Display and log "event clear" with Notifier

[Christophe Houbre]

Hello,

I would like to insert in a log file, the information of the attribute that clear the alarms when alarms are cleared.

 

Example:

alarm_title;cause_code;event_clear.

 

It is possible ?

 

Regard's,

 

Chris.

 

 

[Jason Meader]

You want to see the event that generated when the alarm cleared? You should be able to do this by changing this in the <SPECROOT>/Notifier/.alarmrc from false to true and cycle the AlarmNotifier process:

 

SHOW_ALL_EVENTS=false

 

Cheers

Jay

[Christophe Houbre]

Thank Jay.

 

But how do I retrieve the value of the event that cleared the alarm ?

 

In fact, I have an alarm that can be cleared by two clear event. I would like to know which event cleared the alarm.

 

I would like to automate it with the Notifier tool.

 

Regard's,

 

Chris.

[Jason Meader]

Hi Chris,

  If you use the SHOW_ALL_EVENTS=TRUE entry, the cleared alarm will show you the event and the event code that cleared the alarm.  For example:

 

Tue 31 Oct, 2017 - 09:24:45 - User meaja05@meaja05m4700 cleared alarm number 951 with probable cause id 0x00010ff6 for device Sim22566:Test-VSS of type SwCiscoIOS. (event [0x00010706])

 

Is that what you are looking for?

Cheers

Jay

[Jason Meader]

Actually, you might not even need to use show_all_events as long as you have get_events=true and the clear event is the last event (which it usually would be) then when the alarm clear is sent through Notifier that clear event would be sent as well:

 

EventMessage:     Tue 31 Oct, 2017 - 09:30:05 - User meaja05@meaja05m4700 cleared alarm number 1124 with probable cause id 0x00010ff6 for device Sim22566:Test-VSS of type SwCiscoIOS. (event [0x00010706])

Only displaying most recent of 2 event messages.

 

Please let me know if this meets your needs or if I am misunderstanding your requirement.

Thank you

Jay

[Christophe Houbre]

Hi Jason,

 

Thank's for the answer.

 

In your example, we don't see the event clear but just the event alarm and event 0x00010706.

Indeed, it is the event 00010ff7 which clear the event alarm 00010ff6.

 

I need to have the event that clears the initial alarm.

 

With your example, I would have liked to have this info.

 

"Tue 31 Oct, 2017 - 09:24:45 - User meaja05@meaja05m4700 cleared alarm number 951 with probable cause id 0x00010ff6 for device Sim22566:Test-VSS of type SwCiscoIOS. (event [0x00010ff7])"

 

==> Probable cause id "0x00010ff6"  clear by event "0x00010ff7".

 

Cheers,

 

Chris.