NetXMS Support Forum

Hi All!

I have a little problem with the alarm key associated to alarm creation/generation: the effect of the problem is that the alarm browser don't show all the ("real") alarms actually active.

I try to explain the problem with a little example:

In the alarm Processing policy, for service problems I have the following two rules:
     for "SERVICE_DOWN" event generate an alarm with alarm key "SERVICE_DOWN_%i" and send an email
     for "SERVICE_UP" event resolve the alarm with key "SERVICE_DOWN_%i" and send an email

Suppose than on node X, I have two service with name "A" and "B".

Suppose that on node X the following event happens(in temporally order):
1)Service A goes down -> netxms create an alarm with key SERVICE_DOWN_IDNODEX
2)Service B goes down -> netxms create an alarm with key SERVICE_DOWN_IDNODEX -> The alarm key is equal to the alarm key of alarm 1, so alarm 2 overwrites alarm1!
3)Service B goes up -> netxms resolve alarms with SERVICE_DOWN_IDNODEX

In this case, the service A is down but no alarms is showed on Alarm Viewer!(Netxms do his job correctly)
Mail notification work correctly of course.

**)
I want to fix the situation changing the alarm key generation to:
     SERVICE_DOWN -> create alarm with key "SERVICE_DOWN_%i_%5"
     SERVICE_UP      ->  resolve alarm wth key "SERVICE_DOWN_%i_%3"

The %5 and %3, in alarm creation and alarm resolving respectively, provide the unique id of the dci.

Unfortunately, i have this problem for many events and many rules, and i can't test all of it.

So my question is, can i do the changes at point **) and be sure that alarm generation continue to works correctly?Are there some event for which macros %5 and %3 don't works?
I know that answer can be obvious, but i have to be sure that mail notification continue to works!

There is the hazard that a problem in the creation of alarm key cause problem to alarm creation and mail notification?

Thank You to All!

Hi,

first of all, mail notification is not related to alarm generation, so it will continue to work. DCI ID provided for all events generated by thresholds - other events will not contain it (although they may have %3 or %5 - it's just numbered event-specific parameters). You can also use named parameter dciId as %<dciId> to avoid misunderstanding. It is always recommended to include DCI ID into alarm key for threshold-based alarms. You can change all existing rules safely - the only problem is that you'll have to terminate currently active alarms manually.

Best regards,
Victor

Ok thanks, it's clear!

I have only one doubt: which are the event not generated by thresholds?
With the exception of SYS_NODE_DOWN/UP, i always use the thresholds for generate event...
Maybe for the event generated by snmp-trap or similar?

Thanks

Hi,

all SYS_* events except SYS_THRESHOLD_* are generated by server (for example, SYS_INCORRECT_NETMASK is generated when incorrect netmask detected on interface). Events also could come from SNMP traps, syslog parser, from agents (usually from log parsers on remote systems) or submitted directly using nxevent tool or API.

Best regards,
Victor