I am looking to create an alert if there are 3 triggered alerts instances of a specific AlertObjectID in the last 10 mins.
I have working SWQL to give me a count but I seek suggestions on setting the Alert.
Thanks,
Sean
===========
I am looking to create an alert if there are 3 triggered alerts instances of a specific AlertObjectID in the last 10 mins.
I have working SWQL to give me a count but I seek suggestions on setting the Alert.
Thanks,
Sean
===========
I don't see see Orion.AlertHistory as accessible in the drop down or in the drop down for Custom SWQL. If this was a SAM Template you might be able to go at it from that direction.
What use case / condition are you going after? Any extra intel on what your alert object?
Thanks for the reply. We are wanting two levels of Alerting. A Warning if the status goes down for 1 min (condition must exist).
We would want a critical alert if there are 3 Alerts on status down in a 10 minute window (ex is the status drops and returns 3 times in 10 minutes.
Groups might be a viable alternative, unless someone smarter comes along and knows if AlertHistory table is in the alert engine.
Trying to catch flapping conditions right? Definitely important! This is especially true when you introduce delays or durations into the triggers. Ie:, the interface must be down for 2 mins before an alarm. Imagine a case where it's down 1 min, up 1 min, etc... You have a service that's basically unusable and you'd never know about it.
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.