alert suppression

Question

I have over 100 remote sites with at least 5 devices behind each router, some sites have up to 40 devices.  This is a whole boat load of emails when routers start dropping.  Is there a way to suppress the switch alerts when the router fails?  Without having to create a separate alert for each switch?

clanger · Answer

No, nothing like that

Custom property editor is in the Orion NPM "orion" menu at the top I think (or from advanced options you can launch it separately), you just create a custom property within it and then assign the custom property to each node.  Nothing to do at the switch end.

In custom property editor, I selected add new custom property, then checked the box by CustomerName.
Then under edit nodes, I created my unique identifier for each site (siteA, siteB, etc)  theres an import option I havent used but you might to make things easier for that many - for me I just copy/paste to the nodes I needed as there were only about 20 at the start and expanded to about 90 now with about 10 different unique names for sites.

then in advanced alerts, you just select off the custom property unique name as only the devices you associated with that property name will match your alert criteria.

FormerMember · Answer

Forgive me, but I just inherited this system a couple of months ago and don't know Orion that well.  I don't understand what you are telling me to do.

"I did mine with a custom property defined for each site.
So site A devices had a custom property of CustomerName=siteA"

are you saying I need to modify every one of my switches?   Good Lord, that is almost 2k devices.

clanger · Answer

I monitor remote sites like this with advanced alerts and have suppressions set up.

I did mine with a custom property defined for each site.
So site A devices had a custom property of CustomerName=siteA, andso on.
I created advanced alerts for the devices and a separate alert for the edge device.  The devices alert was suppressed when the edge device was down and of course there was no suppression for the edge device alert.
Then it's just a matter of using those two alerts and copying them and modifying for the new custom property.
Ex.  If custom property = siteA and node status != up then alert (unless edge device is down)

depending on polling overlap you may get a couple alerts despite this setting if polling sees a device down before it sees the edge device down (can happen if you poll every X seconds) but I also built a delay into the alert of a minute before the alert fired to account for fase positives etc.