Prerequisites
NMIS version 8.3.18G or greater.
Introduction
An alert is a custom event generated by testing the value of an OID against a boolean operation. If the test returns true, an event is raised and it will run through the escalation system. Later on, when the test returns false again the event will be cleared.
The values required for the alert are:
test => this is a boolean operation using $r to determine if the alert should be raised
event => the name of the event when it is raised
level => the level of the event when it is raised
Test
This can be any Perl expression that evaluates into a boolean (true or false, 0 or 1). $r holds the value of the oid, use this to test for the condition you want to raise the alert for. All of the perl operators are available, the most likely suspects are:
# Numbers "==" returns true if the left argument is numerically equal to the right argument. "!=" returns true if the left argument is numerically not equal to the right argument. "<" returns true if the left argument is numerically less than the right argument. ">" returns true if the left argument is numerically greater than the right argument. "<=" returns true if the left argument is numerically less than or equal to the right argument. ">=" returns true if the left argument is numerically greater than or equal to the right argument. #strings "eq" returns true if the left argument is stringwise equal to the right argument. "ne" returns true if the left argument is stringwise not equal to the right argument. "lt" returns true if the left argument is stringwise less than the right argument. "gt" returns true if the left argument is stringwise greater than the right argument. "le" returns true if the left argument is stringwise less than or equal to the right argument. "ge" returns true if the left argument is stringwise greater than or equal to the right argument.
A quick not on stringwise and numerically. If $r is 0, $r == 0 is true, $r eq "0" is also true. If $r is 00, $r == 0 is true, $r eq "0" is false. That's the basic idea.
Where to add the Alert
The alert can be added to current variables being polled from the devices, or a new section can be added. For example a new section in Model->system->sys could be added which might look like this.
'sys' => {
'alerts' => {
'snmp' => {
'tcpCurrEstab' => {
'oid' => 'tcpCurrEstab',
'title' => 'TCP Established Sessions',
'alert' => {
'test' => '$r > 250',
'event' => 'High TCP Connection Count',
'level' => 'Warning'
}
}
}
},
Example
The following is an example of the layout of an alert (in this example serialNum is taken from Model-CiscoRouter.nmis) and uses a string based (stringwise) comparison:
'serialNum' => {
'oid' => 'chassisId',
'title' => 'Serial Number',
'alert' => {
'test' => '$r ne "SomeSerialNumber"',
'event' => 'Serial Number Invalid',
'level' => 'critical'
}
}
$r in this case is the value of the OID chassisId. This will raise the event "ALERT: Serial Number Invalid" when the oid chassisId is not equal to "SomeSerialNumber.
A numeric based comparison can also be used, in this case when the value is 0 the alert is raised, when the value is not 0 the alert is cleared:
'cipSecGlobalActiveTunnels' => {
'oid' => 'cipSecGlobalActiveTunnels',
'title' => 'Global Active Tunnels',
'alert' => {
'test' => '$r == 0',
'event' => 'No tunnels present',
'level' => 'critical'
}
}
Another example might be to check the number of TCP Connections to a server and alert when it is higher than 250.
'tcpCurrEstab' => {
'oid' => 'tcpCurrEstab',
'title' => 'Current TCP Established Sessions',
'alert' => {
'test' => '$r > 250',
'event' => 'High TCP Connection Count',
'level' => 'Warning'
}
}
Adding the alert also adds the information to the "Device Details" panel, so you get the last polled value displayed all the time.
