question

Michael-4753 avatar image
0 Votes"
Michael-4753 asked RogerXue-3369 commented

Alert suppresion on rule

Hi

I get spawned by alerts created by rule and need to use suppression but cant build expression. I use regex to trigger alert.

138819-image.png


138820-image.png


138861-image.png

Alert context:

![138823-image.png][4]

What should expression be like in this field:

138777-image.png


msc-operations-manager
image.png (84.3 KiB)
image.png (94.9 KiB)
image.png (85.9 KiB)
image.png (84 B)
image.png (146.5 KiB)
image.png (38.5 KiB)
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

RogerXue-3369 avatar image
0 Votes"
RogerXue-3369 answered

You may try to set the suppression expression of parameter1 to achieve your goal.
In my testing, we use a rule (log file alert) to monitor the log file content.
Setting as:
Directory : c:\temp
140830-pict002.jpg
Pattern: temp.txt

Expressions : Params/Param[1] contains error
140809-pict003.jpg

suppression expression: Parameter 1

140923-pict001.jpg

As a result, the error count will increase by 1 when same error message occur in temp.txt file in same machine.
140931-pict005.jpg
140914-pict004.jpg


Roger



pict002.jpg (19.2 KiB)
pict003.jpg (27.2 KiB)
pict001.jpg (24.6 KiB)
pict005.jpg (11.7 KiB)
pict004.jpg (29.6 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Michael-4753 avatar image
0 Votes"
Michael-4753 answered

Can anybody assist?

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

CyrAz avatar image
0 Votes"
CyrAz answered Michael-4753 commented

You don't say on what criteria you want the suppression to happen... Same server? Sale log file? Same error message?

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

same server, same log file and same error message.

0 Votes 0 ·
Michael-4753 avatar image
0 Votes"
Michael-4753 answered

Can anybody help?

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Michael-4753 avatar image
0 Votes"
Michael-4753 answered RogerXue-3369 commented

Hello

thank you @RogerXue-3369. Everything works except for the suppression part. It spawn a lot of alarms. I tried with both Parameter 1 and logging computer but without luck.

Any ideas?

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Nichael
What is the meaning of " I tried with both Parameter 1 and logging computer but without luck."? How different between your expected output and actual output? Moreover, what is your suppression expression?

Roger

0 Votes 0 ·
Michael-4753 avatar image
0 Votes"
Michael-4753 answered RogerXue-3369 commented

Hello RogerXue-3369

I did the suppression on logging computer which added one to counter every time problem occured.

146041-image.png




Thank you.


image.png (27.8 KiB)
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

It is great to hear you that the issue is solved.

Roger

0 Votes 0 ·