8 Replies Latest reply on Aug 19, 2009 9:56 AM by Congo

    Alerting: evaluate two nodes during supression (Complex Condition?)

    mvjames

      I'm trying to suppress an alert based on whether the triggering node is on the same subnet (custom property) as another specific node. 

      Yes, I do know I could have an alert for each subnet but this could be impossible to maintain after a certain point 

      example

      if NodeT.subnet=NodeR.subnet AND

      NodeR.IP=X.X.X.X AND NodeR.Status <> UP then suppress

      I see the Complx Condition option but no real documentation of examples of how to put one together.

        • Re: Alerting: evaluate two nodes during supression (Complex Condition?)
          mvjames

          Or simpler

          if NodeT.subnet=X.X.X.0 AND

          NodeR.IP=X.X.X.1 AND NodeR.Status <> UP then suppress

            • Re: Alerting: evaluate two nodes during supression (Complex Condition?)
              MagnAxiom

              Unfortunately, everything I have seen points to the alert system being "stateful" meaning that when an alert triggers, you only have access to the data of the node that triggered the alert.

               

              This is one of the biggest issues I have with Orion right now.  For instance, say I want a server alert to be suppressed if the switch it connects to is also down. Sounds like a pretty strait forward Parent/Child like scenerio.  Everything I have found says you can't do that, because you only have visibility to the status and custom properties of the node that triggered that alert.  As a result, you will get an alert for the swtich and all devices monitored off that switch, rather than one single alert that lets you know that all the nodes connected to it are down as a result of this outage.

                • Re: Alerting: evaluate two nodes during supression (Complex Condition?)
                  denny.lecompte

                  Alert-suppression based on dependencies is planned for an upcoming release.

                    • Re: Alerting: evaluate two nodes during supression (Complex Condition?)
                      mvjames


                      Alert-suppression based on dependencies is planned for an upcoming release.

                       



                       Not so fast denny to suggest your answer as the "solution". My question was a two parter. Do not assume that I am referring to "dependant" nodes. I was just making an example. Your suggested solution is part of the problem for what you are thinking this question is about. Solarwinds representatives have been claiming parent/child dependencies "will appear" or "is planned for an upcoming release" since before 9.0 came out and before 2007. "upcoming release" can mean anything tomorrow, next week, next year, next decade.

                       

                      A) I am looking to relate two or three nodes that may or may not have the same parent node. Not looking for a physical topology failure.

                      B) I have physical topology node failure/ "parent node" alert suppression working. At the moment the only way to impalement this is to have AN ALERT PER PARENT NODE. Solarwinds builtin functionality to determine Parent Node relationship but my question is on a multiple node suppression ie AN ALERT FOR MANY PARENT NODES.

                      C) describe or explain or give examples on how to use the "complex condition" in your current product. Note I am not asking ow to create complex scenarios with the condition groups and simple conditions. just how the field/value * is equal * works and what is expected.

                        • Re: Alerting: evaluate two nodes during supression (Complex Condition?)
                          denny.lecompte

                          Do not assume that I am referring to "dependant" nodes. I was just making an example

                          You're assuming that I'm referring to topological dependencies, but in our current design, any object could be denoted as the "parent" of any other.

                          Solarwinds representatives have been claiming parent/child dependencies "will appear" or "is planned for an upcoming release" since before 9.0 came out and before 2007. "upcoming release" can mean anything tomorrow, next week, next year, next decade.

                          True.  But until we're we're about to release it, there's not much else we can say.  I can see why it seems like weak tea, but it's what we have.  There are some things that we've wanted to do for a long time that have proven to be difficult technically because of internal architecture.  Dependencies is one of those.  But we have a very concrete plan on how to do it, and that means its not too far away. 

                           

                          A) I am looking to relate two or three nodes that may or may not have the same parent node. Not looking for a physical topology failure.

                          Good.  We're planning to allow arbitrarily-defined groups to depend on arbitrarily chosen objects.

                           

                          B) I have physical topology node failure/ "parent node" alert suppression working. At the moment the only way to impalement this is to have AN ALERT PER PARENT NODE. Solarwinds builtin functionality to determine Parent Node relationship but my question is on a multiple node suppression ie AN ALERT FOR MANY PARENT NODES.

                          Yes, the current solution is clunky.  The planned solution would involve a different UI for defining dependency relationships.  When a dependent node goes down, if it's logical parent is also down, the dependent node is marked as "unreachable" rather than "down".  If you're alerting on "down" nodes, you'll only get alerts for the logical parent, not the "unreachable" children.  The unreachable state will also show up on node lists, maps, etc.  It's not so specific to the alert engine.

                           

                          C) describe or explain or give examples on how to use the "complex condition" in your current product. Note I am not asking ow to create complex scenarios with the condition groups and simple conditions. just how the field/value * is equal * works and what is expected.

                          When you see "field * is equal to value *", you select a field like "Node Name" and a value like "bubba".  But it's more free form than the other fields, so you can select any field and then the value for that field.