Automated Emailing of Alarm History

[Sam Green]

Hi Forum,

 

Does anyone know how to send all the Critical alarms we have received within the last month via email?

 

I've been playing around with the alarm.history statement but I cant get any results..

 

This is for an Audit requirement and if I can automate this it would be perfect!

 

Thanks in advance!

[Sam Green]

Something similar to this would be good:

-- This script gives an example on using external libraries
-- and sends an email to recipent containing a list of the current open alarms
--
require ("library/html-alarms-lib")

recipient = "[e-mail]"
title = "Current Alarm Report"
transactions = 3

buf = ""
buf = buf .. html_start (title)
buf = buf .. html_alarms (transactions)
buf = buf .. html_end ()

action.email(recipient,title,buf)


But instead of "Current alarms" I'm after all historic Critical alarms..

[Anon Anon]

I might be wrong, but I don't think the historic alarms are available thru any API/SDK as such. You'd need to query the NAS_TRANSACTION_LOG/NAS_TRANSACTION_SUMMARY tables in the NimsoftSLM db.

 

How many historic alarms you'd be able to see depends on retention settings in the nas probe.

[Anon Anon]

You can query historic alarms using a Lua script in the NAS. The alarm.history() function provides summary info--one entry per alarm. If you need more details, you might have to use the alarm.transactions() function to get those. For example, the result from the alarm.history() function might just shows the last severity, which is not too helpful when most alarms have cleared before closing. If that is all you see there, you need the details from the alarm.transactions() function.

[odom]

Did you get anywhere with this Greenones? I'm looking to do something similar but limit the results to a subsystem ID or user tag. The main goal was to send an email one a day or week showing the amount of alerts that happened over that time frame for said subsys or user tag.

[Sam Green]

Im afraid not odom

Still looking for a solution myself..

[Anon Anon]

I think your best bet is going to be a direct query into the NAS_TRANSACTION_SUMMARY table in the NIS. I tried going the alarm.history() and alarm.transaction() route and it was timing out and/or crashing the NAS_Conf GUI.

[Anon Anon]

Hi,

 

I think Bryan's solution is the best. While we normally do this kind of things directly from sql reporting, here's an example how to do it with a nas script. Notice that I skipped error checking.

 

database.open("provider=nis;database=nis;driver=none")
query = "select * from NAS_TRANSACTION_SUMMARY where created >= DATEADD(MONTH, -1, GETDATE());"
data, rc = database.query(query);

email_msg = "\n"
email_msg = email_msg .. sprintf("%-20s%-20s%-20s%-40s%s\n", "created", "closed", "origin", "host", "message")

for _, x in pairs(data) do
 closed = "open"

 if x.closed then
 closed = timestamp.format(x.closed)
 end

 email_msg = email_msg .. sprintf("%-20s%-20s%-20s%-40s%s\n",timestamp.format(x.created), closed, x.origin, x.hostname, x.message)
end

database.close()

print(email_msg)

 

-jon

[Sam Green]

Looks good Jon!

 

Should I be seeing results when running your script in the NAS?

 

Screenshot attached to show you what I'm getting.

[Anon Anon]

Yes you should. It appears it's not getting any results for you. DO you have multiple nasses setup and are you running it from a nas that can access the database directly?

 

-jon

[Anon Anon]

I made an edit to the script, I had actually used "created" in "closed" column as well. Here's the same for local nas database (sqlite):

 

day = 60*60*24
past_day = timestamp.now() - day
past_week = timestamp.now() - 7*day
past_month = timestamp.now() - 30*day

database.open("transactionlog.db")
query = "select * from NAS_TRANSACTION_SUMMARY where created > \"" .. timestamp.format(past_month, "%Y-%m-%d %H:%M:%S") .. "\";"
data, rc = database.query(query);

email_msg = "\n"
email_msg = email_msg .. sprintf("%-25s%-25s%-20s%-40s%s\n", "created", "closed", "origin", "host", "message")

for _, x in pairs(data) do
   closed = "open"

   if x.closed then
      closed = x.closed
   end

   email_msg = email_msg .. sprintf("%-25s%-25s%-20s%-40s%s\n",x.created, closed, x.origin, x.hostname, x.message)  
end

database.close()

print(email_msg)

 

-jon

[Sam Green]

Hi all,

 

I ran the new script and it spent age sat on "Executing" then finally came back with "The execute request failed: communications error".

