Filter alarms

Similar Questions

• HowTo generate by ESX report alarms?

  Hi all

  I use vFoglight v6.1 pro to monitor my VMware Lab Manager environment.

  It is needless to mention that I get tons of alerts several types.

  As part of my effort to reduce the amount of alerts vFoglight, I disabled a lot of alerts under Administration--> rules Admin &--> manage rules.

  I left only referring to my ESX memory alerts | swap | CPU which gives me more visibility of the State of my environment.

  The thing is I'm having a problem generating a statistical report that will give me specific information on how alertsI have on each of my ESX hosts by type.

  I need an easy way to show more of memory or cpu required and prove the increase of resources actually solved the problem.

  This must be done through vfoglight level reporting.

  I'll be happy to get assistance to each and every one of you, if you know the inner workings of the vfoglights.

  Thank you very much

  Nissim.

  Here are a few steps you can try:

  Navigate to the home alarms

  In the upper right corner of the dashboard alarms, set the time interval, you are interested. For example "7 d" for 7 days.

  To the right of the table of alarms in half the dashboard lower alarms, click on "filter alarm.

  In the field "Origin" on the popup filter, type in "VMW ESX" (this will filter the alarms for ESX most of alarms)

  The results of all ESX alarms for the last 7 days will be displayed, use the error Instances see the breakdown of the alarms tab how by host, but also the history of the health of these hosts in the selected time interval

  Use the Customizer button to export the alarms to Excel, and select export (it's the last option when you click the customizer, screenshot see attached)

  

• Create alarm "Network redundancy lost" by the script?

  Hello:

  I'm trying to write a script that will create the alarm in order to monitor the redundancy of the lost network (I know manually there) on the host.

  I know how to create alarm for additional exhibit the ' basic' event (LucD - thank you for your help) and I know that I have for alarm 'Lost network redundancy' to use 'vprob.net.redundancy.lost' instead of 'EnteringMaintenanceModeEvent' (as in my example); but I still struggle to combine...

  Can someone help me please?

  Thank you

  qwert

  I don't have a particular script fantasy with the settings and all the rest, but I can show you the steps to filter alarms by name and remove the desired one.

  alarm #retrieve Manager

  $alarmManager = get-view-Id "AlarmManager-AlarmManager.

  #Get the entity that contains the alarm that you want to remove. I'll do it for a virtual machine

  $entityView = get-Vm-name MyVm | Get-View

  #get all MoRefs alarm

  $alarmMoRefList = $alarmManager.GetAlarm($entityView.MoRef)

  #Retrieve tha alarm views from the MoRefs

  $alarmViewList = $alarmMoRefList | foreach (Get-view $_)

  #Now filter the name alrams

  $alarmToDelete = $alarmViewList | where {$_.Info.Name - eq "AlarmToDelete"}

  #Finally remove alarms

  $alarmToDelete.RemoveAlarm)

  It shouldn't be hard to put this in a script or function reussable. If you have problems with this, I'll be happy to help you again!

• Service alarm report filter

  Hello

  I'm writing a groovy script to get a list of filters of alarm for a service, but with not a lot of success. Anyone have advice on how to do this?

  Thank you

  Kris

  Hello

  the bottom should cover all the possible filter that can be created:

  def service = #! FSMService WHERE name = "YourServiceName" #. getTopologyObjects() [0]
  def filters = service. Get ("alarmFilterConditions")

  def filtersToString =]

  (filter filter)
  {
  include some DEF = filter. include
  def severityThreshold = filter. severityThreshold
  def filterToString = "";

  If (include! = null & severityThreshold! = null)
  {
  If (include)
  {
  Switch (severityThreshold.get ("name"))
  {
  "Fatal" case: filterToString = "include Fatal."
  break;
  case "Criticism": filterToString = "include fatal and critical."
  break;
  box "Warning": filterToString = "include all".
  break;
  }
  }
  on the other
  {
  Switch (severityThreshold.get ("name"))
  {
  "Fatal" case: filterToString = "exclude Fatal."
  break;
  case "Criticism": filterToString = "exclude fatal and critical."
  break;
  box "Warning": filterToString = "exclude".
  break;
  }
  }
  }

