1 Reply Latest reply on Sep 23, 2014 6:15 AM by Tomas.Saghy

    Some alerts doesn't end up in Alert Central

    joakimn

      Hi,

       

      I have an issue with one of the alerts that I have setup in Advanced Alert Manager on our Orion main core server. The alert is being triggered like it should as I can see the alert in the Orion web console, but it doesn't end up in Alert Central. All my other alerts that are triggered end up in Alert Central. I have checked "Automatically share alert data with other Solarwinds products and subscribers" under the Alert Sharing tab. The particular alert is checking if any hardware sensor on the node has Error as status.

       

      Below is the trigger query for the alert.

       

      Trigger query
      SELECT DISTINCT APM_HardwareSensorAlertData.HardwareSensorID AS NetObjectID, APM_HardwareSensorAlertData.SensorDisplayName AS Name FROM Nodes INNER JOIN APM_HardwareSensorAlertData ON (Nodes.NodeID = APM_HardwareSensorAlertData.NodeId) WHERE ( (APM_HardwareSensorAlertData.SensorOriginalStatus = 'Error') AND (Nodes.Mute_Alerts = 0) AND (Nodes.SLA = 'Critical') AND ( (Nodes.Vendor = 'Windows') OR (Nodes.Vendor = 'VMware Inc.')) )  

       

      How does the integration work between Orion and Alert Central? What does decide if an alert should be routed to Alert Central? I know that you setup an Orion Source in Alert Central using an account that has access in Orion. We also have routing rules in Alert Central that determines which support group the alert should be assigned to using custom properties that each node has in Orion. However I haven't found any detailed information that describes the connection between them.

        • Re: Some alerts doesn't end up in Alert Central
          Tomas.Saghy

          When you create an "Orion Alert Source" the Alert Central subscribes to alert related changes in Orion - Orion sends an indication to the Alert Central when any alert in the Orion is triggered/updated/reset. This is handled by Alert Central depending on whether there is already an alert and based on "Route to Group" rules.

           

          When there is already a non-closed alert in Alert Central for the same Orion alert (the same alert; same object), the change is simply logged to that existing alert as a note.

           

          When no such alert exists and an alert is triggered in Orion, the "Route to Group" rules are evaluated:

          • when the result is that the alert is assigned to a group a new alert is created in Alert Central and the workflow/escalation policy starts
          • otherwise the Orion alert is ignored ("trashed") - no alert is created in Alert Central
          • note that no alert is created for Orion alerts which are already triggered when the integration is configured; only the triggered action can create an alert in Alert Central