Suppressing reboot alerts only on certain nodes?

[rharland2012]

I have a few printers that we manage for our EMEA colleagues. We poll these printers using SNMP.

These printers get turned on and off a good bit, and we invariably get quite a few reboot alerts as a result of this.

I decided to suppress the reboot notifications for these specific nodes.

To that end, I populated the 'Comments' field in their custom properties with the word 'Printer', and then modified the reboot alert definition in Advanced Alert Manager to only trigger the alert when Boot Time had changed (the default condition) and Comments field did NOT contain 'Printer'.

For some reason, however, that seems to have suppressed all reboot alerts for all nodes.

I'm not positive why this isn't doing what I think it should, or if I am simply misinterpreting the effective definition of the alert.

Any information or previous experience with this situation would be great to hear.

Thanks!

[rharland2012]

I was doing it the other way - asking for the engine to check for two things before it triggered the alert.

[rharland2012]

The funny thing is the original placement of that argument was on the suppression tab! It killed the reboot alerts - for everything.

My custom property value was taken directly from drop-down input - that is to say, the prelisted populated values when building a condition based on a custom property. I didn't have to type anything.

[netlogix · Accepted solution]

The suppression tab is for global suppression.  suppress everything if it is true anywhere.  If you suppress "Comment = Printer", then if you have any comments that say printer for any node, suppress for every node until there isn't a comment of printer.  Try to stay away from the suppression tab, unless you can not do it in the alert tab.

[netlogix]

you might need to add a group that is "any" and add the Comments is not equal to printer and add another there that says Comments is empty - it's a weirdness of SQL that if the field is null (because you didn't put anything in it), then it does show up when you say does not contain.

[rharland2012]

Ah, I see. Thank you.

[cahunt]

Machine type or Vendor is good(maybe best if you have same device types that you want reboot alerts on), or if you have a qualifying Custom Property to use. Also depending on your naming convention you may be able to trigger off that or a portion of it that denotes a printer.

To verify logic though could you post your alert argument?

[bluefunelemental]

Can you include a copy of your alert screen? It might be easier both to use the machinetype field for the printers in the suppression of the alert - do not trigger if machinetype starts with to Canon or something.