Check_Mk Event Console

[taipan (Georgi)]

Hello everyone,

I faced a problem with the configuration of new rule in the Event Console. I have experience, but for some reason is not working as I want. I am adding two messages, one for new alarm and for clear alarm.

For new active alarm:
BW-NOTIFICATION::alarmId.0: 55,
BW-NOTIFICATION::alarmText.0: The Diameter latency probe has entered a state of major congestion,
BW-NOTIFICATION::alarmType.0: Major Congestion Threshold Exceeded,
BW-NOTIFICATION::alarmSeverity.0: major,
BW-NOTIFICATION::alarmDateAndTime.0: 20210202143354069,
BW-NOTIFICATION::alarmState.0: Set,
BW-NOTIFICATION::componentName.0: Diameter Latency Probe,
BW-NOTIFICATION::instanceName.0: PC

if alarmState is equal to “Set” that is a message for new active alarm, if it is equal to “Cleared” it is a message for clear alarm.

BW-NOTIFICATION::alarmId.0: 55,
BW-NOTIFICATION::alarmText.0: The Diameter latency probe has entered a state of major congestion,
BW-NOTIFICATION::alarmType.0: Major Congestion Threshold Exceeded,
BW-NOTIFICATION::alarmSeverity.0: major,
BW-NOTIFICATION::alarmDateAndTime.0: 20210202143354069,
BW-NOTIFICATION::alarmState.0: Cleared,
BW-NOTIFICATION::componentName.0: Diameter Latency Probe,
BW-NOTIFICATION::instanceName.0: PC

That is my text to match:
BW-NOTIFICATION::alarmId.0:\s(\d+),\sBW-NOTIFICATION::alarmText.0:\s(.),\sBW-NOTIFICATION::alarmType.0:\s(.),\sBW-NOTIFICATION::alarmSeverity.0:\s(.),\sBW-NOTIFICATION::alarmDateAndTime.0:\s(\d+),\sBW-NOTIFICATION::alarmState.0:\s(.),\sBW-NOTIFICATION::componentName.0:\s(.*),

That is my text to cancel:
BW-NOTIFICATION::alarmState.0:\s(Cleared)

That is my Rewritting box:

That is how the States are configured:

One example of new alarm:

I want when a message is received and it has the same host name and pattern in text to match is found in the message if it has active event that match to be cancelled.

I read about text to cancel and how it is working and tried different scenarios but I cannot find solution.

Can you help?

[ChristianM (Christian Michaelski)]

Hi,

if you need to cancel an event, it should be clear to match the entire event. You need to set a unique key to get the open event id. This will be handled by the matching groups. When I look at your text to match, I see that there is a matching group on time and date. This will not work, this is not a unique value for this kind of event. So, all dynamic values will not be good to bild a unique key.

Cheers,
Christian

[taipan (Georgi)]

Hi,

Can you give me a hint about text to match?
How can I get only alarmID, alarmText, AlarmState, AlarmComponent.

I tried with:
BW-NOTIFICATION::alarmId.0:\s(\d+),\sBW-NOTIFICATION::alarmText.0:\s(.),\sBW-NOTIFICATION::alarmState.0:\s(.),\sBW-NOTIFICATION::componentName.0:\s(.*),

but the second group, which is alarmText return - The avg of cpu.usage_percent reaches above the threshold of 60 and below 80., BW-NOTIFICATION::alarmType.0: VM_CPU_Usage, BW-NOTIFICATION::alarmSeverity.0: major, BW-NOTIFICATION::alarmDateAndTime.0: 20210203115557143

It is catch everything between alarmText and alarmState, which is
BW-NOTIFICATION::alarmType.0: Major Congestion Threshold Exceeded,
BW-NOTIFICATION::alarmSeverity.0: major,
BW-NOTIFICATION::alarmDateAndTime.0: 20210202143354069,

How to match everything until BW-NOTIFICATION is met.

I tried with:
BW-NOTIFICATION::alarmId.0:\s(\d+),\sBW-NOTIFICATION::alarmText.0:\s(.),\sBW-NOTIFICATION,\sBW-NOTIFICATION::alarmState.0:\s(.),\sBW-NOTIFICATION::componentName.0:\s(.*),

But will not work

[taipan (Georgi)]

Hi,

I managed to structure the regex in Text to match correctly:
alarmId.0:\s(\d+),\s.*alarmText.0:\s(.+?),\s.alarmState.0:\s(.),\s.componentName.0:\s(.),

The result is:
168280887 Loss of OAM contact to the CTA ‘sf-is02.pcrf.test.test’. Set OAMConnection

In text to cancel I tried with - Cleared, ‘Cleared’ - according to the documentation, using this approach should cancel all events which host names are equal.

I also tried with:
alarmId.0:\s(\d+),\s.*componentName.0:\s(.+?),\s.*alarmState.0:\s’Cleared’$

Thanks

[taipan (Georgi)]

Hi,

I solved my problem.

Thanks