nas - after alarmreception wait for 12h till next one

[Matthias Gruber]

Hi!

 

Just starring in my nas, and I didnt see it how to get it running.

 

The Job is the following: I parse a logfile, if some special line appears, a alarm should be send (not the trouble), but after sending this one, despite how many alarms occur (the same line appears), no one should appear + send mails/sms-Stuff till 12h are over.

overdue 12h wouldnt it be, because the first alarm would occur 12h later, but on first occurance th alarm should be send (mail/sms) and after that silence till 12h are over.

 

I am thinking of something with trigger and some automatic ack if 12h are over...but not sure...

 

Has anybody build something like that before ?

 

cheers

Matthias

 

P.S. Perhaps it is so simple that I can see it ;-)

[Matthias Gruber]

Hi!

 

Hmm propably I have a solution, but not tested that...

 

Line appears

 - Trigger is set in nas

 - AO Rule "On Trigger" fires the alarm

 - AO Rule "on Overdue 12h" -> action type "close Alarm

 - Trigger gone, because alarm was removed

 

Could that work or is there a more simple method, looks a bit fiddly ?

 

cheers

Matthias

[Matthias Gruber]

Hi!

 

Yes... that works, well some flash of wit is sometimes helpfull, but nevertheless if there is some easier solution I  would appreciate this.

 

cheers

Matthias

[Anon Anon]

Matthias,

 

Can you explain why simply closing the alarm on overdue age of 12 hours would not be sufficient?  I do not see why you need the trigger right now, so I think I am missing something...

 

Thanks,

Keith

[Matthias Gruber]

Hi Keith,

 

I'll try to do the following

 

logfileparsing on some words, e.g. the word "Dummy".

 

 

14:30 - Logmon hits, and found "Dummy" in the monitored file, a alarm incl. email+sms should occur

14:56 - Logmon hits, and found "Dummy" in the monitored file, nothing should happen

19:23 - Logmon hits, and found "Dummy" in the monitored file, nothing should happen :-)

02:44 - Logmon hits, and found "Dummy" in the monitored file, a alarm incl. email+sms should occur

 

I have to make sure, that on first occurence a alarm inkl. mail+sms should be sended, after this first alarm nothing else till 12h are gone.

Hmm could do a AO which hits on the first occurence and the rely on the default messagesupresson and a close on 12h overdue, hmm... but same amount on AO-Profiles :->, and nobody cares about the count on this alarm and no QoS on it

 

cheers

Matthias

[Anon Anon]

That is exactly what I was thinking. You can send an email when the alarm first gets created and then auto-close the alarm 12 hours later so that a new one can be created and a new email sent when the log message apears again. I do not think you need a trigger in this case.

 

-Keith

[Matthias Gruber]

Hmm...

I'll check that tomorrow... yes sounds better, than the trigger-solution

 

cheers

Matthias

[Matthias Gruber]

Hi Keith,

 

just tested your suggestion... yes... works, no need for my triggers :-), just have faith on DupMessage-Find of the nas.

 

cheers

Matthias

 

 

[Anon Anon]

For alarms from the logmon probe, you do not need to have faith in suppression. You can set the suppression key yourself for each watcher in the logmon GUI, which allows you make several the same if that is what you need.

 

-Keith