I currently have AlarmPoint integrated with the NNMi and I am trying to ensure all notifications we need will be sent. We have it configured so that we are receiving InterfaceDown alerts, but we would like to also receive InterfaceUp alerts to know it is back up. The problem is that there is not a seperate event in the NNMi for InterfaceUp, but instead I believe that the InterfaceDown event is just simply closed by an InterfaceUp attribute according to the correlation notes - example below:
Incident duration: 4 minutes, 328 ms Time incident detected: Tuesday, May 4, 2010 6:01:20 PM CDT. Time incident resolved: Tuesday, May 4, 2010 6:05:20 PM CDT. Incident cancelled by: InterfaceUp.
Anyone have any idea on what options I have to send alerts when the interface comes back up?
P.S. - This seems to be the case for AddressNotResponding as well... no AddressResponding event.
Thanks for the response! It helps a lot to know where I can edit the email subject and other stuff with the PRESENTATION script.
I like what you did to get the emails to work like you did, but I'd like to find another option to actually state NORMAL and InterfaceUp for the subject and to do this for InterfaceDown, ConnectionDown and AddressNotResponding events.
This is something I am considering... does the logic look correct?
# Specify subject line content. IF ($event.name == InterfaceDown) AND ($event.lifecycleState == com.hp.nnms.incident.lifecycle.Closed) $subject = "AlarmPoint (NNMi) - " & NORMAL & " " & InterfaceUp & " on " & $event.sourceNodeName ENDIF IF ($event.name == ConnectionDown) AND ($event.lifecycleState == com.hp.nnms.incident.lifecycle.Closed) $subject = "AlarmPoint (NNMi) - " & NORMAL & " " & ConnectionUp & " on " & $event.sourceNodeName ENDIF IF ($event.name == AddressNotResponding) AND ($event.lifecycleState == com.hp.nnms.incident.lifecycle.Closed) $subject = "AlarmPoint (NNMi) - " & NORMAL & " " & AddressResponding & " on " & $event.sourceNodeName ENDIF ELSE $subject = "AlarmPoint (NNMi) - " & $event.severity & " " & $event.name & " on " & $event.sourceNodeName
What I would be trying to accomplish would be to have it recognize when an InterfaceDown/ConnectionDown/AddressNotResponding event changes its lifecycle state to Closed then it should use a different email subject which would use a static variables of NORMAL and InterfaceUp/ConnectionUp/AddressResponding simply for the sake of the email it will send.
I've got the script below that I actually ended up implementing. It still isn't working, though. All the old emails are still working properly, but I'm not receiving the different emails from the IF statements like I was hoping. Seems like the problem may be that it doesn't see when the lifecycle state changes from Registered to Closed to know to send an email... only thing I can think of. Any ideas?
# Specify subject line content.
IF ($event.name == InterfaceDown & $event.lifecycleState == com.hp.nnms.incident.lifecycle.Closed)
$subject = "AlarmPoint (NNMi) - NORMAL InterfaceUp on " & $event.sourceNodeName
It might be worth double checking your nnmi.properties file just to make sure all the brackets, quotes etc are in the right place
(lifecycleState='com.hp.nms.incident.lifecycle.Registered' or lifecycleState='com.hp.nms.incident.lifecycle.Closed')
Apart from that, I would probably try changing the subject text very slightly in the ELSE statement of the script and see if it is reflected in the emails that are arriving - at least that would prove that alarmpoint is readint the current version of the script.
I had two n's instead of just one. I changed these all to $event.lifecycleState == com.hp.nms.incident.lifecycle.Closed, so now hopefully the different emails will be sent.
Next on my list is to edit the email body with additional information we want to include... oh boy what a headache! Thanks again - I'll let you know if this fixed things next time Interface/Connection/Address events happen.
Still didn't work even after I fixed the typo. Hmmmm... well for now I'm going to try and set it up like you first posted with the $State = OPENED / CLOSED and see if that won't help things any.
I should probably share my nnm.filter with you as well in case there are any issues with that. If you have time, do you mind sharing yours with me as well? Thanks!
nnm.filter=(nature='ROOTCAUSE' or nature='INFO') and ( lifecycleState='com.hp.nms.incident.lifecycle.Registered' or lifecyclestate='com.hp.nms.incident.lifecycle.Closed') and (severity='CRITICAL' or severity='NORMAL') and ( name='AddressNotResponding' or name='ConnectionDown' or name='InterfaceDown' or name='NodeDown' or name='NodeUp' or name='NonSNMPNodeUnresponsive' )
I think the problem might be the AND in your if/else-if statements.
& - string concatenation operator && - logical AND
I've just dug out a PDF called AP400-devguide-scriptref.pdf which I assume I downloaded from the Alarmpoint website when I first started trying to edit the emails. It's worth getting hold a copy as it covers the basics of the scripting language.