Lower severity of an alarm using preprocessing rule

book

Article ID: 34685

calendar_today

Updated On:

Products

DX Infrastructure Management NIMSOFT PROBES

Issue/Introduction

Customers may have various operational reasons in PROD environments for wanting to lower the severity of an alarm or alarms related to alarm management processes.

You may be sending major/critical alarms to your help desk system as P1 Critical Events that page your on call personnel. For example, you may be getting sporadic major alarms from controllers that say "Failed to send set_hub to spooler (communication error)".  This is a known problem that's fixed in robot version 5.52 and it generally is not a serious condition and it seems to eventually resolve itself in most cases. You may not want to ignore the alarms in case there is a real problem so as an alternative, you want them to show up in the alarm viewer as warnings so you can see them but they don't wake people up in the middle of the night.

Cause

- need to lower severity of an alarm(s)

Environment

NMS 5.61 or higher
nas 3.72 or higher

Resolution

As an example, simply add a Script under Auto Operator->Scripts and save it as "lower severity of an alarm"

---------------------------------------------
event.level = 4
event.message = "steved" (or some message you want it to filter on)
return event
---------------------------------------------

Don't bother testing it using the green arrow (Validate and Execute script) as it won't work and it will return an error if you try to test it in the AO window.

See screen shot below for a sample pre-processing rule configuration where the Filter type is custom, and reference the script you just created. Name your rule lower severity of alarm or something similar.



Then use the nas Status window and rt-click and send a test alarm with Critical severity (level 5) and message like Test message from steved

And you will see in the alarm sub-console window the alarm will automatically be changed to a major severity. (level 4).

(hint: In the alarm sub-console, filter on the message /.*steved.*/ and Apply the filter so you can see it easily among your alarm message),

Additional Information

Here is an additional scenario involving a alarm from the data_engine which the customer wanted to lower from Critical to Major severity.

1. Setup a nas preprocessing rule to filter on the data_engine alarm message substring:

  /.*Failed to insert QoS data into the database.*/

- which uses a custom Action (script):

-------------------------------------------------------
event.level = 4
event.message = "Failed to insert QoS data into the database, check that the database is running"
return event
-------------------------------------------------------

Send a test message via the nas Status Tab->
Failed to insert QoS data into the database, check that the database is running

...and the message should be generated and the severity successfully lowered to Major from Critical.

Note that for testing purposes, you may have to temporarily clear other fields, e.g., delete the probe field value "data_engine" since you cannot send a test message using a probe value. Afterwards, you can repopulate the probe field value with data_engine.

Attachments

1558693456445000034685_sktwi1f5rjvs16hca.jpeg get_app
1558693454661000034685_sktwi1f5rjvs16hc9.jpeg get_app