Alarm Clear-key

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
7 messages Options
Reply | Threaded
Open this post in threaded view
|

Alarm Clear-key

j.f.beaulieu

Hello,

 

I have a question about the alarm reduction key to automatically remove alarm from the dashboard when a new trap for an alarm resolved is received.

 

Here is my 2 event below, I do get an alarm in the dashboard for  .1.3.6.1.4.1.750.111.1  whit a varbind2 value of “3600”. But when my second event is received in the system .1.3.6.1.4.1.750.111.1 whit a varbind 2 value of “3601” it doesn’t clear the previous alarm. But the last one do get cleared of the dashboard because I have defined auto-clean="true".

 

Any idea what I can be missing here??  I am using OpenNMS 1.5.93 on Linux Debian.

 

Thanks

 

 

<event>

        <mask>

            <maskelement>

                <mename xmlns="">id</mename>

                <mevalue xmlns="">.1.3.6.1.4.1.750.111.1</mevalue>

            </maskelement>

            <maskelement>

                <mename xmlns="">generic</mename>

                <mevalue xmlns="">6</mevalue>

            </maskelement>

            <maskelement>

                <mename xmlns="">specific</mename>

                <mevalue xmlns="">2</mevalue>

            </maskelement>

            <varbind>

                 <vbnumber>2</vbnumber>

                 <vbvalue>3600</vbvalue>

            </varbind>

            <varbind>

                 <vbnumber>3</vbnumber>

                 <vbvalue>~(?s).*ontario-a.*</vbvalue>

            </varbind>

           </mask>

        <uei xmlns="">uei.opennms.org/vendor/Tektronix/traps/Spiprobealarms</uei>

        <event-label xmlns="">Tektronix SpiProbeAlarm</event-label>

        <descr xmlns="">&lt;p&gt;This trap signifies that a Spiprobe has encounter a problem .

&lt;/p&gt;

 </descr>

        <logmsg dest="logndisplay">Ontario-a Loss of Ethernet Connection</logmsg>

            <severity xmlns="">Major</severity>

        <alarm-data

        reduction-key="%uei%:%nodeid%:%operinstruct%" alarm-type="1" auto-clean="false"/>

        <operinstruct xmlns="">ontario-a-3600

       </operinstruct>

       </event>

----------------------------------------------------------------------------------------------------------------------------------

<event>

        <mask>

            <maskelement>

                <mename xmlns="">id</mename>

                <mevalue xmlns="">.1.3.6.1.4.1.750.111.1</mevalue>

            </maskelement>

            <maskelement>

                <mename xmlns="">generic</mename>

                <mevalue xmlns="">6</mevalue>

            </maskelement>

            <maskelement>

                <mename xmlns="">specific</mename>

                <mevalue xmlns="">2</mevalue>

            </maskelement>

            <varbind>

                 <vbnumber>2</vbnumber>

                 <vbvalue>3601</vbvalue>

            </varbind>

            <varbind>

                 <vbnumber>3</vbnumber>

                 <vbvalue>~(?s).*ontario-a.*</vbvalue>

            </varbind>

           </mask>

        <uei xmlns="">uei.opennms.org/vendor/Tektronix/traps/Spiprobealarms-Restored</uei>

        <event-label xmlns="">Tektronix SpiProbeAlarm</event-label>

        <descr xmlns="">&lt;p&gt;This trap signifies that a Spiprobe has recover from a problem .

&lt;/p&gt;

 </descr>

        <logmsg dest="logndisplay">Ontario-a Ethernet Connection Restored</logmsg>

        <alarm-data

        clear-uei="uei.opennms.org/vendor/Tektronix/traps/Spiprobealarms"

        clear-key="uei.opennms.org/vendor/Tektronix/traps/Spiprobealarms:%nodeid%:%operinstruct"

        reduction-key="%uei%:%nodeid%:%operinstruct%" alarm-type="2" auto-clean="true" />

 

        <severity xmlns="">Normal</severity>

       <operinstruct xmlns="">ontario-a-3600

       </operinstruct>

       </event>

 

 


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/index.php/Mailing_List_FAQ

opennms-discuss mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-discuss
Reply | Threaded
Open this post in threaded view
|

Re: Alarm Clear-key

Jeff Gehlbach
On Sep 3, 2008, at 3:41 PM, <[hidden email]> wrote:

> I have a question about the alarm reduction key to automatically  
> remove alarm from the dashboard when a new trap for an alarm  
> resolved is received.

Don't feel bad -- really smart people sometimes have difficulty  
grokking this mechanism.

> Here is my 2 event below, I do get an alarm in the dashboard for  .
> 1.3.6.1.4.1.750.111.1  whit a varbind2 value of “3600”. But when my  
> second event is received in the system .1.3.6.1.4.1.750.111.1 whit a  
> varbind 2 value of “3601” it doesn’t clear the previous alarm. But  
> the last one do get cleared of the dashboard because I have defined  
> auto-clean="true".

I think you've misunderstood the meaning of the "auto-clean"  
attribute, as well as possibly confused "clearing" with "cleaning".

