San HQ 3.1 alert frequency

Similar Questions

• IPS (7.0 (7) E4) on ASA-SSM-10 block DNS without alerts

  Hi all

  I have the IPS module:

  Build version: 1.1 - 7, 0000 E4

  ASA 5500 Series Security Services Module-10

  Update of the signature S652.0 2012-06-20

  Journal of the ASDM inferred events:

  4 June 26, 2012 18:21:47 193.227.240.38 53 IPS 65347 sd-out asked to drop the UDP packet from outside:193.227.240.38/53 to dmz1:sd - outside/65347

  But the IPS not deducted from alerts - it does not explain why blocking these packets. DNS requests cannot just one network.

  ! ------------------------------
  ! Current configuration last modified Tue Jun 26 18:01:58 2012
  ! ------------------------------
  ! Version 7.0(7)
  ! Host:
  !     Realm Keys          key1.0
  ! Signature Definition:
  !     Signature Update    S652.0   2012-06-20
  ! ------------------------------
  service interface
  exit
  ! ------------------------------
  service authentication
  exit
  ! ------------------------------
  service event-action-rules rules0
  filters edit PROXY
  attacker-address-range 192.168.72.7
  actions-to-remove deny-attacker-inline|deny-packet-inline
  os-relevance relevant|not-relevant|unknown
  exit
  filters edit Q00000
  signature-id-range 5684
  attacker-address-range 95.190.8.0-95.190.8.255
  actions-to-remove deny-attacker-inline|deny-packet-inline
  os-relevance relevant|not-relevant|unknown
  exit
  filters edit Q00001
  signature-id-range 5684
  victim-address-range 95.190.8.0-95.190.8.255
  actions-to-remove deny-attacker-inline|deny-packet-inline
  os-relevance relevant|not-relevant|unknown
  exit
  filters edit USERS
  signature-id-range 1102,5237,2152,5684,2100,5581,3030,6061,3030,11020,5403,5474,20020,60000-60100
  attacker-address-range 192.168.0.0-192.168.255.255
  actions-to-remove deny-attacker-inline|deny-packet-inline
  os-relevance relevant|not-relevant|unknown
  exit
  filters edit USERS2
  signature-id-range 5575-5591,2151,21619,2150-2151
  attacker-address-range 192.168.0.0-192.168.255.255
  victim-address-range 192.168.0.0-192.168.255.255
  actions-to-remove deny-attacker-inline|deny-packet-inline
  os-relevance relevant|not-relevant|unknown
  exit
  filters move PROXY begin
  filters move USERS after PROXY
  filters move Q00000 after USERS
  filters move Q00001 after Q00000
  filters move USERS2 after Q00001
  general
  global-deny-timeout 14400
  exit
  target-value low target-address 192.168.0.0-192.168.255.255
  target-value medium target-address 192.168.1.0-192.168.1.255,192.168.64.0-192.168.64.255,192.168.3.0-192.168.3.49,192.168.65.128-192.168.65.255
  target-value high target-address 192.168.72.2-192.168.72.254,192.168.66.0-192.168.67.255,192.168.2.0-192.168.2.255
  target-value mission-critical target-address 192.168.65.0-192.168.65.127
  os-identification
  calc-arr-for-ip-range 192.168.0.0-192.168.255.255
  exit
  exit
  ! ------------------------------
  service host
  network-settings
  host-ip 192.168.64.194/24,192.168.64.1
  host-name gw1-ips
  telnet-option disabled
  access-list 192.168.0.0/16
  dns-primary-server enabled
  address 192.168.66.2
  exit
  dns-secondary-server enabled
  address 192.168.72.19
  exit
  dns-tertiary-server enabled
  address 192.168.72.20
  exit
  exit
  time-zone-settings
  offset 360
  standard-time-zone-name GMT+06:00
  exit
  ntp-option enabled-ntp-unauthenticated
  ntp-server 192.168.64.1
  exit
  summertime-option disabled
  auto-upgrade
  cisco-server enabled
  schedule-option calendar-schedule
  times-of-day 04:20:00
  days-of-week sunday
  days-of-week tuesday
  days-of-week thursday
  days-of-week saturday
  exit
  user-name dimaonline
  cisco-url https://198.133.219.25/cgi-bin/front.x/ida/locator/locator.pl
  exit
  exit
  exit
  ! ------------------------------
  service logger
  exit
  ! ------------------------------
  service network-access
  general
  enable-acl-logging true
  never-block-networks 192.168.0.0/16
  exit
  exit
  ! ------------------------------
  service signature-definition sig0
  signatures 60000 0
  alert-severity low
  sig-fidelity-rating 50
  sig-description
  sig-name XPress Administrator Service
