AnsweredAssumed Answered

Alarm Enrichment Trouble

Question asked by Clecimar on Jul 7, 2017
Latest reply on Jul 10, 2017 by Clecimar

Like • Show 0 Likes0
Comment • 7

Hi guys.

I´m having an issue with alarm enrichment. I got some messages on alarm enrichment log saying the folowying:

jul 07 15:06:53:477 [pool-1-thread-1, alarm_enrichment] RoutingService: forwarding message RN99092413-21215 to routing rules
jul 07 15:06:53:477 [pool-1-thread-1, alarm_enrichment] AlarmRouter: 1 is posting message with subject 'NAS_QUARANTINE'
jul 07 15:06:53:477 [pool-1-thread-1, alarm_enrichment] AlarmRouter: '1' is forwarding 'RN99092413-21215' with subject: NAS_QUARANTINE

It´s match the enricher rule I did, but is sending to NAS_QUARANTINE.

If I disable the routing rule:

I got the followying messages:

jul 07 15:17:42:982 [pool-1-thread-16, alarm_enrichment] RoutingService: forwarding message RN99092413-21260 to routing rules
jul 07 15:17:42:982 [pool-1-thread-16, alarm_enrichment] RoutingService: the message RN99092413-21260 did not match ANY routing-rule. It is being DISCARDED!
jul 07 15:17:44:809 [checkSelfHealth, alarm_enrichment] AlarmQueueReader: Restart check : memory (free/used/total): 798319912/230857432/1029177344 OR 0.2243125865001552% used

Wonder if someone here already had this kind of issue and can help me.

Thank you.

Clecimar

Clecimar Jul 10, 2017 1:41 PM

Correct Answer

Hi Gene.

Yep, now is correct what I´m talking about…

I found some differences between what is default and what I did, then I fixed them (yellow). Please, take a look:

udata.custom_4 =

Now I got new messages on log file, but still without any enrichment on alarmrs.

jul 10 10:35:53:420 RoutingService: forwarding message RN99092413-35957 to routing rules

jul 10 10:35:53:420 AlarmRouter: 1 is posting message with subject 'alarm2'

jul 10 10:35:53:420 AlarmRouter: '1' is forwarding 'RN99092413-35957' with subject: alarm2

jul 10 10:35:54:654 AlarmQueueReader: Restart check : memory (free/used/total): 945714968/83462376/1029177344 OR 0.08109620415429589% used

If you have more tips or ways to troubleshooting this behavior I really appreciate it.

Thank you.

Clecimar

De: Gene_Howard

Enviada em: sexta-feira, 7 de julho de 2017 16:44

Para: Clecimar Fernandes

Assunto: Re: - Re: Alarm Enrichment Trouble

<https://communities.ca.com/?et=watches.email.thread> CA Communities

Re: Alarm Enrichment Trouble

reply from Gene HOWARD <https://communities.ca.com/people/Gene_Howard?et=watches.email.thread> in Unified Infrastructure Management - View the full discussion <https://communities.ca.com/message/241991437-re-alarm-enrichment-trouble?commentID=241991437&et=watches.email.thread#comment-241991437>

See the reply in context

No one else had this question

Outcomes

Gene_Howard

Jul 7, 2017 7:19 PM

So the NAS_QUARANTINE is done for storm protection that can be enabled or disabled.

Have you see the following KB articles on this?

https://www.ca.com/us/services-support/ca-support/ca-support-online/knowledge-base-articles.TEC000003600.html

https://www.ca.com/us/services-support/ca-support/ca-support-online/knowledge-base-articles.TEC000003665.html

https://www.ca.com/us/services-support/ca-support/ca-support-online/knowledge-base-articles.TEC000003712.html

If those do not help you resolve your issue and or answer your questions I would suggest you open a support case.

Actions

Clecimar @ Gene_Howard on Jul 7, 2017 7:30 PM

Hi Gene.

I´ve already opened and didn’t get the answer I need from support: the solution of my problem.

They sent a bunch of links as you, but, my issue is on alarm enrichment and not NAS QUARANTINE.

