NAS - Identifying alarms blocked by pre-processing rules in logs

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

When a NAS pre-processing rule is configured to exclude or filter alarms, it may be necessary to verify that the rule is triggering correctly.

Or, if an alarm is unexpectedly not arriving at the NAS, it may be necessary to determine if a pre-processing rule is excluding it.

This article describes how to identify alarm exclusions within the NAS probe logs.

Symptoms

• A pre-processing rule is created but the expected alarms still appear in the console.
• Verification is needed to ensure a specific regex or filter is matching the incoming alarms.
• Uncertainty regarding whether an alarm was blocked by a rule or never reached the NAS probe.

Environment

DX Unified Infrastructure Management (All Versions)
nas probe (all versions)

Resolution

To identify if an alarm is successfully blocked, review the nas.log file using the following steps:

1. Open the nas probe configuration in Infrastructure Manager or Admin Console.
2. Increase the Log Level to 5 and the Log Size to at least 10000 to ensure sufficient detail is captured.
3. Locate the nas.log file in the probes/service/nas directory of the UIM installation.
4. Search the log for the string EXCLUDED BY RULE. A successful exclusion will appear in a format similar to the example below:

 

Aug 05 10:28:05:152 [139942684505664] 1 nas: EXCLUDED BY RULE '<rule name>' - msg:<alarm message>,src:##.##.##.##,sev:5

Breakdown
EXCLUDED BY RULE: indicates that a pre-processor "exclude" rule matched the alarm
<rule name>: the name of the rule that matched
<alarm message>: the actual text of the alarm that was blocked
src: the Source IP address of the host that generated the alarm
sev: the severity level of the blocked alarm (1-5)

 

Additional Information

If you still see the alarm in the console and do not see a corresponding EXCLUDED BY RULE entry in the log for that timestamp, a rule did not match. Common reasons include regex syntax errors, case-sensitivity issues in the source/message fields, or alarms being queued or active before the rule was implemented.