Forum Discussion

CaseyW's avatar
3 years ago
Solved

Routing error/critical alerts to a ticketing system

I tuned all of my alerts just how I want them, and now that I am ready to fully implement LM into our enviornment, I am working on creating alert rules. I ran into a problem. Using the Ping Loss Percent as an example: I have thresholds set at 20 for warn, 70 for error and 90 for critical. These happen to be out of the box. I still want these warning alerts to happen at 20%. Mostly for trend analysis and reporting reasons, but I do not want to send these off to ServiceNow for incident creation... However, I do want tickets created for ping loss at the error and critical thresholds.

The problem is when creating alert rules, I can only choose All alerts routed (I dont want warnings) or I can select only one of the following Warn, Error OR Critical. If I create 2 alert rules, one for error and one for critical alerts, I will get double tickets and I dont want that either. The only thing I can think of to fix this is create a new complex datapoint called Ping Percent (Warn), set that at 20% with no thresholds set for error and critical, and then get rid of the warning alert for the original datapoint. This seems messy. Is there a better way? 

  • You can try creating an overriding rule above the normal rule that NoEscalates warning alerts.

3 Replies

  • You can try creating an overriding rule above the normal rule that NoEscalates warning alerts.

  • Yeah, that's how we've had to do it forever -- you have to create two rules to get error & critical since you still cannot select multiple severities in one rule (first matches warn with noescalation and second matches all).  Made unnecessarily more annoying since alert rules are one of the random parts of the UI where you cannot clone.

  • OMG, thank you, so simple. Glad I didnt go ahead and create unnecessary datapoints!