Anonymous_User Absent Member.
Absent Member.
376 views

Custom Automation Filter


Hello!
Since I know how to send emails from NOC, now another task appears -
how to filter alarms in order to not send emails every time I restart
BDI adapter, or every time when BDI adapter performs scheduled queries.
For example, I want to send an email once, when critical alarm on this
element appears for the first time. But if I set automation filter
"Critical alarm opened" or "Element in critical condition" - emails are
being sent every 3 min as it is scheduled in BDI. Don't know why, every
time I restart BDI adapter the ID alarm column in Alarms view is updated
as if it were a new alarm. Consequently it is impossible to track alarm
history. That is why NOC considers that new critial alarm is opened and
sends email in response, and overflows my mailbox with the same
alarms...

So I have a couple questions:
1. how to configure BDI adapter in order to enable alarm history, so
that it would keep alarm ID for the element and not change it whenever I
restart the adapter? I have a key property "status_id" taken from
database, but Alarm ID column in Alarms view doesn't match it. Why?
2. how to create an automation filter, which would filter in elements
being in CRITICAL condition for the last 10 min? I mean, to send emails
only if the element unavailable more than 10 min in order to inform
Service Desk? I found out in Monitoring Guide that it is possible to
define custom filters. I'd like to define a rule that time of condition
change should be less or equal to (CurrentTimestamp-10 min), but I
haven't found how to do it.

Thank you in advance,
Elena


--
SmiLena
------------------------------------------------------------------------
SmiLena's Profile: http://forums.novell.com/member.php?userid=109527
View this thread: http://forums.novell.com/showthread.php?t=449329

Labels (1)
0 Likes
4 Replies
Anonymous_User Absent Member.
Absent Member.

Re: Custom Automation Filter


There are a couple of response for this thread.

1) Yes, if BDI is set up to re-query, all alarms will be considered
"new" every time they come in. (more on this in a minute). You should
look in the Data Integrator guide at the "Delta query". This is a way
that you can do a full query on startup and then only look for
updates/new rows on the re-query. This should be good for performance
of the adapter, the volume of network traffic, the strain on the
database, etc.

2) Since there are potentially many adapters that can be configured, we
need a way to have an "id" for an alarm that we are sure is unique
across all adapters, we manage that id'ing. You as the administrator
of the Data Integrator adapter have control over a "key" which is more
an id within that instance for the alarm for update purposes. This key
is not used as the global "id".

3) For these types of filters, the Services folks typically find a way
to store off either a list of status_id's or if they are sequencial,
just the last status_id. As emails are sent, the current id is written
out to a property file, that way if the server is restarted, your
automation script knows where it left off when the system fully
restarts. The other option is to have a field on the alarm that you
issue a sql update on the fly to stamp it as "emailed" or something like
that. You can also add that to the alarm columns so users can see.

There are several options, unfortunately you need to dream up the
solution and then write it. Let me know if you have more questions.


--
tisenberg
------------------------------------------------------------------------
tisenberg's Profile: http://forums.novell.com/member.php?userid=56548
View this thread: http://forums.novell.com/showthread.php?t=449329

0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: Custom Automation Filter


Thank you for such a detailed response.
Delta queries are very useful for performance and database size, but
they didn't solve the problem of sending multiple emails...

I think I found a solution. I defined LastAlarmUpdate property witn
LastStatusChange time taken from datasource so that Date\Time alarm
column is now showing the real time, when condition had changed to
critical. The only thing left is to make the automation filter out
alarms with too "old" Date\Time columns. In this case, a new email won't
be sent even if I restart the adapter, because LastStatusChange time
remains unmodifyed in the source database.

I found an option shown at the link below, that provides creating
custom rules for alarm filters.
It's possible to filter by Date\Time column there (exactly what I
need), the only question is - what should I write in place of <Value>?
I need something like "now-10min", but I can't find correct syntax for
this field...

http://s017.radikal.ru/i417/1112/cc/05dfa515e785.png


--
SmiLena
------------------------------------------------------------------------
SmiLena's Profile: http://forums.novell.com/member.php?userid=109527
View this thread: http://forums.novell.com/showthread.php?t=449329

0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: Custom Automation Filter


I'm not sure it supports that type of feature, I'm sorry, but you should
contact support to see what the field options are.

If the adapter has a hierarchyfile (IE: alarm queries and generators
for elements), another option is to put a java script test tag in place
that examines the alarms and puts additional fields on the alarm. IE:
check a date and stamp it... not sure, just an generic idea.


--
tisenberg
------------------------------------------------------------------------
tisenberg's Profile: http://forums.novell.com/member.php?userid=56548
View this thread: http://forums.novell.com/showthread.php?t=449329

0 Likes
Anonymous_User Absent Member.
Absent Member.

Re: Custom Automation Filter


Well, I'll contact support.
By the way, aren't you planning to develop an adapter for CA Service
Desk?


--
SmiLena
------------------------------------------------------------------------
SmiLena's Profile: http://forums.novell.com/member.php?userid=109527
View this thread: http://forums.novell.com/showthread.php?t=449329

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.