7 Replies Latest reply on Jul 15, 2014 9:20 AM by carlton.patterson@matthey.com

    Alert Trigger Condition Question

    carlton.patterson@matthey.com

      Hello Community,

       

      I'm trying to create a Trigger Condition which basically states if an Interface Down and the Node contains the Name GBBL send me an alert, but I don't want to know about interfaces that contain the name 'phone' in the description. See below for a visual.

       

      I'm sure what I'm trying to achieve is possible, but I'm not sure how to compile the trigger condition.

      Can someone please help

       

      Cheers

       

      Carlton

       

       

      Exclude Phone.PNG

        • Re: Alert Trigger Condition Question
          supiya

          you can add a new condition to alert suppresion as "interface caption contains phone". so alarm will not trigger when phone interface down

          1 of 1 people found this helpful
            • Re: Alert Trigger Condition Question
              carlton.patterson@matthey.com

              Thank you

               

              Cheers

               

              Carlton

              • Re: Alert Trigger Condition Question
                blsanner

                This is not true at all.  The Alert Suppression tab within the Advanced Alert Manager does not work as most people suspect.  Please see page 8 of the following document:

                 

                http://www.solarwinds.com/documentation/Orion/docs/UnderstandingOrionAdvancedAlerts.pdf

                 

                Basically, the Alert Suppression condition is evaluated completely separate from the Alert Trigger condition.  In the recommendation above of adding a condition of "interface caption contains phone", as long as there is an interface in the Orion database that contains the string 'phone', the alert will be suppressed and never fire regardless of what is on the Trigger Condition tab.  The best way to do this, since Solarwinds does not give us a 'does not contain' operator, would be to add another condition group with a 'not all' operator that says "interface caption contains phone".  Something like the following:

                 

                  • Re: Alert Trigger Condition Question
                    carlton.patterson@matthey.com

                    blsanner,

                     

                    Thanks for responding. I was told by support the following would work:

                    Can you please try reconfiguring the alert as follows:
                    (I'm showing indentation via stars so that you can get the indentation right)
                    Trigger Alert when all the following apply
                    ***Interface Status is equal to Down
                    ***Node Name contains GBBL
                    ***Trigger Alert where none of the following apply
                    ******Interface Caption contains phone

                    The appear to work.


                    I have tweaked the trigger to look like the following, but it won't work:


                    filteralerts.PNG

                      • Re: Alert Trigger Condition Question
                        martinstenner

                        How about:

                         

                        Trigger Alert when all of the following apply:

                        Interface Status is equal to Down

                        Node name contains GBBL

                         

                        Trigger Alert when none of the following apply:

                        Interface Name contains phone

                        alert.jpg

                        • Re: Alert Trigger Condition Question
                          blsanner

                          Going back to the document I linked yesterday, the 'none' and 'not all' options don't work as you might suspect.  You can look at the top of page 7 of the document for a description of how they work.  The none option you have it configured with is saying something like the following in the appropriate portion of the SQL:

                           

                          NOT (FullName = '%phone%') OR

                          NOT (Caption = '%Tunnel%') OR

                          NOT (Caption = '%Vlan%') OR

                          NOT (Caption = '%Edge%')

                           

                          I would think that when this alert is enabled it would trigger on every down interface.  I would suggest changing the 'none' to 'not all' which would change the ORs in the above SQL to ANDs:

                           

                          NOT (FullName = '%phone%') AND

                          NOT (Caption = '%Tunnel%') AND

                          NOT (Caption = '%Vlan%') AND

                          NOT (Caption = '%Edge%')

                           

                          This should ensure that all of those conditions were not true.  However, to be perfectly safe, you could just separate each one of the conditions into its own condition group.