11 Replies Latest reply on May 2, 2014 9:06 AM by iunderwo

    advanced alert - where nodename "does not contain" etc...

    the_toilet

      hi all,

      is there any way to use in advanced alerting, the parameter of "interface fullname "does not contain" a string of chars?  i can see "contains" whcih is OK, but is the reverse of what i want...

      i want to monitor all of my BRI interfaces for being UP, but do not want to get alerts from the INTERFACE DOWN alerts for them as they are in a good state when they are DOWN.

      alert structure woudl be:

      custom-property1 is equal to toilet
      interface status is equal to down
      interface fullname does not contain bri

      what do you think?  don't think you can do it now, but will you be able to any time soon?

        • Re: advanced alert - where nodename "does not contain" etc...
          MagnAxiom

          I am by no means an expert... but couldn't you create a custom property called InterfaceType that identifies each interface that is a BRI?

          InterfaceType is equal to BRI

          interface status is equal to up

           

          This would allow you to trigger an alert whenever a BRI interface goes to an UP mode.

           

          I know it's a different approach, but then you could have a separate alert that tests just for the BRI up status and can do custom alerts for that situation.

            • Re: advanced alert - where nodename "does not contain" etc...
              the_toilet

              that is a good idea, but i shyed away from it as my interfaces table is thousands, so this woudl be a mighty task.

               

              in the end, i went down the supression TAB route.  I have not have much success with supression tab before, but it seems to be working on this...  i have a very good alerting structure build for thsi particular customer, where i can not

              - monitor for ISDN up in error
              - ISDN not ready for use in event of MPLS failure
              - MPLS interface DOWN
              - usual stats alerts, errors on line, utilisation etc...

              seems to be working well, though i have not rolled it into live.  this particular roll out is to replace a CA unicentre implementation of NSM/NPO

            • Re: advanced alert - where nodename "does not contain" etc...
              lhorstma

              You just want a "does not contain" right? That's an easy one, just add a none condition group:

              Trigger Alert when all of the following apply
              ..custom-property1 is equal to toilet
              ..interface status is equal to down
              ..Trigger Alert when none of the following apply
              ....interface fullname contains bri

              Or if you want to exclude a list of possible things you need one extra, an any condition group under the none:

              Trigger Alert when all of the following applY
              ..custom-property1 is equal to toilet
              ..interface status is equal to down
              ..Trigger Alert when none of the following apply
              ....Trigger Alert when any of the following apply
              ......interface fullname contains bri
              ......other condition here

              Think of it this way, the none condition group is your NOT, the all condition group is your AND, and your any condition group is your OR.

              To the devs:

              One future option I would like to see with the advanced alerts is an "advanced view" for forming more standard conditional statements (rather than what I guess they consider is more human readable), kind of like how Report Writer has the advanced SQL option which lets you just put in whatever SQL you want. I want to use my ANDs ORs and NOTs like I'm used to in other applications.

                • Re: advanced alert - where nodename "does not contain" etc...
                  the_toilet

                  LOL...  in the years of using Orion, i have never seen the NONE option, what a dufus i am LOL...  i will have a play...  i am not fond of the supression tab as i can not get my head around how it works, and if it adds unnecessary CPU overhead...  i will try your method which is brilliant...  and simple

                  • Re: advanced alert - where nodename "does not contain" etc...
                    MagnAxiom

                    Indeed, quite nice!

                     

                    I love your summary "Think of it this way, the none condition group is your NOT, the all condition group is your AND, and your any condition group is your OR." quite helpful!!!

                      • Re: advanced alert - where nodename "does not contain" etc...
                        Detroiter

                        "You just want a "does not contain" right? That's an easy one, just add a none condition group:

                        Trigger Alert when all of the following apply
                        ..custom-property1 is equal to toilet
                        ..interface status is equal to down
                        ..Trigger Alert when none of the following apply
                        ....interface fullname contains bri"

                        Has anyone been able to get this type of format to work on a Custom Property field as oppposed to a Node, Volume, Interface, etc field?

                        I am looking to create as editable Custom Property field that the Node Managers can modify with specific text to suppress specific alerts.  For example, they would type "DataDisk" and it would suppress only the email for the non-C: drive disk space alerts, leaving the rest intact.  Similar results would happen for "OSDisk, CPU", etc.

                        When I use the NONE clause for any other type of field, it works as expected.  However, when I use any Custom Property, nothing happens.  It almost appears that the trigger is looking at the entire Custom Property column and if it finds that text in any row, it suppresses the alert.

                        Thoughts?

                          • Re: advanced alert - where nodename "does not contain" etc...
                            Detroiter

                            I have opened a case on my issue.  Hopefully support can shed some light on this.

                              • Re: advanced alert - where nodename "does not contain" etc...
                                DanielleH

                                Hi Detroiter--

                                Please post your ticket # for the community to reference (if needed) and for internal folks to follow.  Also, please keep us updated with your progress.

                                Thank you,
                                DH

                                  • Re: advanced alert - where nodename "does not contain" etc...
                                    Detroiter

                                    It is case# 291330.  I have done a bit more testing.  I will certainly be sure to share any insights with the community.

                                      • Re: advanced alert - where nodename "does not contain" etc...
                                        iunderwo

                                        I'm having the same problem, and this is not a SolarWinds problem.

                                         

                                        In my example, I've got an alert that I want to use generically, so I created a property called Alert_Flags so I could turn custom fields on and off.

                                         

                                        --[ Initial Queries ]--

                                         

                                        I did roughly the same sort of thing a not contains "something" in a CP field, but I did some SQL digging to check.

                                         

                                        The following generated code actually works well:

                                        SELECT DISTINCT Nodes.NodeID AS NetObjectID, Nodes.Caption AS Name FROM Nodes WHERE ( (Nodes.Alert_Flags LIKE '%HiCPU%') AND (Nodes.CPULoad >= Nodes.HiCPU_Alert) )

                                         

                                        However, the following returns a NULL result:

                                        SELECT DISTINCT Nodes.NodeID AS NetObjectID, Nodes.Caption AS Name FROM Nodes WHERE ( (Nodes.CPULoad >= 60) AND ( NOT (Nodes.Alert_Flags LIKE '%HiCPU%')) )


                                        --[ Fixing in SQL ]--


                                        A little poking around in the queries reveals that the NOT LIKE combination won't return any rows with a NULL value in the property.  It would make sense for a Not Like to work on something empty, but it does not.


                                        I ended up modifying the SQL to do something like this:


                                        SELECT DISTINCT Nodes.NodeID AS NetObjectID, Nodes.Caption AS Name

                                        FROM Nodes

                                        WHERE (

                                          (Nodes.CPULoad > 60)

                                          AND (

                                          (Nodes.Alert_Flags NOT LIKE '%HiCPU%')

                                          OR

                                          (Nodes.Alert_Flags IS NULL)

                                          )

                                        )

                                         

                                        --[ Making it Work ]--

                                         

                                        Now, the way around it in the Advanced Alert Editor is to do the following.

                                         

                                        Trigger when ALL the following apply:

                                        CPU load is greater than or equal to 60%

                                        Trigger when ANY of the following apply:

                                           Alert_Flags is empty

                                           Trigger when NONE of the following apply:

                                             Alert_Flags contains HiCPU

                                         

                                        For what it's worth, this is what I did in my second alert trigger for the custom alert:

                                         

                                        Trigger when ALL the following apply.

                                        Alert_Flags contains HiCPU

                                        field CPULoad is greater than or equal to field HiCPU_Alert

                                         

                                        Resolved!