hi Steve,
the task you are having can be attacked in several ways, both with
SingleWith2Thresholds and EventGroup rule. After reading your mail, I had
two different approaches in mind for those two rule types, but the one with
SingleWith2Thresholds is probably simpler and easier to understand. This is
probably because the problem description matches this rule type most
closely, and if SingleWith2Thresholds would support the 'count' field as
EventGroup does, setting up the solution would be straightforward.
Fortunately, though, the missing functionality can be easily added by
employing additional Single rule which is connected to the main rule with
the help of a context. Here is the ruleset that should address the task:
type=Single
continue=TakeNext
ptype=RegExp
pattern=linkDown: device (\w+) interface (\w+)
context=!LINKDOWN_DEVICE_$1_INTERFACE_$2
desc=Device $1 interface $2 down
action=write - %s
type=SingleWith2Thresholds
ptype=RegExp
pattern=linkDown: device (\w+) interface (\w+)
desc=Four linkDown events for device $1 interface $2
action=create LINKDOWN_DEVICE_$1_INTERFACE_$2
thresh=4
window=600
desc2=No linkDown events for device $1 interface $2 during 15 minutes
action2=delete LINKDOWN_DEVICE_$1_INTERFACE_$2
thresh2=0
window2=900
The Single rule that comes before SingleWith2Thresholds provides alerts for
linkDown events, as long as LINKDOWN_DEVICE_ context does not exist for a
given device and interface pair. Since this context is
(1) created when four events have been seen in 10 minutes for the given
device-interface pair, and
(2) deleted when no events have been seen in 15 minutes for the given
device-interface pair,
it ensures we will get alerts for four linkDown events and the following
ones will be ignored, until there is a 15 minute event-free time slot.
To make things more bulletproof, a fixed lifetime might be introduced to
LINKDOWN_EVENTS_ contexts, since otherwise they are only deleted by
counting operations started with SIngleWith2Thresholds rule. If at some
point SEC receives a signal which drops running operations from memory,
some contexts might become orphaned and will exist forever. Having a
lifetime of, say, 12 or 24 hours will ensure that each context will
eventually be dropped. Of course, this will recreate alerts for interfaces
which see many linkDown alerts over long periods of time.
hope this helps,
risto
2013/9/11 Steve Amren <[email protected]>
> Greetings!
>
> I have been banging my head against the wall for a few weeks now
> trying to figure out how to create a SEC rule (or set of rules) that
> will alert on the first four occurrences of an event within a 10
> minute period, suppress alerting for additional matching occurrences
> and then resume normal alerting after no occurrences are seen for 15
> minutes.
>
> Basically, I have SEC monitoring a log file which receives translated
> SNMP traps which are output by an NMS application. These traps are
> received from various network devices. The problem is that we often
> receive huge numbers of duplicate traps. I am trying to put together a
> rule or ruleset that can do the following:
>
> -Monitor a log file containing translated SNMP traps
>
> -Send an individual email notification for each of the first four
> occurrences of a specific trap type (linkUp or linkDown), for the
> specific device and interface name
>
> -After four occurrences within a 10 minute period, suppress further
> email notifications until no matching traps are seen for 15 minutes,
> then rest normal alerting status.
>
> I have been trying to find a way to make this work using the
> SingleWith2Thresholds rule type but without much success. Perhaps the
> EventGroup rule type would be more appropriate? In any case, I am not
> making much progress.
>
> I've been studying the man pages, tutorials, and whatnot that are
> available, which have been very helpful, and have successfully created
> 13 rules to manage other traps, and so far those are working fine. But
> I have not seen any examples that address a scenario quite like this.
>
> Perhaps there is even a better way to do this that I am not aware of.
>
> If anyone can provide me with some suggestions or assistance I would
> greatly appreciate it!
>
> Thanks,
> Steve Amren
>
>
> ------------------------------------------------------------------------------
> How ServiceNow helps IT people transform IT departments:
> 1. Consolidate legacy IT systems to a single system of record for IT
> 2. Standardize and globalize service processes across IT
> 3. Implement zero-touch automation to replace manual, redundant tasks
> http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
> _______________________________________________
> Simple-evcorr-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
>
------------------------------------------------------------------------------
How ServiceNow helps IT people transform IT departments:
1. Consolidate legacy IT systems to a single system of record for IT
2. Standardize and globalize service processes across IT
3. Implement zero-touch automation to replace manual, redundant tasks
http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
