Using IP address as a condition in an alert

Dear bthornto,

The conditions should be make a big difference in my point of view.

The first condition, when ALL of the following are true, supposed IP address for a node is unique, so for this point of view, the first alert cannot find any node that are both begins with 10.50 AND 10.51.

In second condition, when NONE of the following are true, it should be some nodes that are not begins with 10.50 and are not begins with 10.51, say 10.52.

But I have no idea on the problem of lower response time, just share the view for the conditions, you may just ignore it if my logic or understanding is incorrect.

Thanks.

Best regards,
Jason

Dear bthornto,

The conditions should be make a big difference in my point of view.

The first condition, when ALL of the following are true, supposed IP address for a node is unique, so for this point of view, the first alert cannot find any node that are both begins with 10.50 AND 10.51.

In second condition, when NONE of the following are true, it should be some nodes that are not begins with 10.50 and are not begins with 10.51, say 10.52.

But I have no idea on the problem of lower response time, just share the view for the conditions, you may just ignore it if my logic or understanding is incorrect.

Thanks.

Best regards,
Jason

Right-  The first condition should have been an 'any' of the following are true.

I had it set up like this and got 161 emails about APAC.  We've since prefaced the SNMP location for devices in APAC with there country code so I'll test a filter on a 'begins with XX'

I am curious why the IP address condition doesn't work though, I looked at the actual SQL query in the alert definitions and it seems like the syntax is correct.

Should the IP address be used as a suppression rule?  I had it as a qualifier in the trigger action.