Highlighted
Super Contributor.. steven.m.weber Super Contributor..
Super Contributor..
363 views

Excluding Maintenance Window in a Report

Jump to solution

We currently have a report that returns data over a week and need to exclude any events generated during two maintenance windows at different points during the week. One is Saturday night from 2200 - 0300, the other Sunday night from 2300-0300

How would I go about making that exclusion?

I have tried unsuccessfully to create a filter with global variables to define the maintenance windows using variables (GetHour and GetDayOfWeek), but they do not seem to be working as intended.

Any assistance would be greatly appreciated!

Thanks,

Steve

Labels (1)
0 Likes
1 Solution

Accepted Solutions
rkent1 Acclaimed Contributor.
Acclaimed Contributor.

Re: Excluding Maintenance Window in a Report

Jump to solution

These types of rules require that all your relevant event source be properly time-synced (preferably NTP) and that the proper event fields are parsed and normalized (timezone) by the connector. In my experience, it's not rocket science, but it's harder than people initially think it is.

Once you've got that done, set up a proper testing scenario for your filters.Create two active channels that use the filters to get just the relevant events displayed: one without the maintenance window filter, and the other with. You should now be able to do a clear cut side by side comparison of which events are matching your filters and which ones are not.


Also, which version are you running? I remember there was the bug with the GetHour function in ESM 6.5 that was supposed to be patched in SP1 -> https://protect724.hp.com/message/42766#42766


This is supposed to be fixed in ESM 6.5 SP1, according to the release notes:

Issue

Description

NGS-8579 NGS-7906

In a Query, the GetHour variable returned the hour translated from local time to GMT. For example, if your local time is 20:31:47, the GetHour variable might return 3, instead of 20, as expected. This is now fixed.


View solution in original post

0 Likes
7 Replies
rkent1 Acclaimed Contributor.
Acclaimed Contributor.

Re: Excluding Maintenance Window in a Report

Jump to solution

These types of rules require that all your relevant event source be properly time-synced (preferably NTP) and that the proper event fields are parsed and normalized (timezone) by the connector. In my experience, it's not rocket science, but it's harder than people initially think it is.

Once you've got that done, set up a proper testing scenario for your filters.Create two active channels that use the filters to get just the relevant events displayed: one without the maintenance window filter, and the other with. You should now be able to do a clear cut side by side comparison of which events are matching your filters and which ones are not.


Also, which version are you running? I remember there was the bug with the GetHour function in ESM 6.5 that was supposed to be patched in SP1 -> https://protect724.hp.com/message/42766#42766


This is supposed to be fixed in ESM 6.5 SP1, according to the release notes:

Issue

Description

NGS-8579 NGS-7906

In a Query, the GetHour variable returned the hour translated from local time to GMT. For example, if your local time is 20:31:47, the GetHour variable might return 3, instead of 20, as expected. This is now fixed.


View solution in original post

0 Likes
Super Contributor.. steven.m.weber Super Contributor..
Super Contributor..

Re: Excluding Maintenance Window in a Report

Jump to solution

Thank you for your reply!

We're running 6.1 currently.

One thing I noticed when inspecting the events is that across the different time zone fields (Agent Time Zone, Device Time Zone, etc.) there is an inconsistency: some fields show "US/Eastern", while others show "America/New_York".

Now, you and I both know those are the same time zone, but it does seem odd that there seems to be two different values for the same thing.

I'm issue I'm running into now is when I build a local variable, let's call it "MaintWindowDayOfWeek", to get the day of the week [ get_day_of_week(Device Receipt Time, Default Time Zone) ] and use that local variable in the active channel I built it on ( MaintWindowDayOfWeek = Sunday ) it will not show me only events from Sunday. It also shows events from Saturday, as early as 20:03.  I enabled the Device Receipt Time column and added the variable to the field set in the active channel and it definitely shows events from July 4th (MRT, ET and DRT are all 4 Jul) and the variable column shows Saturday!

Very frustrating, to say the least!

Thanks again,

Steve

0 Likes
Super Contributor.. steven.m.weber Super Contributor..
Super Contributor..

Re: Excluding Maintenance Window in a Report

Jump to solution

I contacted support and there was an issue with my version of ESM where the getHour function was using GMT instead of local time. This was addressed in a patch which fixed the issue.

0 Likes
rkent1 Acclaimed Contributor.
Acclaimed Contributor.

Re: Excluding Maintenance Window in a Report

Jump to solution

Hi Steven,

Is that the same bug I notified you of above?

-> https://protect724.hp.com/message/42766#42766

0 Likes
Super Contributor.. steven.m.weber Super Contributor..
Super Contributor..

Re: Excluding Maintenance Window in a Report

Jump to solution

Yes, it was! Thanks for your help!

0 Likes
rkent1 Acclaimed Contributor.
Acclaimed Contributor.

Re: Excluding Maintenance Window in a Report

Jump to solution

Great, if it wasn't then I'd really be worried! Just a heads up that there's this new page created by the P724 Admins to help keep track of outstanding bugs:

I'd highly recommend following that page to stay up to date

0 Likes
saurabh_kulkarn Absent Member.
Absent Member.

Re: Excluding Maintenance Window in a Report

Jump to solution

Hi Steven and Richard,

  I have similar queries regarding the maintenance windows. I am not able to make the maintenance window. For instance, I wish to create a maintenance time windows for each day a week and for a certain time (like, 00.00 -- 01.00). I also used GetDayoftheWeek as a local variable. But, how do I match with Event's end time with my AL's Endtime (maintenance_endtime)?

    Can you please help me with this?

Kind Regards,

Saurabh Kulkarni.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.