nas rule > Post Processing close after x day Time Received

[Daniel Blanco]

Hello,
So I wanted to ask is there a way to configure a nas > Auto-Operator > Profiles rule such that it will close the alert(s) matching criteria when the last "Time Received" is older than say 3 days. I only see "On overdue age" which from the help docs say goes by when the alert was created [Time Origin].

I want to close the alert(s) when the last [Time Received] was more then say 3 days old. (ntevl, logmon) alerts since they don't auto-clear.

Is there a way to do this?

------------------------------
Daniel Blanco
Enterprise Tools Team Architect
[e-mail]
------------------------------

[David Michel]

time received isn't even in the database. 
you may be forced to use the out of the box "On overdue age". 

------------------------------
Support Engineer
Broadcom
------------------------------

[James Christensen]

Hi Daniel,
To accomplish this, you will likely need to use a LUA script that is executed on a schedule. You can use the alarm.list() to get a filtered list of alarms (see the nas probe documentation).

alarm.list ( [Field, Value [, Value…]] )

Returns an array of table elements containing alarm data. Will, if used with the field and value(s) parameters, filter the result set according to the user criteria. Use the column name for your field and one or more match strings. The 

%

 is used as the wildcard character. E.g alarm.list ("hostname","%xp%") returns alarms for all hostnames with 'xp' in them. These records are extracted from the NAS_ALARMS table.

The table structure of each alarm returned has multiple timestamps that you can evaluate. When you find one that matches up with the age you want, use the action.close(<nimid>) function.
The nas-4.20.pdf document contains more information regarding LUA functions and table structures and constants for creating scripts.

------------------------------
[Designation]
[City]
------------------------------

Attachment(s)

nas-4.20.pdf   2.47 MB 1 version

[Luc Christiaens]

Example LUA script we use, manually from the NAS GUI, when we need to acknowledge a huge amount of alarms.
In the script you can test on message, probe or time

Attachment(s)

alarm_close_msg_match.txt   1 KB 1 version

[Garin Walsh]

As an aside I've seen alarm.list behave somewhat unpredictably at times - most notably it sometimes returns all alarms and sometimes returns only a limit of 500. I think that maybe there's a timeout in the code somewhere that might get tripped to change the behavior, but regardless, you need to loop on calling alarm.list until you know you have seen all the records.

Also there's a poorly documented feature where you can use the "where" feature like this:

alarm1=alarm.list("where","origin = '" .. origin .. "' and supp_key = '" .. supp .. "'")

This allows you to do some complex things using the SQLite where syntax and save yourself from having to do it in your code. And if you have many alarms but only care about a small set of them, using the where clause is much faster than transferring the data to Lua and then processing.

[Daniel Blanco]

Thanks everyone for the suggestions.. Will try them out.

------------------------------
Daniel Blanco
Enterprise Tools Team Architect
[e-mail]
------------------------------