  sig-string-info Access to Administrator Service
  sig-comment External user open Admin
  sig-creation-date 20120622
  exit
  engine service-http
  max-field-sizes
  specify-max-uri-field-length no
  exit
  regex
  specify-uri-regex yes
  uri-regex [Aa]dministrator[Ss]ervice[.]asmx
  exit
  exit
  service-ports 80
  exit
  event-counter
  event-count 1
  event-count-key Axxx
  specify-alert-interval no
  exit
  alert-frequency
  summary-mode summarize
  summary-interval 15
  summary-key Axxx
  specify-global-summary-threshold no
  exit
  exit
  vulnerable-os windows-nt-2k-xp
  specify-mars-category yes
  mars-category Info/Misc/Login
  exit
  exit
  signatures 60000 1
  alert-severity low
  sig-fidelity-rating 50
  sig-description
  sig-name Xpress Bridge
  sig-string-info Service URL
  sig-comment External Access to bridge
  sig-creation-date 20120625
  exit
  engine service-http
  regex
  specify-uri-regex yes
  uri-regex [Bb]ridge[/][Ss]ervice[.]asmx
  exit
  exit
  service-ports 80
  exit
  event-counter
  event-count 1
  event-count-key Axxx
  specify-alert-interval no
  exit
  alert-frequency
  summary-mode summarize
  summary-interval 15
  summary-key Axxx
  specify-global-summary-threshold no
  exit
  exit
  status
  enabled true
  exit
  specify-mars-category yes
  mars-category Info/Misc/Login
  exit
  exit
  signatures 60001 0
  alert-severity high
  sig-fidelity-rating 90
  sig-description
  sig-name FreePBX Display Extentions
  sig-string-info Acces to Extentions settings
  sig-comment Weak Password Detection
  sig-creation-date 20120622
  exit
  engine service-http
  event-action produce-alert|deny-attacker-inline
  regex
  specify-uri-regex yes
  uri-regex [/]admin[/]config[.]php
  exit
  specify-arg-name-regex yes
  arg-name-regex display
  specify-arg-value-regex yes
  arg-value-regex (extensions)|(trunks)
  exit
  exit
  exit
  service-ports 80
  exit
  event-counter
  event-count 1
  event-count-key Axxx
  specify-alert-interval no
  exit
  alert-frequency
  summary-mode summarize
  summary-interval 15
  summary-key Axxx
  specify-global-summary-threshold no
  exit
  exit
  exit
  exit
  ! ------------------------------
  service ssh-known-hosts
  exit
  ! ------------------------------
  service trusted-certificates
  exit
  ! ------------------------------
  service web-server
  enable-tls false
  port 80
  exit
  ! ------------------------------
  service anomaly-detection ad0
  internal-zone
  enabled true
  ip-address-range 192.168.0.0-192.168.255.255
  tcp
  enabled true
  exit
  udp
  enabled true
  exit
  other
  enabled true
  exit
  exit
  illegal-zone
  enabled false
  tcp
  enabled false
  exit
  udp
  enabled false
  exit
  other
  enabled false
  exit
  exit
  ignore
  source-ip-address-range 192.168.0.0-192.168.255.255
  exit
  exit
  ! ------------------------------
  service external-product-interface
  exit
  ! ------------------------------
  service health-monitor
  signature-update-policy
  enable false
  exit
  license-expiration-policy
  enable false
  exit
  event-retrieval-policy
  enable false
  exit
  exit
  ! ------------------------------
  service global-correlation
  exit
  ! ------------------------------
  service aaa
  exit
  ! ------------------------------
  service analysis-engine
  virtual-sensor vs0
  physical-interface GigabitEthernet0/1
  exit
  exit
  

  I confirmed with the Ironport team that this IP is a bad host in sensorbase. This is the reason for the traffic of this host being removed. There could be several reasons for this subnet to the list, for example, it could be part of a controlled host known by spammers. You must reach out to the development team for a confirmation however.

• IDS/IPS signatures for monitor audio/video streaming applications

  Hi people,
  Can someone Advisor on the names or signatures that could be used successfully to control the use of streaming on the network applications. The plan must feed to MARS and then create reports on streaming applications use to use it later for the creation of a security policy preventing the theft of bandwidth.

  Perhaps suggestions on how to create a custom signature to monitor the audio and video streams would be appreciated.

