This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Blocking or Filtering Events

I'm trying to find a way to filter alerts related to High Interface Utilization caused by our Backup Server running its nightly jobs.

I know this traffic will occur, but I don't need the heart attack every morning when I forget that this is what is causing the 90% plus utilization on our Internet link at 2am. 

I'm not monitoring the Backup Server, but can, and am wondering if that is the easiest way to filter this.  But I'm also not seeing any features that will allow me to suppress alerts based on source or destination addresses within the flow itself...I know other tools I've worked with would allow me to exclude certain source addresses and their traffic as known good devices.  I don't think this is built into Solarwinds yet.

Open for suggestions or ideas.  I've seen other posts about adding resources to NPM for more advanced filtering, but that's beyond my skill set and I haven't tried that yet.

 

Thanks in advance,

William

  • The NTA alerts are all interface utilization triggered so they are not traffic type aware. I think the best way would be to omit that link form the standard alert, create a serparate alert for that link that omits the backup time period. 

  • I agree that would be a good idea.  I'm getting this alert for every device in our internet stack in between the server(s) being backed up and the backup server.  So I'll have to create a custom alert for every one of those links experiencing this high utilization.

    How exactly do you 'omit' a link as you describe?  My understanding is that by creating seperate alerts during that time periods for those links (essentially my entire internet stack) if I omit any high utilization alerts during that time period (approximately 12:01 am - 2:00 am) I'll be blind to anything else that occurs during that time frame. 

    My only other alternative is to just leave it be and just ignore them until a better solution is provided.

    Am I understanding correctly?

    Thanks,

    William