How to control alert flooding in solman monitoring?

[Former Member]

Hi Gurus,

I am working on monitoring in solman 7.1 SP12 for an AS JAVA system (Portal system to be precise). I have finished the config and activated the metrics which I require. However I am not able  to control the frequency of alerts that are generated.

I know that for each alert there are options to decide the threshold and the rule using which the alert will be generated. There is also a data collection period for each alert. But these do not really answer my problem.

I have an alert for high CPU configured for linux host. The interval for collection is 5 mins. Now if the value crosses the threshold then an alert is generated, which is fine. But my issue is that the same alert is coming continuously over a period of time. I want to restrict this alert to only one or two may be. Is there any way to do that?

Also please tell me what exactly is the role of alert severity in monitoring?

I seem to miss the logic behind alert frequency. Please help.

Thanks

Best Regards

Robin Singh

[former_member185326 · Accepted solution]

Hi Robin,

" I have an alert for high CPU configured for linux host. The interval for collection is 5 mins. Now if the value crosses the threshold then an alert is generated, which is fine. But my issue is that the same alert is coming continuously over a period of time. I want to restrict this alert to only one or two may be. Is there any way to do that?"

>> How frequently you are getting the same alert?

>> You want to restrict the number of alerts per day? or per occurrence?

For every 'change' in the event, solman will trigger an alert email. Like say you have configured high CPU threshold as : >90 for RED, then for an instance if the utilization is now 90, it triggers an alert and after few minutes, if the cpu utilization reaches below 90, then there is a change in the metric and a warning alert will be triggered. Again if the utilization is above 90% , you will receive another alert email. However, if there is no change in the event, (say the threshold is continuously above 90%) then you will receive only 1 alert 'email' but the alerts will get piled-up in the alert inbox of solman.,until you "confirm" them in the inbox.

[Former Member · Accepted solution]

Hi Shahid,

Thanks for the information.

Can you explain how the option which Aditya Khorana has mentioned will help my case.

Also, do you mean to say that  after I get an alert for CPU utilization at 90% and then the value further increases three times, I will get total four alerts but only one alert mail?

Best Regards

Robin

[former_member185326 · Accepted solution]

"Also, do you mean to say that  after I get an alert for CPU utilization at 90% and then the value further increases three times, I will get total four alerts but only one alert mail?"

>> Yes. Unless you do not "confirm" them in the alert inbox. If you confirm each alert, then for every change in event , it triggers an email alert.

What Aditya has mentioned is about "advanced" settings which are not default. I suppose you haven't made any changes there.

[Former Member · Accepted solution]

Shahid,

Can the advance options be used to address my difficulty?

For performance related metrics we do not want alerts at every event change. Can we control that?

Best Regards

Robin

[Former Member · Accepted solution]

Hi Robin,

The Advance option will only help if you have put a tick mark on "Send additional Notification" and then you can uncheck that and stop alert flooding.

Also you can look for below options

1) Alert only for CPU utilization Average values. For instance if for 5 min or 15 min, the value is more than 90% then you get alerted.

2) Check what threshold has been maintained. The monitored value should be set as Average value to reduce alerts.

Hope it helps.

Regards

Aditya Khorana

[former_member185326 · Accepted solution]

Hi Robin,

For your below queries:

Can the advance options be used to address my difficulty?

>> As Aditya has mentioned, this is helpful only if you have 'selected' it before. By default these parameters are 'unselected'. I presume that you haven't selected these options.

For performance related metrics we do not want alerts at every event change. Can we control that?

>> Have threshold monitored value as "average" and you can configure alerting only for "RED" alerts. With this you can minimize the # of alerts. However, you cannot actually interfere with the default alerting mechanism of SAP Solman MAI. If an issue / alert is known and is very frequent, then you can anytime "postpone" it from the Alert inbox until you fix the same.

Hope it helps..

Regards,

Shahid

[Former Member]

Hi Robin,

You can try the following options.

Generate an alert only for Red Value

Also you can check if the Send Additional notification is checked. If it is, you can disable the same. Usually an email gets triggered when threshold gets breached and then if there is any change in the value. All the alerts are not triggered.

Hope this helps.

Regards

Aditya Khorana

[Former Member]

Hi Aditya,

Thanks for the reply.

I had seen this option earlier but was not sure how does it work.

With this can I reduce the number of alerts related to performance because for such alerts there is frequent change in event throughout the day.

If we take the same example which I had mentioned of CPU usage, then many alert mails are generated due to fluctuation in CPU usage. As performance related issue cannot be addressed straight away, we want that we get as less mails as possible.

Please let me know if this can be achieved using the above options.

Best Regards

Robin Singh

[ruth_reilly]

Hello Robin,

For your question regarding the role of alert severity in monitoring?

The Severity of an Alert can be used for a ranking in the Alert Inbox.

Regards,

Ruth