6 Replies Latest reply on Oct 22, 2009 5:08 PM by MarieB

Complex Advanced Alert, Need Some Help

byrona Oct 20, 2009 10:31 AM

I am trying to figure out a way to write an advanced alert but I am not sure if it is possible.

I am watching a value on a network device and I want to know if that value goes above the configured threshold more than x number of times in y number of polls.

For example: If response time is greater than 20 milliseconds for 3 checks out of the 5 checks that that take place in a 25 minute period (5 minute collection/check interval); trigger an alert.

Is something like this possible and if so, how?

Re: Complex Advanced Alert, Need Some Help

Andy McBride Oct 20, 2009 5:29 PM (in response to byrona)

We certainly can trigger on a specific number of violations over a specific time span. The polling period is constant so is it possible for this case you could just use violations per period time as the trigger?
Like (0)

Actions
- Re: Complex Advanced Alert, Need Some Help
  
  byrona Oct 21, 2009 9:30 AM (in response to Andy McBride)
  
  Well, I could certainly try this. How exactly would I configure it to trigger on a specific number of violations over a specific time period?
  
  Like (0)
  
  Actions
  - Re: Complex Advanced Alert, Need Some Help
    
    byrona Oct 21, 2009 9:38 AM (in response to byrona)
    
    Hrm, I am guessing something like the following...
    If I want it to trigger only after 3 violations across a 15 minute time period that I would tell it to [check alert every 5 minutes] and [do not trigger until condition exists for more than 14 minutes]
    or something to that effect?
    
    Like (0)
    
    Actions
    - Re: Complex Advanced Alert, Need Some Help
      
      Andy McBride Oct 21, 2009 5:22 PM (in response to byrona)
      
      It would have to be a parameter that the device could trap on the use Trap Viewer Alerts to filter. The Trap alerts can trigger by number of occurances per time. I thought that was in Advanced Alerts but I am mistaken. In Advanced Alert Manager you could use the "Do not trigger this action until condition exists for more than ..." and make that for 10 minutes so if it exists for 2 SNMP polls you would get alerted. Does this do what you need?
      
      Like (0)
      
      Actions
      - Re: Complex Advanced Alert, Need Some Help
        
        byrona Oct 22, 2009 2:14 PM (in response to Andy McBride)
        
        Well, it will suffice; however, I would prefer the functionality like you mention for the traps where I can alert by number of occurrences per time... at least in some cases that would be the preferred method.
        
        Like (0)
        
        Actions
        
        Re: Complex Advanced Alert, Need Some Help
        
        MarieB Oct 22, 2009 5:08 PM (in response to byrona)
        
        Hi byrona--
        Andy's on vacay for the rest of the week, so I'll throw this out to the community and see if they can answer you.
        M
        
        Like (0)
        
        Actions

Go to original post