hi Steve,
actually, one of the main reasons for having contexts is that they allow
for connecting different rules together, and create advanced correlation
logic which can't be achieved with one rule only. There are also other
means for connecting rules (such as synthetic events), but with contexts
one can accomplish many things that can't be easily done in other ways.
Also, contexts have several other useful features, such as aggregating
event data for reporting or advanced processing.
Finally, I am very glad you have found SEC useful :)
kind regards,
risto
2013/9/12 Steve Amren <[email protected]>
> Hi Risto,
>
> I appreciate your reply. Contexts are not something I have dealt with
> much, but now that I see your example it makes a lot of sense now.
>
> I have adjusted your sample rules to fit my environment and also
> created another pair of rules for the linkUp traps as well. My testing
> so far has been successful.
>
> I also incorporated the context lifetimes at 12 hours per your
> suggestion. I don't think it will pose a problem for us.
>
> You have my thanks for creating SEC, it is a very useful tool!
>
> Regards,
>
> Steve Amren
>
>
>
> On Wed, Sep 11, 2013 at 2:06 PM, Risto Vaarandi
> <[email protected]> wrote:
> > hi Steve,
> > the task you are having can be attacked in several ways, both with
> > SingleWith2Thresholds and EventGroup rule. After reading your mail, I had
> > two different approaches in mind for those two rule types, but the one
> with
> > SingleWith2Thresholds is probably simpler and easier to understand. This
> is
> > probably because the problem description matches this rule type most
> > closely, and if SingleWith2Thresholds would support the 'count' field as
> > EventGroup does, setting up the solution would be straightforward.
> > Fortunately, though, the missing functionality can be easily added by
> > employing additional Single rule which is connected to the main rule with
> > the help of a context. Here is the ruleset that should address the task:
> >
> > type=Single
> > continue=TakeNext
> > ptype=RegExp
> > pattern=linkDown: device (\w+) interface (\w+)
> > context=!LINKDOWN_DEVICE_$1_INTERFACE_$2
> > desc=Device $1 interface $2 down
> > action=write - %s
> >
> > type=SingleWith2Thresholds
> > ptype=RegExp
> > pattern=linkDown: device (\w+) interface (\w+)
> > desc=Four linkDown events for device $1 interface $2
> > action=create LINKDOWN_DEVICE_$1_INTERFACE_$2
> > thresh=4
> > window=600
> > desc2=No linkDown events for device $1 interface $2 during 15 minutes
> > action2=delete LINKDOWN_DEVICE_$1_INTERFACE_$2
> > thresh2=0
> > window2=900
> >
> > The Single rule that comes before SingleWith2Thresholds provides alerts
> for
> > linkDown events, as long as LINKDOWN_DEVICE_ context does not exist for a
> > given device and interface pair. Since this context is
> > (1) created when four events have been seen in 10 minutes for the given
> > device-interface pair, and
> > (2) deleted when no events have been seen in 15 minutes for the given
> > device-interface pair,
> > it ensures we will get alerts for four linkDown events and the following
> > ones will be ignored, until there is a 15 minute event-free time slot.
> > To make things more bulletproof, a fixed lifetime might be introduced to
> > LINKDOWN_EVENTS_ contexts, since otherwise they are only deleted by
> counting
> > operations started with SIngleWith2Thresholds rule. If at some point SEC
> > receives a signal which drops running operations from memory, some
> contexts
> > might become orphaned and will exist forever. Having a lifetime of, say,
> 12
> > or 24 hours will ensure that each context will eventually be dropped. Of
> > course, this will recreate alerts for interfaces which see many linkDown
> > alerts over long periods of time.
> > hope this helps,
> > risto
> >
> >
> > 2013/9/11 Steve Amren <[email protected]>
> >>
> >> Greetings!
> >>
> >> I have been banging my head against the wall for a few weeks now
> >> trying to figure out how to create a SEC rule (or set of rules) that
> >> will alert on the first four occurrences of an event within a 10
> >> minute period, suppress alerting for additional matching occurrences
> >> and then resume normal alerting after no occurrences are seen for 15
> >> minutes.
> >>
> >> Basically, I have SEC monitoring a log file which receives translated
> >> SNMP traps which are output by an NMS application. These traps are
> >> received from various network devices. The problem is that we often
> >> receive huge numbers of duplicate traps. I am trying to put together a
> >> rule or ruleset that can do the following:
> >>
> >> -Monitor a log file containing translated SNMP traps
> >>
> >> -Send an individual email notification for each of the first four
> >> occurrences of a specific trap type (linkUp or linkDown), for the
> >> specific device and interface name
> >>
> >> -After four occurrences within a 10 minute period, suppress further
> >> email notifications until no matching traps are seen for 15 minutes,
> >> then rest normal alerting status.
> >>
> >> I have been trying to find a way to make this work using the
> >> SingleWith2Thresholds rule type but without much success. Perhaps the
> >> EventGroup rule type would be more appropriate? In any case, I am not
> >> making much progress.
> >>
> >> I've been studying the man pages, tutorials, and whatnot that are
> >> available, which have been very helpful, and have successfully created
> >> 13 rules to manage other traps, and so far those are working fine. But
> >> I have not seen any examples that address a scenario quite like this.
> >>
> >> Perhaps there is even a better way to do this that I am not aware of.
> >>
> >> If anyone can provide me with some suggestions or assistance I would
> >> greatly appreciate it!
> >>
> >> Thanks,
> >> Steve Amren
> >>
> >>
> >>
> ------------------------------------------------------------------------------
> >> How ServiceNow helps IT people transform IT departments:
> >> 1. Consolidate legacy IT systems to a single system of record for IT
> >> 2. Standardize and globalize service processes across IT
> >> 3. Implement zero-touch automation to replace manual, redundant tasks
> >>
> >>
> http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
> >> _______________________________________________
> >> Simple-evcorr-users mailing list
> >> [email protected]
> >> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
> >
> >
>
------------------------------------------------------------------------------
How ServiceNow helps IT people transform IT departments:
1. Consolidate legacy IT systems to a single system of record for IT
2. Standardize and globalize service processes across IT
3. Implement zero-touch automation to replace manual, redundant tasks
http://pubads.g.doubleclick.net/gampad/clk?id=51271111&iu=/4140/ostg.clktrk
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
