How To: Show/Publish normal alerts from Spectrum in SOI

[Daniel Blanco]

Looking for a way to get the Normal Alerts that are published in Spectrum over into the SOI console?

These Normal Alerts are Alerts that generated after say a BGP Flap comes back online, or if the interface comes back up. SOI won't display these alerts but our NOC needs to know when these alerts occurred for device outages reports.  These alerts are very important and need a way to get them over into SOI. Has anyone done this before?

[Michael Boehm]

Normal Alerts cannot be shown on the SOI Console.

Because SOI is by design a Service Management and not a Fault Management system, it only deals with Alerts that have an impact, e.g. the Severity is not Normal.

Normal Alerts are seen as "Clear" of a previous message and as such are not visible in the Console.

The only way to make this information visible in the Console would be to give it a Severity different to Normal, for example via Event Management Policies.

But this would mean that you have "Error" Messages on the console for things which are not really "Errors" in the environment.

 

By the way:

All the "Normal" messages are brought over to the SOI System: you can see them in the Event Store.

But due to the fact that they are "normal", they are not shown on the console.

[Michael Boehm]

Addition:

If you define Event Policies to give these messages a Severity, you can avoid that these messages have impacts to Services by using the Exempt feature.

[Daniel Blanco]

Hi Michael, thank you but one question is within the Event Policies, the "Normal" alerts from Spectrum once they make it into SOI they do not contain any message summary details. That portion of the alert is empty.

 

Also someone here brought up the following scenario. What if I have a service defined and the service goes down for a split second. I blink and miss the event and the alert. How do I know that the service went down for the split second. I would want to follow up with my service provider or my database service went down, i'd need to follow up with my dba. How would a NOC be informed of the event. An event occurred that did effect my overall service then cleared but how do you determine that actually happened by just looking at the service console or the alarm console. There is no way to see that something did happen to the service w/o looking at the service history but then again I don't know which service went down then came back up.

[Michael Boehm]

Hi,

first I have to correct my previous statement for the newest Spectrum Connector (.178):

This Spectrum Connector is not sending "Normal" Alerts to clear a previous message - it is directly clearing the existing Alert, using the element ID of the Alert; e.g. the existing Alert is updated and set "inactive".

But previous versions of the Spectrum Connector as well as other Connectors (such as the SNMP Connector) use the Normal severity to clear Alerts.

 

The Message of the Clear Alert does not play a role, it can be empty.

The matching parameter is the element ID of the Alert that is on the console.

Whenever another Alert with the same element ID arrives, the existing one is updated; in the case of Severity Normal this means it is cleared.

 

 

Regarding the "missed" problem for a Service:

This is a generic problem looking at any type of console: if you miss to look for a moment, or if the refresh is slower than actions performed on the console, you do not see that anything has happened.

There are different ways to handle this case:

For Services you have reporting or the History - but as you mention correctly, this would required to look at the proper Service to see the missed outage.

It would be better to introduce a notification mechanism in case of an outage, such as opening a ticket or sending a mail.

This is normally triggering a person to act on the reported message - and if you then see that in the meantime the problem has been solved already: great.

[Jose Vicente Espinosa]

Hi Michael,

 

I have found similar situations in some of our customers. I have opened several Enhancement Requests around Alert History Queues and Alert Lookup.

 

Regards