Combined Rules in UIM to Generate Single Alarm

Idea created by Rajashekar Allala on Sep 26, 2018

Comment • 9

New

Score11

+2 more

We would like to generate alarm only if the "Rule A" and "Rule B" are True. For Example, If CPU Utilization is Above 85% (Rule - A) and CPU Load Average is Above 10 (Rule - B), then Generate an Alarm. Most of the monitoring tools are having this feature.

As of now in UIM, there is no direct option to created the combined rules. Instead, always being suggested to use LUA scripts with Auto Operator on NAS probe.

I just want to simplify this process by adding the ability to use combined rules to reduce the manual work in writing the piece of code for each monitoring requirement.

Probes that need this feature are:

CDM

PROCESSES

NTSERVICES

NTPERF

PERFMON

and if any other probes.

Thank you.

Rajashekar

9 Comments

RowanCollis Sep 26, 2018 2:41 PM
You can do this with Alarm Policies which is new functionality in UIM 9.0.x and this is due to be GA very soon.
Like • Show 0 Likes0
Actions
- Rajashekar Allala @ RowanCollis on Sep 26, 2018 2:46 PM
  Thank you for the reply Rowan. I have 9.0.1 installed. Can you help me where to configure these? I don't see anything under enhanced profiles or using the operator console.
  Like • Show 0 Likes0
  Actions
  - RowanCollis @ Rajashekar Allala on Sep 26, 2018 2:50 PM
    You should find it in the Operator Console/ settings / alarm policies
    Like • Show 0 Likes0
    Actions
Rajashekar Allala Sep 26, 2018 3:53 PM
I see only the option to add multiple conditions and under each condition multiple individual thresholds. But, not an option to use the combined rules as mentioned in the actual requirement in the beginning of this thread.

Below is an example:
Like • Show 0 Likes0
Actions
- RowanCollis @ Rajashekar Allala on Sep 26, 2018 4:52 PM
  Yes you are correct, you cannot perform multiple conditions in the same alarm in policies.
  I think the only way to do this is with NAS triggers which will look for separate alarms for each condition and combined in one AO profile (using the triggers)
  Like • Show 1 Like1
  Actions
  - Rajashekar Allala @ RowanCollis on Sep 26, 2018 5:35 PM
    This is a pain for most of the users and hence need the inbuilt feature to avoid the manual efforts in writing the script/setting the AO profile for each monitoring condition.
    
    Also, there are limitations using the AO profiles:
    
    1. We will get single alarm for each threshold configuration along with the combined alarm
    Ex: If I configure AO profile to generate alarm "CPU Utilization is Degraded" when there are two alarms "CPU is High" and "CPU Load is High" on particular robot. Then we will get 3 alarms --> CPU is High, CPU Load is High and the CPU Utilization is Degraded.
    2. Two avoid first two alarms, we may need extra efforts to create another AO profile to not generate the alarms before it triggers the Custom Alarm on match of the two alarms/events.
    3. We need extra effort to create another AO profile to clear the combined rule custom alarm if one of the prior conditions clear
    4. If we are not having the enough knowledge in AO profile creation and LUA scripting, even the above process is very difficult and will not be able to achieve.
    
    Considering all of the above points, we definitely need this feature for all of the mandatory probes.
    
    I am not sure why UIM developers didn't include these basic features as most of the monitoring tools are having these by default (Example: CA eHealth).
    
    Hope, CA will consider this for coming releases.
    Like • Show 2 Likes2
    Actions
Garin Sep 26, 2018 6:58 PM
I agree that this is a huge failing in the product not having this capability.

I think that one "easy" way of addressing it within the current infrastructure is to introduce another class of message.

Today you have QoS (a raw value) and an Alarm (the result of a rule being triggered).

The problem is that once you're a QoS, you're always a QoS and once you're an Alarm, you're always an Alarm.

What we really need is something that's in between - You need something that indicates that the QoS is in violation of a rule or that a rule has been triggered but you need it not to be an Alarm.

What you really need is a message type of "alert" in addition to "alarm". An alert would be handled exactly like an "alarm" message except it would be separate from those items that were of an alarm status.

You could then have the nas process "alerts" (script based and trigger like) to turn alerts into alarms based on whatever logic you imposed. And not have to worry about keeping the contributing alarms around.
Like • Show 3 Likes3
Actions
- raphael.franck @ Garin on Sep 28, 2018 6:31 AM
  Hi Garin, all,
  
  this is a great description and I just want to mention one more example, even from a CA product:
  CA Spectrum always had (and still has) the concept of:
  something happens -> an event is raised -> event rules are processed -> follow up action takes place
  The event rules can vary from
  - a simple and static mapping e.g. event A causes Alarm A
  - do conditional stuff e.g. clear existing alarm of same type only if variable 3 equals value 5
  - to rare stuff like find another object which has ip address from event variable 7 and raise a new event on that one
  - and much more
  However, to me it seems like the concept of UIM right now is to have the alarm creation responsibility within the probes only, not within the hubs. The above idea would require a little shift of that paradigm.
  
  My vote is set, ARHR0503.
  
  regards,
  Raphael
  Like • Show 0 Likes0
  Actions
Chrlu03 Apr 26, 2019 7:53 AM
There was a probe (some years ago): qos_aggregate that offered this possibility. (written by: Gijsbert Wiesenekker)
Like • Show 0 Likes0
Actions

Incoming Links

What You May Have Missed in the CA UIM Community (September 2018)

Combined Rules in UIM to Generate Single Alarm

Related Content

Recommended Content

Incoming Links