Adv Alert Suppresion

There are a couple of methods to accomplish this. One is in the Understanding Orion Advanced Alerts Paper, the other is in NPM content exchange. I have not done the second one but it has great user reviews.

I havent tried the second method either (I wouldnt be able to... this is just to "manual")... however I never found a solution to this, not in the guide either... i am pretty much guessing that every orion user would use that function.

I have tried looking thru the manual and on posts, but have never discovered a concrete way of doing it, i am supposed to make a presentation on how we are going to do this as upper management wants it.   I have seen how to do 1 layer  of supprsion but nothing on mulitple layers which is what I need.

Well you probably need to start by having a down alert specifically for the DMVPN's and the sites.  You can do this by using a custom property field and noting something specific to them.  I have seen several cases where folks use a custom property field to note the Network Layer or something like that.

Once you have that setup you can then setup a suppression for that alert where device name is Dist SW and status is equal to down.

This is one way that I think you can accomplish what you want.

That is along the lines I was thinking, perhaps by using a numeric field to depect each layer for main core all the way down to sites.  The most unfortuante thing is there is no way to test as we do not have a matching test environment and I don't think I could convince NetEng team to take down a core device!!  

You can test the SQL by toggling the status condition... its not perfect but then you at least can screen out any obvious typos.

Using traceroute is something I thought might help but for some reason the IPs returned don't match what I would expect the COREs would be ( I don't understand why this is...).

The other thing that I've been doing is I leave the original alerts active... as I add my suppression I have it only email me... eventually when an outage occurs... I can validate my suppression. 

Short of taking a core down.. I can't think of anything else.