Just starring in my nas, and I didnt see it how to get it running.
The Job is the following: I parse a logfile, if some special line appears, a alarm should be send (not the trouble), but after sending this one, despite how many alarms occur (the same line appears), no one should appear + send mails/sms-Stuff till 12h are over.
overdue 12h wouldnt it be, because the first alarm would occur 12h later, but on first occurance th alarm should be send (mail/sms) and after that silence till 12h are over.
I am thinking of something with trigger and some automatic ack if 12h are over...but not sure...
Has anybody build something like that before ?
P.S. Perhaps it is so simple that I can see it ;-)
Hmm propably I have a solution, but not tested that...
- Trigger is set in nas
- AO Rule "On Trigger" fires the alarm
- AO Rule "on Overdue 12h" -> action type "close Alarm
- Trigger gone, because alarm was removed
Could that work or is there a more simple method, looks a bit fiddly ?
Yes... that works, well some flash of wit is sometimes helpfull, but nevertheless if there is some easier solution I would appreciate this.
Can you explain why simply closing the alarm on overdue age of 12 hours would not be sufficient? I do not see why you need the trigger right now, so I think I am missing something...
I'll try to do the following
logfileparsing on some words, e.g. the word "Dummy".
14:30 - Logmon hits, and found "Dummy" in the monitored file, a alarm incl. email+sms should occur
14:56 - Logmon hits, and found "Dummy" in the monitored file, nothing should happen
19:23 - Logmon hits, and found "Dummy" in the monitored file, nothing should happen :-)
02:44 - Logmon hits, and found "Dummy" in the monitored file, a alarm incl. email+sms should occur
I have to make sure, that on first occurence a alarm inkl. mail+sms should be sended, after this first alarm nothing else till 12h are gone.
Hmm could do a AO which hits on the first occurence and the rely on the default messagesupresson and a close on 12h overdue, hmm... but same amount on AO-Profiles :->, and nobody cares about the count on this alarm and no QoS on it
That is exactly what I was thinking. You can send an email when the alarm first gets created and then auto-close the alarm 12 hours later so that a new one can be created and a new email sent when the log message apears again. I do not think you need a trigger in this case.
I'll check that tomorrow... yes sounds better, than the trigger-solution
just tested your suggestion... yes... works, no need for my triggers :-), just have faith on DupMessage-Find of the nas.
For alarms from the logmon probe, you do not need to have faith in suppression. You can set the suppression key yourself for each watcher in the logmon GUI, which allows you make several the same if that is what you need.