How to escalate a single alarm severity in the ntperf probe

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)
• CA Unified Infrastructure Management On-Premise (Nimsoft / UIM)
• CA Unified Infrastructure Management SaaS (Nimsoft / UIM)

Issue/Introduction

This technical article covers the ability to use the nas probe to preprocess a rule via a custom script, that utilizes an alarm suppression key that will work with the ntperf probe configuration, for the purpose of elevating a single alarm severity.

Environment

• The latest editions of components are being used in this article.
• UIM 8.51 or higher
• Nas probe 8.52
• ntperf probe 2.06
• NOTE: The numerical values in this example are not required and are subject to your threshold requirements.

Resolution

In this example, we are using the ntperf watcher for Memory that is greater than (>) threshold for Committed Bytes in Use. The use case is defined as such:

Defined Watcher values: Warning at 80%, and Error at 88%.

You can configure two alarms to fire by setting up two profiles, but they both remain as active alarms. The suppression key is different so they are distinct alarms with their own clears. See the below alarm supp_key values.

example of error/warn alarms that both stayed active:
open: 2017-05-05 12:52:20.000
closed: 2017-05-05 12:52:55.000
supp_key: ntperf/CommitInUseError/value
message: CommitInUseError: Memory Committed bytes in use - percent error Memory//% Committed Bytes In Use = 90.0361, which is above the error threshold (88.000000)

open: 2017-05-05 12:52:20.000
closed: 2017-05-05 12:52:55.000
supp_key:ntperf/CommitInUseWarn/value
message:CommitInUseWarn: Memory Committed bytes in use - percent warn thresh Memory//% Committed Bytes In Use = 90.0361, which is above the warning threshold (80.000000)

The goal is to key off of the description by creating a suppression key that reads it.

1. Create a lua script in the nas probe UI, Auto-Operator > scripts section. Here is an example for committed bytes in use supp_key:

--ntperf messages are in format "Ntperf/$description:...."
--where the description is the same for which ever profiles you want to correlate

sMessage = event.message

sPattern = "Ntperf%/(%S+):"

sWatcher = string.match(sMessage, sPattern)

event.supp_key = "ntperf/" .. sWatcher

return event

 

2. Create a pre-processing rule that points to the ntperf_suppkey script:

 

3. Create two new messages in the ntperf probe UI Messages tab. For this example, we are using the ntperf64 probe.

 

a. AlarmOnValueWarn

Message text: Ntperf/$description: $object/$instance/$counter = $value, which is above the warning threshold ($limit)

Message token: alarm_on_value

Severity: minor

 

b. AlarmOnValueError

Message text: Ntperf/$description: $object/$instance/$counter = $value, which is above the error threshold ($limit)

Message token: alarm_on_value

Severity: major

 

4. Create two new profiles in the ntperf probe UI Status tab

 

a. Name: CommitInUse

    Description: CommitInUse

Object Selection Tab

Object: Memory

Counter: % Committed Bytes In Use

Alarm On Value Tab

Threshold Operator: >

Threshold Value: 60

Samples: 3

Message: AlarmOnValueWarn

Clear Message: ClearOnValue

 

b. Name: CommitInUseError

    Description: CommitInUse

Object Selection Tab

Object: Memory

Counter: % Committed Byte In Use

Alarm Value Tab

Threshold Operator: <

Threshold Value: 70

Message: AlarmOnValueError

Clear Message: ClearOnValue

 

Save all profiles as you normally would and restart the probe.

The end result you should now see is the same alarm elevates from warning to major as per this example:

 

The screenshot indicates that the threshold has already breached < 70 so the alarm is automatically elevated thus you would never see the warning alarm.

Additional Information

UIM Support does not assist with the creation or troubleshooting of LUA scripts. The one provided in this technical article is permitted for use at your own risk.