Change severity of an alarm using a nas preprocessing rule

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)
• Unified Infrastructure Management for Mainframe
• CA Unified Infrastructure Management SaaS (Nimsoft / UIM)

Issue/Introduction

Customers may have various operational reasons in PROD environments for wanting to change the severity of an alarm or alarms related to alarm management processes.

You may be sending major/critical alarms to your help desk system as P1 Critical Events that page your on call personnel. For example, you may be getting sporadic major alarms from controllers that say "Failed to send set_hub to spooler (communication error)".  This is a known problem that's fixed in robot version 5.52 and it generally is not a serious condition and it seems to eventually resolve itself in most cases. You may not want to ignore the alarms in case there is a real problem so as an alternative, you want them to show up in the alarm viewer as warnings so you can see them but they don't wake people up in the middle of the night.

Environment

- NMS 5.61 or higher
- nas 3.72 or higher

Cause

- need to know how to change the severity of an alarm

- increase alarm severity

- decrease alarm severity

- Use nas Auto Operator rule or preprocessing rule

Resolution

As an example, simply add a Script under Auto Operator->Scripts and save it as "lower severity of an alarm"

---------------------------------------------
event.level = 4
event.message = "<username>" (or some message you want it to filter on)
return event
---------------------------------------------

Don't bother testing it using the green arrow (Validate and Execute script) as it won't work and it will return an error if you try to test it in the AO window.

See screen shot below for a sample pre-processing rule configuration where the Filter type is custom, and reference the script you just created. Name your rule lower severity of alarm or something similar.

Then use the nas Status window and rt-click and send a test alarm with Critical severity (level 5) and message like Test message from <username>

And you will see in the alarm sub-console window the alarm will automatically be changed to a major severity. (level 4).

(hint: In the alarm sub-console, filter on the message substring, /.*<username> or <sub-string>.*/ and Apply the filter so you can see it easily among all of your alarm messages).

If you want to increase the severity of the alarm simply set the script to increase the severity from a lower level/value.

Additional Information

Here is an additional scenario involving an alarm from the data_engine which the customer wanted to lower from Critical to Major severity.

1. Setup a nas preprocessing rule to filter on the data_engine alarm message substring:

  /.*Failed to insert QoS data into the database.*/

- which uses a custom Action (script):

-------------------------------------------------------
event.level = 4
event.message = "Failed to insert QoS data into the database, check that the database is running"
return event
-------------------------------------------------------
Send a test message via the nas Status Tab->
Failed to insert QoS data into the database, check that the database is running

...and the message should be generated and the severity successfully lowered to Major from Critical.

Note that for testing purposes, you may have to temporarily clear other fields, e.g., delete the probe field value "data_engine" since you cannot send a test message using a probe value via the nas Status GUI. Afterwards, you can repopulate the probe field value with data_engine.

2) Using wildcards for a group of common devices with changing host name.

For an example, Robot wXXXXXX1 is inactive

Configured string 

/.*Robot .* is inactive.*/ was not able to get it to work without the . after the Robot even though the test returned positive.