Date: Fri, 29 Mar 2024 00:31:25 +0000 (UTC) Message-ID: <640874409.3993.1711672285721@skald.opmantek.com> Subject: Exported From Confluence MIME-Version: 1.0 Content-Type: multipart/related; boundary="----=_Part_3992_1750421447.1711672285721" ------=_Part_3992_1750421447.1711672285721 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Content-Location: file:///C:/exported.html
Table of contents
The NOC team of a service provider needed to get very specific alerts se= nt to their instance of NetCool from NMIS.
This solution leverages the nocSyslog.nmis from the NMIS Events sent to= IBM Tivoli Netcool using syslog solution.
Sample event.
1388903720,NODENAME,Proactive Interface Utilisation,Critical,INTERFACENAME,=
INTERFACE DESCRIPTION Bandwidth=3D7168000: Value=3D93.17 Threshold=3D93,GRO=
UPNAME
This event will either be sent as a syslog or logged to a file, either o= f which will be processed by NetCool.
An NMIS utility script which finds all the interfaces on all the nodes, = performs the calculation on the interfaces and sends events to the configur= ed syslog server.
For testing a local syslog server can be used and the facility could be = local3 (configurable).
In production the syslog should be sent using TCP to ensure it arrives. = The NetCool team would then process the received syslog event into Ne= tCool.
Example syslog
Aug 25 17:55:01 v= olla interface_util_alerts.pl[4264]: NMIS_Event::volla::1661414101,asgard-p= phh,Proactive Interface Utilisation,Fatal,FastEthernet0/0,123 -- Opmantek L= AN -- Bandwidth=3D100000000 -- Value=3D11.95 Threshold=3D10 Aug 25 17:55:01 volla interface_util_alerts.pl[4264]: NMIS_Event::volla::16= 61414101,asgard-pphh,Proactive Interface Utilisation,Fatal,FastEthernet0/1,= 123 -- WAN -- Bandwidth=3D100000000 -- Value=3D11.92 Threshold=3D10 Aug 25 18:23:06 volla interface_util_alerts.pl[7621]: NMIS_Event::volla::16= 61415786,asgard-pphh,Proactive Interface Utilisation,Fatal,FastEthernet0/0,= 123 -- Opmantek LAN -- Bandwidth=3D100000000 -- Value=3D6.48 Threshold=3D5 Aug 25 18:23:06 volla interface_util_alerts.pl[7621]: NMIS_Event::volla::16= 61415786,asgard-pphh,Proactive Interface Utilisation,Fatal,FastEthernet0/1,= 123 -- WAN -- Bandwidth=3D100000000 -- Value=3D6.45 Threshold=3D5
The code for this solution is included in the NMIS9 contrib folder which= is available in the installation or from NMIS9@GitHub, it = will be in the folder nmis9/contrib/interface_util_alerts
A good option to install is to create a util folder e.g. /usr/local/nmis= 9/util and then create a symbolic link so the file will run with the correc= t paths, and copy the nocSyslog.nmis to the NMIS9 conf folder
Some handy commands (sudo might be required):
sudo mkdir /usr/l= ocal/nmis9/util=20 sudo ln -s /usr/local/nmis9/contrib/interface_util_alerts/interface_util_al= erts.pl /usr/local/nmis9/util/interface_util_alerts.pl sudo cp /usr/local/nmis9/contrib/noc_netcool_syslog/nocSyslog.nmis /usr/loc= al/nmis9/conf sudo /usr/local/nmis9/bin/nmis-cli act=3Dfixperms
Update nocSyslog.nmis with your needed config, the options should be sel= f explanatory except for extra_logging, which if enabled will give you some= logging to nmis.log with when events are sent over syslog to NetCool.
%hash =3D ( 'syslog' =3D> { 'syslog_facility' =3D> 'local3', 'syslog_server' =3D> 'localhost:udp:514', 'extra_logging' =3D> 1, } );
To run it on a single node.
/usr/local/nmis9/= util/interface_util_alerts.pl node=3DYOURNODENAME info=3Dtrue
To run on all nodes, just run the script.
To put into production, set a cron.d file, e.g. /etc/cron.d/interface_ut= il_alerts
sudo cp /usr/loca= l/nmis9/contrib/interface_util_alerts/interface_util_alerts.crond /etc/cron= .d/interface_util_alerts
Check the nmis.log for debug and info messages, check the configured sys= log target to see the events.
To test locally, add the following to /etc/rsyslog.conf for testing and = restart syslogd.
# provides UDP sy= slog reception module(load=3D"imudp") input(type=3D"imudp" port=3D"514") # provides TCP syslog reception module(load=3D"imtcp") input(type=3D"imtcp" port=3D"514") local3.* /usr/local/nmis9/logs/noc.log