I thought NAS QUARANTINE is an important feature.

The question is: why the alarm enrichment is sending the alarm to NAS QUARANTINE and not sending to alarm2 ? If I disable the routing rule that apparently is sending the alarm for NAS QUARANTINE, the alarms are discarded. Why ?

Why this behavior ?

Anyway, thank you for your help again.

Hope this have a solution.

Thank you.

Clecimar

De: Gene_Howard

Enviada em: sexta-feira, 7 de julho de 2017 16:20

Para: Clecimar Fernandes

Assunto: Re: - Re: Alarm Enrichment Trouble

<https://communities.ca.com/?et=watches.email.thread> CA Communities

Re: Alarm Enrichment Trouble

reply from Gene HOWARD <https://communities.ca.com/people/Gene_Howard?et=watches.email.thread> in Unified Infrastructure Management - View the full discussion <https://communities.ca.com/message/241991418-re-alarm-enrichment-trouble?commentID=241991418&et=watches.email.thread#comment-241991418>

Actions

Gene_Howard

@ Clecimar on Jul 7, 2017 7:43 PM

So I think there is some confusion.

Alarm_enrichment is what takes car of storm protection.

I would need to see your nas.cfg to be able to provide any insight.

Alarm_enrichment if activated incorrectly will discard messages.

Below is what a default workings NAS.cfg should look like for alarm-enrichment:

<enrichment-source>
   <cmdbs>
      <os_enricher>
         active = false
         connection_url = jdbc:mysql://127.0.0.1:3306/DBname
         user = root
         password = password_gets_enrcyrpted_on_first_use
         query = select name,ip,os_type from cm_computer_system where name=?
         population_query = select name,ip,os_type from cm_computer_system
      </os_enricher>
   </cmdbs>
</enrichment-source>
<enrichment-rules>
   exclusive_enrichment = no
   <1>
      match_alarm_field = prid
      match_alarm_regexp = (cdm|controller|hub)
      use_enricher = os_enricher
      lookup_by_alarm_field = robot
      lookup_by_regexp =
      <overwrite-rules>
         udata.custom_4 = [cmdb.os_type]
      </overwrite-rules>
   </1>
</enrichment-rules>
<routing-rules>
   exclusive_routing = no
   <1>
      active = yes
      post_subject = alarm2
      condition = true
   </1>
   <2>
      active = yes
      post_subject = /setup/storm_subject
      condition = true
   </2>
</routing-rules>
<flood-protection>
   routing_rules_during_flood = 2
   routing_rules_no_flood = 1
</flood-protection>

1 person found this helpful

Actions

Clecimar @ Gene_Howard on Jul 10, 2017 1:41 PM

Hi Gene.

Yep, now is correct what I´m talking about…

I found some differences between what is default and what I did, then I fixed them (yellow). Please, take a look:

udata.custom_4 =

Now I got new messages on log file, but still without any enrichment on alarmrs.

jul 10 10:35:53:420 RoutingService: forwarding message RN99092413-35957 to routing rules

jul 10 10:35:53:420 AlarmRouter: 1 is posting message with subject 'alarm2'

jul 10 10:35:53:420 AlarmRouter: '1' is forwarding 'RN99092413-35957' with subject: alarm2

jul 10 10:35:54:654 AlarmQueueReader: Restart check : memory (free/used/total): 945714968/83462376/1029177344 OR 0.08109620415429589% used

If you have more tips or ways to troubleshooting this behavior I really appreciate it.

Thank you.

Clecimar

De: Gene_Howard

Enviada em: sexta-feira, 7 de julho de 2017 16:44

Para: Clecimar Fernandes

Assunto: Re: - Re: Alarm Enrichment Trouble

<https://communities.ca.com/?et=watches.email.thread> CA Communities

Re: Alarm Enrichment Trouble

Actions

Gene_Howard

@ Clecimar on Jul 10, 2017 2:06 PM

It would probably be best to open a support case unless you are willing to attach your nas.cfg to this thread for review and comment.

Actions

Clecimar @ Gene_Howard on Jul 10, 2017 2:11 PM

Hi Gene.

