Unless this is a known issue, I may have found a possible bug with the alert rule logic in the Orion platform 2015.1.2. I'll get straight to the point:
Our current version level: Orion Platform 2015.1.2, SAM 6.2.1, DPA 9.2.0, QoE 2.0, NPM 11.5.2, IVIM 2.1.0
In our instance of Orion we rely on node custom properties for grouping, alerts, reports, and dashboards. One of our defined custom property is called "System" and is applied at the node level.
Custom Property Details:
Name = System
Format = Text
Drop down selection, over 50 defined values.
Required Property = No (unchecked)
Usage = All are selected; Alerts, Filtering, Grouping, Reports, Object Details Views
Applied at the Node level.
We have several alert rules that rely on the custom property. Here is the rule I'm referencing:
-- Note the selection "If Node - System - Is Not Equal to - SOMETHING". --
If the “system” custom property field in the node properties is “NULL” (i.e. if the None or Blank) we've found that the alert rule will be ignored.
The workaround was to create a new custom property value for System called "Unknown", then apply that value to all of the nodes that had the definition of NULL/None. The custom property just can't be Null or "none".
To prove this, here is an example of the alert evaluation result if the System custom property is NULL:
First I edited the System custom property value for the "ABIO000620" node in my environment and set it to "none" (i.e. NULL in the database).
For the node name ABIO000620, the C: system drive capacity is currently at 68%. I duplicated the alert rule as shown above but made the condition if the volume is over 50%. A screenshot of the test rule is below.
** Note for testing: The scope is limited to the ABIO000620 node.
Click through to the Summary and the result is zero.
Save and submit.
Edit the properties of the node again, but this time choose an existing System that is NOT "None". Save and submit.
Go back into the alert rule without changing anything, check the Summary.
End of example.
After we implemented the workaround by making sure the System custom property was not NULL, a slew of other critical alert rules fired off immediately that apparently had not been working.
I assume this is a bug in the alert logic in Orion. Am I correct? Is this a known issue?
- Joe