  Eugene

  Hello Eugene,

  It is possible to matching strings video specified in your capture by examining the Type of content. Run after the connection with a TCP reset or refuse the inline package will keep the video of the game - which will save bandwidth that the video would have used otherwise. However, it is important that we establish the role of the IPS appliance. The IPS is designed to detect and limit the attacks by matching known traffic patterns. For TCP, this obligation can also include some that drop a bag to disrupt a flow. The IPS is not fundamentally designed to monitor flow and provide a number of bytes for a particular protocol so that the use of protocols analysis can be performed.

  The signature below will drop packets with the flv-application Content-Type, which will keep the video that you have tested on break.com of play. Each video streaming site works differently. A screenshot of each video streaming site will have to be examined and another custom signature written, if you want to block all. Also, keep in mind that many sites offer different options for streaming videos. It may ask you to take multiple shots at each site - one for each method of streaming.

  signature-60001 0
  alert-severity average
  GIS-description
  Flv-application TCP SIG - name string
  output
  engine-tcp chain
  products-event-action alert | Reset tcp-connection
  Regex-string flv-application
  service port 80
  the service management
  output
  alert frequency
  Summary-fire-all mode
  output
  output
  status
  enabled true
  output
  output

  Thank you

  Blayne Dreier

  IDS Cisco TAC team

  * Please check our Podcast *.

  TAC security show: http://www.cisco.com/go/tacsecuritypodcast

• Critical alert SAN HQ - cannot get balls of PS4100X

  Hello.

  I have a Dell Equallogic SAN PS4100X v7.0.10 and a SAN HQ server in version 3.0.2.7457.

  Yesterday, I get an email that speaks 14.2 error

  Warning conditions:

  • 28/07/2016-17:17:09
    • [ID: 14.2] A connection could not be made.
    • The HQ SAN server issued the group SNMP requests, some or all failed.  This condition is probably due to the congestion of the network or has no network connectivity.  The server will try again in 60 seconds.  Check your network connectivity and that the storage group is online.  If the problem persists, contact your Dell support provider.

  If I run SAN HQ Client I can watch a critical alert 14.1: an unexpected Exception in Service. SAN HQ seems to be connected, but there is no newspaper.

  I'm trying to upgrade to 3.2.0.8291 but it's the same problem. Change anything on our side, and I test a snmpwalk with the same community, it works.

  You have any ideas?

  Thank you

  Finally, I don't update the firmware and open a file, I reinstalled SAN HQ (withour keep newspapers) and everything is good now.

  Thank you

• Alert Notification SAN HQ

  Hello team Dell,

  Had this error: hope you can help

  This message was generated by the service Dell EqualLogic SAN headquarters (version 2.5.0.6470) running on SaNHSVR

  The following conditions on the group EQL (MailScanner WARNING: digital links are often malicious: 150.xxx.xxx.x19) generated an alert notification:

  Warning conditions:

  • 23/07/2016 01:04:26 to 26/07 / 2016 09:02:46
    • [ID: 1.6] The Group EQL was added by using non well known address (MWKA). Delete and add the group using the well-known address 150.xxx.xxx.x21 management group.
    • The Group EQL was added by using non well known address (MWKA). Delete and add the group using the well-known address 150.xxx.xxx.x21 management group.
    • Condition has already generated an e-mail message. If the problem persists, additional messages will be sent approximately once every 6 hours.
  • 23/07/2016 07:16:20 to 26/07 / 2016 08:09:19
    • [ID: 3.23] ATTENTION: Network member EQL01-FLC Port isn't reachable.  Unable to get network for Member performance data.
    • Condition has already generated an e-mail message. If the problem persists, additional messages will be sent approximately once every 6 hours.

  NOTE: To customize the e-mail notification to alert launch an instance of the customer SAN seat then:

  1. Click on the 'Settings' button, then select "e-mail settings."
  2. Select the tab 'Notifications '.
  3. Select the group to edit.
  4. The upper part of the checkboxes allow enabling/disabling of all alerts in a specific category.
  5. The selection of the bottom contains allows enabling/disabling of individual alerts.
  6. Click on the "Apply" button to save the changes to this group or all groups.

  Hello

  You are running a very old version of SANHQ.   The current version is v3.2.

  The first error is quite simple, it seems that the incorrect IP address was used to add to this group.   What the dedicated management interface configured once it has been added to SANHQ?

  The 2nd error could be a connectivity issue, old SANHQ, old EQL FW or table was very busy at the time.  It could also be linked to the incorrect configuration error if errors refer to the same group.

