25 Replies Latest reply on Mar 17, 2016 10:27 AM by sans

    Alert Reset Actions not firing

    sans

      It seems that when an alert fires, it is not firing off the reset actions. The action gets triggered and the triggered action fires. Once the reset condition happens, the alert resets, but no action fires.

       

      I have tried this with the built in alerts and i have created an alert from scratch. Before I place a ticket, anyone have ideas on what else I could do?

        • Re: Alert Reset Actions not firing
          neomatrix1217

          Can you give us a screen shot of the reset condition and the reset trigger?

          • Re: Alert Reset Actions not firing
            cjfranca

            see configurations.

            1 of 1 people found this helpful
            • Re: Alert Reset Actions not firing
              superfly99

              Sounds like you've not filled out the Reset Actions tab.

               

              This screenshot is from non web based Advanced Alert Manager.

               

              Capture.JPG

              • Re: Alert Reset Actions not firing
                HolyGuacamole

                You can export the entire alert definition and attach to the discussion. Without looking at the alert definition, difficult to say what's going on

                • Re: Alert Reset Actions not firing
                  neomatrix1217

                  You can copy your action trigger to your reset trigger also.

                  • Re: Alert Reset Actions not firing
                    sans

                    7. Summary of Alert Configuration

                     

                    Please review the alert configuration before saving...

                     

                    Name of alert:

                    Alert me when a node goes down

                    Description of alert:

                    This alert will write to the SolarWinds event log when a node goes down and when a node comes back up again.

                     

                     

                    Type of Property to monitor

                     

                    Node

                    Enabled(On/Off):

                    ON

                     

                    Evaluation Frequency of alert:

                    Every minute

                     

                    Severity of alert:

                    Critical

                     

                     

                    Alert Custom Properties: (1)

                     

                    Comments:

                    Alert Limitation Category

                    No Limitation

                     

                    Trigger Condition:

                    Reset Condition:

                    Time of Day schedule:

                    Trigger Action:

                    Reset Action:

                    • Re: Alert Reset Actions not firing
                      tigger2

                      It's probably *not* this, but it could be some issue with Orion trying to send the email (email recipients not existing in email system you are sending to, address formatting issue, some sort of block on the email side, etc.).  You can look for failed email alerts with the MS SQL query example below (If you're comfortable querying the Orion database directly). The error is in  "'Message" column of the query,  I'm using NPM 11.0.1 so it will probably work against the 11.x versions.

                       

                      SELECT TOP 100 [MsgID]

                            ,[LogDateTime]

                            ,[AlertDefID]

                            ,[ObjectType]

                            ,[ObjectID]

                            ,[ObjectName]

                            ,[ActionType]

                            ,[Message]

                        FROM [SolarWindsOrion].[dbo].[AlertLog]

                        where message like 'Failed%'

                      1 of 1 people found this helpful
                        • Re: Alert Reset Actions not firing
                          sans

                          I ran it and didn't pull up anything from this year.

                            • Re: Alert Reset Actions not firing
                              tigger2

                              The only other gotcha I can think of is if you are using the "Test" button to test the alerting.  This button is not to actually test alerting as its more of a "test to make sure the trigger condition and SMTP server are working" and not much else.

                              If you are *not* using this button and letting Orion itself trigger the alerting, then I'd say it's in the alert rule configuration or you've found a bug/condition within Orion itself.

                               

                              If you hit the "Export" button on the rule and post the *.AlertDefinition" file as file attachment to this post (as some others above have suggested) then the alert rule can be examined/imported by others and the issue might be found.  If you do this you will be exposing any IP addresses/email addresses/hostnames, etc. defined  in the rule.  It's a small XML file so you could remove that info from the file by hand.

                          • Re: Alert Reset Actions not firing
                            sans

                            Here is the link to the Alerts that are giving me issues.

                            • Re: Alert Reset Actions not firing
                              sans

                              Yes, i have.

                              • Re: Alert Reset Actions not firing
                                sans

                                Just an update, it seems to be working on its own now.

                                 

                                Also, since this post, I am receiving notices for nodes that I do not have. I believe someone (at solarwinds) has taken my alerts to look at, and failed to change the server (because I forgot to edit them out.) I will post the email header.

