cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 14

Alerting with Enhanced Node Status

An initial thought I had when Enhanced Node Status came out was that since I would be able to include Application and Interface metrics into the determination of Node status, I might be able to retire some or all Interface and Application status alerts. I reasoned that I could potentially get away with a single "Node is in Warning/Critical Status" alert that would include the root cause variable in the notification telling me what was causing the node to be in a degraded state.

I believe that would work - except in the case where I am using a custom property for the Node, Interface and Application to contain an email address for alert notification. So, in a case where the email address is different depending on whether it is the node, interface or application that is the issue, it appears that I cannot yet build that level of "intelligence" into an alert based solely on Enhanced node status.

Am I correct, or have I missed how to do this? Or, so I still need separate alerts for nodes, interfaces and applications? Is a Group approach the answer?

Thanks.

0 Kudos
3 Replies

If I wanted to redo the alerts to a single form like that I'd probably just use a custom sql variable with some case logic for my To:

Itd be something like case when alert object type = 'orion.nodes' then nodes.alertrecipient
when alert object type = 'orion.interfaces' then interfaces.alertrecipient
Etc
- Marc Netterfield, Github
0 Kudos

I get the general idea, but what would that look like embedded in the "To" field of the alert email action?

0 Kudos

@borgan Once you build out the query you can use the variable builder to do the rest

Screen Shot 2020-07-30 at 6.44.37 AM.png

Once you insert it you can then copy and past it to the "To:" line