Allow operators to suppress alarms

[Anon Anon]

Does anyone know of a way to allow operators (end users) permanently suppress alarms?  Currently our operators need to have our Nimsoft administrators go in the suppress the messages permanently to eliminate non-actionable alarms.

 

Thanks,

 

Jay

[RobPol]

how much granularity do you want on alarm supression? If you want to supress eaxctly the alarm seen from exactly the host seen I can think of a way to approach it with lua scripting.

 

Have the ops assign the alarm to a 'Supression Users' then have a small script to look for these assignments and generate pre-filter rules based on them.

 

Of course the first probelm I see comes with things like numbers in the message. Would your script buid its ow regex replacing numbers with \d+ and of course adding other required regex fixing? Would you need a way to say supress this alarm from all hosts? The complexity could rapidly climb.

 

I think I would stick with making them invissible and regulary reviewing what had been supressed as well as the set of rules that had been built up.

 

If this sounds useful drop me a line and I can give you a hand with some test scripts

[Anon Anon]

Robin,

 

Thanks for the suggestions.  I'll have our Nimsoft Adminsitrator review your suggestion.  The issue we are trying to solve is the following.  We receive about 2000 alams per day from all the customers we are managing.  About 40% of the alarms are not actionable, so the alarm console gets cluttered with things we don't care about. 

 

We are trying to eliminate the noise and get to actionable events hitting the console.

 

Ideally we would like the operator to right click the message and turn off/supress that alert for a particular customer, so it doesn't show up on the alram console.

 

Thanks,

 

Jay  

[RobPol]

If you are looking to remove about 800 alarms per day (40% of 2000) then you should probably start with tuning the thresholds of the monitors, adding general excludes etc. It is always better not to generate alarms or to supress them at source rather than generate spurious alarms and try to clean them up in the alarm server.