 

We only have one NAS, it's a pretty small NMS set up compared to others

[Sam Green]

I think that last script crashed out my system

 

Shortly after it timed out all my dashboards went down, connection to the DB was lost and the system became unresponsive

 

Next time I'll be testing in my test enviorment

[Anon Anon]

Most likely you're querying something that is taking over 5 minutes to return, I believe that is the default timeout of NAS scripts. 

[Anon Anon]

I believe sqlite databases only take one user at a time, so if that query runs long for you it likely blocks nas itself from access the DB, which can trickle down to dashboards etc.

 

i'd be a bit worried if the query ran that long though, but it is the reason why I prefer to query the NIS db

 

-jon

[Sam Green]

Your solution is working

 

Slightly edited:

 

require ("library/html-alarms-lib")

 

recipient   = "[e-mail]"

title       = "24 Hour Alert Report"

 

buf = ""

buf = buf .. html_start (title)

buf = buf .. html_alarms (transactions)

buf = buf .. html_end ()

 

day = 60*60*24

past_day = timestamp.now() - day

past_week = timestamp.now() - 7*day

past_month = timestamp.now() - 30*day

 

database.open("transactionlog.db")

query = "select * from NAS_TRANSACTION_SUMMARY where created > \"" .. timestamp.format(past_day, "%Y-%m-%d %H:%M:%S") .. "\";"

data, rc = database.query(query);

 

email_msg = "\n"

email_msg = email_msg .. sprintf("%-25s%-25s%-20s%-40s%s\n", "created", "visibility", "origin", "host", "message")

 

for _, x in pairs(data) do

   closed = "open"

 

   if x.closed then

      closed = x.closed

   end

 

   email_msg = email_msg .. sprintf("%-25s%-25s%-20s%-40s%s\n",x.created, x.visible, x.origin, x.hostname, x.message) 

end

 

database.close()

 

action.email(recipient,title,buf)

 

--print (email_msg)

[Sam Green]

Hi all,

 

I found this LUA script somewhere, but I cant remember where..

 

It doesnt error but doesnt deliver any emails either..

 

Could someone take a look at see if they can tell why?

 

----------------------------------------------------------------------------------------------

-- Script to dump alarms that happened within a time-period e.g during last night/evening

--

recipient    = "[e-mail]"

timezone_ofs = 0

-- Uncomment for manual timezone ofset override.

-- timezone_ofs = -7200      -- GMT+2

 

-- This function checks if the alarm has arrived within a predefined period

--    E.g check_alarm (a,18,8)           -- will return true if alarm arrived last night

--        check_alarm (1,21,06,false)    -- will return true if alarm arrived in timewindow regardless.

--

function check_alarm(a,t1,t2,last_night)

   local d,midnight,pstart,pend

 

   if t1==nil then t1=0 end

   if t2==nil then t2=6 end

   if last_night==nil then last_night=true end

 

   if last_night then

      d = math.floor (timestamp.now() / 86400)

   else

      d = math.floor (a.arrival / 86400) 

   end

 

   midnight = d*86400 + timezone_ofs     -- compute 'last' midnight for alarm (adjusted with timezone)

 

   if t1 > t2 then

      pstart   = midnight + (t1 * 3600)

      pend     = midnight + 3600*24 + (t2 * 3600)  -- adjust till "todays" midnight

   else

      pstart   = midnight + (t1 * 3600)

      pend     = midnight + (t2 * 3600)

   end

 

   if a.arrival >= pstart and a.arrival <= pend then

      return true

   end

 

   return false

end

 

-- Get active alarms

al  = alarm.list()

buf = ""

 

for i,a in pairs(al) do

 

   -- auto timezone: use the first alarm with tz_offset as the timezone_ofs

   if timezone_ofs == 0 and a.tz_offset ~= nil then

      timezone_ofs = a.tz_offset

   end

 

   if a.level > NIML_CLEAR then

      -- check alarms between 22 and 06, last night

      if check_alarm(a,22,06) then

         buf = buf .. sprintf ("\n%s - %s %s %s %s",timestamp.format(a.arrival),a.nimid, a.hostname, a.severity, a.message)

      end

   end

 

end

if buf ~= "" then

   action.email (recipient,"Nightly Alarm Report",buf)

end