DX NetOps

Looking for some best practices/suggestions related to this situation...

In our environment, we have "BSM" systems that do monitoring using HP tools. These systems send traps to Spectrum, which raises BSM alarms, as expected. The systems also have Sysedge installed, and they are monitored for host resources, etc

The challenge is that the BSM host itself is owned by my team (since it is a Windows system), but the BSM application (which is running on the host and sending the traps) is owned by a different team.  But, all alarms are asserted on the device model, so they all have the same contact information.

Scenario 1: Something goes wrong with system itself (i.e.: MPV-APPHPBSM01.cgi.int), such as "disk utilization exceeded" or "system is not responding to polls". Spectrum raises an alarm, and our Operations team will call the team that is listed in the Contact field of the model.

Scenario 2: BSM sends a trap based upon its monitoring, Spectrum raises an alarm against MPV-APPHPBSM01.cgi.int, and our Operations team will call the team that is listed in the Contact field of the model.

In Scenario 1, my team should be called.

In Scenario 2, the team that owns the BSM app should be called, but my team ends up getting incorrectly called because we are the contact.

The model can only have one Contact value, and our internal procedures rely on this to assign incidents to specific teams. 

One other thing: please do not suggest that we enhance the alarms with information that people can use to decide how to assign the incident, or add conditional logic to launch specific alarms with instructions on who to assign to.  People do not read the alarm contents. 

Can we do something with "event models".

Thanks for your help.

I think you can achieve what you want with the info in this post about using event procedures:

https://communities.ca.com/message/241831990

Hope that helps

Jay

Hi,

We have the same sort or scenario, what we did was customised the Asset Information fields in order to add a different owner and different services as below:

You could you regular expressions to filter out your alarms, the custom alarms could provide information from the customised asset information.

For example:

You could set up two custom fields 'team 1' and 'team 2' each providing the relevant contact information. An alarm would be generated destined for team 1, using regular expressions you could generate an alarm title of such 'THIS IS ALARM 1 - CONTACT TEAM 2'.

Could this help the problem, let me know and I can go into more detail.

Why not user SANM to create Policy filters to automatically e-mail these alarms to the appropriate team?

Joe