Smarts SAM: How can I change the severity of selected Interface 'Down' events in Smarts SAM?

Products

• VMware

Environment

VMware Smart Assurance - SMARTS

Resolution

Can I change severity of selected Interface Down events in Smarts SAM?
Can I have all Serial Interface Down events be CRITICAL severity and all other events have a default severity of Major?




No. The severity of a given type of event (Down in this case) is universal setting that is configured in the dxa-*.conf configuration file used by the underlying domain (dxa-conn.conf in the case of Smarts AM, dxa-conn-perf.conf in the case of Smarts AM-PM). This setting cannot be modified based on the object name or interface type, so there is no automated or designed way to configure Smarts SAM to accomplish either of the goals listed in this solution.

Possible workaround
It is possible to have this functionality if you customize your system. The suggestion for doing this includes the following tasks:

1. Create a Notification List in Smarts SAM that matches the interfaces you want to be CRITICAL (Interface Down events come into Smarts SAM as MAJOR by default). 
2. • For this step, it is also suggested that you use additional criteria such as IsRoot=TRUE to keep the incidence of false alarms to a minimum.
3. Create an Automatic Tool that would use the sm_ems command to modify the severity of a notification passed to the tool.
4. Create an Escalation Policy that subscribes to the Notification List created in the first option and uses the Automatic Tool created in the second option.  
5. • For this step, it is suggested to have the escalation policy wait at least 90 seconds so that Interface Down events that later correlate to Impacts (and are not IsRoot=TRUE) will not have their severity modified.

Additional Information

Instructions on creating Notification Lists, Automatic Tools, Escalation Policies and sm_ems can be found in the found in the documentation pdf directory, which is installed with the Smarts system here:

<BASEDIR>/SAM/smarts/doc/pdf