
CP

Thanks for the reply CP, but I cannot get any delay to work. I created an Alert and set the Alert Escalation delay for 12 mins, but the email is always sent when when the alert is triggered and never delayed. Am I missing something else?
thanks
Peter

cherrypicker

quote:Originally posted by praghubar

praghubar

What version of Orion are you running with the new Alerting Engine?
Does the action (email) that you have configured (in Trigger Actions tab) display T+12 minutes on the right side? It should also be displayed above the Add New Action button as well.

CP

Thanks CP, I am running Ver 7.8 but I just re-check the website and I need Ver 7.8.3 for the new alerting engine. I'll upgrade and hopefully it will all work OK.
( Just a comment that I do get the T+12 mins on the right side and also the Execute 12 mins after the alert is trigerred messages on my version of Orion )
thanks again
Peter

BryanBecker

Don....any eta on the final alert engine release? I'm having a difficult time writing new alerts because of my lack of use with these macros. In the mean-time do you guys have canned alerts (like in the old versions of Orion) that can be loaded into the new alert engine?

For instance in the old systems (InBps) showed up as Mbps in the alert. In the new enginer its not showing that way...its actuall Bps. I want to see Mbps. Things like that do not seem to be consistant.

Thanks,

BB

cherrypicker

quote:Originally posted by Don Yonce

Keep in mind, this is a "pre-release", not the final release.

On the macros .... we will probably be adding a Macro Builder feature to the actions. The supported Macros in the new engine are far, far more advanced than the previous version. The new set of Macros can be as simple as the current set, or as complex as refering to related devices or interfaces, or even run SQL statements. So... a Macro Builder will be needed.

As for Test Alerts. It is not available in the pre-release. They are still unsure what the best method of implementing that feature is. Since, the new Alert Engine is service based, generating a genuine Test Alert is more difficult. But, I'm sure they will figure something out.

The escalation is pretty limited - would like to see features such as groups, scheduling (for on call person). Would like the ability to acknowledge the alert via email in addition to the Alert Manager.

BryanBecker

quote:Originally posted by cherrypicker
The escalation is pretty limited - would like to see features such as groups, scheduling (for on call person). Would like the ability to acknowledge the alert via email in addition to the Alert Manager.

Good point there. Every Monday I have to go into Orion and update a few alerts to page the oncall person and not everyone else on the team. That's a tedious task to do every single week. It would be nice to be able to load some sort of oncall schedule so that Orion know whos to alert.

BB

cherrypicker

Nice to have...

Orion should have to ability to monitor Windows event logs? It would be nice if it can be incorporated into the alerting engine as well.

Any thoughts?

CP

lohelle

snare (freeware) can do that.. It forwards event logs (can be filtered) to a syslog server (like solarwinds syslog server)

But it would be nice if this feature was included in NPM

RyanJett

quote:Originally posted by cherrypicker

Nice to have...

Orion should have to ability to monitor Windows event logs? It would be nice if it can be incorporated into the alerting engine as well.

Any thoughts?

CP

There is a free add-on utility that can be installed on Windows Servers that forwards the Event Logs via Syslog Messages. This can be downloaded in the Customer Area of the SolarWinds website. Once logged in, go to Additional Components for Orion, and download the Windows Event Log Forwarder.

Ryan Jett
SolarWinds.Net
918-307-8100

cherrypicker

quote:Originally posted by RyanJett

quote:Originally posted by cherrypicker

Nice to have...

Orion should have to ability to monitor Windows event logs? It would be nice if it can be incorporated into the alerting engine as well.

Any thoughts?

CP

There is a free add-on utility that can be installed on Windows Servers that forwards the Event Logs via Syslog Messages. This can be downloaded in the Customer Area of the SolarWinds website. Once logged in, go to Additional Components for Orion, and download the Windows Event Log Forwarder.

Ryan Jett
SolarWinds.Net
918-307-8100

Is there a similar utility for Unix, Linux and Solaris boxes?

pblatz

quote:Originally posted by cherrypicker

quote:Originally posted by RyanJett

quote:Originally posted by cherrypicker

Nice to have...

Orion should have to ability to monitor Windows event logs? It would be nice if it can be incorporated into the alerting engine as well.

Any thoughts?

CP

There is a free add-on utility that can be installed on Windows Servers that forwards the Event Logs via Syslog Messages. This can be downloaded in the Customer Area of the SolarWinds website. Once logged in, go to Additional Components for Orion, and download the Windows Event Log Forwarder.

Ryan Jett
SolarWinds.Net
918-307-8100

Is there a similar utility for Unix, Linux and Solaris boxes?

CP
Here are the basic steps. the specifics will depend upon versions of Unix, Linux, and Solaris.

Set the ORION box up in your /etc/hosts file as the loghost
x.y.z.h orion loghost

Then edit the syslog.conf file to send syslogs of desired severity to the loghost.

Thanks,
P. B.

Success requires three bones--wishbone, backbone and funnybone. Kobi Yamada

chapter29

quote:Originally posted by casmith32

What about dependencies ? I would be great to have the ability to create device groups, then assign dependencies to the group as a whole - i.e. all switches behind a router at a site are dependant on the router. Then have the option to have alerting set to not alert on the nodes dependant on another node... i.e. if router x goes down, automatically do not alert on all the nodes dependant on that node.

will this ever happen ? it's a real pain to have to setup an alert and it's supression for every site I have, as well as dependencies within that site for larger locations. I'd like to see this simplified. that way if I add a switch or any other node to a group - I know it's automatically going to be covered in an alert that's already been created, vs having to go update the alert each time.

I imagine this grouping capability could also be applied to numerous other functionality within orion - view limitations, reporting, etc...

This question does not appear to have been answered, so I will bump it.

We are evaluating Orion as a replacement to What's Up Gold. What's up has recently released their pro version, which now uses SQL, but is still severely lacking in it's reporting and presentation. Their polling can be up/down dependant, not only the alerting.

This is a major flaw to Orion and although it appears to be a better product on many levels, alerting is a huge factor in a product of this type.

There are several other flaws that I see when comparing the 2 products, but this is not the thread for that discussion.

Network_Guru

Hey Chapter 15+14,

I think you will find a solution in this post:

www2.solarwinds.net/.../topic.asp

-=Cheers=-
NG

chapter29

quote:Originally posted by Network_Guru

Hey Chapter 15+14,

I think you will find a solution in this post:

www2.solarwinds.net/.../topic.asp

-=Cheers=-
NG

Thanks for the reply Guru.

We have approached this in a similar way, using subnets. Essentially saying if anything in subnets X or Y are down AND the router is down suppress the alert.

This will have to be timed I would guess with the router for example, being polled at a faster rate then the other devices to avoid erroneous alerting.

The issue at hand is that we have roughly 200 sites with several device types at a given site, thus requiring the need to have what I can tell a minimum of 5 or 6 alert definitions per site. One per device type (IE sending alerts to the group that manages the given device), and a suppression alert. This can be signifigantly more if we need to send to different teams based on time of day (IE on call).

Orion severely lacks some basic functionality in my opinion. Groupings. Polling sequencing off of these groupings, with dependencies (IE forget alerting, up/down polling dependencies, then alert). Why continue to poll devices that we know are down? For example, if we know that the router at a given site is down, do not even bother to try and poll devices that are up dependant on it? And the finally generic alert definitions that can pinned to a group.

This is something that quite frankly WUP does much better then Orion.

I will continue to look for ways to stream line this and make it more effective, but creating 1000 plus alert definitions is simply a poor solution, though be it perhaps the only solution.