Regex for CPU alarm

[Akash Saini]

Hi Folks,

We tried to create custom regex of below mentioned alarm. But no luck.

Average (4 samples) total cpu is now xx%, which is above the error threshold (x%).Top Processes [mcshield.exe[x]-(x%)];[SCAN64.EXE[x]-(x%

And the value of x is different on every time.

So please help me out.

Thanks in advance !

[Akash Saini]

Hi Folks 

Any one help me. 

Thanks !

[Stephen Danseglio]

Hi Akash,

Please provide the test of a few live alarm examples for testing.

Steve


------------------------------
Support Engineer
Broadcom
US
------------------------------

[Akash Saini]

Hi Stephen,

Please find the alarm details :-

x.x.x.x-apwsu01||3171773||WINDOWS||SAFIISTPF||Average (4 samples) total cpu is now 99.97%, which is above the error threshold (95%).Top Processes [mcshield.exe[2508]-(99.64%)];[SCAN64.EXE[2248]-(0.08%

xx.x.x-apwsu01||3171776||WINDOWS||SAFIISRGP||Average (4 samples) total cpu is now 96.39%, which is above the error threshold (95%).Top Processes [mcshield.exe[2408]-(97.14%)];[SCAN64.EXE[7260]-(0.19%

x.x.x.x-apepo01||3171775||WINDOWS||SAFIISTRM||Average (4 samples) total cpu is now 97.48%, which is above the error threshold (90%).Top Processes [mcshield.exe[2828]-(68.04%)];[nxlog.exe[5876]-(30.49%

Alarm not require when the top process is - Top Processes [mcshield.exe

Thanks in advance !

[Stephen Danseglio]

Perhaps something like this which uses an AND Operator but not the string/process you dont want which in this case is mcshield.

/^(?!.*mcshield.*)(.*total cpu is now.*)(.*Top Processes.*)/

You can test it by sending a few sample alarms with different Top process names via the nas Status Tab window (rt-click).

Add the regex to filter it via the IM alarm filter message field.



Steve

------------------------------
Support Engineer
Broadcom
US
------------------------------

[Akash Saini]

Thanks Stephen,

[Keith Kruepke]

I think you can get by on an even simpler regex if you'd like:

/total cpu is now .*Top Processes \[mcshield\.exe/

[Akash Saini]

Thanks Keith,

its working fine.