13 Replies Latest reply on Feb 6, 2009 12:50 PM by Tuchux

    Node Suppression for Interface Alert Not Working

    DirtySouth

      I just wanted to mention I've opened case # 75635 for an issue I'm having with alert suppression. I've created an alert to notify if "critical" interfaces on routers go down. The alert triggers if the interface is "Not Equal" to Up. I had to include a supprression if the node was unmanaged otherwise unmanaged nodes will trigger in the alerts. There appears to be a bug that doesn't like suppressing an alert based on node when you're monitoring the interface.

        • Re: Node Suppression for Interface Alert Not Working
          DirtySouth

          It appears that this affects any monitor, Node or Interface. I'm unable to suppress any alerts based on a nodes status of "Unmanaged". Anyone else having this issue?

          • Re: Node Suppression for Interface Alert Not Working
            Tuchux

            I am having a similar problem with Advanced Alerts. Have set up an advanced alert to monitor %Volume Used. Have trigger at PercentVolumeUsed over 90%. This works fine by itself but for some reason it also alerts on Physical and Virtual memory. I added an Alert Suppression to say if Caption = Physical Memory OR Virtual Memory suppress the alert. Unfornately it suppresses all volume alerts.

              • Re: Node Suppression for Interface Alert Not Working
                DirtySouth

                That sounds like it could be related. I haven't received any updates yet. I just emailed support again.

                  • Re: Node Suppression for Interface Alert Not Working

                    Can you post the trigger and suppresion criteria for your alert?

                     The alert suppression function isn't particularly intuitive.  I think most people would assume that the suppresion criteria is automatically associated to the trigger criteria but this is not the case.  The suppression criteria is basically an independent query that uses the count function to see if any records are returned when the query is executed.  For example, if you configure an alert criteria that says:

                    Trigger  Alert when all of the following apply

                    InterfaceID is equal to 30

                    And then configure a suppresion that says:

                    Suppress Alert when all of the following apply

                    Status Description is equal to Node status is Unmanaged

                    You might assume that the suppression would only apply to the node that contains the interface specified in the trigger criteria but it doesn't.  In this case, it would apply to any node in the database.  This will cause the alert to be suppressed if any node in the database has an unmanaged status.

                    Hope I have explained this properly and clearly.

                      • Re: Node Suppression for Interface Alert Not Working
                        Tuchux

                        Sedmo,

                          Here is the trigger condition:

                         

                        Volume Percent Used is Greater Than '90'

                        Vendor is equal to 'Windows'

                         

                        The suppression is:

                        Caption Contains 'Physical Memory'

                         

                        I made the assumption that the suppression criteria was based against a single trigger and if the trigger was on volume Physical Memory that it would be suppressed.

                        The idea being that Solarwinds sees Physical and Virtual Memory as volumes and we only want to alert on Physical Disk volumes.

                         

                         

                        Tuchux

                        • Re: Node Suppression for Interface Alert Not Working
                          Tuchux

                          Sedmo,

                            OK ...I re-read your post and if I understand correctly...In advanced alerts the Suppression function runs your query against the entire database not the trigger and; in my case, If I have a suppression of "Caption contains Physical Memory" then any node that has Physical memory being monitored would never trigger the alert correct..

                           

                          Tuchux

                          • Re: Node Suppression for Interface Alert Not Working
                            DirtySouth

                            Sedmo, you're absolutely right. I did hear back from Support yesterday and that is basically what I was told. The suppression is not specific to the monitor that is triggered. Instead, it queries the entire database for any node matching the suppression.

                            I'm at a loss as to why suppressions would be configured this way. Support reccomended a workaround that seems to be doing the same thing...

                            -----------------

                            Type of Property to Monitor: Interface

                            Trigger Alert when all of the following apply:

                            Interface Status is not equal to UP

                            Node Status is Not Equal to UnManaged

                            Critical is Equal to Yes

                            ------------------

                              • Re: Node Suppression for Interface Alert Not Working
                                Tuchux

                                Dirty South,

                                I agree....strange way to suppress. Typically if I want to suppress something in an alert...it is specific to each alert...not to everynode in the DB...

                                What was the work around Support gave you?

                                Tuchux

                                  • Re: Node Suppression for Interface Alert Not Working
                                    Tuchux

                                    Now it makes more sense. For my situation the answer was simple. Forget the suppresion, just add a "not equal" statement in the trigger.

                                    Trigger when ALL Apply

                                    Volume Percent Used Greater than 90

                                    Vendor equals windows

                                    Volume Caption is not equal to 'Physical Memory'

                                    Volume caption is not equal to 'Virtual Memory'

                                    This Alert now works the way I intended. Instead of suppressing just add additional criteria for the alert trigger.

                                    Dirty South,

                                    Don't know why yours is still not working.....Similar situation........

                                    Sedmo & Dirty South.....Thanks for the info ....lead me in the right direction.

                                    Tuchux