  Rule def = ID filter. Rule ID
  If (ruleId! = null)
  {
  def rule = server. RuleService. getRule (ruleId)
  If (! filterToString isEmpty ()).
  {
  filterToString += «...» "
  }
  filterToString += "State:"+ rule. " Name + «...» Scope: "+ rule. scopingTopologyObjectType?. name
  }

  expression of def = filter. expression
  If (expression! = null)
  {
  If (! filterToString isEmpty ()).
  {
  filterToString += «...» "
  }
  filterToString += "Groovy Expression:"+ expression. "
  }

  filtersToString. Add (filterToString)
  }

  return filtersToString

  Thank you

  Alain Abdulsater

• regular expression for alarm url

  Hello

  I have a problem with the regular expression. I want to filter only the name of a dsc alarm url: \\EW-MONITOR\monitor\000_t-ist_STB-M1-AS. Alarms.HI must be 000_t-ist_STB-M1-AS. Someone has a tip for me?

  Best regards

  --
  Joachim

  If as jcarmody asked, the name will always be between 'monitor\' and '. '. Alarms"use the output matching sub regular expression corresponds to

   

  

  It takes the name from alam of the entire game.

• Y at - it an alarm I can put on my laptop?

  I just need to use an alarm on my cell phone and if there is one where is it?

  you might try this one: http://bluefive.pair.com/alarm.htm

  or this sidebar gadget: http://www.lytebyte.com/2007/04/07/free-alarm-clock-sidebar-widgets/

  or this shareware: http://www.fileguru.com/Analogue-Vista-Clock/info

  or something else: http://www.bing.com/search?q=alarm+clock+for+windows&form=QBLH&filt=all&qs=n&sk=&sc=4-20

  I hope this helps!

  teengeek.freehostingcloud.com

• Question about hit FxV filter using positioning counties/session

  Hello

  Is there a way to create a filter of success for sessions with just 1-2 shots?  These may be just the regular shots listed in the screen FxV search Sessions or stored hits.

  I'm trying to capture scenarios where something is wrong with our back-end system and only all first hit comes in which is a post for a specific URL method.  So if no other success does come in and if we see enough of these place, we can then trigger an alarm (on FMS).

  ideas?

  Thank you

  "mark".

  Hi Mark-

  You can create a filter of Session in FxV who will catch only sessions with a number of access. Please see the screencap.

  I hope this helps.

  Robert

  Robert

• subnets and alarms - FxM / FMS

  Hello

  It is a question of both parties;

  We have a portal that we use FxM and FxV FMS systems to monitor the traffic of users and the application servers.  The FxM I defined a certain number of subnet mask definitions depending on the type of users on our system.  Filter mask Eash can cover several subnets.  Users of type A may be the IP (subnets) ranges and type b users would come over the IP address ranges associated with subnets.  Its all dependent on the range of IP addresses used to access our system and all this seems to work very well.

  I want to try to do is to create an alarm when all traffic on subnets from Type A (through multiple companies) falls below a fixed threshold and the same Type B subnets.  As seen below, each subnet in the FxM definition can include subnet ranges 4-5 - so there would be not bad to try to put in a single rule.   This alarm would indicate that there is a problem of backend associated with servers that process requests user Type A or Type B of separately.

  Subnet 1 for typical business has X:

  124.32.0.0/16
  124.30.0.0/16
  124.31.0.0/16

  Subnet 2 for Type B Company X:

  124.16.0.0/16
  124.17.0.0/16
  124.21.0.0/16

  Subnet 3 for typical business has Y:

  117.39.0.0/16
  117.40.0.0/16
  117.41.0.0/16
  117.45.0.0/16

  Subnet 4 Type B Company Y:

  117.22.0.0/16
  117.26.0.0/16
  117.28.0.0/16
  117.27.0.0/16

  ...

  So my question is this - is there an easy way to do it on the FxM?

  My second question is - the notions of subnets transmitted upward to the FMS or trace the overall traffic on subnets or creating alarms it?

