Observability

Duplicate alerts are not generated for the same Log Analyzer rule on the same node in SolarWinds Platform

This article provides information about a behavior where Log Analyzer (LA) does not generate multiple (duplicate) alerts from the same alert rule for the same node, even when multiple traps or syslog messages are received. The article also includes details about the underlying design and an optional configuration change that allows each log event to trigger a separate alert.

First published date

11/6/2025 10:35 PM

Last published date

11/6/2025 10:35 PM

Overview

In SolarWinds Platform environments with Log Analyzer (LA), users may observe that when multiple traps or syslog messages matching the same alert rule are received from a single node, only one alert is triggered. Subsequent events increment the alert trigger count instead of generating new alerts.

Example scenario:

  • A network device sends multiple syslog or SNMP trap messages related to the same condition (for example, interface status changes or system notifications).
  • A Log Analyzer rule is configured to trigger an alert whenever such messages are received.
  • However, only one alert is generated per rule per node, even if several log messages are received that match the same rule within a short time period.

This can give the impression that the alerting system is not responding to additional events, when in fact the events are being processed but are temporarily suppressed by Log Analyzer’s internal alert queue mechanism.

Product section

Hybrid Cloud Observability

Cause

By design, Log Analyzer suppresses identical alerts that occur within a short interval to prevent flooding the alerting component. This behavior is managed by the following setting:

 

LogManagement.RuleProcessing.Settings → RuleAlertQueueItemExpiration

  • The default value is 00:01:00 (1 minute).
  • During this 1-minute interval, duplicate alerts for the same rule and node are suppressed.
  • As a result, only one active alert instance exists per rule-node combination, even if multiple matching events are received.

Resolution

This behavior is expected by design. However, if it is necessary for each event (trap or syslog message) to trigger its own alert, the suppression cache can be disabled.

Important: Disabling the cache is a global change that affects all Log Analyzer rules. It may result in alert flooding or performance degradation in environments that receive high log or trap volumes. Proceed with caution.

To disable alert suppression:

  1. Go to the Advanced Configuration page:
    http://<solarwinds_server>/Orion/admin/advancedconfiguration/global.aspx
  2. In the search box, type RuleAlertQueueItemExpiration.
  3. Confirm that the setting path is:
    LogManagement.RuleProcessing.Settings
  4. Change the value from the default 00:01:00 to 0.
    • Setting this to 0 disables caching, allowing each log event to generate a new alert immediately.
  5. Click Save.

After this change:

  • Each trap or syslog message that meets the alert rule conditions will trigger an independent alert, even if multiple are received from the same node at the same time.

If disabling the cache causes alert flooding or performance issues, revert the setting to its default value:

00:01:00