Hi Risto, I appreciate your reply. Contexts are not something I have dealt with much, but now that I see your example it makes a lot of sense now.
I have adjusted your sample rules to fit my environment and also created another pair of rules for the linkUp traps as well. My testing so far has been successful. I also incorporated the context lifetimes at 12 hours per your suggestion. I don't think it will pose a problem for us. You have my thanks for creating SEC, it is a very useful tool! Regards, Steve Amren On Wed, Sep 11, 2013 at 2:06 PM, Risto Vaarandi <[email protected]> wrote: > hi Steve, > the task you are having can be attacked in several ways, both with > SingleWith2Thresholds and EventGroup rule. After reading your mail, I had > two different approaches in mind for those two rule types, but the one with > SingleWith2Thresholds is probably simpler and easier to understand. This is > probably because the problem description matches this rule type most > closely, and if SingleWith2Thresholds would support the 'count' field as > EventGroup does, setting up the solution would be straightforward. > Fortunately, though, the missing functionality can be easily added by > employing additional Single rule which is connected to the main rule with > the help of a context. Here is the ruleset that should address the task: > > type=Single > continue=TakeNext > ptype=RegExp > pattern=linkDown: device (\w+) interface (\w+) > context=!LINKDOWN_DEVICE_$1_INTERFACE_$2 > desc=Device $1 interface $2 down > action=write - %s > > type=SingleWith2Thresholds > ptype=RegExp > pattern=linkDown: device (\w+) interface (\w+) > desc=Four linkDown events for device $1 interface $2 > action=create LINKDOWN_DEVICE_$1_INTERFACE_$2 > thresh=4 > window=600 > desc2=No linkDown events for device $1 interface $2 during 15 minutes > action2=delete LINKDOWN_DEVICE_$1_INTERFACE_$2 > thresh2=0 > window2=900 > > The Single rule that comes before SingleWith2Thresholds provides alerts for > linkDown events, as long as LINKDOWN_DEVICE_ context does not exist for a > given device and interface pair. Since this context is > (1) created when four events have been seen in 10 minutes for the given > device-interface pair, and > (2) deleted when no events have been seen in 15 minutes for the given > device-interface pair, > it ensures we will get alerts for four linkDown events and the following > ones will be ignored, until there is a 15 minute event-free time slot. > To make things more bulletproof, a fixed lifetime might be introduced to > LINKDOWN_EVENTS_ contexts, since otherwise they are only deleted by counting > operations started with SIngleWith2Thresholds rule. If at some point SEC > receives a signal which drops running operations from memory, some contexts > might become orphaned and will exist forever. Having a lifetime of, say, 12 > or 24 hours will ensure that each context will eventually be dropped. Of > course, this will recreate alerts for interfaces which see many linkDown > alerts over long periods of time. > hope this helps, > risto > > > 2013/9/11 Steve Amren <[email protected]> >> >> Greetings! >> >> I have been banging my head against the wall for a few weeks now >> trying to figure out how to create a SEC rule (or set of rules) that >> will alert on the first four occurrences of an event within a 10 >> minute period, suppress alerting for additional matching occurrences >> and then resume normal alerting after no occurrences are seen for 15 >> minutes. >> >> Basically, I have SEC monitoring a log file which receives translated >> SNMP traps which are output by an NMS application. These traps are >> received from various network devices. The problem is that we often >> receive huge numbers of duplicate traps. I am trying to put together a >> rule or ruleset that can do the following: >> >> -Monitor a log file containing translated SNMP traps >> >> -Send an individual email notification for each of the first four >> occurrences of a specific trap type (linkUp or linkDown), for the >> specific device and interface name >> >> -After four occurrences within a 10 minute period, suppress further >> email notifications until no matching traps are seen for 15 minutes, >> then rest normal alerting status. >> >> I have been trying to find a way to make this work using the >> SingleWith2Thresholds rule type but without much success. Perhaps the >> EventGroup rule type would be more appropriate? In any case, I am not >> making much progress. >> >> I've been studying the man pages, tutorials, and whatnot that are >> available, which have been very helpful, and have successfully created >> 13 rules to manage other traps, and so far those are working fine. But >> I have not seen any examples that address a scenario quite like this. >> >> Perhaps there is even a better way to do this that I am not aware of. >> >> If anyone can provide me with some suggestions or assistance I would >> greatly appreciate it! >> >> Thanks, >> Steve Amren >> >> >> ------------------------------------------------------------------------------ >> How ServiceNow helps IT people transform IT departments: >> 1. Consolidate legacy IT systems to a single system of record for IT >> 2. Standardize and globalize service processes across IT >> 3. Implement zero-touch automation to replace manual, redundant tasks >> >> http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk >> _______________________________________________ >> Simple-evcorr-users mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > > ------------------------------------------------------------------------------ How ServiceNow helps IT people transform IT departments: 1. Consolidate legacy IT systems to a single system of record for IT 2. Standardize and globalize service processes across IT 3. Implement zero-touch automation to replace manual, redundant tasks http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