  Thank you

  "mark".

  In the definition of FxM alarms, select your metric to alarm on. I chose the number of downloads for the category called subnets. When you have selected a metric, the alarm setting will allow you to choose regular expressions.

  David Mendoza

• Foglight - report - history alarm / Error Messages

  Hello

  I want to create a report that shows all mortals have taken place-alarms and error messages (history of the alarm).

  Is it possible to do that?

  Thank you

  You can also create a new report and choose the alamrs with a filter template list

  

  then apply a filter on gravity

  

  You then just add the headers, the images, the texts that you hear and annex / generate the report

  

  Golan

• Origin of the dashboard alarm

  Hi all

  I played with capacity of Foglight to monitor for specific events in the Windows event logs.  I have it working (I think!), but face a slight problem.

  I copied the OOTB EventLog rule and renamed it as the name Windows event log.  The OOTB EventLog rule has been disabled and the rule of the name of the Windows event log is enabled and customized.  Fires the rule very well, but in the dashboard of the alarms, the origin is displayed as simply EventLog - whenever we copied and renamed the rules in the past, the origin is defined correctly for the name of the actual rule, that is the name of file system capacity.

  OOTB rule:

  

  My custom rule:

  

  Dashboard of alarms:

  

  As you can see, in the dashboard of the rule management, alarms are all recorded against the OOTB EventLog rule disabled rather than the name Windows event log rule enabled.  Is it possible to change this original?  The reason why it is important, is that we have operators who monitor the dashboard of the alarms and they have a filter set to 'name' - in the State, they would not see this alarm and would not therefore not take appropriate action.

  Either incidentally, we also have LogFilter rule, which seems to be very similar to EventLog, and its origin is displayed correctly in the dashboard of the alarms.

  Thank you

  Brian

  For the OOTB, both the condition and the SevVar of the TEXT of reference the id of the rule...

  checkObservationAlarms (#Windows_System_EventLog to 1ms #,)

  {the entry->

  If (entry.get ("User_Severity") == "Warning") {}

  return 2;

  }

  If (entry.get ("User_Severity") == 'Critical') {}

  return 3;

  }

  If (entry.get ("User_Severity") == "Fatal") {}

  return 4;

  }

  return 0;

  },

  {entry, severity-> {switch (severity)}

  case 2:

  return ' NT event log: "+ entry.get ("Event_Category") +" "+ entry.get ("Event_Source") +" "+ entry.get ("Event_Message") +" ";" "

  case 3:

  return ' NT event log: "+ entry.get ("Event_Category") +" "+ entry.get ("Event_Source") +" "+ entry.get ("Event_Message") +" ";" "

  case 4:

  return ' NT event log: "+ entry.get ("Event_Category") +" "+ entry.get ("Event_Source") +" "+ entry.get ("Event_Message") +" ";" "

  by default:

  Return ' ';

  }}, "33a97525ed2f82c48a015358d96e944a") () .size > 0;

  Change the last line to

  }}, @foglight_rule_id) () .size > 0;

• Alarms, appear in the journal of the IDM, but not in the VEI

  I saw alarms in the event ID that have not been received by the IEV logs. There is no filter on the VEI.

  Thanks in advance,

  Maged

  I think I may have an answer...

  There may be something to do with 'Level' Information for the alarm data must be passed to the host that is running VEI?

  Under the "Configuration > Communications > remote hosts > event Destinations" in IDM, change the remote host and check the information 'Level' which is defined.

  There are four levels: 'Information', 'Low', 'Medium' and 'High '. These map to alarm severity levels: 1 and 2 are 'Information '. 3 is 'low '. 4 is 'support; and 5 is high.

  If I understand correctly, the VEI will receive alarms that are equal (or higher) 'Level' in IDM. In other words, if you have configured to accept the 'Medium' then VEI will see only level 4 and 5 alarms. Since many alarms in the NSDB are level 3, then of course you would see them in the newspapers of IDM, but thanks to a 'Level' setting 'Medium' Information, you will not see reflected them in VEI.

