This technical article covers the ability to use the nas probe to preprocess a rule via a custom script, that utilizes an alarm suppression key that will work with the ntperf probe configuration, for the purpose of elevating a single alarm severity.
In this example, we are using the ntperf watcher for Memory that is greater than (>) threshold for Committed Bytes in Use. The use case is defined as such:
Defined Watcher values: Warning at 80%, and Error at 88%.
You can configure two alarms to fire by setting up two profiles, but they both remain as active alarms. The suppression key is different so they are distinct alarms with their own clears. See the below alarm supp_key values.
example of error/warn alarms that both stayed active:
open: 2017-05-05 12:52:20.000
closed: 2017-05-05 12:52:55.000
supp_key: ntperf/CommitInUseError/value
message: CommitInUseError: Memory Committed bytes in use - percent error Memory//% Committed Bytes In Use = 90.0361, which is above the error threshold (88.000000)
open: 2017-05-05 12:52:20.000
closed: 2017-05-05 12:52:55.000
supp_key:ntperf/CommitInUseWarn/value
message:CommitInUseWarn: Memory Committed bytes in use - percent warn thresh Memory//% Committed Bytes In Use = 90.0361, which is above the warning threshold (80.000000)
The goal is to key off of the description by creating a suppression key that reads it.
1. Create a lua script in the nas probe UI, Auto-Operator > scripts section. Here is an example for committed bytes in use supp_key:
--ntperf messages are in format "Ntperf/$description:...."
--where the description is the same for which ever profiles you want to correlate
sMessage = event.message
sPattern = "Ntperf%/(%S+):"
sWatcher = string.match(sMessage, sPattern)
event.supp_key = "ntperf/" .. sWatcher
return event
2. Create a pre-processing rule that points to the ntperf_suppkey script:
3. Create two new messages in the ntperf probe UI Messages tab. For this example, we are using the ntperf64 probe.
a. AlarmOnValueWarn
Message text: Ntperf/$description: $object/$instance/$counter = $value, which is above the warning threshold ($limit)
Message token: alarm_on_value
Severity: minor
b. AlarmOnValueError
Message text: Ntperf/$description: $object/$instance/$counter = $value, which is above the error threshold ($limit)
Message token: alarm_on_value
Severity: major
4. Create two new profiles in the ntperf probe UI Status tab
a. Name: CommitInUse
Description: CommitInUse
Object Selection Tab
Object: Memory
Counter: % Committed Bytes In Use
Alarm On Value Tab
Threshold Operator: >
Threshold Value: 60
Samples: 3
Message: AlarmOnValueWarn
Clear Message: ClearOnValue
b. Name: CommitInUseError
Description: CommitInUse
Object Selection Tab
Object: Memory
Counter: % Committed Byte In Use
Alarm Value Tab
Threshold Operator: <
Threshold Value: 70
Message: AlarmOnValueError
Clear Message: ClearOnValue
Save all profiles as you normally would and restart the probe.
The end result you should now see is the same alarm elevates from warning to major as per this example:
The screenshot indicates that the threshold has already breached < 70 so the alarm is automatically elevated thus you would never see the warning alarm.
UIM Support does not assist with the creation or troubleshooting of LUA scripts. The one provided in this technical article is permitted for use at your own risk.