Alerts being sent regarding child devices though parent device is down

Greeting Community,

I am running a default alert rule “Device Down! Due to no ICMP response.”
Most of my devices have “child” or parent configured. (this was done via api to all of the ~1500 devices)
the issue is I receive notification about both the parent and the child device once the parent device goes down…
I am missing something or is there anything I should look into?

10xs All.

Hello All, is there to know issue with the toppic?
Could it be me doing something wrong?

Attaching the output of ./validate.php

-bash-4.2$ ./validate.php

Component Version
LibreNMS 21.7.0-69-g9723c44
DB Schema 2021_08_04_102914_add_syslog_indexes (213)
PHP 7.3.28
Python 3.6.8
MySQL 10.5.10-MariaDB
RRDTool 1.4.8
SNMP NET-SNMP 5.7.2

====================================

[OK] Composer Version: 2.1.5
[OK] Dependencies up-to-date.
[OK] Database connection successful
[OK] Database schema correct
[WARN] IPv6 is disabled on your server, you will not be able to add IPv6 devices.
[WARN] Your local git contains modified files, this could prevent automatic updates.
[FIX]:
You can fix this with ./scripts/github-remove
Modified Files:
LibreNMS/Alert/RunAlerts.php

Adding some screenshots of the alerts and the device configuration showing the dependency configured…



In the description of the feature it says: “The aim for that is, if all parent devices are down, alert contacts will not receive redundant alerts for dependent devices.” It is unclear if this means that the alerts for the children will not go through to Transport (if any is defined) of it the alerts should not be raised. From your description, it seems that the first alternative is the correct one.

I have a similar observation - during a complete site outage: as the devices return polling information at different times - the alerts appear to check the parent status at that point, and if not down through luck of timing, it will notify after the configured delay without checking the parent status again. This means the majority of devices on the site will notify, and this includes the recovery alerts.

Have not looked at the code yet, but to be true to its aim, it should be checking the parent status at each decision point from alert through to final notification.

The default pollers do not poll in any particular order and if a child device is marked down before a parent device, it will still alert.

Only the fast ping code will fully respect device precedence.

Feel free to contribute code to make the other pollers respect parent/child.

This topic was automatically closed 91 days after the last reply. New replies are no longer allowed.