1 Reply Latest reply on Sep 5, 2013 10:40 AM by stuartwhyte

    Simple alert not working

    handbrake2

      Hi guys,

       

      I have created some very simple alerts in Orion Alert Manager and they are not triggering as I would like.

      I want to be notified if a switch or router in my network goes down. The alert rule is as follows:

       

      Trigger Condition:

      Trigger Alert when ALL of the following apply

           Node Status is equal to Down

           Trigger Alert when ANY of the following apply

                Vendor is equal to Cisco

                Vendor is equal to Rapid City Communication

                Vendor is equal to Synoptics

       

      Reset Condition:

      Reset Alert when ALL of the following apply

           Node Status is equal to Up

       

      Alert Suppression:

      CriticalNetworkComponent is equal to Yes

       

      Trigger Action:

      NetPerMon Event Log: Node ${NodeName} is ${Status}

      Send email/page to [my email address]

       

      CriticalNetworkComponents is a custom property that has a yes/no value. Only a handful of devices on the network have a yes assigned to that field.

      Right now, devices go down and I don't receive any email notification but when I check the NPM event log, the event is there.

      What am I doing wrong?

       

      Regards,

      David Smith.

        • Re: Simple alert not working
          stuartwhyte

          Hi David,

           

          The alert suppression does not work as you would logically expect it to, and so this alert is not firing.

           

          It looks like your objective is to not have the alert fire if CriticalNetworkComponent is equal to Yes.  Remove this from the suppression tab, an add it to your trigger condition, reversing the logic, i.e. CriticalNetworkComponent is not equal to Yes

           

          The event log notification you are receiving will be the internal "Node down" warning (EventType 1) and would be red, rather than "Alert Triggered" warning (EventType 5000) in yellow.

           

          hope this helps

           

          Stuart