8 Replies Latest reply on Feb 14, 2011 10:07 AM by Questionario

    Inbuilt functionality to filter 'Events'

    Ciag

      Hi folks,

      I have requirement to monitor some Polycom Video conferencing units in quite a specific manner. The requirement is to primarily monitor up/down status. Initially when a polycom VC unit goes down the customers want a mail to be sent to the voice team mail box, if the node has not come back up within a few hours only then wouldthey like an event posted in the message centre for the NOC to see.

      Building this alert was the easy part but when a VC unit goes down it still shows up in the 'Nodes with problems' resource and basic events are generated in message centre as soon as it goes down. This negates the 2 hour waiting period I have specified in the advanced alert.

      I understand the difference between Advanced alerts and events but is there any way I can suppress particular events from being displayed in the 'nodes with problems resource' and the message centre.

      I have read similar topics that refer to a custom 'event' filtering resource, this is not an option for us as I don't want to start messing with the standard build of NPM, also using SQL  filtering on the 'Nodes with problems' resource is not a solution either I would like to some how suppress the events at source.

      Cheers

        • Re: Inbuilt functionality to filter 'Events'
          Questionario

          you could set a filter to only show nodes where lastup is longer than X hours or create a custom report for this and put the report as a resource on the website :)

           

          these are the best options you have, there is no possibility of suppressing this at the source (which would be more messing around with NPM than using NPM for what it is made for: customizing!)

          PS: if you filter the resource on that view, that filter only applies to that single resource, if you use the same resource on a different view, the filter will not be applied there unless you configure it there too... again if you dont want this you can also create a custom report that looks similar to the nodes with problems resource and put that report in your view!

            • Re: Inbuilt functionality to filter 'Events'
              Ciag

              Thanks for your reply Questionario :- )

              Yeah that's just one of the reasons why I mentioned SQL filtering of the 'nodes with problems' is not an option. Using custom reports is not a solution either unfortunately as the functionality of the web output isn't the same as the 'nodes with problems' I would not be willing to replace it with a custom report plus my difficulty is not with creating time delayed triggers, that part is already done using advanced alerts.

              I agree that NPM is very much about customsing but I don't agree that having the ability to adjust, filter or supress the basic event triggers is not what NPM is about; it's very much what Orion is about and having that control in itself is a clear form of customisation. Not all networks were created equal lol

              Having the ability to notify users about the status of node, interface, operations etc based solely on advanced alerts triggers is primarily what I was seeking. Thanks for your suggestions :-) 

                • Re: Inbuilt functionality to filter 'Events'
                  Questionario

                  Hi Ciag,

                   

                  could you elaborate on why you dont want to use the built-in filtering though?

                    • Re: Inbuilt functionality to filter 'Events'
                      Questionario

                      hmmm... maybe I misunderstood you...

                      could it be possible that you dont mean the "nodes with problems" resource but the messages written to the event logs instead? you can delay these by 2 hours as well in their options in the alert.

                        • Re: Inbuilt functionality to filter 'Events'
                          Ciag

                          Hi Questionario,

                          Hope you had a nice weekend. Yes I was referring to the 'nodes with problems' but also to the events in the 'Event Viewer'. Basically I don't want to see any trace of Polycom nodes going down in the Orion web GUI until it has been down for more than 2 hours. That includes not seeing a ‘Down’ or ‘Warning’ status in 'Nodes with problems' nor a ‘down’ or 'request timed out' event in the event viewer/message centre.

                          Think of it this way, let’s say I have 2 teams, each have their own custom home pages and both need a full view of every node in the database. One team will need to know if the Polycom nodes have gone down immediately, so there's no need for filtering there. The other team however does not want to see any Polycom notifications in Orion NPM until 2 hours have elapsed. So the latter still need to have access to the Polycom nodes but they do not want to see the ’Down/Warning/Request Timed out' notifications until after 2 hours in either 'nodes with problems' or the 'Message centre'.

                          The 'nodes with problems' may be able to be filtered using SQL this will have to be an additional filter on top of the filters I have in place already for this resource. I haven't tried it yet because there's no point in only being able to filter that resource and yet still having 'Down' events coming into the message centre. It needs to be a full solution or nothing. I can't be telling users on certain teams to start ignoring specific 'events' this would not be best practice.

