NetXMS Support Forum

Hi,

In user manual, last page lists all macros available for building key and message in event processing.
Is there a way to do some regexp in the field where we define the pattern for terminating several alarms?

A kind of EVENT_ERROR_(.*) or event EVENT_[ERROR|WARNING]_%i etc.

Best regards,

Jdamien

By the way, is there no way to define "terminate alarm" while keeping the message in the event list?
So having access to both "terminate alarms" and "Generate new alarm" sections?

Regards,

Jdamien

Quote from: jdl on May 11, 2009, 05:55:43 PM
In user manual, last page lists all macros available for building key and message in event processing.
Is there a way to do some regexp in the field where we define the pattern for terminating several alarms?

A kind of EVENT_ERROR_(.*) or event EVENT_[ERROR|WARNING]_%i etc.

No, it is not possible (but idea is very good, I'll try not to forget it and implement). Currently you have to define multiple rules to terminate each kind of alarms.

Best regards,
Victor

Quote from: jdl on May 11, 2009, 06:12:41 PM
By the way, is there no way to define "terminate alarm" while keeping the message in the event list?
So having access to both "terminate alarms" and "Generate new alarm" sections?

I'm not sure I understand correctly - you wish to terminate alarm and then generate new alarm immediately? Then you have to define two rules with identical matching part, first will terminate alarm, and second create new alarm.

Best regards,
Victor

Don't know how complex or feasible it is but here is the idea...

Today you can either "terminate alarm" by giving the message key OR "Generate new alarm". Indeed, as you say you can probably do it by defining two rules one to "terminate alarm" and a second one to "Generate new alarm". But what if you could do both in a simple rule? A rule could be defined to "terminate alarm" AND "generate new alarm".

This can be useful if you enter an escalation scenario... First alarm is "warning" then "major", following "critical"... at each step you don't need the previous alarm... and finally the clearing event which will "terminate alarm" only. But for previous step, you when to "terminate alarm" and display the new alarm...

Imagine how many rules you may get if you have many such scenarios? Allowing generation and termination in on rule would divide this number by two for those at least...

Regards,

It's not very difficult - mostly UI change. Also, for escalation you can simply replace alarms (but this depends on how you create your alarm keys). Alarm key is also used by server to identify duplicate alarms, so if you generate new alarm with same key as existing one, server will update all fields in existing alarm except creation time, and increase repeat count.

Best regards,
Victor

So in the event log, you will see the latest alarm text and severity will be increased or decreased according to last alarm, right?

That's what we call "flexibility" 

JDamien

Hi,

Any news on having regex in the termination key of the event processing (see first input in this thread to get refreshed ;-)?
Best regards,

JDamien

Hi!

Sorry, I forgot about it Now I have added this as feature request to bugtracker (issue 309), and hopefully it will be included in 1.0.7 release.

Best regards,
Victor

Thanks - we will then wait for 1.0.7.

Best regards,
Jdamien

Alarm termination by regular expression implemented in 1.0.7. You have to upgrade both server and management console to be able to configure it.

Best regards,
Victor