  What a picture of model and firmware currently running?

  Kind regards

  Don

• Space in use SAN HQ alert 4.2 on volume

  I've recently been reconfiguration of EQL (1 PS6100, 1 PS4000) customers.  As part of the cleaning and modernization of the former ESXi environment, virtual machines were vMotioned storage of 4000 to 6100 and the4000 reset, reconfigured and added to the 'new' group began with the PS6100.

  The PS6100 is RAID10 and in its own pool of storage, the PS4000 RAID6 and in its own pool of storage.  The PS6100 has a single TB 5.5 thin provisioned volume (total available is 5.75 to), the reconfigured PS4000 has a single 4TB thin volume (total available East of 5.66 to).

  About halfway through to storage quick vMotioning of PS4000 to PS6100 VMS, SANHQ began reports 4.2 warnings of space on the volume of same PS61000 if running in Workgroup Manager of space in use for the volume and the pool was only about 2 TB with him remains marked free.  Once the PS4000 has been revamped and its created volume and about 1.1 to migrate back, this volume has begun to take a 4.2 errors as well.

  SanHQ reports 4.2 errors, the two volumes now that more than 99% complete, even if the Group Manager shows as much less complete volumes - the PS6100 is about 70% full, the PS4000 only 30% full (volume, pool is only 20% full).

  My understanding of thin volumes with VMware is that they grow only represented by how much space has been consumed by the upstream file system (for example, VMware VMFS) and "shrink" only if manually unmap you them (VMware) or run another operating system that automatically cancel the mapping.

  That being the case, none of my thin LUN EQL never showed more than 70 percent use of space (maximum) and some never more than 25% maximum, than even San HQ throws 4.2 errors.   Why?

  Hello

  It is a known issue with SANHQ v3.1.   The next version should exit this month this will resolve this error.  There are several other threads here discuss this issue.  For now, turn off the alerts is best work around.

  Kind regards

  Don

• Annoying Alert Notification SNMP SAN HQ

  Maybe if I add the email address of Mr Dell'Alba to this alert. Stop the madness. -This message was generated by the service Dell EqualLogic SAN headquarters (version 3.0.0.7189) running on vcenterserver.kembacu.org the following condition on WESTCHESTER (192.168.50.16) group has generated an alert notification: critical conditions: * 5/15/2014 13:39:37 * [ID: 14.2] could not establish the connection. * The HQ SAN server issued the group SNMP requests, some or all failed. This condition is probably due to the congestion of the network or has no network connectivity. The server will try again in 60 seconds. Check your network connectivity and that the storage group is online. If the problem persists, contact your Dell support provider. NOTE: In order to customize the email alert notification launch an instance of the customer SAN seat then: 1. click on the 'Settings' button, then select "e-mail settings." 2. Select the tab 'Notifications' 3. Select the group to edit. 4. the upper part of the checkboxes allow enabling/disabling of all alerts in a specific category. 5. the selection of the bottom contains allows enabling/disabling of individual alerts. 6. click on the "apply" button to save the changes to this group or all groups.

  Uncheck the event ID 14.2 (under review) and apply the change to all your groups... Please keep in mind that a restart of the service is necessary for entry into force of the amendments.

  Kind regards

  Joerg

• Unknown status alert

  I have about 50 iDRAC to OME - a mixture of iDRAC6 & 7. Every day I receive 1 or 2 of the following "Status unknown" alerts raised. Generally followed a warning of "Normal State" 50 to 70 seconds later. There is no visible trend for these, but the frequency makes OME virtually unusable due to the high number of false alarms.

  Is there a solution?

  

  Enterprise SNMP OID:. 1.3.6.1.4.1.674.11000.1000.100.1
  SNMP generic Trap OID: 6
  SNMP specific Trap OID: 3001

  Hi and thanks for the post.

  Your discovery range includes both iDrac IP and the IP of the server of this box as well Strip in the same range?

  I saw some people are having similar problems with lines configured in this way.

  There is also a setting preferred (preferences |) I think that the alerts).  On this screen, there is a single checkbox.  If this is true?  If so, you could try unchecking it.  What is OME send an alert to additional State for health change to the console.  The reason that it is for people who don't use SNMP.  Assuming that allows you to track your physical/alerts failures SNMP, you really don't need to have it checked.

  Let me know.  THX

  Rob

• ASM and SAN issues HQ

  Hello

  I have a few problems in ASM 4.6 and SAN HQ 3.0.

