Header Only - DO NOT REMOVE - Extreme Networks
Question

Netsight Manager Alarm Custom Criteria Not Working


Userlevel 1
I have an event in NetSight ARP violation is recorded in Syslog, but when I set the alarm on the Alarm Manager did not reach the alarm console nor the email.

I set the alarm for Trap and Custom Criteria but neither works. Attached pictures to collaborate me with their contributions.

Thank you for your recommendations.





10 replies

Userlevel 6
Hello,

It looks like the alarm is actually coming in without any source information and you have a group of "Datacenters" selected.

Can you try and remove the group assignment to see if it works? I don't think it's triggering because NetSight can't determine if the alarm is part of the configured source as there is no source information in the event.

Thanks
-Ryan
Userlevel 1
Thanks Ryan for your help,
However in the group DataCaenter I have approximately 40 Core Switches in which the event occurs.

I do not understand what is your recommendation?

The definition of the alarm okay?
Userlevel 4
Hi Jairo,

if you select a single switch from dataccenter group , do you see the alram from netsight ?

Thanks,
Suresh.B
Hi,
we have the same issue.
We got a syslog message for a defective FAN.
The information is
SIM[127798864]: edb_bxs.c(1578) 61925 This is from manager 1 %% Unit 3 Fan 2 failed

Client is the Management IP, Type is Event

I build an alarm with a custom criteria which only match to the information text.
I tried a two phrases (Match any Selected and a contain phrase)

This is from manager /d %% Unit /d Fan /d failed <-- my prefered phrase

This is from manager <-- only a test to see that the alarm is working

Every 5 minutes we got the syslog message but no alarm is generated.

Thanks for your help,
Stefan
Userlevel 7
Stefan Seubert wrote:

Hi,
we have the same issue.
We got a syslog message for a defective FAN.
The information is
SIM[127798864]: edb_bxs.c(1578) 61925 This is from manager 1 %% Unit 3 Fan 2 failed

Client is the Management IP, Type is Event

I build an alarm with a custom criteria which only match to the information text.
I tried a two phrases (Match any Selected and a contain phrase)

This is from manager /d %% Unit /d Fan /d failed <-- my prefered phrase

This is from manager <-- only a test to see that the alarm is working

Every 5 minutes we got the syslog message but no alarm is generated.

Thanks for your help,
Stefan

Hi Stefan & welcome to the forum.

I've done a simple test with my EMC 8.0.2 - configure a alarm for the syslog event if a user logs in to my switch.

Here how the syslog event looks like...



And here my customer alarm...you'd need to match on the Syslog log manager and and then on the information text i.e. passed - in my test.



If it still doesn't work could you please open a new post so we'd separate it from the other ones and make sure to incl some screenshots of the configuration.

-Ron
Userlevel 3
I've also got a problem with alarms customization in the version 8.0.2 of EMC.
I'm trying to use the custom action for use a script after a syslog event.
I set the flag to Override Content and pass parameters to the script, and save the changes.
If I try to reopen again the custom action I see that my changes are not saved and the flag on the override content is no more present and my custom parameters are lost.
Userlevel 3
Antonio Opromolla wrote:

I've also got a problem with alarms customization in the version 8.0.2 of EMC.
I'm trying to use the custom action for use a script after a syslog event.
I set the flag to Override Content and pass parameters to the script, and save the changes.
If I try to reopen again the custom action I see that my changes are not saved and the flag on the override content is no more present and my custom parameters are lost.

I've open the console java client and from this client, seems that the Override Content filed il related only to the email format, and not as described in the GTAC solution "Can NetSight Alarm be configured to run a script?" to the paramters to pass to the script.
Is possible to pass custom parameters to a script?
Userlevel 7
Antonio Opromolla wrote:

I've also got a problem with alarms customization in the version 8.0.2 of EMC.
I'm trying to use the custom action for use a script after a syslog event.
I set the flag to Override Content and pass parameters to the script, and save the changes.
If I try to reopen again the custom action I see that my changes are not saved and the flag on the override content is no more present and my custom parameters are lost.

Hi Antonio,

could you post some screenshots so we better unterstand the problem.

I think it's best to open a separate forum thread for it.

- Ron
Userlevel 3
Antonio Opromolla wrote:

I've also got a problem with alarms customization in the version 8.0.2 of EMC.
I'm trying to use the custom action for use a script after a syslog event.
I set the flag to Override Content and pass parameters to the script, and save the changes.
If I try to reopen again the custom action I see that my changes are not saved and the flag on the override content is no more present and my custom parameters are lost.

Hi Ronald,
here are the screenshot taked from java console or from OneView:



The test seems to be executed correctly, instead the script is not executed.
If I run the same script from CLI on the EMC with the same parameters passed in the action, it ends correctly.
Userlevel 3
Antonio Opromolla wrote:

I've also got a problem with alarms customization in the version 8.0.2 of EMC.
I'm trying to use the custom action for use a script after a syslog event.
I set the flag to Override Content and pass parameters to the script, and save the changes.
If I try to reopen again the custom action I see that my changes are not saved and the flag on the override content is no more present and my custom parameters are lost.

If I look the server.log file, I see that after the Test of execution of the script made from OneView page, appear a message error tat is the following:
root@extrememanagement.demo.com:/usr/local/Extreme_Networks/NetSight/appdata/logs$ tail -f server.log

2017-07-21 16:24:00,962 ERROR [com.enterasys.netsight.api.notification.NotifyActionContent] Error deserializing loadFromXml xml blob

My custom arguments are the following:
"root" "password" $message "/(?<=src: )(.*)(?=; dst:)/" "CK infected" "192.168.30.34" "8443" "Distributed_IPS"

I've noted that if I set the parameters from OneView, these are not saved, and I need to add these from the java console.

Reply