Tune the "the new LA" alerts

I got the trap alert to work

I use ${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage} to get the trap message

The problem is its look like that

CISCO-SYSLOG-MIB:clogMessageGenerated : clogHistFacility.204 = PM, clogHistSeverity.204 = 5, clogHistMsgName.204 = ERR_DISABLE, clogHistMsgText.204 = bpduguard error detected on Gi1/0/19, putting Gi1/0/19 in err-disable state, clogHistTimestamp.204 = 477058492, sysUpTime = 55 days 5 hours 9 minutes 44,94 seconds, experimental.1057.1.0 = 10.50.20.10, snmpTrapEnterprise = CISCO-SYSLOG-MIB:ciscoSyslogMIBNotificationPrefix :clogMessageGenerate

I wish I could to display only text from clogHistMsgText.204 =

clogHistMsgText.204 = bpduguard error detected on Gi1/0/19, putting Gi1/0/19 in err-disable state

Is there away to fine tune that ?

Find more posts tagged with

log analyzer

Alerts

trap

Accepted answers

All comments

terryk

Hi sja,

Take a look at the ARTICLE https://thwack.solarwinds.com/product-forums/log-analyzer/f/forum/6791/editing-alert-message-using-sql-using-substring

Try this as a starting point for your Trap message. The 22 is the length of the message text Before the message you wish to display. You may need to experiment with the length to get your exact text.

${N=SWQL;M=SELECT SUBSTRING('${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}',
CHARINDEX('clogHistMsgText.204 = ', '${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}')+22,
(CHARINDEX(', clogHistTimestamp.204 =', '${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}') -
CHARINDEX('clogHistMsgText.204 = ', '${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}')-22)
) AS Message
FROM Orion.Nodes n}

sja

When I set that as alert message I do not see any change ...

${N=SWQL;M=SELECT SUBSTRING('CISCO-SYSLOG-MIB:clogMessageGenerated : clogHistFacility.249 = PM, clogHistSeverity.249 = 5, clogHistMsgName.249 = ERR_DISABLE, clogHistMsgText.249 = bpduguard error detected on Gi1/0/19, putting Gi1/0/19 in err-disable state, clogHistTimestamp.249 = 511385810, sysUpTime = 59 days 4 hours 30 minutes 58,13 seconds, experimental.1057.1.0 = 10.50.20.10, snmpTrapEnterprise = CISCO-SYSLOG-MIB:ciscoSyslogMIBNotificationPrefix', CHARINDEX('clogHistMsgText.204 = ', 'CISCO-SYSLOG-MIB:clogMessageGenerated : clogHistFacility.249 = PM, clogHistSeverity.249 = 5, clogHistMsgName.249 = ERR_DISABLE, clogHistMsgText.249 = bpduguard error detected on Gi1/0/19, putting Gi1/0/19 in err-disable state, clogHistTimestamp.249 = 511385810, sysUpTime = 59 days 4 hours 30 minutes 58,13 seconds, experimental.1057.1.0 = 10.50.20.10, snmpTrapEnterprise = CISCO-SYSLOG-MIB:ciscoSyslogMIBNotificationPrefix')+22, (CHARINDEX(', clogHistTimestamp.204 =', 'CISCO-SYSLOG-MIB:clogMessageGenerated : clogHistFacility.249 = PM, clogHistSeverity.249 = 5, clogHistMsgName.249 = ERR_DISABLE, clogHistMsgText.249 = bpduguard error detected on Gi1/0/19, putting Gi1/0/19 in err-disable state, clogHistTimestamp.249 = 511385810, sysUpTime = 59 days 4 hours 30 minutes 58,13 seconds, experimental.1057.1.0 = 10.50.20.10, snmpTrapEnterprise = CISCO-SYSLOG-MIB:ciscoSyslogMIBNotificationPrefix') - CHARINDEX('clogHistMsgText.204 = ', 'CISCO-SYSLOG-MIB:clogMessageGenerated : clogHistFacility.249 = PM, clogHistSeverity.249 = 5, clogHistMsgName.249 = ERR_DISABLE, clogHistMsgText.249 = bpduguard error detected on Gi1/0/19, putting Gi1/0/19 in err-disable state, clogHistTimestamp.249 = 511385810, sysUpTime = 59 days 4 hours 30 minutes 58,13 seconds, experimental.1057.1.0 = 10.50.20.10, snmpTrapEnterprise = CISCO-SYSLOG-MIB:ciscoSyslogMIBNotificationPrefix')-22) ) AS Message FROM Orion.Nodes n}

terryk

I see the issue, the message number is changing, It was originally 204 and in your example, it is 249. Try the following which does not look for any number in the length index.

${N=SWQL;M=SELECT SUBSTRING('${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}',
CHARINDEX('clogHistMsgText.', '${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}')+22,
(CHARINDEX(', clogHistTimestamp.', '${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}') -
CHARINDEX('clogHistMsgText.', '${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}')-22)
) AS Message
FROM Orion.Nodes n}

sja

[quote userid="61071" url="~/product-forums/network-performance-monitor-npm/f/forum/91115/tune-the-the-new-la-alerts/290407#290407"]${N=SWQL;M=SELECT SUBSTRING('${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}',
CHARINDEX('clogHistMsgText.', '${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}')+22,
(CHARINDEX(', clogHistTimestamp.', '${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}') -
CHARINDEX('clogHistMsgText.', '${N=OLM.AlertingMacros;M=OLMAlertMessage.EventMessage}')-22)
) AS Message
FROM Orion.Nodes n}[/quote]

Yes.!!! that works!!