topic Re: Custom Alarm Email Notification in ExtremeCloud IQ- Site Engine Management Center

Custom Alarm Email Notification

Michael_M — Fri, 28 Oct 2022 17:36:04 GMT

I have created an alarm configuration to send me an email if a switch experiences a SpanGuard event the locks out a port on my EOS switches.

I have the alarm definition setup as follows:

The email comes through fine, but I get 3 copies of one email and a single copy of another email with the same alert. You can see the Information column below is the email I see and the "Seen Count" is the number of emails that are sent to me.

I have gotten the second alarm to only send me a single email by setting up the Alarm Suppression rule in the Actions tab of the rule creation window

I still get the top alarm emailed to me though and I cant figure out how to eliminate multiple emails from being sent.
I also feel there is probably a better way to filter the rule so that the second alert isnt "seen" 3 times.
I have tried altering the Match On: Log: criteria field to include or exclue Syslog and the other, but have not found anything that works. Its almost like XIQ-SE is getting 4 syslog events evertime I reproduce the issue.

Thanks for any guidance.

Re: Custom Alarm Email Notification

Thorp6 — Mon, 31 Oct 2022 05:08:08 GMT

Regardless, it's exquisite information. Investigating from gifted music makers is a really fulfilling experience regardless considering the way that they have staff to help with heaps of assessment, changing, etc.

@Michael_M Panorama Charter Login wrote:
I have created an alarm configuration to send me an email if a switch experiences a SpanGuard event the locks out a port on my EOS switches.

I have the alarm definition setup as follows:
The email comes through fine, but I get 3 copies of one email and a single copy of another email with the same alert. You can see the Information column below is the email I see and the "Seen Count" is the number of emails that are sent to me.
I have gotten the second alarm to only send me a single email by setting up the Alarm Suppression rule in the Actions tab of the rule creation window
I still get the top alarm emailed to me though and I cant figure out how to eliminate multiple emails from being sent.
I also feel there is probably a better way to filter the rule so that the second alert isnt "seen" 3 times.
I have tried altering the Match On: Log: criteria field to include or exclue Syslog and the other, but have not found anything that works. Its almost like XIQ-SE is getting 4 syslog events evertime I reproduce the issue.
Thanks for any guidance.

Re: Custom Alarm Email Notification

Zdeněk_Pala — Sun, 30 Oct 2022 06:25:35 GMT

Check how many events you get from switches. Check those events. are you getting the same log message multiple times? Are those messages equal or different?

Re: Custom Alarm Email Notification

Michael_M — Mon, 31 Oct 2022 16:32:03 GMT

Three of the messages are the same and the fourth is in a slightly different format but with the same details.

This is the identical message I will get 3 copies of:

This is the second message I get a single copy of:

Blacked out portions are the IP address of the switch.

Re: Custom Alarm Email Notification

Zdeněk_Pala — Tue, 01 Nov 2022 21:58:35 GMT

thank you for sharing emails. I am interested in the original events. can you find those events in Alarms > Events > Syslog

Re: Custom Alarm Email Notification

Michael_M — Wed, 02 Nov 2022 14:05:30 GMT

Re: Custom Alarm Email Notification

Zdeněk_Pala — Thu, 03 Nov 2022 20:44:36 GMT

Can you confirm:

There is one syslog message from a switch and you get number of emails based on the "Seen count"
What is the version of ExtremeCloud IQ - Site Engine

What you can try is to get rid of those special characters ":" and "=" in the alarm condition