I have an interface which has a threshold profile for alerting when there are more than 540 discards in 5 minutes and I am polling on a 1 minute interval.
However it does not create events and it is taking lots of discards.
Dx NetOps PM : 20.2.x/21.2.x/22.2.x
Component : CA Performance Center
If an event was raised on an interface threshold, a new event will not be raised until the existing one is cleared.
1. get item if of device or interface
connect to vsql on the Vertica host as the dauser, and run:
./vsql -Udauser -wdapass (your password may vary)
select * from alarm where item_id=<Item ID of device or interface>;
Are there events in this table where the clear_date =0, if so, event never cleared.
Change threshold profile rules, and change accordingly to clear old events.
Make sure you are changing the correct threshold profile
note, for a more detailed result, you can run this query, replacing ID with the correct values for that spot.
select profile_name, profile_id from alarm where profile_name like 'enter_case_sensitive_name_here';
now use the profileid for this one:
SELECT a.item_id, a.rule_id, a.profile_id, a.alarm_id FROM alarm a WHERE a.profile_id=<ID> AND a.alarm_type='Threshold' AND NOT EXISTS (SELECT 1 FROM alarm_clear ac WHERE ac.profile_id=<ID> AND ac.alarm_type='Threshold' AND ac.alarm_id = a.alarm_id);
An event created will only be seen for 30 days before EM drops it. In case the event never clears in 30 days.