How to change suppression key through NAS auto operator/pre-processor
Article ID: 221404
Updated On:
Products
Issue/Introduction
Is it possible to change the suppression key on an alarm which does not allow the suppkey to be configured at the probe level?
Environment
UIM - NAS
Resolution
Yes, this is possible, but you must be careful to consider the ramifications and ensure that you do not cause unexpected results or an alarm loop.
This should be done by a pre-processor script as opposed to an auto-operator, because pre-processing occurs at an earlier point in the alarm cycle -- changing the suppression key too late in the cycle will have unexpected results (e.g. the suppression may not actually behave as expected).
When an alarm comes in to the NAS pre-processor it is considered an "event" and in the context of a Lua script we can access the suppkey here and change it before the alarm is published which will allow suppression to work correctly.
The following is an example of a simple LUA script that changes the suppression key on an incoming message to a desired string:
if event.supp_key ~= "mysuppkey" then
event.supp_key = "mysuppkey"
end
return event
This script checks to see if the incoming event supp_key is not already equal to "mysuppkey" and if so, changes it.
Your script must check the suppression key to make sure it has not already been changed or you can cause an infinite loop.
You can also match on the (unchanged) suppkey within the rules of the pre-processor so that only alarms with the original suppkey are sent to the script.
You can save this script in NAS and then pass alarms to it through a pre-processor rule.
This script would be paired with a Pre-Processor rule of type "custom" in NAS which matches existing messages.
Type: custom
Custom Script: choose the script above
You must ensure your pre-processor is specific enough that it will not mistakenly combine alarms by replacing the suppkey on alarms you don't intend to replace.
Example
Below is an advanced example of changing the suppression key on an incoming alarm, extracting information from the alarm itself to use as part of the suppkey.
Consider the following sample message:
The curent suppression key for this alarm type is "memory/pagefile" and we would like the suppression key to include the percentage captured from the alarm message, so that each time the percentage is the same, the alarms will be grouped together.
The Lua script could look something like the following, which captures the percentage from the alarm message using Regex and creates a new suppression key containing that percentage:
matching_regex = "Average %(5 samples%) memory usage is now (%d+).*"suppkey_base = "Memory Alarm - Percent "mymessage = event.messagesuppkey_to_add = string.match(mymessage, matching_regex)event.supp_key = suppkey_base .. suppkey_to_addreturn event
This script uses a Regex to match the alarm message and extract the percentage value, which is stored in the "suppkey_to_add" variable. That variable in turn is appended to a string that says "Memory Alarm - Percent " and so the final string would be "Memory Alarm - Percent 73" in this particular example.
The pre-processor rule would be configured to match the original suppkey only - in this case we only pass alarms to the script that contain the word "pagefile":
The result is that any alarm which matches the above filter will have the suppkey altered:
Feedback
