This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

How Do I Exclude Devices From an Alert Trigger?

I need a few devices to NOT show up for my high response time counters. I don't like HP 1920 or Cisco 819's emoticons_happy.png.

These are the devices popping up.

pastedImage_1.png


In theory I want it to function like this:  "Trigger this alert when the node average response time is greater than 200ms and the node name DOES NOT contain 819 or 1920."

This is what I've set up.

pastedImage_3.png

However for some reason, I still gt those things popping up.

pastedImage_4.png

It varies depending on current response time but they are still there:

pastedImage_5.png

Is there anyway to better lock this down? Am I doing something wrong?

  • change this "OR" to an "AND" and it should work.

    pastedImage_0.png

    What you want:

    Average Response Time > 200ms and Node Name Not Like '%1920%' and Node Name Not Like '%819%'


    What you have right now:
    ( Average Response Time > 200ms and Node Name Not Like '%1920%' ) OR ( Average Response Time > 200ms and Node Name Not Like '%819%' )

    It's a common hurdle in building alert logic; but when you want to REMOVE items from your results; you almost always want to use "AND"

    Hope that helps!

  • Hi sceritz​, I have marked the response from zackm​ as correct for you as it hits the nail on the head. Getting the logic right is sometimes confusing.

    I often prefer to use the "Scope of Alert" section if I want to include/exclude items. This leaves the Trigger Condition clear for just the event that has to occur for the alert to trigger. It builds the query almost identically, but visually it makes it easier to see what your building. Plus you can then click on "Show List" to validate you've got it right.

    pastedImage_9.png

    Either way will get you the same result, so I hope these responses have helped you get your alerts setup as desired. Shout if you still need assistance.

  • Thank you so much Zack. I apologize for the late response. I manage a few different systems and was only now circling back to curating Solarwinds. This worked perfectly. I suppose my brain was trying to work the logic a different way but your explanation put it into perspective

  • Thank you! I actually tried it this way as well and it also works! Thanks so much for your help with this.