1 Reply Latest reply on Jan 25, 2018 1:14 AM by mesverrum

    Need help creating complex alert

    baneland

      Hello everyone!

      I'm trying to create a specific alert that will trigger if the firewall of a remote server goes off.

      I have multiple remote locations each with their own firewalls. Each is a separate node.

      What I'm trying to determine is if the issue was a server issue or a network issue, but I'm not sure what it would looks like written.

       

      But this is the general idea of what I'm looking to do.

       

      Im thinking of applying this to a group of firewalls (all called the same as their servers except with a -FW at the end)

       

      If object(firewall) is online

      and

      node(firewall name minus -FW) exist and is offline

      alert

       

      or the inverse

      if node(server) is offline

      and

      object(node name + -FW) exist and is online

      alert

       

      Is this possible? Or would this only work if I made individual alerts for each one?(in which case it wouldn't work, I'm looking at a lot of servers/firewalls)

        • Re: Need help creating complex alert
          mesverrum

          I think you are probably making this more complicated than it has to be.

          Unless you have multiple routes to the remote site then both the node and the firewall would show as down when the firewall goes down, so your first scenario will never exist. 

          The second scenario is effectively just a node down alert for the far end server.

           

          For Solarwinds purposes it is near impossible to differentiate between a node that is down due to the server dying versus a server that is "down" due to a network outage.  In all cases a down status really means "You polling engine cannot ping this device"

           

          You might have better luck creating a netpath monitor to particular endpoints to get a sense of where the break in the line sits but it will never tell you anything about what is on the other side of your point of failure.