Identification of email notification with respect to alarm

[Purneswara Rao Konda]

Hello folks,
I come up with new thread that How do I check email notification is sent for particular alarm in UIM 20.3.3? Ex. there are 3 critical alarms are raised and for each alarms, 3 email notifications was sent so in this case how I know that 3 emails was trigger for which alarm?

I have gone through the nas probe options like Audit log in the status tab but I didn't find any information. If any one knows kindly share the inputs.

------------------------------
Regards,

Eshwar
------------------------------

[Olympia Sett]

For UIM  Email communication
========================
NAS and Email gateway probe needed.

In nas we configure the alert based email action profile , and email gateway probe send the  email notification . So check debug log from email gateway probe side  , you may receive some clue .

Thanks
Olympia

[Purneswara Rao Konda]

Thanks for your response Olympia.
Is there no other way to check because it's tedious task to check in email gateway logs for each and every notification. Can't we get information from database or OOTB reports or from IM other than logs?

------------------------------
Regards,

Eshwar
------------------------------

[Guillaume Briere]

Hello,
Yes there's another way. 
If you look under the "scripts" tab of the NAS probe there's an example for HTML email

What you can do is to create a script that will send an email and add a note to the alarm or inside a custom_ field that an email has been sent

You create an auto-operator profile that will run your script and you add the recipient as a script parameter


You will have the information directly inside the alarm.

Thanks

[Garin Walsh]

This is very much a proverbial rabbit hole scenario.

If you don't trust the monitoring system to send an email when it's supposed to then what makes you think that it's OK to trust the same system to tell you that it failed to send the email?

You can't.

Email is also not a guaranteed delivery system - so where do you stop checking that the "email was sent"? Do you stop if emailgw processed successfully? Or do you stop at your local SMTP server? Or any one of the possibly many intermediate SMTP/other mail format systems? Or do you check the recipient's email reading client? There are really too many hops in the whole process to be sure a given message "was sent".

But taking a step backwards from that, you can work from the assumption that the monitoring process works 100% of the time and then monitor for failures from pieces of the system. Unfortunately that relies on knowing what the failures look like. I'd suggest watching the nas and emailgw logs to begin with. Likely you'll need to run them at log level 3 or higher to get info on the successes and failures.

For something like sending an email in response to an event one has to rely on having a failure scenario to test for otherwise you don't know what it's going to look like.

With your example of an alert being created and no email sent, you have to know what the failure looks like otherwise you have nowhere to start. Consider the scenario where the alert comes in, nas detects it, puts a success record in the log and records a success in the events database table but the email submission fails. Where do you look to figure out that happened? Or consider that an alert arrives and nas misses doing anything - what's the trigger you use to go looking to see if the email sending failed?

It's a much bigger problem to tackle than it would appear.

[Guillaume Briere]

They should start by monitoring their smtp server for error.