                          With regards to replacing the 'nodes with problems' with a Custom report. Admittedly it certainly comes close to replacing the 'Nodes with problems' resource however it is missing some key functions such as the mouse rollover feature but most importantly none of the node names are http links. I wouldn't be willing to replace such a vital tool which my customers are already familiar with, with one that is inferior just for the sake of one alert. As an alternative it could be suggested to not replace the ‘Nodes with Problems’ but use it in conjunction with the Custom reports on the same page. However I don’t like this idea either, we have a hard enough time keeping our Home pages as clean as possible with 'need to know' vital stats only. Having redundant resources present on the page is not desirable and would be confusing for users.

                          This brings us back full circle. As you mentioned earlier it is not possible to filter Orion basic events at source, there is a possibility that SQL filtering will work for the 'nodes with problems' resource so that leaves me trying to find some method to permanently filter the Event Viewer/Message Centre for certain teams so the Polycom events only appear after 2 hours.

                            • Re: Inbuilt functionality to filter 'Events'
                              Questionario


                              With regards to replacing the 'nodes with problems' with a Custom report. Admittedly it certainly comes close to replacing the 'Nodes with problems' resource however it is missing some key functions such as the mouse rollover feature but most importantly none of the node names are http links. I wouldn't be willing to replace such a vital tool which my customers are already familiar with, with one that is inferior just for the sake of one alert. As an alternative it could be suggested to not replace the ‘Nodes with Problems’ but use it in conjunction with the Custom reports on the same page. However I don’t like this idea either, we have a hard enough time keeping our Home pages as clean as possible with 'need to know' vital stats only. Having redundant resources present on the page is not desirable and would be confusing for users.

                               



                              actually you can also have the report set up so it links to the nodes and also shows that rollover functionality :)

                              as long as you include the nodeID in your report (which you can hide) it should even create the link automagically!

                               



                              This brings us back full circle. As you mentioned earlier it is not possible to filter Orion basic events at source, there is a possibility that SQL filtering will work for the 'nodes with problems' resource so that leaves me trying to find some method to permanently filter the Event Viewer/Message Centre for certain teams so the Polycom events only appear after 2 hours.

                               



                              You have two options here:

                              1.) Edit the alert so it delays the entry of the alert into the database, this would however still create events saying the node stopped responding, etc. but hopefully your staff isn't monitoring every single event and only filters for something like EventType=AlertTriggered (otherwise, wow... tons of work if you have to read every event...)

                              2.) if the above does not work for you, the only alternative you have is to create a custom view with just the events you want your staff to see, it will not be formatted as nicely and will sure look different (in my opinion, the worse choice).

                              These are about all the options for you that I can think of...

                              I wouldnt't know why the custom report or filtered report together with open #1 wouldnt be enough...

                               

                              If you can explain why it isn't, maybe I can help further

                                • Re: Inbuilt functionality to filter 'Events'
                                  Ciag

                                  Good to know that about the custom report's mouse roll over feature via NodeID thanks. That boxes that one off nicely, infact I may just replace the 'node with problems' resource throughout our environment altogether as the custom report feature is far more flexible. 

                                  With the events, no there isn't anyone watching every single event but it may as well be like that. In the scenario I outlined in the last mail I mentioned just 2 teams as an example where as in reality it's many more than that, it's a 24hr opertaion here. Some have the EvenViewer / last 25 events and 'nodes with problems' blasted up on to huge 20 ft screens. I have had a look at creating a custom events view in the past and from what I remember I have to agree, the format is not desirable but I still can't time delay the basic response events from appearing in it.  

                                  cheers

                                    • Re: Inbuilt functionality to filter 'Events'
                                      Questionario

                                      Hi Ciag,

                                      good to hear the solution works for part of your problem.

                                      As for the other part:

                                       

                                      you do not want your tech's to react on certain events so you have 2options:

                                      1.) teach them what to react on and what not (which you dont want to)

                                      2.) create that custom view we talked about, there you can filter for "Alert Triggered" events and exclude node not responding, etc. events until it has the info you require. This will not look as nice as the message center but it is the only alternative right now.