This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Roll-up Alerting: Firewall goes down, don't alert for each node behind it?

WillAyerst over 14 years ago

Hi guys,
Does anyone have a nice set of criteria for suppressing alerts on nodes when a specific node with the same name prefix is down? For example, I have a few nodes in their own Network map for our London office.

London-Firewall
London-Server1
London-Server2

When the link does down, I get notifications for every single node there, which is a bit useless since when the link is down it's a given that all the servers will appear down to us too! I've tried to suppress the alerts like so:

In the Alert I create an Trigger Condition like this:
Node Status is equal to Down
Node Name contains London

And I create an Alert suppression like this:
Node name contains London
Vendor is equal to net-snmp (as all our firewalls report as)
Node Status is equal to Down

This appears to work fine, but we have many offices and I'd really prefer to not have to do this for every single one of them! Is there an easy way in the Alert Suppression to reference the Node Name used in the Trigger? Or even a better way to do it altogether? Anyway, here's the kind of thing I was thinking of:

So I create an Trigger Condition like this:
Node Status is equal to Down
Node Name contains $Site

And I create an Alert suppression like this:
Node name contains $Site
Vendor is equal to net-snmp
Node Status is equal to Down

As you can see, I'd just like to prevent hundred of emails saying Server1 is down, Server2 is down, Server3 is down when the Firewall is down too.

Can anyone help?

0 mharvey over 14 years ago

The simplest solution would be to create a custom propery called SITE or OFFICE and then set the values for each device. The create your first Site alert of
Trigger this alert when ALL the following apply
Node Status is equal to Down
Site is equal to A

then create the suppression of
Node Status is equal to Down
Node Name is equal to Name-Firewall.

You will still need to create an alert per site. Otherwise the suppression will block the alert even if the firewall device is not for that particular site. However, once complete you can then copy the alert and make simple changes to the trigger and suppression to match each site and each firewall device. This way you don't have to manually create all new alerts and re-add the conditions each time. Then, to make sure you get alerted on the firewalls create an alert specifically for them of
Node Staus is equal to Down
Node Name contains Firewall
Cancel
Vote Up 0 Vote Down

Cancel
0 WillAyerst over 14 years ago in reply to mharvey

That's awesome! Thanks for the reply - Is there definately no way to do it all with one alert setup?
Cancel
Vote Up 0 Vote Down

Cancel
0 mharvey over 14 years ago in reply to WillAyerst

Unfortunately not with the supression you want. You would end up causing the alert to be suppressed for a site firewall, and since the alert is supressed, no other alert will fire, regardless of site as long a a firewall is down. So if Site A firewall goes down it suppresses the alert. If a device in Site B goes down, due to the suppression, the alert will not fire.
Cancel
Vote Up 0 Vote Down

Cancel