Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Craft an Alert without generating an alert - IYSWIM?

OK, so some of my lack of understanding may be to do with unfamiliarity with word usage but let me try and explain.

If I craft an alert - let's say the trigger is for F5 Pool Members going down for a specific client. This alert is working just fine, and triggers a line of text into the alert centre, and also triggers our external incident management system to raise an incident for the same. Now, sometime later, client 2 says - oh, can we have alerting for pool members going down.

To me, the simplest answer should be that I edit the current alert, and add in the second client as a trigger action which now reads as: is it client a or if client b, and othert conditions are met then trigger However, when I get to the summary page I get the following box just above the submit button:

Searching the forum doesn't produce an answer that helps me... so a couple of questions I guess.

1. Some of these 269 objects may already have triggered - so does this mean it will re-trigger and in our case also create a new incident?

2. Presumming the above is true, then how would you go about adding a second client (condition I guess) to an alert? Create a new alert just for that client?

3. If true, then how do you edit an alert such that it doesn't do this?

4 Also, if I just edit the alert but ultimately cancel out, it appears the Solarwinds is triggering these alerts anyway. Surely that isn't right?

Bottom line: we want to be able to edit alerts without Solarwinds going 'oh look, I found xxx number like that and will trigger them now' each, and every time.

Or am I barklng up the wrong tree? Any clarity, anybody can offer is most welcome. Thanks.

Find more posts tagged with

Accepted answers

All comments

christopher.t.jones123

can you post a screenshot of the trigger condition?

neomatrix1217

2. Presumming the above is true, then how would you go about adding a second client (condition I guess) to an alert? Create a new alert just for that client?

On this point here yes you could use custom properties to filter for only that client.

Create a custom location property in the Orion Platform

sturdyerde

Yeah, it sounds like you may want to (A) create a separate alert that can filter by client, and (B) create a custom property on nodes to identify the client. The custom property could also be used to route alerts via actions.

stuartd

Not sure which of you to reply to so will go with one post

The actual current trigger condition is:

But this would become:

But even if I do a separate alert I still get the "this alert would immediately trigger xxx" - and it is this that has me concerned, not the actual alert logic or creating triggers, etc. Also, my original questions still stan and just for ease of viewing they are:

1. Some of these 269 objects may already have triggered - so does this mean it will re-trigger and in our case also create a new incident?

2. Presumming the above is true, then how would you go about adding a second client (condition I guess) to an alert? Create a new alert just for that client?
3. If true, then how do you edit an alert such that it doesn't do this?

4. Also, if I just edit the alert but ultimately cancel out, it appears the Solarwinds is triggering these alerts anyway. Surely that isn't right?

Also, something else weird is happening in relation to this. This morning I have acknowledged and cleared a bunch of olf F5 Pool Member down alerts and these then generated incidents into our ticketing tool. Trouble is, these pools have been down for over a month so why create an incident from them? Thoughts on this, as I suspect it is related?

As I say, some of this may just be my lack of understanding.

sturdyerde

Your "this would become" screenshot of the new alert criteria is missing a condition for "F5 LTM Pool - F5 Status - is equal to - Down". If you fix that, the trigger count should go down, I think.

superfly

If you edit an alert, the alert will not re-trigger.

If you create (or copy) a rule, then it will trigger on what ever the condition is even if it's the same as an existing rule.

sturdyerde

superfly99 wrote:
If you edit an alert, the alert will not re-trigger.
If you create (or copy) a rule, then it will trigger on what ever the condition is even if it's the same as an existing rule.

In my experience, editing an alert does re-trigger if a new alert condition is met, or if a previous instance of the alert was cleared prior to saving my edits.

superfly

Actually that is correct. It will trigger on new alerts it found but not on ones that have been triggered already.

stuartd

As above, I have no issues with how to create the alert. We, in fact, already have one which is actively working and doing what is expected.

The problem is how to add a new client to that alert (or a new one) without Solarwinds threatening to trigger on XXX number of objects.

sturdyerde

OK, I feel caught up now. I think that, as you guessed (Re: Craft an Alert without generating an alert - IYSWIM? ), you will need to create a new, separate alert for the new client.

An alternative approach would be to add a custom property to the device to store your clients' email addresses. You could then use one alert that takes the client condition out of the trigger conditions, but use the custom property that contains the client email address as a variable in the To: box for the "send email" action type.

stuartd

OK, apologies if I'm not being clear.

I know SW will do that - what I am asking is how (if possible) can I do the opposite? i.e. create an alert without it alerting.

sturdyerde

Unless you disable it from the start, you cannot create an alert that will not send alerts if there are conditions resulting in TRUE after the alert configuration is evaluated. (I'm sure you already know this, but it seems to be what you are asking. ?)