cancel
Showing results for 
Search instead for 
Did you mean: 

Automated Analyst - OFF-Event

Community Manager

Automated Analyst - OFF-Event

Hello dear Experts!

I'm a NSK and Prognosis admin (more than 15 years) in germany and work for the softwarehouse twinsoft. www.twinsoft.de
I have created in past some automated analysts at mostly 2 custemersides.

My customer Daimler (Mr. Klump) give me a task which seems easy but which I can not solve with the automated analyst.

The task is:

We have on NSK on each system about 2, 3 or 4 discs named $SYSDP*. These discs are for TMF-Onlinedump.
1. We want to raise an alert if the total free diskspace of all $SYSDP*-Discs is less then 40%.
2. You should get that alert once and get an off alert if you have again enough freespace. (OFF-Event)

Point no 1 is easy. See my analyst below. :-)
But point no 2 ... sorry I tried a lot with secondary rules, but I come to no result.

My wish is:
Best you solve my problem and do my work. :-)

Or can you give me a hint, or an example, which I can use to solve point no. 2 ?
The example can also be for Windows or (L)unix.

Best Regards
Bernd Marten

-----------------------------------------------
PS: the analyst rule for point no 1

SECTION CONFIG
! The max_size limits the number of closed problem record kept
MAX_SIZE 0.5 MB

NUMERIC SYSDB_USEDSPACE_MB[2]:= 0
NUMERIC SYSDB_VOLSIZE_MB[2] := 0
NUMERIC SYSDB_FULL_PCT[2] := 0

END_SECTION

SECTION RULE_DEF

RULE SYSDB_VOLS PRIMARY

RECORD VOLUME

WHERE volume MATCHES "$SYSDP*"
REFRESH 10 Seconds
SORT DESCENDING volume

IF ALL
SET SYSDB_USEDSPACE_MB := SYSDB_USEDSPACE_MB + @volume.Filespac
SET SYSDB_VOLSIZE_MB := SYSDB_VOLSIZE_MB + @volume.Volsize
END_IF

IF @volume.volume = "$SYSDP1"
SET SYSDB_FULL_PCT := SYSDB_USEDSPACE_MB * 100 / SYSDB_VOLSIZE_MB
END_IF

! We have in anycase a $SYSDP1-Volume and additional $SYSDP2, 3, ...
IF SYSDB_FULL_PCT > 60 AND @volume.volume = "$SYSDP1"
LOG PROBLEM_SUMMARY 100 IMMEDIATELY
END_IF

END_RULE

END_SECTION

SECTION MSG_TEXT

MSG 100 "$SYSDP-VOLS are to @SYSDB_FULL_PCT@% used"

END_SECTION
2 REPLIES 2
Community Manager

Re: Automated Analyst - OFF-Event

Hi Bernd,

Not an easy one to kick off the expert forum.

You're right that off events can't easily be used when aggregating metrics in an analyst rule. It is also hard to use a secondary rule to detect that the problem has gone away.

The example below uses a few common analyst tricks to address this type of problem:

* the aggregation is done in a secondary rule, and collated and checked in a primary rule
* this primary rule uses a special secondary rule to hold the problem open, in lieu of an off event
* a separate primary rule triggers periodically while there is an alert raised, to check that the underlying problem is still there
* if the problem is no longer there, it issues an analyst command to force close the alert

It has been adapted to address your problem. Note that in rule CLOSE_SYSDB_VOLS it assumes the analyst is called SYSDB.

Let us know if it works for you. And if you have any suggested improvements, please include them.

SECTION CONFIG
! The max_size limits the number of closed problem record kept
MAX_SIZE 0.5 MB
END_SECTION

SECTION RULE_DEF
RULE SYSDB_VOLS PRIMARY
! This will open an alert if the SYSDB disks are more than 60% full
NUMERIC SYSDB_USEDSPACE_MB[2]:= 0
NUMERIC SYSDB_VOLSIZE_MB[2] := 0
NUMERIC SYSDB_FULL_PCT[2] := 0

RECORD PNODES
WHERE ALL
REFRESH 10 Seconds

IF ALL
START RULE CALC_SYSDB_VOLS WAIT
SET SYSDB_FULL_PCT := SYSDB_USEDSPACE_MB * 100 / SYSDB_VOLSIZE_MB
END_IF

IF SYSDB_FULL_PCT > 60
LOG PROBLEM_SUMMARY 100 IMMEDIATELY
START RULE STAY_OPEN WAIT
END_IF
END_RULE

RULE CLOSE_SYSDB_VOLS PRIMARY
! This will close the alert opened by SYSDB_VOLS if the SYSDB disks are now less than 60% full
NUMERIC SYSDB_USEDSPACE_MB[2]:= 0
NUMERIC SYSDB_VOLSIZE_MB[2] := 0
NUMERIC SYSDB_FULL_PCT[2] := 0

RECORD PROBSUM
WHERE ANNAME = "SYSDB" AND
RULENAME = "SYSDB_VOLS"
REFRESH 10 Seconds

IF ALL
START RULE CALC_SYSDB_VOLS WAIT
SET SYSDB_FULL_PCT := SYSDB_USEDSPACE_MB * 100 / SYSDB_VOLSIZE_MB
END_IF

IF SYSDB_FULL_PCT < 60.01
EXEC #ANALYST 999 NOLOG
END_IF
END_RULE

RULE CALC_SYSDB_VOLS SECONDARY
RECORD VOLUME
WHERE volume MATCHES "$SYSDP*"
REFRESH 10 Seconds
SORT DESCENDING volume

IF ALL
SET SYSDB_USEDSPACE_MB := SYSDB_USEDSPACE_MB + @volume.Filespac
SET SYSDB_VOLSIZE_MB := SYSDB_VOLSIZE_MB + @volume.Volsize
END_IF
END_RULE

RULE STAY_OPEN SECONDARY
RECORD PNODES
WHERE 1 = 0
REFRESH 5 minutes
RETRY WHEN_NO_MATCH

IF ALL
! Will never get here
END_IF
END_RULE

END_SECTION

SECTION MSG_TEXT
MSG 100 "$SYSDP-VOLS are to @SYSDB_FULL_PCT@% used"
MSG 999 "STOP PROBLEM @PROBSUM.PROBNO@.0 ANALYST @PROBSUM.ANNAME@"
END_SECTION
Community Manager

Re: Automated Analyst - OFF-Event

Hello Jamie,

sorry that it takes so long that I replied. Embarassed

Very tricky and genial your analyst!!! I will try this if I'm the next time at that customer side. It takes some weeks ...
In the meanwhile I will forward this Analyst to our customer with a friendly hint that you (IR) have give me in January this solution!

Many thanks, and best Regards
Bernd
Blog: What Optimal Transaction Performance Means

A number of our customers use Prognosis to monitor the health of their payment systems. As part of this, they monitor the transactions flowing through the system ...

Read blog
Top Liked Members