In logmon 4.11 the "maximum alarm count" doesn't appear to work correctly

book

Article ID: 222331

calendar_today

Updated On:

Products

DX Infrastructure Management

Issue/Introduction

I have a logmon profile configured such that max alarm count is set:

 

The behavior currently (which is incorrect) is:

- if you get a number of matches for your watcher(s) that does not exceed the "Maximum Alarm Count" then you get the alarm from your watcher, as expected.
- if you get a number of matches for a watcher that does exceed the limit, then you get the "Maximum Alarm Count" message; but because the suppression key is actually the same as the watcher, this ends up overriding the message on the original "watcher alarm" with whatever you have specified for the "Maximum Alarms Reached" message.
- On the following interval, if the same watcher matches but is under the limit, it sends that alarm, but also sends a clear alarm for the "max alarms" which clears both and so you end up missing the watcher-based alarm.

 

Cause

defect

Environment

Release : 20.3

Component : UIM LOGMON

Resolution

This will be resolved in the next build of logmon (after 4.11).  

The forthcoming fix will be to append some string like "maxalarm" to the suppkey just for the "Maximum" alarm itself.  So if you have, in your watcher, ${WATCHER} - ${PROFILE} then for the "Max Alarms" alert we would use something like: ${WATCHER} - {PROFILE}.maxalarm

This would result in the following behavior - 

- if you get a number of matches for your watcher(s) that does not exceed the "Maximum Alarm Count" then you get the alarm from your watcher, as expected.
- if you get a number of matches for a watcher that does exceed the limit, then you get the "Maximum Alarm Count" message; this would no longer be combined/suppresed with the watcher message, but would be kept separate.
- On the following interval, if the same watcher matches but is under the limit, it would send a new alarm for the watcher, and clear the "max alarms" alert only, leaving the original alert from the watcher alone.

Additional Information

This will also be updated in the GUI and MCS Templates in the near future.