2 Replies Latest reply on Jan 27, 2011 6:29 PM by William_Powley

    Blocking or Filtering Events

    William_Powley

      I'm trying to find a way to filter alerts related to High Interface Utilization caused by our Backup Server running its nightly jobs.

      I know this traffic will occur, but I don't need the heart attack every morning when I forget that this is what is causing the 90% plus utilization on our Internet link at 2am. 

      I'm not monitoring the Backup Server, but can, and am wondering if that is the easiest way to filter this.  But I'm also not seeing any features that will allow me to suppress alerts based on source or destination addresses within the flow itself...I know other tools I've worked with would allow me to exclude certain source addresses and their traffic as known good devices.  I don't think this is built into Solarwinds yet.

      Open for suggestions or ideas.  I've seen other posts about adding resources to NPM for more advanced filtering, but that's beyond my skill set and I haven't tried that yet.

       

      Thanks in advance,

      William

        • Re: Blocking or Filtering Events
          Andy McBride

          The NTA alerts are all interface utilization triggered so they are not traffic type aware. I think the best way would be to omit that link form the standard alert, create a serparate alert for that link that omits the backup time period. 

            • Re: Blocking or Filtering Events
              William_Powley

              I agree that would be a good idea.  I'm getting this alert for every device in our internet stack in between the server(s) being backed up and the backup server.  So I'll have to create a custom alert for every one of those links experiencing this high utilization.

              How exactly do you 'omit' a link as you describe?  My understanding is that by creating seperate alerts during that time periods for those links (essentially my entire internet stack) if I omit any high utilization alerts during that time period (approximately 12:01 am - 2:00 am) I'll be blind to anything else that occurs during that time frame. 

              My only other alternative is to just leave it be and just ignore them until a better solution is provided.

              Am I understanding correctly?

              Thanks,

              William