Alarm correlation with Keys

[drainuzzo]

Hello,

 

is there a way to correlate different alarms using Suppression Keys?

For example if I have a CPU alarm for the server Server1 with key 'KEY1' and a PROCESS down alarm for the Server2 with the same key 'KEY1', if a clear event occurs for the PROCESS alarm of the Server2 (and the key is 'KEY1'), it is possible to acknowledge both the CPU alarm of the Server1 and the PROCESS alarm of the Server2 with the same key in one shot?

 

Is there a way to do the same thing with SNMP TRAPS events and variables defined on different events?

 

 

There are documents i can check?

 

Thanks

[Garin Walsh]

If you have alerts with the same origin and same suppression key then they should be the same alert when it's created in my thinking. So your CPU alarm creates the alert, the process alarm increments the count and then the clear closes the one matching alert.

 

This would bear testing but this is the way I think that it works.

 

If it is not, then I think that you'd need to create an AO profile that matched the two clear messages and executed a short LUA script that located the other related alert and closed it too.

 

-Garin

[Anon Anon]

Origin is not enough, as source is also part of the equation, and I am assuming Server1 and Server2 would be two different sources in this setting.

I believe you might be able to do something with lua script and triggers, but I'm not entirely sure how it would look.

[drainuzzo]

Thank you for the answers.

 

The source are different, the idea is to correlate alarms of different Servers (snmp trap or robot alarms), but as far as I can undertstand now is not possible only with keys.

 

How I can manage the correlation with lua scripts? Should these scripts be associated to nimsoft alarm server? Does exist specific documentation to address this need?

 

 

Thanks all again