Re: Re: Tiered Alerts

I would hesitate to recommend using the alert suppression tab, it has been known to cause  a lot of errors in alerting. It's even mentioned as such in SW documentation: Understanding Orion Advanced Alerts (beginning on Page 8)

Looking again at the dbo.AlertDefinitions table we see the suppression field is now populated with the

following query:

SELECT Count(*) AS Supress FROM Interfaces WHERE ((Interfaces.InterfaceSpeed >
10000000))

 

 

And the SQL alert trigger:

SELECT Interfaces.InterfaceID AS NetObjectID, Interfaces.FullName AS Name FROM
Interfaces WHERE ((Interfaces.InPps > 10000) AND (Interfaces.Inbps < 51200))

 

It would appear that the alert will fire for interfaces at or under 10 Mbps bandwidth and not fire for

interfaces faster than 10Mbps. This is a common misinterpretation of suppression. The way suppression

works is that if the suppression condition is true, all alerts for that trigger condition are suppressed, no

matter what the alert condition contains. So, because the Orion database has an interface with a

bandwidth of greater than 100 Mbps this alert will always be suppressed.

Really, you need to use a second condition group and rely on the 'none of the following' option:

Which will give you a back-end SQL query like this:

WHERE
(  (Nodes.Status = '2') AND  (  NOT (Nodes.DeviceType LIKE '%PC_Box1%'))
)

HOWEVER, if you are calling a custom property directly and do not need the wildcards, it gets even easier:

WHERE
(  (Nodes.Status = '2') AND  (Nodes.DeviceType <> 'PC_Box1')
)

I would highly recommend reading that document I have linked above. It's only about 17 pages long and can really give you some valuable insight into how the alerting really works within Orion. Of course, with the release of NPM 12, we will have access to an amazing web alert engine! But the basics of alerting will still be the same and this foundational knowledge will undoubtedly save you some headaches down the road! (such as the often misunderstood 'functionality' of the alert suppression tab)

Hope this helps to clear things up

-ZackM

Loop1 Systems: SolarWinds Training and Professional Services

• LinkedIN: Loop1 Systems
• Facebook: Loop1 Systems
• Twitter: @Loop1Systems