Question about advanced alerting

For this all you need is two separate alerts.  One alert that covers all of your devices except for the problematic devices and a 2nd alert that is specifically for the problematic devices.

To exclude the devices in your first alert put in a set of conditions that look like the following...

Trigger Alert when any of the following apply:

Node Name is not equal to <problem device 1>

Node Name is not equal to <problem device 2>

Node Name is not equal to <problem device #>

And for the 2nd alert do the same thing noted above but change the logic to be "Node Name is equal to".

Hope this helps!

There's probably a better way to do this than what I'm about to suggest.  But if you had some number of devices, say 20, that are the flapping hosts you could create a custom property and fill it with a value to indicate flapping and leave it blank for the rest.  In your alerts setup, you could then include consideration for the flapping host on whether or not to process it like your regular alerts.

There's probably a better way to do this than what I'm about to suggest.  But if you had some number of devices, say 20, that are the flapping hosts you could create a custom property and fill it with a value to indicate flapping and leave it blank for the rest.  In your alerts setup, you could then include consideration for the flapping host on whether or not to process it like your regular alerts.

Yeah, I completely agree with this.  If you have more than just a few flapping devices or anticipate having more in the future, use custom properties to flag that and then use those in the alert to separate out those nodes.

Thanks for the advice guys.  I will work on this with the information given and see how it works out.

-Kevin