How to make CAPC Monitoring Profiles "re-evaluate" all event rules manually.

[David Distel]

I will spare you all the background as to "why" , but it general here is my question.

 

- Once a CAPC evaluation generates an event because of a threshold violation, it will not generate another or a new event for that same Event Rule until teh evaluation has gone back below teh threshold and a Clear event is generated.

 

 What I am looking for is a way to manually force all of teh Event Rules to re-fire and generate a new event.

 I am being told by CA Support ( from CA Engineering ) that there is no way to do this.

 

 I am told the only way is to modify the create/clear parameters on a specific Event Rule , such that the new parameters will generate a Clear Event. Then modify the parameters back to the original I had set, and wait for teh re-evaluation to generate a new event for over threshold. 

 

 I have over 35 Monitoring Profiles, each profile with between 6 and 12 Event Rules each. It is unrealistic to be expected to modify every one of those Event Rules, wait for a clear, modify the rules back, and wait for an event generation.

 

 Does anyone know if ....

 Restarting the "dcmd" process on the CAPC Data Collectors (2 of them) , and "dadaemon" on the CA Data Aggregator , make everything reevaluate ?

 

Thank You

David

[Carlos Radice]

Which is your purpose to want the "re-evaluate" all events?

Does the events disappeared from CAPC Events Display or from Spectrum and you need to re-generated?

[David Distel]

1 - Some folks in our ECC ( NOC ) clear partition alerts in Spectrum ( accidentally or not ). 

2 - Since the threshold in CAPC is still Raised, CAPC will not send another alert regarding that threshold violation.

3 - I want/need to regenerate the alert in CAPC and have it passed back to Spectrum again .

 

Thanks.

[Carlos Radice]

There is no way to delete without damage the tables 

 

There is two tables on Vertica DB

List of tables
Schema | Name | Kind | Owner | Comment
--------+--------------------------------------------------+-------+--------+---------
dauser | alarm | table | dauser |
dauser | alarm_clear | table | dauser |

 

The alarm is generate on Vertica and propagated to CAPC

 

The following tables has on CAPC mysql em database:

mysql> show tables;
+-------------------------------+
| Tables_in_em |
+-------------------------------+
| data_sources |
| deleted_events_work |
| em_items |
| email_templates |
| event_consumers |
| event_identifiers |
| event_item_info |
| event_items_old |
| event_properties |
| event_property_meta |
| event_property_meta_l10n |
| event_type_meta |
| event_types |
| event_types_l10n |
| events |
| events_l10n |
| general |
| item_changes_work |
| item_grouppath_work |
| item_members |
| item_properties |
| item_property_types |
| item_types |
| item_types_l10n |
| items |
| notifications |
| performance_center_properties |
| producer_for_event_items |
| revision_info |
| snmp_profiles |
| t_tenant |
| unresolved_event_items |
| user_definitions |
+-------------------------------+

 

So to remove an Alarm it is not easy task and I would say impossible .... Sorry

[David Distel]

Carlos,

 

 Do you if doing the following will get the CAPC Monitoring Profile evaluation to be redone, and generate a new set of alerts/events for items over threshold?

1 - stop dadaemon on the DA

2 - Stop dcmd on the 2 Data Collectors

3 - Start dadaemon on the DA

4 - Start dcmd on the DCs

 

Thanks.

[Carlos Radice]

If the alerts/events already in Vertica alarm table the DA/DC restart it won't generate the events again but you can send enhancement request asking for include on CAPC Events Display the "Delete" option