Disable specific alerts

[ovuser1]

Is it possible to disable a specific alert for a blade chassis? 

For examle. We'd like to temporarily disable this alet Critical The stacking health has changed to disconnected. bladechassisA  interconnect group for a specific chassis. is this possible to achieve? 

[ChrisLynch]

Are you asking if an administrator can disable an alert within the UI?  Today that is not possible.  If you are using the EMail alerting feature, then you can look at the alert details, and use the alertTypeID property to exclude the value in your email filter rule.  Here is an example on an email rule that will capture critical and warning alerts, but not when the alert type is a specific value:

status:critical status:warning 
NOT alertTypeID:REPLACEME

[astacy]

I want to suppress the new "Overall Security Status" alerts.  Is there away to do that? For context the alert says, "Overall security status of the system is at risk"  The resolution is, "Navigate to the 'Security Dashboard' tab under the 'Information' section on the iLO Web UI in order to evaluate your configuration for potential risks and view advice on improving system security. "

[ChrisLynch]

Unfortunately, we do not have the ability to suppress alerts within the appliance.  If you are asking about email alerting, then you can add an exclusion rule by looking at the alert details for the trap ID and add a NOT alertId:{IDVALUE}.

[astacy]

Yes I am looking for a way to filter the email alerting.  I have tried adding an exclusion rule but it's not working.  The alert we receive says, "Overall security status of the system is at risk."  The alert ID for this is 9030 so the exclucsion would look like this: status:warning NOT alertId:9030.  Is that correct?  And if I wanted to a a second one for 9029 would it look like this: status:warning NOT alertId:9030 NOT alertId:9029

[ChrisLynch]

Do you have a full screenshot of the event details?  There should be an snmpTrapID table property name.  You want it plus the value of that property to add to your filter.

[astacy]

Chris this is from the iLO event log:

The overall security state of the system is at "Risk".

Initial Update 10/16/2020 01:53:53

Event Class 0x23

Event Code 0x491

Recommended Action Refer to iLO user manual or Security Dashboard help page.

[astacy]

[ChrisLynch]

You want to use NOT alertTypeID:Trap.cpqSm2OVeralSecStatusChange as part of the filter.  That should exclude the alert from propogating via email to the recipients.

[astacy]

Still receiving the messages.  This is what my filter looks like.:

[ChrisLynch · Accepted solution]

A few things:

1. Make sure I didn't fat finger the alertTypeID value.
2. Make sure the alert severity is Warning, and not Informational.
3. Do you have any other email alert filters configured on the appliance?  Just because you are trying to filter it out for one email destination doesn't mean it is applied to all.

[astacy]

#3!  I believe it was hitting a filter before that and never processing this new one.  Problem resolved.  Thank you!!!