Change the severity of selected Interface 'Down' events in SAM

Products

• VMware Smart Assurance

Issue/Introduction

Is it possible to change or update the severity of selected Interface 'Down' events in Smarts SAM?

Is it possible for all Serial Interface Down events be CRITICAL severity and all other events have a default severity of Major ?

Environment

SMARTS - 10.1.X

Resolution

The severity of a given type of event (Down in this case) is universal setting that is configured in the dxa-*.conf configuration file used by the underlying domain (dxa-conn.conf in the case of Smarts AM, dxa-conn-perf.conf in the case of Smarts AM-PM). This setting cannot be modified based on the object name or interface type, so there is no automated or designed way to configure Smarts SAM to accomplish either of the goals listed in the issue description.

 

However, a workaround is possible to have this functionality for which follow the below steps and accordingly customize your environment: 

• Create a Notification List in Smarts SAM that matches the interfaces you want to be CRITICAL (Interface Down events flow into Smarts SAM as MAJOR by default). For this step, it is also suggested that you use additional criteria such as IsRoot=TRUE to keep the incidence of false alarms to a minimum.
• Create an Automatic Tool that would use the sm_ems command to modify the severity of a notification passed to the tool.
• Create an Escalation Policy that subscribes to the Notification List created in the first point and uses the Automatic Tool created in the second option. For this step, it is suggested to have the escalation policy wait at least 90 seconds so that Interface Down events that later correlate to Impacts (and are not IsRoot=TRUE) will not have their severity modified.

Additional Information