7 Replies Latest reply on Mar 18, 2011 5:43 PM by netlogix

    help with alerts

    MrSampsonite

      I'm trying to get two alerts to work. The first is supposed to send an alert every time it finds an event log during it's polling cycle. We check for certain event logs and I want to get an alert for each type it finds every cycle. Right now it sends one and doesn't continue to send them even though they appear for multiple polling cycles. I don't want it to send them multiple times for the same entry. I do that when a server is down, but not for event logs.

       

      The second type is disk space. I moved basic disk space alerts over to advanced, but I must have messed it up because I don't get alerted on drives that are below a certain size. I want it to send at various tiers (like 1 GB left, 500MB left, 100MB left, etc) and I want it to be marked as "fixed" for each tier when it gets above that area.

       

      Can anyone help? Sales said this request is "professional services" so I'd have to pay. Funny how in pre-sales I was getting all the help I could ask for.

        • Re: help with alerts
          netlogix

          First one: what is the alert set for and, what is the reset for it?  (It's an APM monitor right?)

          My gut feeling on it is that you have it set to rest once the condition are no longer true, so it doesn't reset because every poll it's still true, so it doesn't re trigger.  That could be fixed by making the reset be based on something that would always be true, like reset when 1 = 1 or node = up.

          I don't get what you mean by "fixed".  That it stays triggered but says fixed?

            • Re: help with alerts
              MrSampsonite

              Yes, it's APM.

              The trigger says

              1. when node status is not DOWN

              2. when component name is 'a' or 'b' or 'c', etc (which I copied the name from)

              3. Component status is DOWN

              4. Application name not 'other application i don't want to trigger alerts from'

               

              The property type is APM Componnent. Reset when not true. No alert suppression. all times of the day.

              action is to send email (a template I imported that I use with all alerts).

              i'm not sure I understand the reset thing you said.

                • Re: help with alerts
                  netlogix

                  It's the next tab in the alert conditions

                  :

                    • Re: help with alerts
                      MrSampsonite

                      and if I do that it will alert us for each one, or one per polling cycle? What I mean is if it detects 3 during a cycle will we get 3 alerts or 1?

                        • Re: help with alerts
                          netlogix

                          Well, it would be one alert per evaluation cycle, there are a few factors to think about.

                          1st) polling cycle - APM Polling Frequency (how often Orion checks the logs)

                          2nd) Alert Evaluation Frequency (how often the alerter service checks for the condition)

                          3rd) condition delay

                          4th) Reset delay

                          one option could be, set the condition delay to 0, Reset of 0, evaluation of 1 minute, poll of 5 minutes and a Trigger action - email - Alert escalation of repeat every 5 minutes.  Also, include the count of events in the email.

                          Another could be a delay=0, reset=0, evaluation=5min, poll=5min and the reset is like 1=1.

                          Or Delay=0, reset=5min, evaluation=1min, poll=5min.

                          if you want an alert for each time, right when they come in, you might want to switch to snmp traps or syslog messages.

                    • Re: help with alerts
                      MrSampsonite

                      the "fixed" comment was custom sorry. The subject line of all alerts we have start with "ALERT:" and then the real subject line. When it's reset or no longer an issue we start it with "FIXED". Just a little visual queue when we're looking at the subject line. It really means 'RESET' but we were going for normal lingo, not Orion's :)