This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Why is this alert telling me in particular

I'm new to alerting. I'm creating a bunch of test alerts in order to help find and kill all the noise we are getting. I constantly see this alert and have no idea what the system is trying to tell me. Can someone help? This server goes from a state of warning to up all the time.

Component Pages/sec of Application "Windows Server 2003-2012 Services and Counters" on xserver is currently in a state of "Up". 

Click the link below for more information related to this component

: Can someone help?

  • Most alerts also have what is called a "Reset Action"; this is probably the result of the component going back into the "Up" status, and your tools are telling you all is well again.

    Couple of notes:

    • I really prefer to begin the subject of my notifications with either "TRIGGER: " or "CLEAR: "; to avoid confusion.
    • You mention that this particular server goes back and forth from Warning to Up, a lto. This is what is known in monitoring as "Sawtoothing" or "Alert Flapping". There are some standard ways to approach this:
      • Find the offending component, and set a more accurate threshold for it: Adjust threshold settings and apply baseline data
      • Create "hold-down timers" for your trigger and reset conditions: Meaning, "Don't trigger/clear until the value has been sustained for XX time"
        • Quick note, you can do something very similar in your component thresholds as well!
      • Consider migrating away from application alerts and towards component alerts. Components are the building blocks of all application monitors. You really do not need both application AND component alerts enabled, because you're duplicating alerts that way. I personally prefer to alert directly on component status because I like the granularity.
        • Some admins prefer to alert at the App-level; but I would then suggest adding some more detail into your alert message. Look for variables that say "Components with Problems" or "Components with Status". These will give you a listing of all the components in the application monitor that are not up (with problems), or just all of them with their current status, even if they're up.
      • Lastly, make sure that you're only monitoring things that make sense to monitor in your environment. The default templates provided with SAM tend to be a bit more verbose than most environments need. I like to look at it like this:
        • Am I OK with this alert waking me up at 2:00am?
          • If not, go ahead and think twice about this monitor/alert. Maybe you only want to enable alerts during business hours?
        • If I don't want to be woken up, do I need to know what happened last night when I get to work in the morning?
          • Great time to look at reports!
        • If still no, do I even need to be monitoring this metric?
          • This is a real question, and it has different answers for everyone. But, especially with SAM, if you don't go through the process of answering this question, you're missing out on a lot of the help SolarWinds can provide you (IMO).

    One of the reasons a lot of us have chosen SolarWinds above the competitors is that we can put this product line into our environment(s) without having to change how we "do IT". Take the time to learn from the hallowed halls of Thwack emoticons_happy.png and I am sure you'll get to a more enjoyable situation, with less "noise".

    Good luck!