event message in email alert

[roopeshs]

Hi

 

We have customized an event id (c40033) which is common for all “disk threshold exceed alarms” so that we can have a separate alert title for Memory and Hard disk drives. And we are successful in that by generating 2 events in Alarm console where 1 alarm shows tittle as “memory threshold exceeded” (whenever RAM memory alarms event triggers) and the other event shows “Disk volume threshold exceeded “(whenever a threshold breaches for all other server logical drives).  But when we are checking the email alerts we are not getting event message printed on it instead its shows as below;

EventMessage:     Wed 26 Jul, 2017 - 22:34:55 - An event occurred for model 'server.com' of type 'Host_Device' for which no event format file exists. (event [0xfff00002])

Here in this above email alert we can not see what is the current utilization of the drive and what is the threshold set for it and most of our clients defends on email alerts. If we see the alarm console it shows all the information with proper event message.

Can someone please help us on this so that we can  get the email alerts with proper event message printed on it as below (where it shows the current utilization and the threshold) as how it used to come before we modified this event id;

 EventMessage:     Tue 25 Jul, 2017 - 18:19:17 The disk 'physical memory' also known as 'Physical Memory' has exceeded the maximum utilization threshold of 90 Percent.  Utilization at the time of this event was    90 Percent.  This disk is being monitored by model BRSAOVM04.hrbl.net.  This is a CRITICAL event.  Host_Compaq (name - SERVER.com). - (event [0x00c40033])

 

[Glenn Shoemake]

Hi Roopesh,

 

The first place to check would be to make sure that you have an Event Format Message for Event 0xfff00002 in the Event Configuration GUI.

 

 

You can copy and paste from the original event that you are borrowing this from 0x00c40033:

 

 

Once this has been completed and you have filled out the Probable Cause, Symptoms, Recommended Actions ,etc.. you will need to save from the GUI by clicking on the floppy disk icon in the top left hand corner.

 

Since the Event Format Files and Pcause files are on the OneClick server, you will need to click on Update Event and Alert files from the OneClick Admin Console and click reload.

 

 

After this any new events / alarms will have the updated Event Message in OneClick.

 

***Please Note as you are using AlarmNotifier for the email alerts you will need to copy to your SpectroSERVER as per the documentation****

 

If you are running multiple OneClick web servers, copy the folders containing the event format files and the probable cause files to the other OneClick servers in your distributed environment. Copy the following folders:

$SPECROOT/custom/Events/CsEvFormat

$SPECROOT/custom/Events/CsPCause

Also copy the contents of these same directories to $SPECROOT/SG-Support on all of the SpectroSERVERs in your environment in the following circumstances:

• Use the command-line interface (CLI) commands showalarms or showevents.
• Use CA Spectrum Alarm Notification Manager (SANM) with AlarmNotifier.

 

Further info here:

 

https://docops.ca.com/ca-spectrum/10-2-1/en/managing-network/event-configuration/getting-started-with-event-configuration

 

 

***** End of Documentation *****

 

 

On the SpectroSERVER there are 3 possible locations where Pcause/EvFormat files may be stored are:

 

$SPECROOT/SG-Support/CsEvFormat

$SPECROOT/SG-Support/CsPCause

 

$SPECROOT/Custom/event/CsEvFormat

$SPECROOT/Custom/event/CsPCause

 

$SPECROOT/Custom/CsEvFormat 

$SPECROOT/Custom/CsPCause

 

And although the docs mention: 

 

 

If you use the Command Line Interface (CLI) commands show alarms or show events, or SPECTRUM Alarm Notification Manager (SANM), then you will want to copy the contents of these three directories to all SpectroSERVERs in <$SPECROOT>/SG-Support.

 

However due to the risk of custom files getting overwritten they should be placed into one of the two custom directories mentioned previously.

 

In checking further it doesn't matter if your custom PCause files from OneClick are in $SPECROOT/Custom/event/CsPCause or $SPECROOT/Custom/CsPCause as Alarm Notifier searches all three of these locations.

[roopeshs]

Hi Glenn,

 

thanks for you response.. But here the problem is with the email alerts where we are not getting the event message printed on it but  in one click alarm console its showing perfectly fine. 

 

please refer below pictures;

 

Oneclick Console where the Event Message is properly shown (circled in red line below) where it shows the current utilization and the threshold set.

 

Email Alert where the event message is not showing any information about threshold and current utilization

 

 

What all we need is we want to print event message in email alerts same way which is shown in oneclick console . Can you please help on this?

 

regards

[Glenn Shoemake]

Hi Roopesh,

 

This is because the OneClick only files CsEvFormat and CsPCause do not exist on the SpectroSERVER (or server) where the Alarm Notifier is running on.

Please ensure that these files are copied from the OneClick server to one of the three locations mentioned above and then restart alarm notifier and the problem should be resolved.

 

Best regards,

Glenn