How does SoloNOC stop an alert storm?

A failure must last 2 minutes to page, alerts behind a down upstream are suppressed and pointed at the root cause, and flapping and duplicates are treated as noise.

Are suppressed alerts deleted?

No. They are kept and marked suppressed, so the record of what failed stays complete.

Does it work out the dependencies for me?

No. You declare each device’s upstream; that is the one step a tool cannot guess.

How do I get one page per outage instead of forty alerts?

Noisy defaults and duplicate alerts are the top monitoring complaint. The four mechanisms SoloNOC uses to turn an outage into one page, and the ratio we have not measured yet.

Updated 2026-10-24. Every quote links to where it was published.

In admins’ own words

“If you want to go out-of-the box there is a big chance of false positives.”
Capterra reviewer of a network monitoring tool · source

“too many false/positives”
Trustpilot review of an uptime monitor (2 stars) · source

What it is

When a core switch dies, every device behind it stops answering at once, and a monitor that sees each device on its own sends one alert per device. The first alert is the cause; the rest are symptoms that bury it.

How SoloNOC does it

A device is only down after it has stopped answering for a set time: the recommended Device down alert waits 2 minutes and then cools down for 15, so one dropped packet pages nobody. (pinned by: alertPolicy.spec.ts)
You declare each device’s upstream. When an upstream is already down, the alerts behind it are kept, marked suppressed and pointed at the root cause, and notify nobody. (pinned by: alertPolicy.spec.ts, loops.spec.ts)
Suppression rules treat flapping and repeats inside a dedup window as noise, and a maintenance window silences a site while you work. (pinned by: alertPolicy.spec.ts)

Not built or not measured yet

We have not yet published a measured ratio of alerts in to pages out from a real customer network, or a count of false pages over a week.

Suppression only knows the dependencies you declare; an undeclared one is paged like any other device.

What admins report from other tools

Reviewers of monitoring tools describe false positives out of the box and noisy default notification settings.

Questions

How does SoloNOC stop an alert storm?: A failure must last 2 minutes to page, alerts behind a down upstream are suppressed and pointed at the root cause, and flapping and duplicates are treated as noise.
Are suppressed alerts deleted?: No. They are kept and marked suppressed, so the record of what failed stays complete.
Does it work out the dependencies for me?: No. You declare each device’s upstream; that is the one step a tool cannot guess.

More from SoloNOC

SoloNOC is network monitoring for the one-person IT shop and the small MSP: one agent per site, flat plans, a 14-day trial with no card. Start free.