We are a large global company and when initially setting up our instance we created remote probes for each site to manage and gather information for all our servers, host, and network devices at the location. Originally everything in our instance had the same notification triggers for all devices and sensors and as expected it got rather noisy, very quickly.
We are changing our alerting set up to a more priority based system with three levels (p1: important, high priority devices, needs to be addressed immediately- keeps current triggers, p2: semi-important, can wait for normal business hours to be handled- auto- acknowledge, p3: mainly for data collection-no triggers), I was wondering if anyone had a recommendation on what the best way to implement this change would be? At the moment, we will be changing a whole device and all its sensor "priority" notifications but there is the potential in the future for a device to have one priority level and one (or more) of the sensors underneath it to have a different priority level.
My current options on how to implement this change:
- Creating libraries for each priority level then making any notification trigger adjustments to the library but I read somewhere that libraries can put a heavy load on the core (please, correct me if i'm wrong because I feel like this will be the easier option). We have a little over 9,000 sensors and one core instance so we are trying to avoid any unnecessary load to the core if we can.
- Create groups under each probe for the different priority levels and update the notification triggers at the group level. We currently have groups set up to separate devices by device type under each probe (i.e network devices, windows, host, etc.)
- Manually changing the triggers on each device one by one (would like to avoid this option as much as possible)
Add comment