DX Infrastructure Manager

  • 1.  Multiple alarms to one alarm?

    Posted 04-29-2019 01:37 PM

    Example A: Splunk can look for "Event A" across multiple hosts and if this event is found on more than one host within a time range, one alert notification is generated to the business unit.

     

    Example B: UIM logmon or ntevl for example are deployed to multiple hosts and configured to monitor for "Event A", when found a unique alert is generated for each and every host for which "Event A" was found on.  Problem: unable to combine those alerts and generate one alarm in their place.

     

    Is there a way to combine alarms into one alarm?  I don't see a way in UIM to do this based on how alarms are generated and processed.  I may not have thought of all UIM's capabilities. Maybe there is a another CA/Broadcom product that can do this? 

     

    At this time I think my only option in this situation is to allow Splunk to perform this task and generate a single alarm to UIM through an SNMP integration.

     

    Thoughts?



  • 2.  Re: Multiple alarms to one alarm?

    Broadcom Employee
    Posted 04-29-2019 01:55 PM

    Outside of Splunk, you should be able to do this via nas triggers and create a new (single) alarm.



  • 3.  Re: Multiple alarms to one alarm?

    Posted 04-29-2019 02:24 PM

    I could add a trigger for each host.  The concern I have is my AO trigger options are AND or OR and do not include a time range.

     

    - AND meaning all Selected Triggers must match.  This would mean triggers for all 20 hosts would need to match.

    - OR meaning any one of the Selected Triggers must match.  This would mean only one host needs to match.  There appears to be no time range option to limit this from triggering for every individual alarm that comes in for example 1m apart.



  • 4.  Re: Multiple alarms to one alarm?

    Broadcom Employee
    Posted 04-29-2019 04:00 PM

    Despite whether or not the trigger(s) may fire, you do have some control over when a new alarm can be generated by using a defined operating period or schedule (by time).



  • 5.  Re: Multiple alarms to one alarm?



  • 6.  Re: Multiple alarms to one alarm?

    Posted 04-29-2019 03:39 PM

    Alarms are coming from probes not traps.  But they still go to Spectrum from UIM, true the correlation engine in Spectrum could still be used.



  • 7.  Re: Multiple alarms to one alarm?

    Posted 04-29-2019 03:48 PM

    Been a long time since I used Spectrum correlations, I don't recall it having a time range option. I'll have to dig back into it.  I may still run into an issue with alarms within a time-range.  That's the caveat that Splunk is better at due to the collect, centrally store, then periodically analyze method of operating.