Setting auto-clean="true" in an event's alarm-data annotation causes  
all old events for an alarm to be deleted from the database when a new  
event comes in that is reduced under an existing alarm.  The use case  
for this attribute is events that tend to be numerous and for which  
the alarm counter is as useful as the individual events, such as SNMP  
authenFailure traps.  So normally one sets this only on trouble (alarm-
type="1") events.  In fact, since Normal-severity resolution (alarm-
type="2") alarms are deleted periodically by an automation, setting  
auto-clean="true" on a resolution event makes no real sense.

So there's what cleaning is about.  Clearing is about automatically  
setting the severity of an alarm to "Cleared" when a resolution (alarm-
type="2") is received whose clear-key matches the reduction-key of the  
trouble (alarm-type="1") alarm.  I think you've got a pretty good  
grasp on clearing, with a couple of caveats:

1. The "clear-uei" attribute is deprecated and should not be used in  
new definitions
2. Clearing is performed by an automation, so its effect is not  
instantaneous.

Does this help?

-jeff
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/index.php/Mailing_List_FAQ

opennms-discuss mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-discuss
Reply | Threaded
Open this post in threaded view
|

Re: Alarm Clear-key

Duncan Hill
Jeff wrote:
> authenFailure traps.  So normally one sets this only on trouble (alarm-
> type="1") events.  In fact, since Normal-severity resolution (alarm-
> type="2") alarms are deleted periodically by an automation, setting
> auto-clean="true" on a resolution event makes no real sense.

> 1. The "clear-uei" attribute is deprecated and should not be used in
> new definitions

Man, I could have used that knowledge when I was writing
http://www.opennms.org/index.php/Creating_Threshold_Alarms :)  Would you
Jeff or someone else) mind checking my interpretation of how the alarm
stuff works so that that page is accurate?


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/index.php/Mailing_List_FAQ

opennms-discuss mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-discuss
Reply | Threaded
Open this post in threaded view
|

Re: Alarm Clear-key

Jeff Gehlbach
On Sep 4, 2008, at 6:50 AM, Duncan Hill wrote:

> Man, I could have used that knowledge when I was writing
> http://www.opennms.org/index.php/Creating_Threshold_Alarms :)  Would  
> you
> Jeff or someone else) mind checking my interpretation of how the alarm
> stuff works so that that page is accurate?

I made some corrections, see the page history :)

-jeff

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/index.php/Mailing_List_FAQ

opennms-discuss mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-discuss
Reply | Threaded
Open this post in threaded view
|

Re: Alarm Clear-key

Duncan Hill
> On Sep 4, 2008, at 6:50 AM, Duncan Hill wrote:
>
>> Man, I could have used that knowledge when I was writing
>> http://www.opennms.org/index.php/Creating_Threshold_Alarms :)  Would
>> you
>> Jeff or someone else) mind checking my interpretation of how the alarm
>> stuff works so that that page is accurate?
>
> I made some corrections, see the page history :)

Thank you Jeff.

On the note of bang vs colon, colon interferes with the SQL in the
Automation trigger, since the reduction key for a Windows machine will
have a reduction key value that looks like:
 org.opennms.uei:88:D:\ Label Fred
when the reductionkey is %uei%:%nodeid%:%parm[label]%

Because the logmsg field is too short, the label gets truncated,
generating a different reduction key (if I use the logmsg as the source of
the label), and thus two sets of alarms for a single threshold breach.
The SQL thus relies on a !, so that split_part(reductionkey, '!', 3) works
- using a colon would return 'D', instead of 'D:\ Label Fred'.  I didn't
find a table that listed all of the parameters in a broken-out form for an
Event, does one exist?

Alternate suggestions for a reduction key appreciated, but from what I
could tell, there's nothing else in the parameters that could be used as a
unique label.

Cheers,

Duncan


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/index.php/Mailing_List_FAQ

opennms-discuss mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-discuss
Reply | Threaded
Open this post in threaded view
|

Re: Alarm Clear-key

Jeff Gehlbach
On Sep 4, 2008, at 10:27 AM, Duncan Hill wrote:

> On the note of bang vs colon, colon interferes with the SQL in the
> Automation trigger, since the reduction key for a Windows machine will
> have a reduction key value that looks like:
> org.opennms.uei:88:D:\ Label Fred
> when the reductionkey is %uei%:%nodeid%:%parm[label]%

OK, I was concentrating on the alarm-data part and there was no  
explanation of why you had chosen to deviate from the de facto  
standard of using a colon as the reduction-key field separator.  Would  
you mind changing it back, and adding a note explaining this point?

-jeff

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/index.php/Mailing_List_FAQ

opennms-discuss mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-discuss
Reply | Threaded
Open this post in threaded view
|

Re: Alarm Clear-key

Duncan Hill
> On Sep 4, 2008, at 10:27 AM, Duncan Hill wrote:
>
>> On the note of bang vs colon, colon interferes with the SQL in the
>> Automation trigger, since the reduction key for a Windows machine will
>> have a reduction key value that looks like:
>> org.opennms.uei:88:D:\ Label Fred
>> when the reductionkey is %uei%:%nodeid%:%parm[label]%
>
> OK, I was concentrating on the alarm-data part and there was no
> explanation of why you had chosen to deviate from the de facto
> standard of using a colon as the reduction-key field separator.  Would
> you mind changing it back, and adding a note explaining this point?

All done.  Thanks for the clarifications :)  Time to bring my setup in line.


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/index.php/Mailing_List_FAQ

opennms-discuss mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-discuss