NAS script to generate a report of alarms that occured last night

[Anon Anon]

I've had this question pop up now and then, so I thought I should share it with the rest of you.
The attached script could be scheduled to run in the morning, giving you an email of the nightly alarm events.  Note that the check_alarm function can also be used to list alarms in the provided time-window related to the last night or whenever.

Enjoy,
Carstein

----------------------------------------------------------------------------------------------
-- Script to dump alarms that happened within a time-period e.g during last night/evening
--
recipient    = "[e-mail]"
timezone_ofs = 0
-- Uncomment for manual timezone ofset override.
-- timezone_ofs = -7200      -- GMT+2

-- This function checks if the alarm has arrived within a predefined period
--    E.g check_alarm (a,18,8)           -- will return true if alarm arrived last night
--        check_alarm (1,21,06,false)    -- will return true if alarm arrived in timewindow regardless.
--
function check_alarm(a,t1,t2,last_night)
   local d,midnight,pstart,pend

   if t1==nil then t1=0 end
   if t2==nil then t2=6 end
   if last_night==nil then last_night=true end

   if last_night then
      d = math.floor (timestamp.now() / 86400)
   else
      d = math.floor (a.arrival / 86400)  
   end

   midnight = d*86400 + timezone_ofs     -- compute 'last' midnight for alarm (adjusted with timezone)

   if t1 > t2 then
      pstart   = midnight + (t1 * 3600)
      pend     = midnight + 3600*24 + (t2 * 3600)  -- adjust till "todays" midnight
   else
      pstart   = midnight + (t1 * 3600)
      pend     = midnight + (t2 * 3600)
   end

   if a.arrival >= pstart and a.arrival <= pend then
      return true
   end

   return false
end

-- Get active alarms
al  = alarm.list()
buf = ""

for i,a in pairs(al) do

   -- auto timezone: use the first alarm with tz_offset as the timezone_ofs
   if timezone_ofs == 0 and a.tz_offset ~= nil then
      timezone_ofs = a.tz_offset
   end

   if a.level > NIML_CLEAR then
      -- check alarms between 22 and 06, last night
      if check_alarm(a,22,06) then
         buf = buf .. sprintf ("\n%s - %s %s %s %s",timestamp.format(a.arrival),a.nimid, a.hostname, a.severity, a.message)
      end
   end

end
if buf ~= "" then
   action.email (recipient,"Nightly Alarm Report",buf)
end

[Anon Anon]

Hi,

The script works fine until he comes to the part of:
if buf ~= "" then
action.email (recipient,"Nightly Alarm Report",buf)
end
The script stops at the if. I checked that the buf is not empty (I'm able to print it). When I change the condition "if buf ~= "" then" TO "if buf ~= nil then" then he is sending the mail but empty... Any ideas why this isn't working?
Thanks in advance.

Best regards,
Steven

[Anon Anon]

Try to declare the buf and al as local variables.

local al    = alarm.list()
local buf  = ""

When
you change the test as you describe ( if buf ~= nil then ) then
remember it is already declared as a blank string "", and that is
definitely not nil, hence the empty mail.

Can't really see what else is wrong with the script, could there be control-characters in your file as part of your copy ?

Can you provide an output, add the following before the test:

printf("buf: %s",buf)
if buf ~= "" then
   action.email (recipient,"Nightly Alarm Report",buf)
end

Carstein

[Anon Anon]

Hi,

The following check always reports false with each alert:

if a.arrival >= pstart and a.arrival <= pend then
return true
end
return false
end

That is why it is not inserting any alert into the buffer... Even though I'm sure different alerts occurred during the night.

Best regards,
Steven

[Anon Anon]

Hi,

 

Does this work with the current version of the nas probe?

 

I have just copied and pasted this script into the nas and while it compiles without error, I fail to receive the email and I am not seeing a log in the emailgtw.

 

If I run the example-html-email-alarms script, it works without error and I receive the email.

 

Thanks

Elise

[Anon Anon]

If I understand the script correctly, I think these lines need to be changed:

 

   if t1 > t2 then
      pstart   = midnight + (t1 * 3600)
      pend     = midnight + 3600*24 + (t2 * 3600)  -- adjust till "todays" midnight

 

And they should read as follows instead:

 

   if t1 > t2 then
      pstart   = midnight + (t1 * 3600) - 86400
      pend     = midnight + (t2 * 3600)

 

Give that a shot and see if it helps. When tesitng, make sure you have alarms in your NAS that arrived within the right time range to appear in the report.

[Anon Anon]

Would it be possible to change this script to generate a report of all alerts in the previous week?  I'm just starting LUA and do not fully understand this script enough to make changes to it.

[Anon Anon]

Hi ssakai,

 

You could, but depending on your requirements it might be simples to just create a new script. This script only fetches currently active alarms, if you'd like to report on all alarms as you said, you might want to check out alarm.history() or alarm.query(). I'll attach nas whitepaper which is very helpful.

 

Here's a quick example for looping through lastweeks alarms (notice there's a difference between last week and previous 7 days)

 

for _,alarm in pairs(alarm.history('lastweek')) do
   for alarm_property,alarm_value in pairs(alarm) do
      printf ("%s:\t%s", alarm_property, alarm_value)
   end
end

 

The script posted originally in this thread is kind of specific, if you find your's differs much, I suggest you start a new thread on it.

 

 -jon

Attachment(s)

nas-4.20.pdf   2.29 MB 1 version

[Sam Green]

I've created a new thread for the 7 day report

 

https://communities.ca.com/message/241792339#241792339

[Sam Green]

This works for me!

 

require ("library/html-alarms-lib")

 

 

recipient   = "[e-mail]"

title       = "Nimsoft - 24 Hour Alert Report"

 

 

buf = ""

buf = buf .. html_start (title)

buf = buf .. html_alarms (transactions)

buf = buf .. html_end ()

 

 

day = 60*60*24

past_day = timestamp.now() - day

past_week = timestamp.now() - 7*day

past_month = timestamp.now() - 30*day

 

 

database.open("transactionlog.db")

query = "select * from NAS_TRANSACTION_SUMMARY where created > \"" .. timestamp.format(past_day, "%Y-%m-%d %H:%M:%S") .. "\";"

data, rc = database.query(query);

 

 

email_msg = "\n"

email_msg = email_msg .. sprintf("%-25s%-25s%-20s%-40s%s\n", "created", "visibility", "origin", "host", "message")

 

 

for _, x in pairs(data) do

   closed = "open"

 

 

   if x.closed then

      closed = x.closed

   end

 

 

   email_msg = email_msg .. sprintf("%-25s%-25s%-20s%-40s%s\n",x.created, x.visible, x.origin, x.hostname, x.message) 

end

 

 

database.close()

 

 

action.email(recipient,title,buf)

 

 

--print (email_msg)

[RHENRIQUE]

Hi All,

 

It was amazing in order to keep on track the amount of alerts are being generated per day, however I would like to know if it would be possible to plot graph instead of text line. I am looking for any way to have a quickly report with Top most common alerts.

 

 

Regards,

Roberto