NetXMS Support Forum

I see this as an option in event processing policy but I have absolutely no idea how it works because you can't enter a time, you can only enter a text string

Can someone explain how this works and how to use it?
I have some alerts that I would like to automatically resolve/terminate after say 6 hours, then reset and if the issue re-occurs it will once again trigger the alert event
Or creating sticky alerts for some thresholds i.e. if temperature is >60c then do an normal event where if it goes <60c it terminates the alarm
But if it goes >70c then execute a different policy that will not automatically cancel even if temp goes <60c. But this alarm will automatically terminate in 72 hours (freak occurance that doesn't happen again, but gives plenty of time to see an alarm is still there and investigate manually)

It seems like a 'timer cancellation' could easily achieve this but........... no way to enter a time?

Here's an example image


The DCI is added to a node (in this case by a template but can also be manually added) and its working perfectly fine. Yet when I try and select it from a list i.e. making a network map/graph/dashboard/anything where I can choose a DCI, an entry sometimes just will not show up at all. Only way I found to fix it was to remove the DCI and re-add it again. But this causes me to lose all existing polled data
And even then sometimes it doesn't work and I have to actually duplicate a DCI, the duplicate will show up but not the original

I've had this issue periodically for years, and when it happens its frustrating as I need that data, sometimes its data thats been silently collecting for months and then I need to put it into a dashboard but am unable to
If I manually go to the node and then last values tab, right click and choose 'graph' the data is shown just fine. And if I right click on that graph and choose properties->data sources I can see its in there. But if I choose 'add' and browse to the node, that DCI still does not show up

Is this a known issue?
I propose a short-term workaround if it can't easily be fixed: Allow manually typing in the object number of a DCI instead of having to browse to the node and choose it. Maybe then it'll pick it up and at least allow me to add the data source, even if I have to go and look it up manually

Is there any way to further space out the link lines in Maps between nodes?
Just creating 2 links they are placed only a couple pixels apart from each other, therefore it makes it impossible to read both labels
Alternatively can I change the position of the DCI labels so they are higher/lower? That way I could fit in data for primary and backup links

Ok will check

Either way I still consider this a bug, and quite undesirable. If a patch is pushed that changes the scripting syntax or behavior this will create an absolute mess for instance discovery. Other scripts just outright fail and this is fine. Instance discovery should not default to 'yes accept everything' if there is an issue with the script, it should just outright fail like the others do. Makes it much more obvious to fix

Is there a way to debug this sort of thing easily? I get no feedback which makes troubleshooting much harder and more time consuming

I made a thread about this a while ago but can't find it
My understanding was NetXMS builds L2 topology maps by looking at MAC addresses on a port, but it has a restriction that the port must only contain 1 MAC address. This means its impossible to build a L2 topology map if there are wireless links because at minimum there will be 3 (other device/switch, AP and SM radios)
The vast majority of our network is wireless hence L2 topology has been useless to me. But i'd like the ability to use it and create from a seed router in our network and see the links that connect to all other directly connected switches/radios coming off it

And i'd also like to use a separate instance of NetXMS to map out unknown networks that contain wireless links between buildings etc

I have no idea how hardcoded the current implementation is. But it would be nice if we could override this behavior in server configuration, or on a map-by-map basis so any additional MAC addresses on a port are shown. Or if node for that MAC is not known just add all extra ones as a ? symbol
I.e
SwitchA
   |
? (MAC of AP AND SM)
   |
SwitchB
  /        \
Node1  Node2

That is much more useful than using SwitchA as seed and nothing at all shows up. And SwitchB only shows Node1/Node2

I'm confused. Has something drastically changed with how instance discovery works for template DCI's?

I've followed this guide https://lasiszm.wordpress.com/2017/10/22/netxms-template-for-monitoring-mikrotik-interfaces/ as a baseline
Except 2 problems, First is EVERY interface is being added as a DCO
And the second is the names are wrong. Everything just has instance number next to it, i.e. instead of "testRx - ether1" it just shows "testRx - 1" and so on for each

Then I find the discovery filter script just isn't working at all. I literally place this as the first line "return false;" and it STILL adds every single interface.............. what the hell?

edit: Ok I think there's a bug. If I have any 'and' or 'or' statements in IF statements anywhere, it seems the result will always return true, even if the very first line of the discovery script is "return false;"

This works fine
transport = CreateSNMPTransport($node);
if (transport == null) return false;

ifName = SNMPGet(transport,".1.3.6.1.2.1.2.2.1.2.".$1);
ifType = SNMPGet(transport,".1.3.6.1.2.1.2.2.1.3.".$1);
ifMAC = SNMPGet(transport,".1.3.6.1.2.1.2.2.1.6.".$1);
// If could not retrieve values, return false
if (ifName == null) return false;
if (ifType == null) return false;
if (ifMAC == null) return false;

// If interface type is 1/other (VPLS shows as this) and MAC begins with 02
if (ifType->value == 1) return %(true,$1,ifName->value);

but this does not

transport = CreateSNMPTransport($node);
if (transport == null) return false;

ifName = SNMPGet(transport,".1.3.6.1.2.1.2.2.1.2.".$1);
ifType = SNMPGet(transport,".1.3.6.1.2.1.2.2.1.3.".$1);
ifMAC = SNMPGet(transport,".1.3.6.1.2.1.2.2.1.6.".$1);
// If could not retrieve values, return false
if (ifName == null) return false;
if (ifType == null) return false;
if (ifMAC == null) return false;

// If interface type is 1/other (VPLS shows as this) and MAC begins with 02
if (ifType->value == 1) && (ifType->value == 1) return %(true,$1,ifName->value);

