DX Unified Infrastructure Management

Hi guys.

I´m having an issue with alarm enrichment. I got some messages on alarm enrichment log saying the folowying:

jul 07 15:06:53:477 [pool-1-thread-1, alarm_enrichment] RoutingService: forwarding message RN99092413-21215 to routing rules
jul 07 15:06:53:477 [pool-1-thread-1, alarm_enrichment] AlarmRouter: 1 is posting message with subject 'NAS_QUARANTINE'
jul 07 15:06:53:477 [pool-1-thread-1, alarm_enrichment] AlarmRouter: '1' is forwarding 'RN99092413-21215' with subject: NAS_QUARANTINE

It´s match the enricher rule I did, but is sending to NAS_QUARANTINE.

If I disable the routing rule:

I got the followying messages:

jul 07 15:17:42:982 [pool-1-thread-16, alarm_enrichment] RoutingService: forwarding message RN99092413-21260 to routing rules
jul 07 15:17:42:982 [pool-1-thread-16, alarm_enrichment] RoutingService: the message RN99092413-21260 did not match ANY routing-rule. It is being DISCARDED!
jul 07 15:17:44:809 [checkSelfHealth, alarm_enrichment] AlarmQueueReader: Restart check : memory (free/used/total): 798319912/230857432/1029177344 OR 0.2243125865001552% used

Wonder if someone here already had this kind of issue and can help me.

Thank you.

Clecimar

So the NAS_QUARANTINE is done for storm protection that can be enabled or disabled.

Have you see the following KB articles on this?

Hi Gene.

I´ve already opened and didn’t get the answer I need from support: the solution of my problem.

They sent a bunch of links as you, but, my issue is on alarm enrichment and not NAS QUARANTINE.

I thought NAS QUARANTINE is an important feature.

The question is: why the alarm enrichment is sending the alarm to NAS QUARANTINE and not sending to alarm2 ? If I disable the routing rule that apparently is sending the alarm for NAS QUARANTINE, the alarms are discarded. Why ?

Why this behavior ?

Anyway, thank you for your help again.

Hope this have a solution.

Thank you.

Clecimar

De: Gene_Howard 

Enviada em: sexta-feira, 7 de julho de 2017 16:20

Para: Clecimar Fernandes

Assunto: Re:  - Re: Alarm Enrichment Trouble

<https://communities.ca.com/?et=watches.email.thread> CA Communities

Re: Alarm Enrichment Trouble

reply from Gene HOWARD <https://communities.ca.com/people/Gene_Howard?et=watches.email.thread>  in Unified Infrastructure Management - View the full discussion <https://communities.ca.com/message/241991418-re-alarm-enrichment-trouble?commentID=241991418&et=watches.email.thread#comment-241991418>

So I think there is some confusion.

Alarm_enrichment is what takes car of storm protection.

I would need to see your nas.cfg to be able to provide any insight.

Alarm_enrichment if activated incorrectly will discard messages.

Below is what a default workings NAS.cfg should look like for alarm-enrichment:

<enrichment-source>
   <cmdbs>
      <os_enricher>
         active = false
         connection_url = jdbc:mysql://127.0.0.1:3306/DBname
         user = root
         password = password_gets_enrcyrpted_on_first_use
         query = select name,ip,os_type from cm_computer_system where name=?
         population_query = select name,ip,os_type from cm_computer_system
      </os_enricher>
   </cmdbs>
</enrichment-source>
<enrichment-rules>
   exclusive_enrichment = no
   <1>
      match_alarm_field = prid
      match_alarm_regexp = (cdm|controller|hub)
      use_enricher = os_enricher
      lookup_by_alarm_field = robot
      lookup_by_regexp =
      <overwrite-rules>
         udata.custom_4 = [cmdb.os_type]
      </overwrite-rules>
   </1>
</enrichment-rules>
<routing-rules>
   exclusive_routing = no
   <1>
      active = yes
      post_subject = alarm2
      condition = true
   </1>
   <2>
      active = yes
      post_subject = /setup/storm_subject
      condition = true
   </2>
</routing-rules>
<flood-protection>
   routing_rules_during_flood = 2
   routing_rules_no_flood = 1
</flood-protection>

Hi Gene.

Yep, now is correct what I´m talking about…

I found some differences between what is default and what I did, then I fixed them (yellow). Please, take a look:

         udata.custom_4 =

Now I got new messages on log file, but still without any enrichment on alarmrs.

jul 10 10:35:53:420  RoutingService: forwarding message RN99092413-35957 to routing rules

jul 10 10:35:53:420  AlarmRouter: 1 is posting message with subject 'alarm2'

jul 10 10:35:53:420  AlarmRouter: '1' is forwarding 'RN99092413-35957' with subject: alarm2

jul 10 10:35:54:654  AlarmQueueReader: Restart check : memory (free/used/total): 945714968/83462376/1029177344 OR 0.08109620415429589% used

If you have more tips or ways to troubleshooting this behavior I really appreciate it.

Thank you.

Clecimar

De: Gene_Howard 

Enviada em: sexta-feira, 7 de julho de 2017 16:44

Para: Clecimar Fernandes

Assunto: Re:  - Re: Alarm Enrichment Trouble

<https://communities.ca.com/?et=watches.email.thread> CA Communities

Re: Alarm Enrichment Trouble

reply from Gene HOWARD <https://communities.ca.com/people/Gene_Howard?et=watches.email.thread>  in Unified Infrastructure Management - View the full discussion <https://communities.ca.com/message/241991437-re-alarm-enrichment-trouble?commentID=241991437&et=watches.email.thread#comment-241991437>

It would probably be best to open a support case unless you are willing to attach your nas.cfg to this thread for review and comment.

Hi Gene.

It´s working now after I change the order of routing rules as your example.

Thank you very much!!!

Sometimes what we need is just a “talk”.

J

Clecimar

De: Gene_Howard 

Enviada em: segunda-feira, 10 de julho de 2017 11:08

Para: Clecimar Fernandes

Assunto: Re:  - Re: Alarm Enrichment Trouble

<https://communities.ca.com/?et=watches.email.thread> CA Communities

Re: Alarm Enrichment Trouble

reply from Gene HOWARD <https://communities.ca.com/people/Gene_Howard?et=watches.email.thread>  in Unified Infrastructure Management - View the full discussion <https://communities.ca.com/message/241991599-re-alarm-enrichment-trouble?commentID=241991599&et=watches.email.thread#comment-241991599>

Check the below parameter in nas.cfg

<setup>/storm_protection = X

If this is set as non-zero value, storm protection is running.