How to stop alerting on specfic cluster

[PhanindraAtchi]

Hello IR Support Team,

How to Stop alerting on specfic CLUSTER, like CUCM, Unity or etc. When customer held some maintenance on specifc cluster or node , and asked to stop alerting on specfic node or cluster , Is there any way to stop and hold the alerts triggering for some time and again start .

Regards,

Phani

[SCOTT_BALDWIN]

Hello Phani,

The only way to disable the alerts for a specific cluster is to modify the Where Clause of multiple Threshold Conditions.
- Example:

• Threshold: cmaDeviceAlerts
• Condition: CmaGatewayDown
• Current Where Clause: DEVSTATE = 3
• Suggested Where Clause to prevent alerts: DEVSTATE = 3 CLUSTER NOT CONTAINS "Cucm_Cluster_Name"

Changes to each Condition of all applicable Thresholds would need to be modified like the example above. This would result in dozens of required changes, so most customers do not update the Where Clauses for maintenance type work.

Alternate alert suppression options:

1. Use the SUPPRESS-THRESHOLD function on the Monitoring Node. This will suppress all alerts from the Node.
   
   • Open the ALERTS configuration on the Node alerts should not be sent from.
   •  Update the "!SUPPRESS-THRESHOLD()" line by removing the beginning "!" and click start.
   • When the maintenance window is complete, add the "!" back to the beginning of the "!SUPPRESS-THRESHOLD()" line in the ALERT configuration and click start.
2. Use Alert Suppression by CI mapping.
   See Prognosis Online Help pages:
   • Alert/CI Integration
   • Alert Suppression

Thank you,
Scott Baldwin

[PhanindraAtchi]

Hello Scot,

Thanks for the information, This is really helpful.

 I went on the second option, and tried to supress the alerts on devices which are kept under maintencance, Client had given the down time for it. I have implemented this on the device and put the check mark for the unity cluster and saved the configuration sucessfully, To stop alerting , But still we are seeing alerts . Can you help me if i am missing any thing here.

And what is ment by Configuration and secondery Key,  And is there any schedule time period in prognosis to enable and auto disable this suppression when down time is completed?

Regards,

Phanindra

[SCOTT_BALDWIN]

Hello Phanindra,

Further investigation into the "Alert Suppression by CI Mapping" feature shows this feature only applies to SNMP traps and will NOT suppress the emails sent by the DISPMAN configuration. My apologies for the previous incomplete response.

If alert emails are used and not SNMP traps, then the best option to suppress alerts is to use the "SUPPRESS-THRESHOLD" option in the ALERTS configuration to suppress all alerts from the Prognosis Node.

If SNMP trap alerts are the ones to be suppressed, then using "Alert Suppression by CI Mapping" can be used. When using this feature, the "Configuration Item" and "Secondary Key" fields should normally be left blank.

There may be a Custom Solution for alert suppression that will better meet this need. The Account Manager should be contacted to provide additional details about the Custom Solution.

Thank you,
Scott Baldwin