This is something to be aware of, but I fall into this trap every time: if you make use of custom SQL alerts then unless it is a very simple trigger you MUST re-write the reset trigger.
Negating SQL is a tricky tasks, and for anything with a JOIN or IN.. clause the alert manager will invariably not get the reset query correct.
Here are a couple of examples:
| Trigger Condition | Auto-generated reset condition | working reset condition |
|---|---|---|
INNERJOIN(SELECTnodeid,Count(*)CS FROM syslog WHERE acknowledged=0 ANDmessagetype='SFP-RX-HIGH' ANDdatetime>Dateadd(hour,-1,Getdate()) GROUP BYnodeid HAVINGCount(*)>5)SM ONSM.nodeid=nodes.nodeid | INNER JOIN ( SELECT nodeid, count(*) CS FROM syslog WHERE NOT acknowledged = 0 AND messagetype ='SFP-RX-HIGH' AND datetime > Dateadd(hour, -1, Getdate()) group by NODEID HAVING count(*)>5 ) SM ON SM.nodeid=nodes.nodeid | WHERE nodeidNOT IN(SELECTDISTINCTnodeid FROM syslog WHERE acknowledged=0 ANDmessagetype='SFP-RX-HIGH' ANDdatetime>Dateadd(hour,-1,Getdate())) |
WHERE nodeid IN(SELECTDISTINCTnodeid FROM syslog WHERE acknowledged=0 ANDmessagetype='SFP-RX-HIGH' ANDdatetime>Dateadd(hour,-1,Getdate())) | WHERE NOT nodeid NOT IN (SELECT DISTINCT nodeid FROM syslog WHERE NOT acknowledged = 0 AND messagetype = 'SFP-RX-HIGH' AND datetime > Dateadd(hour, -1, Getdate())) | WHERE nodeidNOT IN(SELECTDISTINCTnodeid FROM syslog WHERE acknowledged=0 ANDmessagetype='SFP-RX-HIGH' ANDdatetime>Dateadd(hour,-1,Getdate())) |
I've not (ha!) reported this as a bug because I'm not entirely sure that generating the negative condition automatically is A Good Idea
Anyway... something to be aware of when using custom SQL alerts and wondering why they never trigger.