4 Replies Latest reply on Sep 1, 2008 9:38 AM by phoffmann

    Storm Alert...

    VaLr Apprentice


      does anyone knows how to desactivate or something the storm alerts....



      I had LDMS (with system manager) 8.7 SP4 with several alerts, one of them about Applications added or removed, now i haveLDMS (with system manager) 8.8 SP1 and one of the new features is tht if you have more than 5 alerts of the same type in 5 minutes, instead of send all e-mails for each event, it´s gather all events in only one e-mail alerting me that i have several alerts ( Applications added or removed in this case).And i have to open the Console to check the LOGS....



      I want to recieve each alert of each event in my inbox... is it posible?



        • 1. Re: Storm Alert...
          Jared Barneck SupportEmployee

          There is a registry key, I think.


          I will have the guy over this post it for you.

          • 2. Re: Storm Alert...



            The alert storm can be configured with some changes to a database table.  But before I flood you with the details, I want to make sure that you understand the implications of changing.  You may be opening yourself up to a flood of e-mails or some other alert action that you may not want.  Please be aware that the storm control only alerts on multiples of the exact duplicate alert.  Other alerts are not suppressed, only if they also lead to a storm.


            With that in mind here is a discussion of what can be controlled and how to set it up.  You will need a database tool to make these changes, such as SQL Management Studio.  There is no UI to make these changes in the LANDesk consoles.


            You will be making changes to the table KeyValue.  The changes you can make involve making new row(s) in the table with the ApplicationName of AlertService.  You will be using the Modify function to add this row if you are using the Microsoft SQL tool.  These entries are not there by default and must be added.  If not found, the hard coded defaults will be used.


            The configurable values are found in the IntValue column.


            The following key names ( KeyName column) can be set:


            StormTriggerCount       -- Number of alerts needed within the window of 'StormTriggerMinutes' to trigger an alert storm.  Default value is 5 (alerts).   If this value is set to 0 (zero), storm watching is disabled.


            StormTriggerMinutes     -- Number of minutes in the trigger period.  If 'StormTriggerCount' alerts occur within this number of minutes, an alert storm is happening.  Default value 5 (minutes).


            CalmDownMinutes        -- Once a storm has been triggered, handler actions will be filtered (not executed) until no more alerts have occurred for 'CalmDownMinutes'.  Default value 60 (minutes).

            The storm control doesn't actually prevent the alerts from being placed in the database (or stop health calculations).  Instead it prevents the handlers from being executed--we don"t want a flood of emails being sent--just enough to let the administrator know that a storm is occurring.  The counts of "missed" emails are sent periodically.  These values are sent to every affected core handler (not just email) periodically while the alert storm continues.   

            Note that the counts and times are applied to equally to every { alert type, handler, configuration } combination.  So if you disable the storm control or change the thresholds, it is changed for all alert types.

            Once you have set these values you need to restart the alert service to make them effective.




            Message was edited by: Paul Hoffmann - Fixed a few display/formatting issues

            • 3. Re: Storm Alert...
              VaLr Apprentice

              Thank you very much, it worked....

              • 4. Re: Storm Alert...
                phoffmann SupportEmployee

                Thanks a lot Don :).


                I've re-edited your post a little (no content was changed) to make sure that all the text was showing up (I've added 'noformat' flags where appropriate).


                I did not change content itself.


                Paul Hoffmann

                LANDesk EMEA Technical Lead