Alert suppression when the network is down..

Question

One of our firewalls crashed. Obviously a problem. But out of it I received a "Node Down" alert  (Node Status is equal to Down) for each of my remote nodes... Nice way to create 100's of auto-generated trouble tickets, and fill up my inbox with a ton of useless e-mails.  I only really needed one Alert;  "Yo the network is down"...

So how do I suppress an Alert generation for all the remote nodes if the firewall ever should crash again?  Is there a way to say "suppress all node down alerts if the firewall is down"? Or "suppress all node down alerts if there are more than X number of nodes down"?

I'm sure this problem is seen by many people and hoping that someone has a solution.

netlogix · Answer

The dependencies setup is the best way, but if you do that, make sure your alert says to either alert when down, or if it says alert when not up, then include not up and not unreachable (and not unmanaged).

Be careful with suppression, suppression suppresses the alert if the suppression is true at all in the database.  So if you put Node name = firewall and node status = down, that would work for that situation, but if that alert is also for the firewall, then it will never tell you the firewall is down.  Suppressions are global which can make them tricky.

mharvey · Answer

The easiest way, in your node down alert, go into the suppression tab and setup

Node Name is equal to Firewall Node Name

Node Status is equal to Down.

Another method would be to create a dependency where you add that firewall as a parent to the devices in your network.  An easy way to do that would be to create a network group that you put all but that firewall into, then use the firewall as the parent.

Regards,

Matthew Harvey

Loop1Systems

http://www.loop1systems.com