Greetings! I have been banging my head against the wall for a few weeks now trying to figure out how to create a SEC rule (or set of rules) that will alert on the first four occurrences of an event within a 10 minute period, suppress alerting for additional matching occurrences and then resume normal alerting after no occurrences are seen for 15 minutes.
Basically, I have SEC monitoring a log file which receives translated SNMP traps which are output by an NMS application. These traps are received from various network devices. The problem is that we often receive huge numbers of duplicate traps. I am trying to put together a rule or ruleset that can do the following: -Monitor a log file containing translated SNMP traps -Send an individual email notification for each of the first four occurrences of a specific trap type (linkUp or linkDown), for the specific device and interface name -After four occurrences within a 10 minute period, suppress further email notifications until no matching traps are seen for 15 minutes, then rest normal alerting status. I have been trying to find a way to make this work using the SingleWith2Thresholds rule type but without much success. Perhaps the EventGroup rule type would be more appropriate? In any case, I am not making much progress. I've been studying the man pages, tutorials, and whatnot that are available, which have been very helpful, and have successfully created 13 rules to manage other traps, and so far those are working fine. But I have not seen any examples that address a scenario quite like this. Perhaps there is even a better way to do this that I am not aware of. If anyone can provide me with some suggestions or assistance I would greatly appreciate it! Thanks, Steve Amren ------------------------------------------------------------------------------ How ServiceNow helps IT people transform IT departments: 1. Consolidate legacy IT systems to a single system of record for IT 2. Standardize and globalize service processes across IT 3. Implement zero-touch automation to replace manual, redundant tasks http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
