Consolidating triggered alert actions or one action per day

awmcgregor  wrote: Hello All, I would like to ask if there is a way to set up an alert that will only alert once per day even if it is triggered more than once a day. Or, one that will only fire a notification once a day regardless of how many times a day it is triggered. The issue is that we have an alert set up for CPU utilization that typically triggers more than once a day, but we don't want it to create a ticket every time it is triggered. We would like it to create one ticket regardless of how many times it gets triggered. Hope this makes sense. Andrew

If you haven't looked over this document I recommend that you do Orion Platform 2019.2 - Enhanced Node Status 

Using a combination of dynamic baseline thresholds and X out of Y polls or X consecutive polls you'll be able to control the alert trigger and consolidate down to much more meaningful triggered alerts.

Optimally, do as Serena suggested and adjust the thresholds so it only triggers when needed.

BUT, I feel the need to answer your question even though I don't think it's the best solution.

You can change the "Reset Condition" to "Reset this alert automatically after 24 Hours".  That will leave the alert out there for 24 hours even if the CPU utilization goes back down. 

Now, if you really want to Rube Goldberg the situation:

Create a custom property called "CPU Alert" and set it to "No" on every node.

Modify existing alert so that it triggers on CPU utilization AND if the custom property "CPU Alert" is set to "No"

Add additional action to that alert to set the custom property to "Yes"

Create another alert that tiggers if the custom propery is set to "Yes" (no other conditions) and say the condition must exist for 24 hours before it's triggered.

Create action on that alert to set the custom property back to "No"

That would allow the alert to quickly clear in Orion, but not happen again for 24 hours.

If I can get scripts involved, then we can really have some fun.

Thanks Serena!

When I look at where those settings are supposed to be, I don't see the options for the dynamic thresholds.  We are on 2018.2 which I think doesn't have those there.

Andrew

Brian,

I'm all about tinkering with things like this.  I wasn't aware of Rube Goldberg, but after looking at the site, I believe that's precisely how I think.  Look for a way to do it with what you have, basically.

I will either try that out or try to get the requester of the requirements to be less aggressive.  They want to know if the CPU goes over 95% for 11 minutes and then open one ticket only and not open another until the next day.  The issue may be better solved by starting with a more realistic request.

I told my colleague that I could write a script that would do some comparisons and get it done, but as of yet I haven't learned how to incorporate powershell with SolarWinds.  That's one of my goals.

Andrew

awmcgregor  wrote: Thanks Serena! When I look at where those settings are supposed to be, I don't see the options for the dynamic thresholds.  We are on 2018.2 which I think doesn't have those there. Andrew

Hi Andrew,

I don't remember off the top of my head when we introduced dynamic thresholds for nodes, as they were in SAM for a long time prior. If you're not seeing the dynamic baseline that I've got highlighted below, then it's quite possible you need to upgrade to enjoy that particular feature for nodes in particular. Is there a reason you're on 2018.2 rather than the latest versions?

Yeah those settings didn't appear until 2019.2.    I highly recommend that SolarWinds be upgraded at least once a year, twice if you can get the time.  They add so many actually useful features each release that you can get behind quick.  This is an example where they listened to the customers and added this feature which can help your situation, though not exactly the way you want it. 

Maybe you can take the chance to "request a feature".  Though I don't need it now, I can see the usefulness of it and I would vote on it.  Something in the alert actions like "Trigger this action no more then X times in Y [minutes|hours|days]"