Showing results for 
Search instead for 
Did you mean: 
Create Post

Alert on Wireless Access points that goes Down/Missing


Been browsing the forums a bit but cannot find any good answer. I need to be able to alert on thin access points that goes down/missing.

The default alert does not seem to trigger when an access point that are pulled through our Cisco Wlan controller.

What is the trick to get this working? I dont want to poll all access points directly. I have tried to change the alert to unknown etc, still no luck.

Any help is appreciated!

Labels (1)
22 Replies
Level 11

Hello All,

I am trying to create this same rule but I where I work I have over 20 wlc. Is there I can get an alert on the ap for a specific set of controllers? I am about to create a test alert, then give NPM 10-15 mins to collect information on the wlc's. Then shut the port down on an ap and see if I get the alert. I will post the rule and my results. If anyone has got this done please share.


0 Kudos

If you are mirroring the alert from above posted by dzastrow, you can group pollers by adding more Match statements in the "Alert on objects where" clause.

Alert on all objects where:

Wireless Access Point - Controller Name - is equal to - zelle-wlc01

Could be something like:

Alert on all objects where

At least one child condition must be satisfied (OR)

Wireless Access Point - Controller Name - is equal to - zelle-wlc01

Wireless Access Point - Controller Name - is equal to - zelle-wlc02


If your hostnames of the WLC groups have something in common, you could also use a "looser" match statement such as "contains" or "starts with"

The below would accomplish the same thing as the rules above and trigger on both WLCs.

Alert on all objects where:

Wireless Access Point - Controller Name - contains - zelle-wlc

0 Kudos

I just tried the one you have above and I got an alert that all my ap were down even though they are all online.

Alert On:

Wireless Access Point

one child must be satisfied(OR)

wireless access point > Controller Name > is equal to > xxxxxxx

wireless access point > Controller Name > is equal to > xxxxxxx

I can put "equal to or contains" and I get an offline alert. When an ap joins or disconnect I get the alert on all 1038 access points rather than 1. It does not even send an up alert when I connect a new one. It just send Offline.

I am going to try another setting to see if it works.

0 Kudos
Level 7

Again this is an old post, but I just set this up with a Cisco WLC and thin access points across our offices.

I used the alerting that Guran84 used (THANKS!!!) and changed the gui setting that kept unknown APs in the database.

This is my summary config:

Name of alert:

Thin AP Down - USE ME

Description of alert:

Thin AP Down - USE ME - unknown/disappear state

Type of Property to monitor

Wireless Access Point



Evaluation Frequency of alert:

Every minute

Severity of alert:


Alert Custom Properties: (1)


Alert owner (user who created this alert):


Alert Limitation Category

No Limitation

Trigger Condition:


Alert on all objects where:
Wireless Access Point - Controller Name - is equal to - zelle-wlc01
The actual trigger condition:
At least one child condition must be satisfied (OR)
Wireless Access Point - Status - is equal to - Unknown
Wireless Access Point - Status - is equal to - Disappeared
Wireless Access Point - Status - is equal to - Disassociated
Wireless Access Point - Status - is equal to - Down

Reset Condition:


All child conditions must be satisfied (AND)
All child conditions must be satisfied (AND)
Wireless Access Point - Controller Name - is equal to - zelle-wlc01
All child conditions must be satisfied (AND)
Wireless Access Point - Status - is equal to - Up

Time of Day schedule:

Alert is always enabled

Trigger Action:

Escalation Level 1
1. Send an Email/Page (Alert ${N=Alerting;M=AlertName} at ${N=Alerting;M=AlertTriggerTime;F=DateTime})

2. NetPerfMon Event Log : This message should be customized to provide more information about the specific alert you created. You can use variables to provide detailed information in your alerts.

Reset Action:

1. Send an Email/Page (Alert ${N=Alerting;M=AlertName} Reset)

2. NetPerfMon Event Log : This message should be customized to provide more information about the specific alert you created. You can use variables to provide detailed information in your alerts.

I have syslog from the wlc pointing to solarwinds as well with the AP associate/disassociate traps forwarding - not sure how much of an impact that has on this and how this is actually monitored, but i can verify that this all does work in my environment.@

0 Kudos
Level 10

Hi Guys,

I know this is an old post but it is relevant to what I am working on so thought I would give it a shot.  We are introducing an alert to detect when an AP goes into an unknown or down state. It looks like we need to adjust the setting so that Orion does not remove the unknown APs.

But how does it work when an AP is decommissioned. The AP will go into an unknown status and our alert would trigger, we could then acknowledge the alert but it would always be in alarm. So if we restart the alert it would alert again. 

Is there is a way to manually remove APs that have been decommissioned?

0 Kudos

The way we work it is to review the down APs every once inawhile for ones that should be online, note them down for follow up and then reset the RemoveDisappearedAPs setting to let it clear everything out. Once the disappeared APs are gone we turn it back off and start again.

Not convenient but it works.

This looks like a fix and works.

0 Kudos

Wonder if there is possibility to automate this with some powershell script to change this settings and then with task scheduler to run it.

0 Kudos
Level 12


ours seem to alert is this of any help to you?


then the trigger section is:


0 Kudos

I've just tested the "Alert me when a Thin Wireless Access Point goes down" and it worked fine for me. This is my trigger. But as the AP information is collected during the Statistics Collection, it can take a while to get a down alert. We do the Statistics Collection once every 10 mins, so I could wait up to 10 mins before I get a down AP alert. I'm using Cisco 5508's.


