| Hi,
Checking better my MCC I found that the there a quite strange
point in common in all the rules fired with the CLEAR severity.
As I said I've 2 general alarm rule on IPReachability on all
the SNMP node, one to check if the IPReachability = UP
and the other one to check if it's DOWN, Sometime happen that
one of these rules fire but the information I've back is the
opposite that I ask to check, e.g. rule UP fired, information
"(snmp * ipreachability = down)", CLEAR severity. Happen the
same with the DOWN rule, information "(snmp * ipreachability =
up)", CLEAR severity.
Do anyone know if the CLEAR severity is used by MCC for some
particular purpose ???
These are 2 examples of rule fired:
RULE "UP" FIRED BUT IPReachability = DOWN:
!!!!!!!!!!!!!! Alarm, 7-AUG-1992 09:07:41 !!!!!!!!!!!!!! [2,2129]
Domain: GUNDAM_NS:.snmp Severity: Clear
Notification Entity: SNMP GUNDAM_NS:.riskyo
Event Source: Domain GUNDAM_NS:.snmp Rule up
Event: OSI Rule Fired
Event Type = QualityofServiceAlarm
Event Time = 7-AUG-1992 09:07:40.96
Probable Cause = Unknown
Additional Info = { (
significance = True,
information = "Rule cleared: SNMP
GUNDAM_NS:.riskyo
ipReachability = down 7-AUG-1992 09:07:38.78" ),
(
significance = True,
information = "(snmp * ipreachability =up)" ) }
Managed Object = SNMP GUNDAM_NS:.riskyo
RULE "DOWN" FIRED BUT IPReachability = UP:
!!!!!!!!!!!!!! Alarm, 7-AUG-1992 09:07:44 !!!!!!!!!!!!!! [2,2132]
Domain: GUNDAM_NS:.snmp Severity: Clear
Notification Entity: SNMP GUNDAM_NS:.riskyo
Event Source: Domain GUNDAM_NS:.snmp Rule down
Event: OSI Rule Fired
Event Type = QualityofServiceAlarm
Event Time = 7-AUG-1992 09:07:44.50
Probable Cause = Unknown
Additional Info = { (
significance = True,
information = "Rule cleared: SNMP
GUNDAM_NS:.riskyo
ipReachability = up 7-AUG-1992 09:07:44.22" ),
(
significance = True,
information = "(snmp * ipreachability =down)"
Managed Object = SNMP GUNDAM_NS:.riskyo
Perceived Severity = Clear
Thanks in advance,
Ciao Luciano
|
| Ciao Luciano,
Each rule that you create will potentially send three different
types for notification events. If the rule FIRES, a rule fired event
will be generated with the severity that you've specified (warning or critical).
If the rule encounters an exception which prevents it from evaluating the
rule condition, a "rule exception" event could be generated with a severity
of "Indeterminate". If a rule had previously fired (evaluated to TRUE) and on
a subsequent evaluation was determined to be "no longer TRUE" (FALSE), then
a "Rule CLEAR event will be generated with a severity of CLEAR. This is
used by the Iconic Map and Notification module to indicate that the previously
reported "condition" is no longer valid. I would guess that your system
has the color MAGENTA associated with the CLEAR severity.
Also from your description of the behavior of your system, I assume
that you've set up notification to display the "Latest" notification. In this
case if the Rule UP fires before the Rule DOWN "clears", the latest (MAGENTA)
color will be displayed. If the Rule DOWN "clears" before the Rule UP "fires"
you will see the expected behavior. Thus creating the apparent "random"
results.
The easiest way to "fix" the problem is to change your notification
(in CUSTOMIZE menu) default to display "HIGHEST"
Bob Merrifield
|