                                 

                                Received: from ocsemps2.state.mo.us (10.241.42.5) by SDEXHUBP002.state.mo.us

                                (10.241.42.21) with Microsoft SMTP Server (TLS) id 14.3.266.1; Wed, 16 Mar

                                2016 22:07:42 -0500

                                Received: from localhost.localdomain (localhost [127.0.0.1]) by

                                ocsemps2.state.mo.us (Postfix) with SMTP id 3qQYFB6cfxz2BwWm for

                                <chris.boillot@oa.mo.gov>; Wed, 16 Mar 2016 22:07:42 -0500 (CDT)

                                Received: from harrier.mo.gov (unknown [10.245.70.220]) by

                                ocsemps2.state.mo.us (Postfix) with ESMTPS id 3qQYFB2792z2BwWj for

                                <chris.boillot@oa.mo.gov>; Wed, 16 Mar 2016 22:07:42 -0500 (CDT)

                                Received: from pps.filterd (momail3.mo.gov [127.0.0.1]) by momail3.mo.gov

                                (8.15.0.59/8.15.0.59) with SMTP id u2H34Y3N031149 for

                                <chris.boillot@oa.mo.gov>; Wed, 16 Mar 2016 22:07:42 -0500

                                Received: from adfcim02.solarwinds.com (adfcim02.solarwinds.com

                                [74.115.12.180]) by momail3.mo.gov with ESMTP id 21qer80vx1-1

                                  (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for

                                <chris.boillot@oa.mo.gov>; Wed, 16 Mar 2016 22:07:41 -0500

                                X-IronPort-AV: E=Sophos;i="5.24,347,1454997600";

                                   d="scan'208";a="229534"

                                Received: from unknown (HELO mail.solarwinds.com) ([10.110.60.120])  by

                                ADFCIM02.solarwinds.com with ESMTP/TLS/AES256-SHA; 16 Mar 2016 22:07:40 -0500

                                Received: from AUSEX01.tul.solarwinds.net (10.110.60.120) by

                                AUSEX01.tul.solarwinds.net (10.110.60.120) with Microsoft SMTP Server (TLS)

                                id 15.0.1130.7; Wed, 16 Mar 2016 22:07:39 -0500

                                Received: from DEV-AUS-CIM-01.swdev.local (10.110.108.21) by

                                mail.solarwinds.com (10.110.60.120) with Microsoft SMTP Server id 15.0.1130.7

                                via Frontend Transport; Wed, 16 Mar 2016 22:07:39 -0500

                                X-IronPort-AV: E=McAfee;i="5700,7163,8106"; a="426396"

                                X-IronPort-AV: E=Sophos;i="5.24,347,1454997600";

                                   d="scan'208";a="426396"

                                Received: from sup-aus-mtul-01.swdev.local (HELO supausmtul01)

                                ([10.110.6.240])  by DEV-AUS-CIM-01.swdev.local with SMTP; 16 Mar 2016

                                22:06:26 -0500

                                thread-index: AdF/+ipUPIlmX5fGTGKsqligdR+now==

                                Thread-Topic: Alert me when a node goes down (reset)

                                X-FireEye: Clean

                                From: orion - Network Performance Monitor <no-reply-OrionTest@oa.mo.gov>

                                To: <chris.boillot@oa.mo.gov>

                                CC:

                                Subject: Alert me when a node goes down (reset)

                                Date: Wed, 16 Mar 2016 22:07:39 -0500

                                Message-ID: <94AA10B15D3C49BC8123F0048F9FC738@supausmtul01>

                                MIME-Version: 1.0

                                Content-Type: text/plain; charset="utf-8"

                                Content-Transfer-Encoding: 7bit

                                X-Mailer: Microsoft CDO for Windows 2000

                                Content-Class: urn:content-classes:message

                                Importance: normal

                                Priority: normal

                                X-MimeOLE: Produced By Microsoft MimeOLE V6.3.9600.18231

                                X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.15.96,1.0.38,0.0.0000

                                definitions=2016-03-17_02:2016-03-16,2016-03-17,1970-01-01 signatures=0

                                X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=1 phishscore=0

                                adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1

                                engine=7.0.1-1601100000 definitions=main-1603170038

                                Return-Path: prvs=87721119d=no-reply-OrionTest@oa.mo.gov

                                X-MS-Exchange-Organization-AuthSource: SDEXHUBP002.state.mo.us

                                X-MS-Exchange-Organization-AuthAs: Anonymous

                                X-MS-Exchange-Organization-AVStamp-Mailbox: SMEXw]nP;1240500;0;This mail has

                                been scanned by Trend Micro ScanMail for Microsoft Exchange;

                                X-MS-Exchange-Organization-SCL: 0