DX Unified Infrastructure Management

  • 1.  Alarm Suppression using LUA

    Posted Jul 25, 2009 02:09 AM
    When a device goes down I get alerts from all sorts of different probes.  SNMPGET, SAA_MONITOR, NET_CONNECT, CISCO_MONITOR, INTERFACE_TRAFFIC and so on.  This is causing alert overload and I decided to try and do something about it.  I initially thought I could do it all via AO profiles and triggers but I can't seem to find out how. 

    What I want is the following:

    net_connect pings a device and it doesn't respond.  All of the rest of the alarms from the above mentioned probes are then suppressed. 

    Here is how I envisioned doing it:

    *Use a trigger to capture the net_connect alarms so they can be evaluated when an alarm from one of the other probes comes in.
    *Use a pre-processing rule to make all the incoming alarms from the other probes invisible.
    *Use a Profile (use the visibility matching criteria along with whatever other you need – “on arrival”) that will execute a LUA script that will
    1.     Check the trigger state to see if there are any net_connect alarms at all
    a.     If the trigger state is False, then set the current alarm to visible
    b.     If the trigger state is True, then loop through the alarms in the trigger and see if there is a match on the source
    i.     If there is a match, then close the current alarm
    ii.     If no match, then set the current alarm to visible

    *One trigger to catch all net_connect alarms
    *One pre-proc that set all incoming alarms to invisible and use a comma separated list of probes in the matching criteria.
    *One profile to execute the LUA script for all invisible alarms

    My LUA isn't up to speed yet.  I have my triggers built and my pre-processing rules built.  Can someone provide some insight regarding that LUA script?


  • 2.  Alarm Suppression using LUA

    Posted Jul 25, 2009 04:22 AM

    I haven't tested it yet, but you can try the attached script.



  • 3.  Alarm Suppression using LUA

    Posted Jul 25, 2009 10:42 AM
    That script looks pretty promising!

    Just a word of warning; you might need to verify that the source field is set as expected on all of the alarms you want to check.  That field is very probe-dependent.  The right configuration of each probe should help get the result you want.  You might have already checked that the sources in the alarms match as needed, but if not, check it out to be sure.

    -Keith


  • 4.  Alarm Suppression using LUA

    Posted Jul 30, 2009 08:57 AM

    Here is a slightly revised version that tests to make sure the alarm.get() function actually returns an alarm into the alist variable.



  • 5.  Alarm Suppression using LUA

    Posted Aug 03, 2009 09:16 PM
    Line 18 has a typo.
    needs the ~= instead of ~- simple fix for for everyone.


  • 6.  Alarm Suppression using LUA

    Posted Aug 23, 2009 10:17 PM

    Here is a variation of this alarm suppression script works great in our env due to the subsystems are setup.  Doesn't use triggers or a preprocessing rule to make alarms invisble.  It use 1 ao profile to run the script which then determines if the alarm should be set to invisible or not. The functions script contains a function to make a alarm invisible.
    The way it works is a aoprofile for the probe you want to make alarm invisible for on arrival.  Alarm is check for any other alarms with that ip in this case our connection sid is 4.4.3 so if net_connect couldn't ping it then no use display a snmpget alarm saying it couldn't talk to it as well could very well be used agains int traffic as well.
    I have uploaded script as well since didn't no how it will display in formum.

    require ("tpi-scripts/functions")
    alist=alarm.get()
    if alist ~= nil then
       thisRobot = alist.robot
       thisAlarm = alist.nimid
       thisSource = alist.source
       al = alarm.list("hostname",thisSource)
       if al ~= nil then
          for i=1,#al do
             a=al
             host,assto,sid,robot,almessage = a.hostname,a.assigned_to,a.sid,a.robot,a.message
             printf ("their is a match moving to next step for ip %s - %s", a.sid,thisSource)
             if sid == "4.4.3" then
                printf ("their is a match setting to invisible - %s", thisSource)
                visible (thisAlarm)
             else
                printf ("no major connection alarm associated or not correct sid")
             end
          end
       else
          print "no match"
       end
    end



  • 7.  Re: Alarm Suppression using LUA

    Posted Apr 28, 2011 09:16 AM

    Hello.

    Can you please paste here the function ? Because i cannot seem to make it work.

    Or at least, from where can i get the function ?

     



  • 8.  Re: Alarm Suppression using LUA

    Posted May 04, 2011 11:30 PM

    --This will contain commonly used funtions that can be called by any script.

    --Variables

    --database.open ('/opt/nimbus/probes/service/nas/transactionlog.db')
    --database.open ('/home/noc/hubs.db')


    --This funtion runs a system command and returns the output.
    function cmdout (cmd)
       local f = io.popen(cmd)
       local lout = f:read("*a")
       f:close()
       return lout
    end

    --This sets nimbus alarm to invisible
    function visible(nid)
       action.visibility(false,nid)
    end