(updated for server version 6.17 or later)
The alarm EMS / User defined provides a method to generate an alarm based on the content of an EMS event. The EMS event may be located in $0 or in another EMS collector that MOMI can access.
An alarm is triggered, and potentially cleared, by defining matching text within a series of logical conditions. This criteria is entered into the text area in the selections of Include if ANY, Include if ALL, Exclude if ANY and Exclude if ALL. Each section has its own text area where zero or more lines of text may be entered. A line of text is matched in its entirety. For example, Fred Smith is considered as one single entry whereas one line of Fred and a second line of Smith means that these words may appear anywhere within the EMS message (i.e. don't have to be together). Comparisons are not case sensitive.
Below is the 1) the order of evaluation of the criteria, and 2) the action taken when a match occurs. This order is the same for both EMS Set and EMS Clear. Overall, EMS Clear is examined first then if no match was found EMS Set is examined second:
if a match occurs with Exclude - the EMS event is ignored
if a match occurs with Include - an alarm is generated or cleared
when no text matches the EMS event is ignored.
While not specified, prior to MOMI Client and Server version 6.04 an OR was effectively implied for Excludes and Includes. A text match of Exclude if Any OR Exclude if ALL caused an EMS message to be ignored. A text match of Include if ALL OR Include if ANY caused a match which would either generate or clear an alarm. As of MOMI Client and Server version 6.04 and later OR is now displayed plus the new logical operand AND was added. The default remains OR. Include if ALL AND Include if ANY requires a match of both in order to generate or clear an alarm.
Text entered within EMS Set and EMS Clear by default searches virtually the entire ASCII translation of the EMS event. To search just a portion of the EMS Message, push the Limit By type button and select which portion of the message to examine. If any <tag(s)> are present, they must precede any other text on that line.
EMS messages with an SSID of BWS, which is used by MOMI, are ignored. This prevents a potential "looping" situation where an Alarm triggered by an EMS message, causes an EMS message that triggers an alarm, that causes an EMS message that triggers an alarm, and so on...
The tab Settings 1 contains various options to activate different features of this alarm.
Active Alarm label is text that appears within various messages generated by this alarm.
Multiple alarms allowed or Multiple active alarms allowed enables more than one active alarms as a result of this definition. A maximum number of active alarms is imposed to help limit run-away alarm situations and is defined by the CONFMOMI keyword ALARMS-MAXIMUM-PER-DEFINITION.
Automatically delete active alarm enables the generation of, for example emails, as a result of the alarm but then clears the alarm. This option would be used when the display of the alarm on the Alarms / Active screen is not required and manual delete of an alarm will not take place.
Key alarm by process $name generating EMS event causes an alarm to be keyed or associated with the process generating the EMS event. For example, several processes on the system generate an event when it falls behind in processing and a follow-up event when it has caught up. Criteria within EMS Set triggers the fall behind alarm and criteria within EMS Clear triggers clearing of the alarm. So that an alarm is directly associated with the processing generating the EMS events this option causes the processes $name to be internally linked to the active alarm. There is no need to specify which processes are monitored. Note that it is required the EMS Set and EMS Clear contain sufficient criteria (such as SSID and event number) to uniquely filter to the subsystem specific EMS events.
Count within time specifies how many matching EMS Set events must occur over a period of time before an alarm occurs. For example, if 15 matching EMS Set events occur over a period of 10 minutes the issue is considered sufficient to generate an alarm.
Related Topics