  Let me know if this solve your mystery.

  Alex Arndt, ARCG

• IPS GIS 3030 event Action filter does not

  Hi guys,.

  On my 4240 and IPS IDSM2 tried applying the event action to filter this GIS were firing from the internal IP and goes on all internal IP ports. Signature continue to be reported to my respective boxes in MARCH. I tried different combinations of internal IP addresses and filter still does not work. I also moved the filter up to the first position in the list. This is the only filter out of dozens who does not work, btw.

  If someone else has a similar problem or have a solution?

  Thank you

  I think I know what is happening. Don't forget, event filters action simply removes the actions for the alarm. This particular alarm contains a few destination outside your filter IP addresses, so that actions are not taken.

• display alarm criteria

  Hello

  We have our operators followed the console alarms and to facilitate the task, I want just that they discover the alarms that are up-to-date and are related to the alarms that originated in either (for example) CPU or SQL - is it possible... i.e. have only alerts showing that are current and the origin of which is one of the two variables?

  I can do very well with, but you can have two origins?

  Thank you

  Davie

  Steps & best practices that should you get

  1. In the function generator to create your category (e.g. alarms filtered). Normally, I keep all the defaults except for the option of having Foglight automatically add hosts that are somehow related to the objects of interest.
  2. Add components via the Green + and choose: Add the specific component
  3. By default displays a list of hosts. When I want something different than a host I use all models and click on search
  4. I navigate to templates and choose the ones that I love. When appropriate the health icon, you can check if the object contains messages of interest
  5. On the column just to the right of the category/Service name you see an icon for an alarm filter, click it and click on add in the following popup
  6. Select the filter rule, select the rule of choice and select 'include all '. This excludes all other alarms not created by the rule of interest
  7. Repeat step 6 for each rule of interest
  8. Start using the SOC by selecting the name of community service through 'select levels to monitor and services' top-left on the main display area

  If you want an example of a service using rules to include verification of the components: http://en.community.dell.com/techcenter/performance-monitoring/foglight-administrators/w/admins-wiki/5929.use-foglight-to-monitor-itself

• create an alarm to be notified when oracle db is shutdown

  Hello

  on 5.5.4, we control an oracle database. How cofigure a notification so that to be notified when oracle db is shutdown?

  In help, I saw this:

  Foglight for Oracle configuration alarms for Email Notification

  To configure Foglight for Oracle email notification:

  1	Select dashboards > Administration > rules & Notifications > manage registry Variables.

  2	In the filter by the Variable name field, enter the string dbo-email to only display the email related variable notifications.

  But do not know how to change them to receive an email when oracle db is stopped.

  A tutorial that shows with an example?

  in the Configuration Guide and Administration Foglight 5.5.4 I do not see any chapter to this topic.

  Thank you.

  Guy,

  You start by specifying a mail server in Foglight.

  Under the houses > welcome edge > configure alarms reporting and power outages

  

  and then configure e-mail settings

  

  Configure the mail server

  

  then set the DB admin user

  

  Golan

• Alarm on VM

  I have a batch file that I am running through Invoke-VMScript who sometimes does not. I can enter the error code from the file of commands on the virtual computer, but I was wondering if there is a way to raise any alarm in vCenter, so I can see there is not? For now, I have my script Invoke VMScript print just "ERROR" on the screen, but the ultimate goal is to put this in an automated process where I will not see the output directly so I need some kind of indicator that it did not work - ideally on the virtual machine at the other end of the call Invoke-VMScript. Really don't care which alarm it is either, just needing an indicator.

  It doesn't seem to be a direct method to generate an alarm, it seems that they must be produced on an event or condition of threshold/State. You can write an event defined by the user in order to keep a track of failure that can partially help you what you are looking for...

  $VM = "VMName".

  $EM = get-view event Manager

  $VMMoRef = (get-View - ViewType VirtualMachine-Filter @{Name = '$VM'}). MoRef

  $EM. LogUserEvent ($VMMoRef, "this is a message")

  When you look at events for the virtual machine, you will see "VMName".