DX Infrastructure Management

Expand all | Collapse all

Logmon and clearing an alarm?

Jump to Best Answer
  • 1.  Logmon and clearing an alarm?

    Posted 06-07-2017 02:03 PM

    I don't get my clear-watcher to work with my alarm-watcher.

     

    I've tried alot of different regex and suppression keys, but still can't get it to work...

     

    I want to capture if a state is in 'MediaW', and to clear that alarm if it goes in to whatever else state. Or even try to suppress it to an informational alarm.

     

    E.g

    q sess

    Sess Comm. Sess Wait Bytes Bytes Sess Platform Client Name
    Number Method State Time Sent Recvd Type
    ------- ------ ------ ------ ------- ------- ------- -------- -----------------
    297,880 Tcp/Ip Run 0 S 24.2 M 1.7 M Admin DSMAPI IBM-OC-PUL
    337,489 Tcp/Ip MediaW 0 S 25.6 M 164 Admin WinNT RESJADM
    359,315 Tcp/Ip IdleW 50 S 1.7 M 645.1 K Admin DSMAPI RESJADM
    359,332 Tcp/Ip IdleW 54 S 1.0 M 1.1 M Admin DSMAPI RESJADM
    359,589 Tcp/Ip IdleW 54 S 935.0 K 649.3 K Admin DSMAPI PDP

     

    I'm trying an alarm and clear watcher with these regex:

    Alarm:

    /(.*(Tcp\SIp)\s(MediaW).*)/

    Clear:

    /(.*(Tcp\SIp)\s(!?MediaW).*)/

     

    For this one I'm using 3 variables, and I've tried to use all of them (one at a time) as suppression key, with no luck.

    If I change the log from MediaW to IdleW, and change the severity to 'informational' on my clear watcher, it will only create a new alarm. Not suppressed.

     

    Have they changed anything in Logmon version 3.90? Or am I missing something here?



  • 2.  Re: Logmon and clearing an alarm?

    Posted 06-08-2017 11:53 AM

    So it's a little tricky because logmon works line by line. One approach is to use the format section to put all this text into one block.

     

    In your case it sounds like what you really want is a test that identifies if "q sess" does or does not contain a media wait request.

     

    One way of doing that is to run the command:

     

    echo "q sess" | dsmadmin | grep "MediaW" | wc -l

     

    This should give you a 0 if nothing is waiting for media, otherwise the number of sessions waiting for a mount.

     

    Then you could use the expected value to generate the alarm rather than the watcher message text.

     

    regexpal.com is a good on line regex evaluate. From what I can see, both your patterns would match line with MediaW in it. And neither one matches a line with IdleW in it.

     

    -Garin



  • 3.  Re: Logmon and clearing an alarm?

    Posted 06-08-2017 02:53 PM

    Hi Garin,

     

    I'm not sure what u mean here. Should I run the command with Logmon? 

     

    The only way I can monitor this is by using Logmon on the output log-file.

     

     

    Sorry, the second pattern should've been like this:      /(.*(Tcp\SIp)\s(?1MediaW).*)/

     



  • 4.  Re: Logmon and clearing an alarm?
    Best Answer

    Posted 06-08-2017 04:27 PM

    So I managed to fix this...

    The issue was that I didn't use a variable that would remain the same when the status 'MediaW' would change to something like 'IdleW'. The only thing that I know will remain is the session number, which is the first part on the line (337,489, if you look at my first post).

    So I created two new watchers:

    Alarm:

    /(.*Tcp\SIp)\s(MediaW).*/

    Clear:

    /(.*Tcp\SIp)\s(?!MediaW).*/

    And a new variable to match the first expression, which would be "337,489 Tcp/Ip".

    This is the variable I'm using for suppkey. Tada!

     

    Thank's for your help guys! I should've been more clear how I used the suppkey variables in the first post