Does anyone know if the message suppression by number of characters in the NAS is based on, for example, the raw trap message from snmptd?
It's based on whatever you see in the "message" field in the alarm console, excluding numbers.
Thanks Jon, seems I may have an issue then as I am seeing alarms rolled up that differ after the first 10 characters of the message.
I have two different traps coming from differing mibs, now that you have explained that it exclude numbers I can see why I am getting them rolled up, for example the alarms rolled up below from the FuidFS mib
FluidFS - Volume Name = "NQ_HS111", Access Denied Reason = "ICAP protocol issue: cannot start scanning", Affected item = "UserData/kl00232/.System/Desktop/desktop.ini", Share Name = "HS333$"
FluidFS - Volume Name = "NQ_HS321", Access Denied Reason = "ICAP protocol issue: cannot start scanning", Affected item = "UserData/lm00195/.System/Favorites/desktop.ini", Share Name = "HS321$"
However I don't understand why I am getting rolled up for the following from Commvault/Simpana mib;
"Client: cserve01 , Description: The total remaining free space  MB for all the mount paths that are online for the disk Library [NODWEM11] on MediaAgent [mediaa.xxxxx.***] is less than the low watermark  MB. , Detected Criteria: Event Viewer Events , Event ID: 1076608 , Job ID: 0 , Event Date: Tue Oct 13 09:45:42 2015 , Program: MediaManager"
"Client: cserve01 , Description: License [SQL Server] is not active at this time. , Detected Criteria: Event Viewer Events , Event ID: 1076625 , Job ID: 250417 , Event Date: Tue Oct 13 10:00:10 2015 , Program: JobManager"
"Client: cserve01 , Description: Failed to gather log files. , Detected Criteria: Event Viewer Events , Event ID: 1076975 , Job ID: 250410 , Event Date: Tue Oct 13 10:05:21 2015 , Program: commserveRD"
The above three alarms all roll into one unless it is something to do with the suppression key
Any thoughts please?
Same Suppression_key perhaps?
Keep also in mind, numbers are nomally ignored for checking
Thanks Matthias, even taking out the numbers they do not exceed the 200 character limit I have set for suppression properties, maybe I need to look in more detail at the suppression keys for this trap.
Also I just checked and skip numeric characters is not checked in my suppression properties.
Am I correct in assuming that if I turn off 'Accept suppression-id in message' that suppression will only be based on 'Enable suppression based on core message contents'? Reason I asked was when I un-checked 'Accept suppression-id in message' a lot of alarms I already had assigned came in as new alarms (these were non snmptd alarms primarily celerra probe.
Yep, that's how it goes.
As for why you get them rolled up, hard to say. If I remember correctly, the snmp probes usually use the oid as supp key.. but as Matt said, I'd check that as well. It does sound a bit like there's something else at play as well. What's the character limit you've set for message based suppression? I've disabled message based suppression myself always, so Im not familiar with it's intricacies
Yes it is something to do with the suppression key being an oid, there appear to be a range of differing traps for a single oid. As that can't be changed I am looking at alternatives as disabling the "accept suppression-id message" has fixed my issue with alarm roll up for one mib but for another which I wanted rolled up now comes in with lots of individuals. Now the thing that changes in this second mib is a numeric value, however as I have a single NAS if I use "Skip numeric values" it would fix this issue but affect a lot of other alarms I need to get , I am thinking that the easiest thing (as we are using UIM in a MSP environment) is to have a separate NAS on the customer HUB to handle all of this at that level rather than at the main HUB.
Character limit is 200
I guess you cant get it just as you want
I appreciate your comments guys, thanks for the help
They're probably in trap variables then. You could modify the supp key for that oid to contain the variable info too
Okay that sounds like an option, not tried this before so will have to investigate how to do that.
I am having trouble finding any documentation regrading suppression keys particularly in the SNMPTD probe when on the advanced tab when modifying a trap, can anyone point me to documents please?
I have found that a particular trap called SIMPANA-MIB::simpanaAlertEventMonitor specific trap number 1058. Which equates to 220.127.116.11.4.1.14604.2.2-6.1508 which is the suppression key.
Examples of the traps that come in form this oid are as follows;
"Client: serve01 , Description: Backup job  failed. Client ******, Agent Type [Virtual Server], Subclient"
"Client: serve01 , Description: The total remaining free space  MB for all the mount paths that are online for the disk Library"
The first one I don't want rolled up as it gives me details of the backup job (in the brackets), the second one I do want rolled up as I know that the threshold is breached but I don't need a different alarm each time the free space changes.
If I use suppression based on suppression id then these would be rolled together (traps 1 and 2), if I disable suppression id in NAS then I get individual alarms for each, and if I use 'skip numeric characters' it would roll up the first and the second but I want the first as individuals.
I can't re-order the variables as the message seems to be a single variable (currently checking this), I am wondering if there is a way to match for example "The total remaining free space" in the trap text and then re-post it with a different message or changing the suppression key just for that message but cannot find a way to do that.
I am guessing there is no easy way round this.
Retrieving data ...