It´s working now after I change the order of routing rules as your example.

Thank you very much!!!

Sometimes what we need is just a “talk”.

Clecimar

De: Gene_Howard

Enviada em: segunda-feira, 10 de julho de 2017 11:08

Para: Clecimar Fernandes

Assunto: Re: - Re: Alarm Enrichment Trouble

<https://communities.ca.com/?et=watches.email.thread> CA Communities

Re: Alarm Enrichment Trouble

reply from Gene HOWARD <https://communities.ca.com/people/Gene_Howard?et=watches.email.thread> in Unified Infrastructure Management - View the full discussion <https://communities.ca.com/message/241991599-re-alarm-enrichment-trouble?commentID=241991599&et=watches.email.thread#comment-241991599>

Actions

Yu_Ishitani

Jul 10, 2017 1:10 PM

Check the below parameter in nas.cfg

<setup>/storm_protection = X

If this is set as non-zero value, storm protection is running.

Actions

7 Replies

Gene_Howard Jul 7, 2017 7:19 PM
Mark Correct
Correct Answer
So the NAS_QUARANTINE is done for storm protection that can be enabled or disabled.

Have you see the following KB articles on this?
https://www.ca.com/us/services-support/ca-support/ca-support-online/knowledge-base-articles.TEC000003600.html
https://www.ca.com/us/services-support/ca-support/ca-support-online/knowledge-base-articles.TEC000003665.html
https://www.ca.com/us/services-support/ca-support/ca-support-online/knowledge-base-articles.TEC000003712.html

If those do not help you resolve your issue and or answer your questions I would suggest you open a support case.
Like • Show 0 Likes0
Actions
- Clecimar @ Gene_Howard on Jul 7, 2017 7:30 PM
  Mark Correct
  Correct Answer
  Hi Gene.
  
  I´ve already opened and didn’t get the answer I need from support: the solution of my problem.
  
  They sent a bunch of links as you, but, my issue is on alarm enrichment and not NAS QUARANTINE.
  
  I thought NAS QUARANTINE is an important feature.
  
  The question is: why the alarm enrichment is sending the alarm to NAS QUARANTINE and not sending to alarm2 ? If I disable the routing rule that apparently is sending the alarm for NAS QUARANTINE, the alarms are discarded. Why ?
  
  Why this behavior ?
  
  Anyway, thank you for your help again.
  
  Hope this have a solution.
  
  Thank you.
  
  Clecimar
  
  De: Gene_Howard
  Enviada em: sexta-feira, 7 de julho de 2017 16:20
  Para: Clecimar Fernandes
  Assunto: Re: - Re: Alarm Enrichment Trouble
  
  <https://communities.ca.com/?et=watches.email.thread> CA Communities
  
  Re: Alarm Enrichment Trouble
  
  reply from Gene HOWARD <https://communities.ca.com/people/Gene_Howard?et=watches.email.thread> in Unified Infrastructure Management - View the full discussion <https://communities.ca.com/message/241991418-re-alarm-enrichment-trouble?commentID=241991418&et=watches.email.thread#comment-241991418>
  Like • Show 0 Likes0
  Actions
  - Gene_Howard @ Clecimar on Jul 7, 2017 7:43 PM
    Mark Correct
    Correct Answer
    So I think there is some confusion.
    Alarm_enrichment is what takes car of storm protection.
    I would need to see your nas.cfg to be able to provide any insight.
    