  SAN AC 3.0:
  I get alerts email saying that network connectivity is not even if there is no network connectivity issues.  The message is below:

  • [ID: 14.2] A connection could not be made.
  • The HQ SAN server issued the group SNMP requests, some or all failed.  This condition is probably due to the congestion of the network or has no network connectivity.  The server will try again in 60 seconds.  Check your network connectivity and that the storage group is online.  If the problem persists, contact your Dell support provider.

  ASM 4.6:
  For some reason when ASM is refreshing the host, it never ends with one of the hosts (in a cluster).  It sticks to the discovery of Cluster connectivity and I don't understand why.  I also get e-mail alerts saying that Smart snapshots failed.

  Can someone please?

  Thank you.

  There SANHQ available from eqlsupport.dell.com/.../download.aspx 3.0.1

  From the release notes:

  Elements fixed in SAN HQ Version 3.0.1

  The following question has been corrected in the version 3.0.1 SAN headquarters maintenance release:

  Previously, after SAN HQ 3.0 upgrade HQ SAN server could not connect to the newsgroups under firmware version 7 or more and SAN HQ has published an alert (HQ SAN event ID: 14.2) indicating that some or all SNMP requests the group failed.

  This condition is resolved.

• Storage vMotion with Syncrep on Equallogic San

  Hello

  We recently bought 2 San Equallogic (PS6510ES) and turned on synchronous replication between them.

  We use ESXi 5.5 and followed the best practices guide to disable TCP ack and 60 logintimeout value.

  Everything seems to work fine until we tried Storage vMotion/migration and cloning VMS on the San.

  When we did the migration of 2 volumes on the EQL SAN storage (the target volume has active syncrep), the target volume will be out-of-sync and then the storage vMotion will hang sometimes.

  The worst is when such a problem has occurred, all other volumes on the EQL constantly to respond also. All volumes will not respond until we rebooted the corresponding ESXi host (NOTE: simple shut down/power outside the host won't help.) The San EQL will only return to normal after a reboot of the ESXi host).

  If we pause / off the syncrep before Storage vMotion, the problem will not happen.

  Is this normal or not?

  In addition, whenever the problem occurred, the latency of writing the corresponding volume will be dry and we will receive alerts similar to the following:

  connection iSCSI target ' xx.xx.xx.xx:3260, iqn.2001 - 05.com.equallogic:xxxxx - test-volume ' initiator 'xx.xx.xx.xx:xxxxx, eqlinitiatorsyncrep' failed for the following reason:

  Initiator, disconnected from the target when connecting.

  Thanks in advance.

  Hi Joerg,

  What is a #SR? I opened a record of support to 24 June and still waiting for Dell to contact me.

  Ryan

• Cannot save the settings of e-mail from SAN HQ

  I used to be able to turn the notifications specific to the HQ of SAN.  I've updated a few times and had not tried for a while but now I can do it no longer.  When I try to disable an alert I say pop-up error: "cannot save the e-mail settings.  The SAN HQ was unable to save the message view recent changes.  Unable to save changes made to the Group (group name) because of insufficient access permissions or administrative credentials.  Verify that your account has all required permissions and administrator-level access to update the selected group. "Then I me it is a question of perm but don't know where.  SAN HQ connects very well to all my reports and datasets, etc.  Where would this leave?  Any help would be greatly appreciated, thank you!

  Your user and group must have all the permissions for the install directory where SANHQ has been installed.

  I'll try again with a local administrator account vs account domain.

• Windows 7 device disconnect alert constantly

  Almost completely using windows 7 thanks to ALERT DEVICE-DISCONNECT every few seconds...

  I get no indication anywhere of what is unplugged.

  The mouse hangs then the sound signal goes from plays, then it can be repeated several times and has happen in seconds or minutes.

  I also get a silent block and freeze the mouse with no beeping, still in the sound control I device connect together to play and several other additional alerts turned on, but still do not see what is the silent shot is happening.

  Day after day this increases in frequency, make the computer useless.

  In the last week, or so it seems to restore all the points have been removed FROM WINDOWS AUTOMATICALLY not by me. THIS ME. ANGERS... !!!

  I want to control my restore points and my computer!

  Windows 7 Ultimate x 64

  AMD athlon 6000 + x 2 double 3.1 ghz

  8 GB ram

  1 terabyte hd

  nVidia gts 250 4 GHz ddr3 pcie x 16

  ASUS m3n78 pro

  I need help trying to focus on what happened. The windows hardware event log does not appear anything.

  At this point, I think that I got the problem.

