4 Replies Latest reply on Jan 6, 2015 11:44 AM by geekplus

    Phantom Alerts

    geekplus

      I'm having trouble with alerts that are triggering but we do nto have an alert that sends out this particular alert text via email.

       

      Version (Orion): 2014.1.0

      Version NPM (10.7):

       

      Whats happening is we have completely revamped the alerts and alert texts. So our node down alerts come out with a "Systems Alert" or a "Networking Alert" start to the subject line with various variables to have them make sense (such as Node Name and status). But in addition to the ones we have written, we are getting some old style "Alert me when a node goes down" alerts generated. I've added alert names to all the existing alerts and these emails don't have any of our variables in it, just s a simple "Node xxxx is down" in the text of the email.

       

      I've deleted all the alerts we are not using.

      I've checked all the emails in ALL the alerts we have and none are set to generate this particular email.

       

      Any ideas on how to track it down?

       

      Thanks!

       

      Roger

        • Re: Phantom Alerts
          d09h

          RDP to your server and launch Alert Manager --> Active Alerts.  Sort them as you see fit (by clicking top of any column).  Look for the questionable alerts.

            • Re: Phantom Alerts
              geekplus

              Unfortunately, that isn't seeming to work. I have a node that went down the other day (non recoverable) and it generated two of these 'extra' alerts as well as the expected one. To see what is happening, I re-managed it today and I have only seen the expected alert, not any of the unexpected ones. I will continue to monitor the active alerts but in the past by the time I get notified and get to active alerts, the machines are back up and the laerts cleared.

               

              Is there a log file I can pull?

                • Re: Phantom Alerts
                  d09h

                  If you caught it in time (no faster than the Alert Manager method I described), you could look in the Alerts table in the database.  If the issue is as short lived as you say, you might have better luck modifying alert actions for all alerts.  Set the text of the email to include the alert name via the variable ${AlertName}.

                   

                  You could create log files if you went to one or more alerts and set an action to write to a text file.  Same exercise as above.  Show ${AlertName} and ${NodeName} and anything else you deem appropriate.  Similar to logging the alert to a file is the option for 'Log the alert to the NetPerfMon Event Log' action (which you can set in the Trigger Action tab of any advanced alert).  The same variables can be used.

                    • Re: Phantom Alerts
                      geekplus

                      Yeah I added that text to all the email alerts already; I didn't add it to the vent logs and haven't seen anything when I looked matching up to the alerts but it's worth a shot. I haven't dived into the SQL tables though. I have a support ticket open however and just uploaded the diagnistics file.

                       

                      Thanks!