I take information from the SNMP traps from the [aruba] controllers and flag the AP down immediately which speeds this up considerably.

In my environment I have to check the AP status on the primary and backup controllers since an AP will be up/down/missing on one, and down/up/missing on the backup.

i.e. on startup a backup controller knows about no AP so they are all missing from the controller, then if an AP connects to it is will know about it, and the state will reflect the state of the connection to this controller.

it's annoying as heck as Aruba AP support is very poor. Orion (by default) removes 'missing' thinAP from the database so I lose stats each time a controller reloads and NPM purges the data (unless you modify the config file with this switch in)

I also lose stats on every upgrade as the darned install process resets the flag to keep the data just before startup so the first thing solarwinds does on polling a controller is purge historical stats for our mising AP, rendering the data less useful.

Yeah alerting through Solarwinds can be slow. If I really want fast responses, I use Cisco Prime. But I get a lot of false positives using Prime for AP offline alerting.

0 Kudos
Level 16

"The default alert" which alert? Node down -- the nodes being polled is the controller so that is the wrong thing.

If you mean 'Wireless access point is down' then you'll need to share some more information, FGA: Please follow the standard litany when giving a problem report.

Do you have an alert defined on thin wireless access points? what is its definition? are the thin access points being discovered? what is their status when they go down?

0 Kudos


The Default Alert is "Alert me when a Thin Wireless Access Point goes down",  We are getting info about the access points from the Wlan Controller.

We have managed to get an Email alert now, when we changed the status to Unknown.

We are trying to create a NOC view for our technicians which are working with the access points. However, since the access points are being polled from the controller, they dissapear from Solarwinds when they are unknown/down since they are missing from the WLAN controller as well. We would like the alert to remain until aknowledged, so that the alarm is visible for the technicians. Would that be possible?

0 Kudos

look in C:\Program Files (x86)\SolarWinds\Orion\Wireless\SolarWinds.Wireless.Collector.dll.config

make sure you have

<add key="RemoveDisappearedAPs" value="False" />

otherwise if an AP disappears from the controller it gets purged from the database, and its alert will disappear too.

[this is my gripe below -- this value defaults to 'true' and is reset to 'true' on install/upgrade]

Hi Richard,

Hope you're doing great.

I'm was also looking for same solution.

It would be of great help, if you could help me to identify where to insert this line "  <add key="RemoveDisappearedAPs" value="False" />  " in the below code.


<?xml version="1.0" encoding="utf-8"?>



    <section name="log4net" type="System.Configuration.IgnoreSectionHandler" />



    <appender name="ConsoleAppender" type="log4net.Appender.ConsoleAppender">

      <layout type="log4net.Layout.PatternLayout">

        <conversionPattern value="[%thread] %-5level: %message - %logger{1}%newline" />



    <appender name="RollingLogFileAppender" type="log4net.Appender.RollingFileAppender">

      <file type="log4net.Util.PatternString" value="${ALLUSERSPROFILE}\Application Data\SolarWinds\Logs\Orion\Wireless\Wireless.Collector.Jobs_[%processid].log" />

      <appendToFile value="false" />

      <rollingStyle value="Size" />

      <maxSizeRollBackups value="5" />

      <maximumFileSize value="5MB" />

      <layout type="log4net.Layout.PatternLayout">

        <conversionPattern value="%date [%thread] %-5level %logger - %message%newline" />



    <appender name="OutputDebugStringAppender" type="log4net.Appender.OutputDebugStringAppender">

      <layout type="log4net.Layout.PatternLayout">

        <conversionPattern value="%date [%thread] %-5level %logger - %message%newline" />




      <level value="WARN" />

      <appender-ref ref="RollingLogFileAppender" />

      <appender-ref ref="ConsoleAppender" />




    <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.0" />





0 Kudos

Hi krupadi,

Im not sure if you managed to resolve it, i came across with the same issue running NPM 12.1.

Anyhow, here is an article i followed to change the way Orion acts on disappeared APs

Remove disappeared APs - SolarWinds Worldwide, LLC. Help and Support

notice that if your NPM is at version 12 and higher you need to change it via the WEB GUI and not from the file it self.

Have fun

The alert remains if you have a Reset Condition configured.

So once the device is up, then the alert will be reset (and disappear from the screen).

0 Kudos


I am working with andreasstenlund99 on this.

The Alert Trigger Rule is configured like this:


And then for Reset Condition:


Yet, Alerts is sent as specified in Alert trigger actions, the active alert is in the alert list. But only until next poll when AP is removed completely from Solarwinds NPM.

Would the solution be to change <add key="RemoveDisappearedAPs" value="False" /> in C:\Program Files (x86)\SolarWinds\Orion\Wireless\SolarWinds.Wireless.Collector.dll.config

I can understand why an disconnected AP would be set as unknown or disappeared when it looses LAN connection, if it is because of values retrieved from SNMP get/walk. But i can't understand why an AP that is disconnected, would it be from power failure or loss of LAN connection, is then removed from Solarwinds because it is not listed under the WLC. This makes it impossible to make any escalation events for instance.

I will have to test it to see if the alert disappears (but I don't believe it does). I will test it and let you know.

But instead of your customized trigger, have you used the Recommended (Reset this alert when trigger condition is no longer true) trigger? That's all I'm using.