Variable Question - SAM And NPM

Hello,

Trying to use the following variable, from a custom configuration file.

My questions/issues are, when an alert is generated and that information gets passed to our CA Spectrum system, anything for the Application Monitor will not populate the nodename request. However, anything for the actual NODE alerts value will pass over the Node variable, with no issues. When the first alerting method occurs, then our CA Spectrum system seems to not recognize anything with APM.Application as critical, and an SDR (ticket) will not get generated. Is there something in the variable information causing this? Or is it possible, we are passing too much information for the system to understand? Or are those variables actually wrong for the S.A.M. side? And if the last question is correct, then where do we find the correct list for the application monitors variables?

Is it possible to run two different template files for NPM related events and SAM related events? Or because some SAM events are node related, that can cause a possible conflict with the correct information being passed through the alert information via the SNMP trap file?

I have attached two pictures, as examples of what (as a team) we are seeing for the alert information.

If anyone, has any insight into this problem/issue? And can provide some valuable feedback, that would be greatly appreciated.

Dé

attachments.zip

Find more posts tagged with

Alert

Application

Node

npm

sam templates

Accepted answers

All comments

mesverrum

The variables change depending on the type of object your alert is built on. So variables that work on nodes generally won't work for applications. You need to create templates with the correct syntax for every different type of object you want to pass to Spectrum. The easiest way to make sure you get them correct is never to use the ${variable} format or to guess. Just use the "insert variable" button and browse through the list it gives you because that is the authoritative list of all possible variables and it even gives you the option to preview what the variable would resolve to on a specified object.

At a glance I don't see why you would even be trying to use nodename, since that is just a duplicate of the caption values you already have. It seems like your first value is a mixed bag of variables that would never all be able to work on the same object.

To clarify,

Application.Node.Caption: ${N=SwisEntity;M=Application.Node.Caption} = Node caption, assuming your alert object is a component (goes from the component table, to the application table to the node table then shows the caption of that node)

Node.Caption: ${N=SwisEntity;M=Node.Caption} Node caption, assuming your alert oject is an application, or any of the other types of objects that would be direct children of nodes such as interfaces, volumes, etc

Caption: ${N=SwisEntity;M=Caption} = Node caption, assuming your alert object is a node

NodeName: ${NodeName} = old variable that resolves the same value as node caption, only works if your alert object is a node.

deonaanne72

Hello,

So if we were to remove just the variable, NodeName: ${NodeName}, from the template. Then we might see better results, on the actual node name or dns being returned to our CA Spectrum system?

We are actually configuring the template file manually, since the OID numbers need to match up with our CA Spectrum Event manager/system.

The other question, related to this is, "Can we use an entirely different trap template for the application part? Or because we are possibly looking at node related variables, do we need to keep this in one template?

Thank you in advance.

Dé

mesverrum

When I am building alert integrations I normally build out several templates depending on the type of object I'm triggering my alert on and the fields that the receiving end needs me to send. Generally I do like to include all the Node information on my app messages, but you don't necessarily have to, it just depends on what kind of information your receiving tool is expecting.

This KB might be helpful for you
Forward Trap action for Alerts - Interface Name Variable issue - SolarWinds Worldwide, LLC. Help and Support

deonaanne72

Here where I am currently at,

based on APM.Application and Node based alerts.

As you can see below, from the changes in the template file, I was able to get the alert system to populate in the necessary host/dns names. Down side is, they are not generating the severity (which I did not touch that field) and it does randomly skip (or input variables) in some fields. I am going to continue poking at the APM.Application Variables, but this is somewhat progress. After, I am done with APM, then I will poke some more at the Nodes (DNS) variable.

Current, revamped template below (yes, I did create a backup of the original). I am still working out this field, Caption: ${Caption}, trying to get it functioning correctly when alerting upon the APM.Applications, as you can see it continues to throw the N=SwisEntity statement into the variable (even though it is not in the template file).

-->

mesverrum

Just make it ${N=SwisEntity;M=Node.Caption} and it should work

deonaanne72

Hello,

I did take this a little further, and created trap templates for two of the specific sets of the alerts (Application and Node). I was hoping to get further assistance, on the APM.Application/Component monitoring piece. I am still seeing the same issue with the variable being returned in the nodeName Field (see attached jpeg). I am also including the variable from the template file, to see if anyone can identify something that may be incorrectly formatted or typed in. Using the Node Trap template, my information is now coming across cleanly, for Node related alerts.

Very top of the image, you can see it is also returning the variable. Does anyone know, where Solarwinds specifically pulls that from (the EventModel information)?

Thank you

Dé

deonaanne72

Hello,

I believe I am beginning to understand how the translation from Solarwinds to our MoM system (Spectrum) is working. However, I do have another issue, that I could use assistance on. This is variable related, and I have tried a number of Group Variables, to get the IP address to populate, but Solarwinds will return this as ANSCII characters. See the attached picture, and have some ANSCII fun!

I am utilizing multiple trap files, to alert on our companies Solarwinds environment, and this seems to be working (so far) - with a few minor hiccups along the way. For example:

The actual translation, is the value listed in the above variable information.

Has anyone worked with Group Down alerts? And if so, how did you get around the IP Address translation from Solarwinds to your MoM system, so it showed the offending nodeIP (or at least something better, than an anscii version of text).

I would appreciate any insight and assistance with this.

Thank you

Dé

mesverrum

I'm confused, groups do not have IP addresses. Groups are just logical collections of other solarwinds objects

deonaanne72

Hello,

If I read the group variable information correctly, the groups should be able to call to the specific NODE causing the issue, within that group. I have this partially configured, as you can see from the below image, where it sees the system (it is generating the test alert against). Now whether it will pick the first system in the group list or the actual system causing the issue, is going to be another test I will need to accomplish.

However, the other piece of this is, “I would like Solarwinds to be able to grab the offending system IP and populate this information into the correct field”. I have used the GroupID, and it did populate a 0.0.0.3 numeric value in the list, but obviously that is not correct, but on the positive side it is not returning an ansi value.

Is it possible to get the template to read this correctly? If not, is there a better way to report on a group being down, getting the critical information, listed in the image over to our MoM system?

Again, thank you in advance for your assistance.

Dé

mesverrum

I don't build alerts on groups, I build alerts on the individual items in the group that have a problem. If a group is in warning because one of the nodes is down, why would I not just alert on the node being down? You can just include a custom sql variable on a node alert that lists any groups it is a member of as part of the message if you want to get fancy. I always alert on the most specific object i can.

deonaanne72

Hello,

Per your statement: You can just include a custom sql variable on a node alert that lists any groups it is a member of as part of the message if you want to get fancy.

How would I add a specific sql variable into the trap template, that would be transferred over correctly to our MoM? Is there documentation on this function/feature, within Solarwinds? I would think you could get granular with the customization in Solarwinds? Or am I incorrect on that assumption?

Thank you

Dé

deonaanne72

Hello,

Follow up to the work, I have been doing within our Corporate Environment. I want to create an alert, which points to a specific three letters within a server group. So for example, if the first three letters are abc and then the second three xyz, I would like to have two individual alerts, which alert against the servers based on an application or node going down. So if node abc (followed by subsequent #'s), goes down or reboots I want an alert generated using only the first three letters in the name. Is that possible?

Side note, this is currently rolling up under an existing alarm in our system. Is that intended by the way Solarwinds translates the copied alert? Or could something be wrong there?

Thank you

Deona