topic Re: Crazy alert in Alerting

Crazy alert

christinmb — Wed, 12 Dec 2012 18:10:02 GMT

Hello, I'm monitoring my PercentFreeSpace in some of my servers so I configurated an alert when the PercentFreeSpace<15 with Time range of 15m and running every minute the search, the problem comes when I want to verify the alert results: I GET 0 EVENTS MATCHING MY SEARCH!

Any idea why this is happening?
Thanks in advanced

Re: Crazy alert

emiller42 — Wed, 12 Dec 2012 18:11:26 GMT

Can you provide sample events and the actual search you're running?

Re: Crazy alert

sdaniels — Wed, 12 Dec 2012 18:28:07 GMT

That could just mean that you don't have any servers with PercentFreeSpace less than 15%. We would expect no results to show up in that case. Why don't you try it as a search and adjust the number and see if indeed the alert should be bringing back something. If you edit your original question with the search, that would help as well.

Re: Crazy alert

christinmb — Wed, 12 Dec 2012 18:36:58 GMT

But why am I getting tons of alerts if the results doesnt match?

Re: Crazy alert

sdaniels — Wed, 12 Dec 2012 18:39:33 GMT

You didn't say in your question that you were getting the alerts so didn't realize that. Can you post the search details.

Re: Crazy alert

christinmb — Wed, 12 Dec 2012 18:47:12 GMT

http://img543.imageshack.us/img543/7492/configuracindealerta.jpg

Re: Crazy alert

sdaniels — Wed, 12 Dec 2012 18:52:12 GMT

Try changing the alert condition from 'always' to 'if number of events' greater than 0.

Re: Crazy alert

christinmb — Wed, 12 Dec 2012 19:09:21 GMT

Ok, i'll try that, but why do i get an alert if the condition doesnt meets?

Re: Crazy alert

sdaniels — Wed, 12 Dec 2012 19:11:38 GMT

I think it might be sending you the results 'always' even though it's not a match, and essentially alerting every time that search runs.