We have a requirement as mentioned below.
Few considerations before asking my actual query.
1. In our environment, we have more than 2 applications hosted on single server and configuring the log file monitoring for respective applications using eHealth AdvantEDGE View.
2. All the LogMon traps/alarms are being forwarded to Spectrum
3. We have created services to represent applications separately by adding the applicable servers as resources
Example:
1. Tomcat and MS SQL apps are hosted on server A
2. Configured log monitoring for tomcat logs and SQL server logs
3. Created two different spectrum services App-Tomcat and App-SQL and added Server A as resource for those two services
********* Actual query/requirement *********
Now, the problem is... Let us say the LogMon alarm is generated for SQL server application on the server A. As the server is part of two services, it is impacting the health of both the services App-Tomcat and App-SQL and this is misleading the SLA calculations and service health for the application for which the LogMon alarm is no longer related (i.e. App-Tomcat).
I would like to make the alarm asserted on respective service model instead of server model (i.e. from the above example, as the LogMon alarm is related to SQL Server, it should only impact the service App-SQL and alarm should be triggered on it.
We are not interested in South bound gateway as we have lot of LogMon files configured on all the servers and SBGW solution will create lot of mess in Spectrum by creating event models for each LogMon trap.
Seems, it can be achieved using event processing based on the traps. But, need guidance on this.
Please let me know the possible ways to achieve this using event codes/procedures or any other.
Regards,
Rajashekar