  It seems that swallow that all the keyboard extra keys reduces the frequency maybe 40%.

  I got a wireless mouse is plugged into a usb port on the front panel, which I think would be the 7th or 8th, and he has not acted since.

  Yet, I have not disconnected the other mouse, and both work well.

  I think that the system was in the hunt for connections he thought should be there, but not sure who shouldn't be there either, and which may account for the multiple connects and disconnects instead of a model connect-disconnect.

  I'll do a few exchanges more and see for sure what is happening, to be sure that it is not not a bad front usb port.

  I've seen bad usb ports do a lot of things, but generally worse due pretty badly damaged ports and it should have no problem, but its possible it could be defective, a 30% of all, China is defective. I guess that explains the smack-n-draw prize draw...

• EEM script to alert on failures of the IP SLA

  I have the following IP SLA put in place and would like to do the following. I wish I had a journal entry, if any the below have a failure and then send an email to alert for this failure. Is it possible to do this with the EEM?

  ALS IP 1010

  interval of UDP-Jig 64.xxx.xxx.xxx 3456 num-30 25 packages

  history of 24 hours-of-statistics - kept

  IP SLA annex 1010 duration to always start now

  ALS IP 1011

  TCP-connect 64.xxx.xxx.xxx 2000

  history of 24 hours-of-statistics - kept

  IP SLA annex 1011 duration to always start now

  ALS IP 1012

  64.xxx.xxx.xxx echo ICMP message

  frequency 30

  history of 24 hours-of-statistics - kept

  History 10 distributions-of-statistics-kept

  ALS IP calendar 1012 duration to always start now

  Thank you

  Mike

  Sure.  You can use Enhanced Object Tracking to track each IPSLA collector and EEM to respond to delays.  For example:

  track 1 accessibility of 1010 ip sla

  !

  Event Manager applet track-1010

  event track 1 State

  message from syslog to action 1.0 "Collector IPSLA 1010 timed out."

  "action mail 2.0 of '[email protected] / * /'to'[email protected] / * /" object "Collector IPSLA 1010 is down" body "Collector IPSLA 1010 has exceeded" Server "10.1.1.1" "

• SAN starts a B200M2 with local disk

  I have a B200M2 with two local disks in it.  Currently, I'm SAN all my startup B200M2.  If I had a few drafts to the blade, but I didn't so I go in, I'd take the local drive.  Service profile, I configure to configure my blades has the boot order using a start-up strategy that starts from SAN.  It works without problem.  I also use a local disk Configuration strategy that has no local storage.  If this model of service profile will not work with the B200M2 that has a disk in it.  So, I cloned the templace of service profile and just change the policy Configuration of Local disk to any selected item.  Can I deploy the blade properly with this model of service profile, but I get an error of blade saying 1 Local disk on the operability of the server 1/1: inoperable and Local Disk 2 on the operability of the server 1/1: inoperable.

  How can I get rid of this error?  What am I not wrong which causes this error?

  Hello Russ,

  You have the operating system on this blade? UCSM version?

  If it is the 2.0.1 and OS is not running on this blade, the alert may be due to the following defects

  http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCty01498

  Padma

• Alert for OEM metric Extensions WARNING/criticism

  OEM version is 12.1.0.5.0

  I have a metric expansion who oversees archive newspaper gap sequence received and sequence applied waiting for database.

  Select (A1 - A2) "Total_Gap"

  (select sum (max(sequence#)) 'A1'

  v $ archived_log val, v$ database vdb

  where val.resetlogs_change # = vdb.resetlogs_change #.

  Sort thread # 1 group),

  (select sum (max(sequence#)) "A2"

  v $ archived_log val, v$ database vdb

  where val.resetlogs_change # = vdb.resetlogs_change #.

  and val.applied in ('YES', "IN-MEMORY")

  b group thread # 1 order);

  WARNING: 30

  Review: 50

  The metric seems to work very well.   Its rated every 30 minutes.  The question I have is on the frequency of the alerts from OEM.

  Even if the metric is evaluated every 30 minutes, it seems only 1 alert is sent when it reaches the warning level and only 1 alert is sent when it reaches the critical threshold.  What I would do is sent an alert every 30 minutes if its still in the warning or critical.

  Is this possible?

  Thank you!

  It's normal.  Notifications are sent only when a threshold is changed.  so clear for the warning, attention to critics, etc...   If you want notifications repeat, warning and always open, you can configure to send every 15 min or more.

  http://docs.Oracle.com/CD/E24628_01/doc.121/e24473/notification.htm#sthref233