Thanks for the reply, thats very similar to what I had tried, the closest I got to what you have suggested was the same as yours but the other way round I had.
Trigger when any apply
node name contains 6509
node name contains 4006
Trigger when all apply
CPU load is greater than 75
I've swapped i round to what you have suggested to see if it makes any diference & changed CPU to => instead of just >
will see what happens - thanks.
EDIT - thank you - thats working now, I'm not sure what the diference was between your alert and mine because logically they looked the same to - maybe I'm missing something!
The difference is in the order in which the elements are processed
In your original alert the cpu load is assessed first and the 'trigger when all apply' becomes true when cpu is greater than 75%
The alert will trigger when either this all group, or either of the node name conditions are true
In the working alert the 'trigger when any apply' is assessed first and becomes true when the node name contains either 6509 or 4006 and the alert is triggered when both this and the cpu level is greater than 75% clause is true
Try thinking brackets
Hope this helps