Alert severity change

Hello,

Thank you for contacting SMARTS Support. I believe your query was answered in SR # 12416966. Can you confirm if that is indeed the case?

Hi,

Here are the steps needed to change the severity levels for events for Smarts and for creating custom individual severity level for specific items:

Smarts SAM: How to change default severity for a notification/event in SAM

To change the default severity for any any notification/event in Smarts SAM, do the following:

Identify the dxa- configured for SAM in the Global Manager Administration Console -> ICS Configuration -> IC Domain Configuration -> Domain Types

Open the appropriate dxa- configuration file using sm_edit, and change the desired event to the desired severity. For example, doing the following will change the default severity for the Processor_Performance HighUtilization event (found in the configuration dxa-conn-perf.conf file) from 2 (Major) to 1 (Critical):

Open the dxa-conn-perf.conf configuration file using sm_edit as follows:

/SAM/smarts/bin/sm_edit conf/ics/dxa-conn-perf.conf

Change the following:

sev Processor_Performance       HighUtilization         Resource        2

To the following:

sev Processor_Performance       HighUtilization         Resource        1

Make a change to Smoothing Interval, example from 65 second to 64 second for the domain type you are changing.  Run reconfigure for the change to take effect.  Change also takes effect when SAM domain is restarted.

Notes Existing notifications of events will not be modified.  This configuration change will apply only to notifications/events created after the dxa- is modified.

To create custom severity levels:

Create a Notification List in Smarts SAM that matches the interfaces you want to be CRITICAL (Interface Down events come into Smarts SAM as MAJOR by default).

For this step, it is also suggested that you use additional criteria such as IsRoot=TRUE to keep the incidence of false alarms to a minimum.

Create an Automatic Tool that would use the sm_ems command to modify the severity of a notification passed to the tool.

Create an Escalation Policy that subscribes to the Notification List created in the first option and uses the Automatic Tool created in the second option. 

For this step, it is suggested to have the escalation policy wait at least 90 seconds so that Interface Down events that later correlate to Impacts (and are not IsRoot=TRUE) will not have their severity modified.

Notes

Instructions on creating Notification Lists, Automatic Tools, Escalation Policies and sm_ems can be found in the found in the documentation pdf directory, which is installed with the Smarts system here:

/SAM/smarts/doc/pdf

Ron Miller

Advisor, Enterprise Tech Services

Great news, glad to be of help

Ron Miller

Advisor, Enterprise Tech Services