This is the exact same script, except the last line if doing 2 IF statements, both are exact same values. This script adds every single interface, as if the result was the very first line said "return true;", even if I put in 'return false;" it'll still add every single interface. Also if I try to condense the failure statements to 1 line i.e.
if (ifName == null) || (ifType == null) || (ifMAC == null) return false;
Once again it doesn't matter at all what is in the rest of the script. It's like the whole script fails and it just defaults to 'return true;'

That fixed it. Old config was all on 1 line with semi-colon to separate the 2 variables. Removing semi-colon and placing on separate lines works

I'm having issues and i'm not sure if its related to the recent update (which has broken a lot of my scripts hence why i'm rewriting a lot of it)

I have this as a script with some debugging in it

// Radio mode check
// First parameter = Node to check
// Second parameter = Vendor ID / Object ID (uses regex expression). Acts as a prequalifier before proceeding
// Third parameter = SNMP OID to check the radio mode, script will return this value
if ($1 == null) {println "Please specify node as first parameter"; return -1;}
if ($2 == null) {println "Please specify Vendor/Object OID as second parameter"; return -1;}
if ($3 == null) {println "Please specify SNMP OID as third parameter"; return -1;}

tempvar = FindObject($1);
println $2;
println tempvar->snmpOID;

// First check for appropriate Vendor ID
if (tempvar->snmpOID ~= $2) {
println "match was made";
println "----";
println $1;
println $2;
println $3;
println "----";
transport = CreateSNMPTransport(tempvar); // Open SNMP Session
if (transport == null) println "Could not open SNMP session" ; return -2; // If can't open session, abort
// Now check if AP or SM
mode = SNMPGetValue(transport, $3);
if (mode == null) println "Failed to retrieve OID $3"; return -3;
return mode;
};
println "Vendor ID not a match"; return -4;


I'm sending this to the server console

exec RadioMode 27560 "(.1.3.6.1.4.1.17713.21.9).*" .1.3.6.1.4.1.17713.21.3.8.2.1.0

First parameter is a nodes object ID
Second parameter is a regex expression that should match the Object ID / Vendor ID which in this case has .39 appended to it (all radio's in this range have a different number but they all begin with .1.3.6.1.4.1.17713.21.9)
Third parameter is the value to check and it should return 1/2/3 depending on the mode that the radio is in (AP/SM/Spectrum Scan)

It's failing at if (tempvar->snmpOID ~= $2) {
It seems to accept it as a regular expression but its like its being treated as a literal string or something. If I instead replace the $2 with the exact same regular expression (typed into the script itself, not taken from a variable) it recognises it as a match and proceeds just fine

I have other issues in this script such as the SNMPTransport seemingly not being created but we'll cross that bridge later

Ok I can see it in there and it was automatically migrated, however not entirely as its not working
Driver name was empty so i've changed that to Slack
Driver Configuration is in the format of
username=NetXMS;url=[WEBHOOK URL]

Then i've gone into my action and changed it to type 'Send Notification' and set channel name to the migrated SMS one
recipient address is #alerts (same as before) and message text %n - %m %M (same as before)
Yet it's not working, still no alerts

Is there a guide to setting it up?

SNMP walk doesn't help me because you can't tell what a value is without the MIB to decode and say "thats temperature". I'd just have to guess at a bunch of values that roughly look like the right temperature

Turns out the value is .1.3.6.1.4.1.3902.1004.3.1.2.1.0 which isn't in the ZXR10 MIB files

Our SLACK alerts have stopped. I noticed if I go to server configuration I can't find the 2 SMS options in there anymore
Running latest version of NetXMS. Unsure if this broke before or after the upgrade to 3.0
Maybe something got corrupted?


How do I troubleshoot and fix this?

3.0
I saw this checkbox, but is there a way to make this the default behavior? I'm happy to have that checkbox ticked for everything in NetXMS
Problem is when i'm going through adding 20 DSLAM's, if 1 of them doesn't add successfully the first time I won't be able to go in and change that option before it reverts to the default port number anyway
Plus adding devices then having to go in and make fiddly manual changes afterwards is always a pain

I guess its better than nothing but i'm not a fan of scripting when it can be avoided, its just messy, hard to read and hard to make changes or troubleshoot down the track (too many rabbit holes to follow to find what is responsible for what)

Any plans to update threshold options and add the ability to specify multiple values?

The current threshold options are somewhat limited especially because you can't do 'AND' or 'OR' operations with them
So from what I gather its not possible to do a threshold range? i.e. 'last polled value between 15 and 20'

I have some SNMP values that return -1, 0 or 4,294,967,295 (highest possible value) and I want to create alerts that exclude these
And others return an incorrect value that I just want to discard. I.e. I have temperature alerts set up, anything >70 send a Slack alert, however when its returning 8,500 we've either created a miniature star or the sensor is faulty. As such I don't want to alert on anything >140

Is there a way to do this?

This is a big problem for us at the moment. I've noticed a bunch of devices that I setup for monitoring have changed from port i've manually set (1616) to the default (161) and this changes the device that NetXMS actually monitors

The setup is there's a bunch of small MikroTik routers and DSLAM's behind those routers. The routers have a forwarding rule, anything UDP 1616 forward to the DSLAM on port 161
Both the router and DSLAM therefore share an IP address, but both can be polled via SNMP on different port numbers. The default of 161 for the Router, and 1616 for the DSLAM

This works fine initially but it seems that if a device stops responding for whatever reason, then NetXMS tries the default port number of 161, this then succeeds and it uses that information, screwing up the monitoring as now its polling the router, not the DSLAM