    Alarm_enrichment if activated incorrectly will discard messages.
    Below is what a default workings NAS.cfg should look like for alarm-enrichment:
    <enrichment-source>
       <cmdbs>
          <os_enricher>
             active = false
             connection_url = jdbc:mysql://127.0.0.1:3306/DBname
             user = root
             password = password_gets_enrcyrpted_on_first_use
             query = select name,ip,os_type from cm_computer_system where name=?
             population_query = select name,ip,os_type from cm_computer_system
          </os_enricher>
       </cmdbs>
    </enrichment-source>
    <enrichment-rules>
       exclusive_enrichment = no
       <1>
          match_alarm_field = prid
          match_alarm_regexp = (cdm|controller|hub)
          use_enricher = os_enricher
          lookup_by_alarm_field = robot
          lookup_by_regexp =
          <overwrite-rules>
             udata.custom_4 = [cmdb.os_type]
          </overwrite-rules>
       </1>
    </enrichment-rules>
    <routing-rules>
       exclusive_routing = no
       <1>
          active = yes
          post_subject = alarm2
          condition = true
       </1>
       <2>
          active = yes
          post_subject = /setup/storm_subject
          condition = true
       </2>
    </routing-rules>
    <flood-protection>
       routing_rules_during_flood = 2
       routing_rules_no_flood = 1
    </flood-protection>
    1 person found this helpful
    Like • Show 0 Likes0
    Actions
    - Clecimar @ Gene_Howard on Jul 10, 2017 1:41 PM
      Unmark Correct
      Correct Answer
      Hi Gene.
      
      Yep, now is correct what I´m talking about…
      
      I found some differences between what is default and what I did, then I fixed them (yellow). Please, take a look:
      
      udata.custom_4 =
      
      Now I got new messages on log file, but still without any enrichment on alarmrs.
      
      jul 10 10:35:53:420 RoutingService: forwarding message RN99092413-35957 to routing rules
      
      jul 10 10:35:53:420 AlarmRouter: 1 is posting message with subject 'alarm2'
      
      jul 10 10:35:53:420 AlarmRouter: '1' is forwarding 'RN99092413-35957' with subject: alarm2
      
      jul 10 10:35:54:654 AlarmQueueReader: Restart check : memory (free/used/total): 945714968/83462376/1029177344 OR 0.08109620415429589% used
      
      If you have more tips or ways to troubleshooting this behavior I really appreciate it.
      
      Thank you.
      
      Clecimar
      
      De: Gene_Howard
      Enviada em: sexta-feira, 7 de julho de 2017 16:44
      Para: Clecimar Fernandes
      Assunto: Re: - Re: Alarm Enrichment Trouble
      
      <https://communities.ca.com/?et=watches.email.thread> CA Communities
      
      Re: Alarm Enrichment Trouble
      
      reply from Gene HOWARD <https://communities.ca.com/people/Gene_Howard?et=watches.email.thread> in Unified Infrastructure Management - View the full discussion <https://communities.ca.com/message/241991437-re-alarm-enrichment-trouble?commentID=241991437&et=watches.email.thread#comment-241991437>
      Like • Show 0 Likes0
      Actions
      - Gene_Howard @ Clecimar on Jul 10, 2017 2:06 PM
        Mark Correct
        Correct Answer
        It would probably be best to open a support case unless you are willing to attach your nas.cfg to this thread for review and comment.
        Like • Show 0 Likes0
        Actions
        Clecimar @ Gene_Howard on Jul 10, 2017 2:11 PM
        Mark Correct
        Correct Answer
        Hi Gene.
        
        It´s working now after I change the order of routing rules as your example.
        
        Thank you very much!!!
        
        Sometimes what we need is just a “talk”.
        
        J
        
        Clecimar
        
        De: Gene_Howard
        Enviada em: segunda-feira, 10 de julho de 2017 11:08
        Para: Clecimar Fernandes
        Assunto: Re: - Re: Alarm Enrichment Trouble
        
        <https://communities.ca.com/?et=watches.email.thread> CA Communities
        
        Re: Alarm Enrichment Trouble
        
        reply from Gene HOWARD <https://communities.ca.com/people/Gene_Howard?et=watches.email.thread> in Unified Infrastructure Management - View the full discussion <https://communities.ca.com/message/241991599-re-alarm-enrichment-trouble?commentID=241991599&et=watches.email.thread#comment-241991599>
        Like • Show 0 Likes0
        Actions
Yu_Ishitani Jul 10, 2017 1:10 PM
Mark Correct
Correct Answer
Check the below parameter in nas.cfg

<setup>/storm_protection = X

If this is set as non-zero value, storm protection is running.
Like • Show 0 Likes0
Actions

Alarm Enrichment Trouble

Outcomes

Related Content

Recommended Content