Hi, No worries, found the cause. Mistake in the discriminator. With discriminator,1 ( varbind = sysedge entry row index ) it works. Als found that the sysedge agent send the private type .13 clear alarm, only when the 'monitor X processes' in combination with X value > 10 is used. So I add both clear and start traps to be used as clearing of the alarm 0xffff1029 E 20 A 1,0xffff1029,1 0xffff1030 E 20 A 2,0xffff1030,1 0xffff1031 E 20 A 3,0xffff1031,1
0xffff1040 E 30 C 0xffff1029,1 C 0xffff1030,1 C 0xffff1031,1 0xffff1048 E 30 C 0xffff1029,1 C 0xffff1030,1 C 0xffff1031,1 Regards, Erwin ________________________________ From: De Munter, Erwin Sent: maandag 15 december 2008 17:29 To: spectrum Cc: [email protected] Subject: RE: [spectrum] Event configuration Clear does not work Hi, Can someone have a look at this. I have the same issue for monitoring ( self monitoring events ), but will focus on this one ( process stop, start ) Systemedge alarm creation with eventcondition works like it should be. REQUIREMENT; Spectrum alarm for process stop, must be cleared automatically with process start trap. When the process is back active, sysedge does not send a private type .13 clear trap, but instead a process start trap private type .11. So my requirement is that the process start trap clears the process stop trap alarm. Enabled debugging, but provides no relevant info. Tried with other disciminators, but same issue. Event 1040 is logged, but will not clear event 1029 Below the entries, everything which is blue, works fine, the red lines don't. the alarm will not clear Custom Alertmap for systemedge agent # processStopTrap MOD 0x1160034 1.3.6.1.4.1.546.1.1.6.10 0xffff1028 1.3.6.1.4.1.546.15.1.1.1(1,0) \ 1.3.6.1.4.1.546.15.1.1.2(2,0) \ 1.3.6.1.4.1.546.15.1.1.5(3,0) \ 1.3.6.1.4.1.546.15.1.1.6(4,0) \ 1.3.6.1.4.1.546.15.1.1.7(5,0) \ 1.3.6.1.4.1.546.15.1.1.8(6,0) \ 1.3.6.1.4.1.546.15.1.1.12(7,0) \ 1.3.6.1.4.1.546.15.1.1.14(8,0) \ 1.3.6.1.4.1.546.15.1.1.17(9,0) # processStartTrap MOD 0x1160035 1.3.6.1.4.1.546.1.1.6.11 0xffff1040 1.3.6.1.4.1.546.15.1.1.1(1,0) \ 1.3.6.1.4.1.546.15.1.1.2(2,0) \ 1.3.6.1.4.1.546.15.1.1.5(3,0) \ 1.3.6.1.4.1.546.15.1.1.6(4,0) \ 1.3.6.1.4.1.546.15.1.1.7(5,0) \ 1.3.6.1.4.1.546.15.1.1.8(6,0) \ 1.3.6.1.4.1.546.15.1.1.12(7,0) \ 1.3.6.1.4.1.546.15.1.1.14(8,0) \ 1.3.6.1.4.1.546.15.1.1.17(9,0) # processClearTrap MOD 0x1160037 1.3.6.1.4.1.546.1.1.6.13 0xffff1048 1.3.6.1.4.1.546.15.1.1.1(1,0) \ 1.3.6.1.4.1.546.15.1.1.2(2,0) \ 1.3.6.1.4.1.546.15.1.1.5(3,0) \ 1.3.6.1.4.1.546.15.1.1.6(4,0) \ 1.3.6.1.4.1.546.15.1.1.7(5,0) \ 1.3.6.1.4.1.546.15.1.1.8(6,0) \ 1.3.6.1.4.1.546.15.1.1.12(7,0) \ 1.3.6.1.4.1.546.15.1.1.14(8,0) \ 1.3.6.1.4.1.546.15.1.1.17(9,0) Custom Eventdisp for systemedge agent #SystemEdge_New_Version Process Stop trap # processStopTrap MODIFIED 0x1160034 0xffff1028 R Aprisma.EventCondition, \ "regexp({ VARDATA 2 }, { S \"[Mm]inor:|MINOR:\" })", "0xffff1029 -:-", \ "regexp({ VARDATA 2 }, { S \"[Mm]ajor:|MAJOR:\" })", "0xffff1030 -:-", \ "regexp({ VARDATA 2 }, { S \"[Cc]ritical:|CRITICAL:\" })", "0xffff1031 -:-", \ "default", "0xffff1029 -:-" 0xffff1029 E 20 A 1,0xffff1029,9 0xffff1030 E 20 A 2,0xffff1030,9 0xffff1031 E 20 A 3,0xffff1031,9 0xffff1040 E 30 C 0xffff1029,9 C 0xffff1030,9 C 0xffff1031,9 0xffff1048 E 30 C 0xffff1029,9 C 0xffff1030,9 C 0xffff1031,9 Custom CsEventformat and Pcause exists for all eventcode id's. example for 1029 -sh-3.00$ cat Eventffff1029 {d "%w- %d %m-, %Y - %T"} - Device {m} of type {t} reported that a ProcessStop Event has occurred. The process being monitored has died or transitioned into a Zombie state. The process monitor description called {S 2} is monitoring the following attribute:{T T1_01160034 3}. - (event [{e}]) -sh-3.00$ -sh-3.00$ cat Probffff1029 PROCESS STOP EVENT SYMPTOMS: A Process stop event has received by the device. PROBABLE CAUSES: Process being monitored had died or transitioned into a Zombie state. RECOMMENDED ACTIONS: See the Event Log for more details and act accordingly. -sh-3.00$ * --To unsubscribe from spectrum, send email to [email protected] with the body: unsubscribe spectrum [email protected] --- To unsubscribe from spectrum, send email to [email protected] with the body: unsubscribe spectrum [email protected]
