First one: what is the alert set for and, what is the reset for it? (It's an APM monitor right?)
My gut feeling on it is that you have it set to rest once the condition are no longer true, so it doesn't reset because every poll it's still true, so it doesn't re trigger. That could be fixed by making the reset be based on something that would always be true, like reset when 1 = 1 or node = up.
I don't get what you mean by "fixed". That it stays triggered but says fixed?
Yes, it's APM.
The trigger says
1. when node status is not DOWN
2. when component name is 'a' or 'b' or 'c', etc (which I copied the name from)
3. Component status is DOWN
4. Application name not 'other application i don't want to trigger alerts from'
The property type is APM Componnent. Reset when not true. No alert suppression. all times of the day.
action is to send email (a template I imported that I use with all alerts).
i'm not sure I understand the reset thing you said.
and if I do that it will alert us for each one, or one per polling cycle? What I mean is if it detects 3 during a cycle will we get 3 alerts or 1?
Well, it would be one alert per evaluation cycle, there are a few factors to think about.
1st) polling cycle - APM Polling Frequency (how often Orion checks the logs)
2nd) Alert Evaluation Frequency (how often the alerter service checks for the condition)
3rd) condition delay
4th) Reset delay
one option could be, set the condition delay to 0, Reset of 0, evaluation of 1 minute, poll of 5 minutes and a Trigger action - email - Alert escalation of repeat every 5 minutes. Also, include the count of events in the email.
Another could be a delay=0, reset=0, evaluation=5min, poll=5min and the reset is like 1=1.
Or Delay=0, reset=5min, evaluation=1min, poll=5min.
if you want an alert for each time, right when they come in, you might want to switch to snmp traps or syslog messages.
the "fixed" comment was custom sorry. The subject line of all alerts we have start with "ALERT:" and then the real subject line. When it's reset or no longer an issue we start it with "FIXED". Just a little visual queue when we're looking at the subject line. It really means 'RESET' but we were going for normal lingo, not Orion's :)